All news with #credential stuffing tag

🔍 Microsoft, Health-ISAC, JC3 and private-sector partners disrupted three Chinese-language phishing kits — CoGUI, Haozi and Iron Man System — linked to a marketplace called YAM Store. The court-authorized operation follows an investigation launched in late 2025 after targeted campaigns in Japan; since January 2026 the kits helped send over one billion phishing emails and SMS messages. Microsoft attributes the kits and marketplace to interconnected actors tracked as Storm-2990 and Storm-3119, who used compromised cloud environments and automated tooling to scale credential-stealing campaigns against organizations worldwide.

🛡️ During Medicare Open Enrollment (October 15–December 7), scammers exploit the legitimate surge in communications to harvest personal, financial, and medical data. They use calls, emails, texts, social posts and fake ads to create urgency or suggest benefits to trick beneficiaries into sharing sensitive details. Be wary of unsolicited contact asking for Medicare or Social Security numbers, bank details, passwords or health information. Verify callers separately, avoid clicking ads, use official .gov sites, and report suspected fraud promptly.

🔒 The FBI and US Secret Service warned administrators to harden Fortinet FortiGate firewalls and SSL VPN gateways after reporting the persistent FortiBleed campaign. Agencies cited SOCRadar data indicating 86,644 compromised devices across 194 countries and linked ransomware affiliates to use of stolen credentials. The notice details attacker techniques including credential stuffing, GPU-accelerated cracking, and creation of administrative accounts to maintain stealthy persistence. Organizations are urged to isolate affected hosts, perform threat hunting, reset credentials, enable phishing-resistant MFA, and follow CISA eviction guidance.

🔎 New Check Point Research findings show a surge in Amazon- and Prime Day-related domain registrations ahead of Fall Prime Day (October 6–7, 2026), with many domains flagged as malicious. The report documents phishing campaigns, fake storefronts, and credential-theft infrastructure targeting shoppers worldwide, and warns that generative AI is enabling more convincing scams. It urges consumers and organizations to verify URLs, enable MFA, and block threats proactively.

🔒 Two former U.S. Air Force airmen were sentenced to a combined 189 months in federal prison for conducting multi-year business email compromise (BEC) and phishing campaigns while stationed at Dover Air Force Base. They stole employee email credentials, used spoofed addresses to redirect corporate payments, and laundered funds through accomplices in the U.S. and abroad. The pair diverted millions in wire transfers and were also ordered to pay substantial restitution and serve supervised release after prison.

🔒 Security researchers report a surge in proxy "transfer stations" used to hide origin of requests to frontier AI models, enabling credential abuse and model distillation. Team Cymru identified tens of thousands of relay servers running open-source platforms like CRS and sub2api that authenticate users with pooled stolen API keys and subscriptions. Activity links include China and Hong Kong, with many relays hosted on U.S. VPS providers, and evidence suggests heavy upload traffic consistent with extraction attempts. Organizations are advised to treat AI credentials as sensitive secrets, use short-lived tokens, monitor usage, and have playbooks to revoke compromised keys.

🛡️ If your family uses Roblox, many offers for “free Robux” are scams aimed at stealing credentials or personal data. Roblox and trusted partners may run legitimate promotions or creators can earn Robux through monetization, but there is no true Robux generator. Be wary of phishing pages, fake giveaways, surveys, and requests for passwords or 2FA.

🛡️ Researchers report DPRK-linked operators have broadened their employment fraud beyond IT into sales, marketing, and healthcare, using stolen and forged identities, VPNs, and proxy services to secure remote jobs at global firms. Investigations found evidence of PiKVM and USB capture hardware, synthetic personas aided by AI, and coordination via multi-account tools and facilitators who provision laptop farms. Agencies and firms are urged to strengthen identity verification and background checks to detect these sophisticated schemes.

🛡️ A new Android attack blends SpyNote RAT with a novel NFC relay malware called WindRelay to steal card data and enable fraud. Attackers socially engineer victims over the phone to sideload a malicious app, grant Accessibility and NFC permissions, and relay live card transactions. Group-IB found multiple WindRelay samples targeting Central Europe and warns users to avoid APKs outside official stores and verify bank calls.

🔒 A federal judge sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, a ransomware-as-a-service operation active from 2021 to 2023. The group attacked at least 18 companies across the U.S. and abroad, using stolen credentials from initial access brokers, a hidden affiliate panel, and cryptocurrency mixers to process ransoms. The sentence follows an indictment unsealed in 2024 and a separate unresolved prosecution in New Jersey.

🛡️ Proofpoint has identified a phishing campaign impersonating COLDCARD that lures victims with a bogus "Hardware audit" notice tied to a recent wallet vulnerability and large Bitcoin theft. The scam directs targets to a clone site that downloads a batch file which escalates privileges, decodes embedded files, and installs a signed decoy plus a ConnectWise ScreenConnect remote access tool. Once connected to the actor-controlled ScreenConnect server, attackers can remotely access systems, steal data or cryptocurrency, and deploy additional malware or ransomware.

🛡️ Bitdefender identified malicious installers posing as the Xeno Executor Roblox utility that deliver a multi-stage Java-based loader and a final RAT/infostealer. The campaign, active since early this year and spiking in March, lures gamers via forums, Discord, and compromised accounts with archives mimicking legitimate Xeno installations. Once executed, the malware extracts a Java runtime, registers victims with a C2, and deploys payloads that steal browsers, wallets, and account tokens while enabling surveillance and remote control.

🔒 Lava researchers found tens of thousands of internet-exposed Baseboard Management Controllers (BMCs) vulnerable to a 2013 IPMI authentication flaw, allowing rapid access by guessing weak or factory-set passwords. BMCs provide out-of-band control of servers and often sit outside standard monitoring, enabling persistent, hard-to-detect compromises that can span shared data center and AI/GPU infrastructure. Vendors including Supermicro and HPE were among the most impacted.

🔐 Chick‑fil‑A confirmed that more than 13,000 customers were impacted by credential stuffing attacks targeting its website and mobile app between June 17 and June 19. The attackers used credentials obtained from a third‑party source and accessed names, emails, membership numbers, Chick‑fil‑A credit amounts, mobile pay numbers, and card last four digits; some accounts may have also exposed birth dates, phone numbers, and addresses. The company logged out affected accounts, removed payment methods, restored balances, added rewards, and urged users to change passwords.

🔒 A coalition of 42 US attorneys general has secured an $18m settlement with genetic testing firm 23andMe following the 2023 credential-stuffing breach that exposed profile and ancestry data for over six million individuals. The settlement, led by New York Attorney General Letitia James, includes more than $705,000 payable to New York and imposes new data protection requirements on the company and its successor. As 23andMe entered bankruptcy in March 2025, its customer data was transferred to TTAM Research; the agreement mandates risk analysis, an advisory board on data security, and continued consumer deletion rights to safeguard that information.

🔍 Flare researchers examined nearly 2,900 underground posts to map how carders assess residential proxies and build fraud-ready digital identities. The analysis shows proxies are judged by reputation and history rather than just being residential, and are commonly paired with antidetect browsers, device fingerprints, and billing consistency. Providers’ restrictions and takedowns have pushed demand for “finance-compatible” IPs and increased operational complexity for attackers.

🔒 A coalition of 43 state attorneys general reached an $18 million settlement with 23andMe (now Chrome Holding Co.) over a 2023 data breach that exposed genetic data of 6.9 million customers. Investigators found the company lacked basic protections against credential-stuffing attacks, including multifactor authentication, password blocklisting, and adequate monitoring. The settlement imposes new security requirements, governance measures, and preserves consumer deletion rights while following prior lawsuits and fines.

🕵️ Law enforcement agencies coordinated Operation First Light 2026 across 97 countries, arresting 5,811 suspects and seizing $293 million in illicit assets. The operation targeted social engineering fraud — including BEC, sextortion, impersonation, romance, and investment scams — and associated money laundering between January 15 and April 30. Authorities identified over 142,000 victims, blocked 31,014 bank accounts, and analyzed 152,808 cases while additional suspects were identified. INTERPOL coordinated the effort with regional policing bodies and funding support from China's Ministry of Public Security.

🔒 Cybercriminals abused Facebook Messenger chatbots to deliver phishing messages that appeared to come from legitimate Facebook Business accounts. The campaign, active from November 2025 until June 2026, coaxed victims to log in on fake pages and surrender credentials, MFA codes, contact details and images of government IDs. Meta disrupted the infrastructure after Huntress reported the activity, but business accounts remain attractive targets.

📧 KDDI Corporation disclosed a breach affecting an email system shared with five Japanese ISPs after discovering unauthorized access on June 17. The company attributes the intrusion to a vulnerability in unnamed third-party software and says it immediately blocked the attacker and implemented defenses. Up to 14.22 million current, former, and inactive customer email addresses and passwords may have been exposed, though some credentials were stored hashed or encrypted. KDDI is notifying regulators and working with affected ISPs while advising customers to reset passwords and enable 2FA where possible.