All news with #token theft tag

🔒 Security teams implementing AI automation face new threats from token-based attacks that can exhaust budgets or trigger provider filters, disrupting incident response. Elastic’s cost estimates show large variability in agent-based SOC expenses, and prompt injection can dramatically inflate token consumption and latency. Practical defenses include deterministic handling of verifiable data, strict limits and alerts, predefined failover behaviors, careful permissioning, scanning untrusted inputs, and using local models to reduce vendor-induced outages.

🔒 The official MCP Python SDK had a vulnerability that allowed a malicious MCP server to trick clients into sending OAuth credentials to an attacker-controlled token endpoint. Affected releases exposed the client secret, authorization code, and PKCE proof key; fixes were released in versions 1.30.0 and 2.2.0. The issue impacts clients using specific OAuth providers over HTTP and requires upgrades plus configuration changes to fully mitigate.

🔍 SOCRadar’s AI Identity Exposure Report analyzed more than one million infostealer records tied to AI services across 80,000+ corporate domains, narrowing to 482 major enterprises to determine which organizations’ AI credentials are being sold. The research found ChatGPT/OpenAI dominated exposures, with 90% of records, while developer platforms like Hugging Face and Replit also appeared. The report emphasizes that stolen AI sessions are more dangerous than passwords, acting as archives, execution engines, billable resources, and identities, and recommends SSO, token rotation, API key controls, and monitoring for session reuse.

📧 Modern email phishing now evades traditional telltale signs, using polished language, QR codes, AI-tailored lures and token-theft flows to bypass training and defenses. Attackers exploit live sessions, device hops and legitimate sites to harvest OAuth tokens or trick users into pasting commands, while deepfakes and delayed fraud increase believability. Organizations must pair awareness with verification, layered controls and MDR capabilities to detect and contain these subtler social engineering campaigns.

🛡️ A GitLab feature that supplies a project-scoped email address to create issues embeds a long-lived token in the address, which can be used to act as the linked user across projects. Aikido Security found the token (prefixed with glimt-) is identical across project addresses for an account and bypasses IP restrictions, enabling actions like creating issues and merge requests with the account's permissions. GitLab updated wording to acknowledge merge request capabilities; Aikido recommends treating the addresses as credentials and rotating tokens if exposed.

📧 Researchers found that private GitLab incoming-email addresses, generated by the Email work item to this project feature, are being published in public READMEs and guides. These addresses include long-lived tokens that let anyone create issues or merge requests if they modify the address suffix, potentially bypassing IP restrictions. Aikido reported instances affecting popular open-source projects and urges token resets and removal from public docs.

🔒 Two recent reports reveal security flaws in OpenAI systems that allowed researchers to chain vulnerabilities and bypass sandbox controls. One team leveraged an image library flaw to gain remote code execution and used stolen tokens to access employee accounts and internal repositories; fixes were applied after coordinated disclosure. Another group demonstrated Codex sandbox escapes that enabled the agent to act beyond intended limits; those issues were also patched within days.

🔐 The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) published Interagency Report 8587 on September 15 to protect cloud identity tokens and assertions used in SSO, identity federation and API access. The guidance, which is voluntary, warns that adversaries are increasingly targeting tokens to move laterally and access sensitive data. It prescribes short token lifetimes, scoped key usage, hardware-backed key storage for moderate impact and above, and strict logging and audience validation rules.

🛡️ Mandiant reports an attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider and used it to install an infostealer via a poisoned PyPI package. The attacker stole GitHub OAuth tokens and deployed the self-spreading Shai-Hulud worm across about 100 internal repositories, exfiltrating secrets and source code. Mandiant recommends verifying AI-recommended dependencies with checksums and allowlists, restricting extension access to secrets, and routing dependencies through controlled internal repositories to protect AI-assisted development.

⚠️ WSO2 users face active exploitation of CVE-2026-5430, a critical JWT signature verification flaw that enables account takeover. Affected products include API Manager, API Control Plane, Traffic Manager, and Universal Gateway across several 4.x releases; fixes and update levels have been published. WatchTowr reports in-the-wild attempts capturing forged admin JWTs on September 13, 2026, and urges immediate patching to prevent unauthorized access and lateral movement.

🔒 A browser extension named Twitch Enhanced Viewer | JeetBot, listed in the Chrome and Firefox stores with over 30,000 installs, captures Twitch OAuth session tokens and transmits them to a commercial proxy service. Socket's analysis shows the extension appends the token as an auth= URL parameter when redirecting playlist requests, causing tokens to be logged in proxy server request logs. The vendor JeetBot, a Russian-language streaming/chatbot service, can therefore access those tokens and potentially hijack sessions.

📣 Threat hunters warn of a broad data theft and extortion campaign targeting Microsoft 365 and other SaaS platforms via help‑desk vishing, adversary‑in‑the‑middle token theft, and residential‑proxy sign‑ins. Tracked by Arctic Wolf as PREY‑0058 and linked to activity groups like UNC6671 and Cinder, the actors impersonate IT staff to lure executives to authentication‑themed pages and capture MFA approvals. Attacks culminate in SharePoint, OneDrive, Exchange, and Box data exfiltration and extortion without deploying endpoint malware. Organizations are urged to adopt Conditional Access, phishing‑resistant MFA, and tighter SharePoint access controls.

📄 Sublime's Threat Intelligence team identified a financially motivated actor, tracked as Doubloon Dredger, abusing free Notion accounts and malicious PDFs in July 2026 to harvest authentication tokens. Fake notifications from compromised Notion accounts bypassed DKIM/SPF/DMARC checks and steered victims to intermediary PDFs that redirected to an EvilTokens device-code phishing page. If users entered the provided code on Microsoft's legitimate device-code entry, attackers obtained authorization tokens and could access accounts and inboxes via tools like MailVault.

🔍 Arctic Wolf Labs warns of a widespread email-driven phishing campaign using adversary-in-the-middle (AitM) techniques to seize Microsoft 365 sessions and harvest payroll and HR email. The campaign leverages residential proxies, multi-step redirections through trusted services, and fingerprinting scripts to evade filters and maintain compromised sessions at roughly eight-hour intervals. Affected sectors include healthcare, education, manufacturing, government, and professional services across the U.S., Canada, and Europe.

🔒 Unit 42 details the surge in AI token jacking, where attackers steal API keys (tokens) to consume expensive AI model resources and sell access via proxy "transfer stations." The report explains token mechanics, attack vectors including stolen keys and malicious npm packages, and demonstrates how rapid abuse can cause catastrophic billing. It outlines mitigations such as spending limits, short-term tokens, AI gateways, and secure developer practices.

🔍 Recent research shows insurance-targeted phishing has shifted from credential harvesting to real-time session hijacking. Attackers use paid Google Ads and disposable hosting to lure victims to realistic portals and then relay OTPs and credentials to authenticate on the legitimate service while the victim is logged in. CTM360 identified a bespoke kit, InsureOTP Kit, and exposed backend infrastructure revealing live session management and operator workflows. Defenders must expand detection beyond malicious pages to include ad monitoring, infrastructure analysis, and attacker workflow intelligence.

🛡️ Cisco Talos uncovered a React-based ARToken management panel exposing 80+ API endpoints and client-side code that reveals expanded phishing capabilities. The platform, tied to the EvilTokens ecosystem, automates Microsoft 365 account compromise by stealing authentication tokens, obtaining persistent Primary Refresh Tokens (PRTs), and accessing Outlook, SharePoint, and OneDrive. ARToken deploys Cloudflare Workers, supports multi-tenant affiliate operations, and includes tools for BEC automation and mailbox monitoring.

🛡️ The Bluekit phishing-as-a-service platform has added browser-in-the-middle (BitM) capabilities and nearly 70 new hostnames, enabling attackers to load legitimate login pages and capture valid session tokens. Netcraft found Bluekit uses the open-source rrweb library to serialize and stream page DOM data over WebSockets while fetching assets through phishing infrastructure. The kit also includes advanced anti-analysis features such as randomized CSS filters, large rotating obfuscated JavaScript bundles, custom CAPTCHAs, browser fingerprinting, and WebRTC IP-mismatch checks.

🔒 The JaredFromSubway Ethereum MEV bot lost $15 million after an attacker fed it fake pools and tokens to manipulate its opportunity detection and gain ERC-20 approvals. Blockaid detected the drain and JaredFromSubway confirmed the attacker deployed deceptive contracts that tricked the bot into issuing allowances to attacker-controlled helper contracts. The attacker used staged, benign-looking transactions to validate the bot’s routines, later exploiting open approvals via transferFrom to withdraw WETH, USDC, and USDT.

🔒 Researchers disclosed an attack chain against Anthropic’s command-line coding assistant, Claude Code, that abuses the Model Context Protocol (MCP). A malicious npm post-install hook can rewrite the local ~/.claude.json configuration to redirect authenticated MCP traffic to attacker infrastructure, allowing interception of stored OAuth bearer tokens. Anthropic has been notified but has not issued a patch; defenders are advised to monitor the configuration file, treat npm post-install hooks as high risk, and rotate OAuth tokens tied to Claude Code integrations.