Sign in Subscribe

Credential Theft

Credential Theft covers the technique of obtaining login credentials, passwords, session tokens, or MFA codes through phishing, vishing, infostealer malware, or similar means. It describes how access was gained, not an actor's classification, so pair it with the relevant actor or campaign tag. Distinct from Credential Stuffing, which covers reusing already-breached credentials against a new target.

FortiBleed 2026: Threat Intelligence Brief

Threat Intelligence

FortiBleed 2026: Threat Intelligence Brief

FortiBleed turned 86,000+ compromised FortiGate firewalls into passive credential-harvesting platforms across 194 countries, now linked directly to Inc Ransom and Lynx ransomware deployments.

Hackerbot-Claw GitHub Actions Exploitation Campaign

Threat Intelligence

Hackerbot-Claw GitHub Actions Exploitation Campaign

An autonomous AI agent called hackerbot-claw is exploiting misconfigured GitHub Actions workflows to steal tokens and hijack repositories, fully compromising Aqua Security's Trivy project and publishing a malicious VS Code extension in its place.

LummaStealer Resurgence After 2025 Infrastructure Disruption

Threat Intelligence

LummaStealer Resurgence After 2025 Infrastructure Disruption

LummaStealer rebounded within weeks of a 2025 law-enforcement takedown that seized 2,300 C2 domains, now spreading through CastleLoader and ClickFix campaigns to harvest browser credentials, session tokens, and crypto wallets at scale.

Surge in Fake Installers and Malvertisement Campaigns

Threat Intelligence

Surge in Fake Installers and Malvertisement Campaigns

Fake installer and malvertising campaigns now span Windows and macOS alike, using trojanized DMG and EXE files, delayed activation, and hardware-gated payloads to harvest browser, keychain, and developer credentials while still installing the expected app.

ConsentFix: MFA-Bypassing OAuth Phishing

Threat Intelligence

ConsentFix: MFA-Bypassing OAuth Phishing

ConsentFix lets attackers hijack Microsoft's own OAuth sign-in flow to steal authorization codes and bypass MFA entirely. Researchers link the technique with moderate-to-high confidence to Russia's APT29.

GRU Tradecraft and Network Edge Access

Threat Intelligence

GRU Tradecraft and Network Edge Access

A GRU-aligned team is abusing misconfigured, cloud-hosted network edge devices as passive listening posts, harvesting and replaying credentials into Western energy, logistics, and telecom networks without deploying any malware.

China’s Typhoon Tradecraft and Risk

Threat Intelligence

China’s Typhoon Tradecraft and Risk

China's Typhoon ecosystem spans distinct PRC clusters — Volt for infrastructure pre-positioning, Salt for telecom surveillance, Silk for supply-chain pivoting — all sharing a playbook of credential abuse and living-off-the-land persistence on unpatched edge devices.

Trending Topics

Trending Topics

TRENDING TOPICS DEC 24, 2025 Phishers Exploit Cloudflare Pages and Telegram to

Ransomware Groups Targeting Maritime and Marine-Industrial Organizations

Threat Intelligence

Ransomware Groups Targeting Maritime and Marine-Industrial Organizations

Nova, Akira, and Qilin are deliberately targeting maritime service and engineering firms for port-call packets, vessel schedules, and turbine maintenance records, turning a single contractor breach into leverage across entire shipping and port ecosystems.

Trending Topics

Credential Theft

Trending Topics

CVE-2025-59287 Critical Windows Server Update Service DESERIALIZATION RCE UNAUTHENTICATED Deserialization