Credential-Stealing GitHub Actions Workflows Found in Thousands of Repos
Attackers compromised open-source maintainer accounts to plant malicious GitHub Actions workflows stealing credentials in over 340 repositories.
Tag
#Credential Theft
13 results in the archive.
Phishing Platform Targets Credentials via Fake AI Chatbot Ad Portals
Researchers discovered a phishing platform impersonating AI chatbot ad portals like Google Gemini and ChatGPT to steal credentials and MFA codes.
China-Aligned TA419 Targets U.S. AI Policy Experts with Microsoft AitM Phishing
China-linked group TA419 uses Microsoft Account-in-the-Middle phishing to target U.S. AI policy experts at think tanks, universities, and legal organizations.
Lunex Stealer Exploits AMD Driver to Bypass Security and Steal Credentials
Lunex Stealer uses a compromised AMD driver to evade detection and steal browser credentials, targeting Ukrainian users through a complex four-stage attack chain.
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials
The Brazilian KREMLIN banking malware uses malicious Chrome and Edge extensions to steal credentials and session tokens, impersonating multiple Brazilian banks.
Florida DMV Database Breached via Stolen Police Credentials
Attackers accessed the Florida Department of Highway Safety and Motor Vehicles' DAVID database using stolen police department credentials, resulting in a data breach.
BigBear Phishing Service Bypasses MFA at 258 Organizations
The BigBear 2.0 phishing-as-a-service framework bypassed multi-factor authentication at 258 organizations, compromising over 5,000 Microsoft 365 credentials.
Coder’s registry compromised to distribute malicious Terraform modules
Attackers breached Coder's Cloudflare infrastructure to push malicious Terraform modules that embed credential-stealing code, threatening developer credentials.
China-Linked Fire Ant Targets Cisco Routers to Steal Credentials
The China-linked Fire Ant group has compromised Cisco IOS XR routers, TACACS servers, and Linux hosts to steal credentials and disable security logs, targeting critical network infrastructure.
SynkLoader Malware Spreads via Microsoft Teams Phishing Campaign
SynkLoader malware is delivered through a Microsoft Teams phishing campaign that uses a fake lock screen to steal enterprise user credentials, enabling unauthorized access.
Hacker Claims 3.6M Azure Account Records Stolen from Major Companies
A threat actor is selling employee databases stolen from Microsoft Azure infrastructure of multiple Fortune 500 companies using compromised credentials, exposing sensitive account records and presenting an enterprise security risk.
Midnight Blizzard's CaptiveCrunch targets travelers with malware and credential theft
The Russian threat group Midnight Blizzard's Storm-2945 sub-cluster has compromised hospitality sign-in portals worldwide since May 2026, delivering malware and stealing traveler credentials.
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
Attackers manipulate DNS settings on hotel and conference center Wi-Fi to redirect users to fraudulent Microsoft 365 login pages, targeting credential theft from business travelers.