Cybersecurity articles tagged #Credential Harvesting on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/man-sentenced-for-hacking-750-snapchat-accounts-via-phishinghttps://runtimerebel.com/blog/man-sentenced-for-hacking-750-snapchat-accounts-via-phishingIllinois man Brandon Sudge sentenced to six years for large-scale Snapchat credential harvesting and theft of private content from over 750 victims.Fri, 24 Jul 2026 13:50:49 GMTSnapchatCredential HarvestingIdentity TheftSocial Engineeringhttps://runtimerebel.com/blog/artoken-phaas-exposes-eviltokens-m365-phishing-toolkithttps://runtimerebel.com/blog/artoken-phaas-exposes-eviltokens-m365-phishing-toolkitARToken PhaaS, an affiliate of EvilTokens, offers advanced Microsoft 365 phishing capabilities, including MFA bypass. Learn about its TTPs and how to defend.Fri, 03 Jul 2026 17:28:05 GMTARTokenEvilTokensPhaaSPhishingMicrosoft 365MFA BypassCredential HarvestingThreat Intelligencehttps://runtimerebel.com/blog/metamask-phishing-campaign-targets-secret-recovery-phraseshttps://runtimerebel.com/blog/metamask-phishing-campaign-targets-secret-recovery-phrasesThreat actors are targeting Metamask users with phishing emails designed to harvest Secret Recovery Phrases, leading to the total loss of cryptocurrency assets.Wed, 01 Jul 2026 09:23:12 GMTMetamaskCryptocurrencyPhishing CampaignSeed Phrase TheftCredential Harvestinghttps://runtimerebel.com/blog/fortibleed-110-million-credentials-harvested-via-fortigate-firewallshttps://runtimerebel.com/blog/fortibleed-110-million-credentials-harvested-via-fortigate-firewallsRussian-speaking threat actors harvest 110 million credentials from 430,000 FortiGate firewalls globally. Learn to detect and mitigate FortiBleed tactics.Tue, 23 Jun 2026 20:49:19 GMTFortiBleedFortiGateCredential HarvestingInitial Access BrokerFirewall Securityhttps://runtimerebel.com/blog/fortinet-fortibleed-campaign-86000-vpn-credentials-stolenhttps://runtimerebel.com/blog/fortinet-fortibleed-campaign-86000-vpn-credentials-stolenFortinet addresses the FortiBleed campaign involving 86,000+ confirmed working credentials. Technical analysis and mitigation steps for security professionals.Mon, 22 Jun 2026 10:16:29 GMTFortinetFortiosFortiBleedCredential HarvestingVPN Securityhttps://runtimerebel.com/blog/ebanking-phishing-using-ipv4-mapped-ipv6-addresses-detectedhttps://runtimerebel.com/blog/ebanking-phishing-using-ipv4-mapped-ipv6-addresses-detectedAnalysis of a sophisticated eBanking phishing campaign targeting a major Belgian bank, leveraging IPv4-mapped IPv6 addresses for obfuscation.Fri, 19 Jun 2026 09:53:08 GMTPhishingeBankingIPv6Email SpoofingCredential HarvestingBelgiumhttps://runtimerebel.com/blog/credential-harvesting-heist-compromises-30k-fortinet-deviceshttps://runtimerebel.com/blog/credential-harvesting-heist-compromises-30k-fortinet-devicesA widespread credential harvesting campaign has compromised over 30,000 Fortinet devices across 200 countries, enabling unauthorized access for threat actors.Wed, 17 Jun 2026 13:29:46 GMTFortinetCredential HarvestingCyberattackData Breachhttps://runtimerebel.com/blog/bluekit-phishing-kit-ai-integration-and-automated-deploymenthttps://runtimerebel.com/blog/bluekit-phishing-kit-ai-integration-and-automated-deploymentThe Bluekit phishing kit uses an AI assistant and automated domain registration to simplify credential harvesting against financial and logistics sectors.Sat, 02 May 2026 12:24:45 GMTBluekitPhishing KitAI Driven AttacksCredential HarvestingSocial Engineeringhttps://runtimerebel.com/blog/telegram-tdata-credential-harvesting-risks-and-mitigation-strategieshttps://runtimerebel.com/blog/telegram-tdata-credential-harvesting-risks-and-mitigation-strategiesLearn how threat actors exploit Telegram Desktop tdata folders for session hijacking and credential harvesting, bypassing multi-factor authentication.Wed, 22 Apr 2026 08:47:07 GMTTelegram DesktopCredential HarvestingTdata ExploitationSession Hijackinghttps://runtimerebel.com/blog/mcgraw-hill-data-breach-13-5-million-accounts-leaked-by-shinyhuntershttps://runtimerebel.com/blog/mcgraw-hill-data-breach-13-5-million-accounts-leaked-by-shinyhuntersThreat actor ShinyHunters leaks 13.5 million McGraw Hill user records following a Salesforce environment breach. Includes password hashes and PII.Thu, 16 Apr 2026 12:33:08 GMTMcGraw HillShinyHuntersSalesforce BreachData LeakCredential Harvestinghttps://runtimerebel.com/blog/teampcp-supply-chain-attack-from-credential-theft-to-payroll-fraudhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-from-credential-theft-to-payroll-fraudTeamPCP leverages supply chain attacks to compromise trusted software, facilitating large-scale credential harvesting, logistics theft, and payroll fraud.Wed, 15 Apr 2026 16:30:57 GMTTeamPCPSupply Chain AttackCredential HarvestingPayroll FraudFinancial Crimehttps://runtimerebel.com/blog/apt41-deploys-stealth-backdoor-for-cloud-credential-harvestinghttps://runtimerebel.com/blog/apt41-deploys-stealth-backdoor-for-cloud-credential-harvestingChina-linked APT41 is targeting AWS, Azure, and Google Cloud with a new zero-detection backdoor designed to harvest credentials and maintain persistence.Mon, 13 Apr 2026 16:35:11 GMTAPT41Cloud SecurityCredential HarvestingAWSAzureBackdoorhttps://runtimerebel.com/blog/identity-based-attacks-why-breach-monitoring-fails-to-stop-infostealershttps://runtimerebel.com/blog/identity-based-attacks-why-breach-monitoring-fails-to-stop-infostealersInfostealers are bypassing MFA by harvesting session cookies. Learn why traditional breach monitoring is insufficient and how to secure identity perimeters.Mon, 06 Apr 2026 16:21:46 GMTInfostealersSession HijackingCredential HarvestingMFA Bypasshttps://runtimerebel.com/blog/guardarian-users-targeted-via-36-malicious-strapi-npm-packageshttps://runtimerebel.com/blog/guardarian-users-targeted-via-36-malicious-strapi-npm-packagesAnalysis of a supply chain attack involving 36 malicious npm packages posing as Strapi plugins to target Guardarian users and harvest sensitive credentials.Mon, 06 Apr 2026 12:24:18 GMTStrapiNPMGuardarianSupply Chain AttackCredential Harvestinghttps://runtimerebel.com/blog/dutch-police-phishing-breach-exposes-internal-contact-datahttps://runtimerebel.com/blog/dutch-police-phishing-breach-exposes-internal-contact-dataThe Dutch National Police (Politie) confirms a security breach after a phishing attack exposed work contact details for 65,000 police department employees.Fri, 27 Mar 2026 08:21:12 GMTPhishingPolitieCredential HarvestingData BreachPublic Sectorhttps://runtimerebel.com/blog/security-firm-executive-targeted-via-dkim-signed-phishinghttps://runtimerebel.com/blog/security-firm-executive-targeted-via-dkim-signed-phishingA sophisticated phishing campaign bypassed security filters using DKIM-signed emails and Cloudflare-protected landing pages to target a security executive.Mon, 16 Mar 2026 16:29:47 GMTPhishingDKIMCloudflareExecutive TargetingCredential Harvestinghttps://runtimerebel.com/blog/romanian-national-pleads-guilty-to-initial-access-brokerage-targeting-oregon-state-infrastructurehttps://runtimerebel.com/blog/romanian-national-pleads-guilty-to-initial-access-brokerage-targeting-oregon-state-infrastructureCatalin Dragomir admitted to harvesting and selling unauthorized administrative credentials for an Oregon state government network, highlighting the persistent threat…Mon, 23 Feb 2026 12:21:04 GMTIABCredential HarvestingInitial Access BrokerOregon Statehttps://runtimerebel.com/blog/sandworm-mode-malicious-npm-cluster-automates-secret-harvesting-and-crypto-thefthttps://runtimerebel.com/blog/sandworm-mode-malicious-npm-cluster-automates-secret-harvesting-and-crypto-theftSecurity researchers have identified a coordinated campaign involving 19 malicious npm packages designed to exfiltrate CI/CD secrets, API tokens, and private…Mon, 23 Feb 2026 12:20:23 GMTNPMSupply Chain AttackCredential HarvestingCI CD SecurityJavaScript