Cybersecurity articles tagged #Credential Stealer on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackAttackers poisoned official Jscrambler NPM packages to distribute cross-platform credential stealers. Learn the impact and how to remediate the threat.Tue, 14 Jul 2026 10:01:24 GMTJscramblerNPMSupply Chain AttackMalwareCredential Stealerhttps://runtimerebel.com/blog/cve-2026-35616-forticlient-ems-exploit-delivers-ekz-infostealerhttps://runtimerebel.com/blog/cve-2026-35616-forticlient-ems-exploit-delivers-ekz-infostealerAttackers are actively exploiting CVE-2026-35616, an authentication bypass in FortiClient EMS, to deploy the EKZ infostealer. Protect your organization now.Thu, 28 May 2026 20:53:31 GMTCVE-2026-35616FortiClient EMSEKZ InfostealerAuthentication BypassCredential StealerFortinethttps://runtimerebel.com/blog/forticlient-ems-critical-flaw-exploited-for-credential-stealinghttps://runtimerebel.com/blog/forticlient-ems-critical-flaw-exploited-for-credential-stealingThreat actors are actively exploiting a critical, patched FortiClient EMS vulnerability to deploy credential-stealing malware, bypassing trusted endpoint security.Thu, 28 May 2026 17:21:27 GMTFortiClient EMSCredential StealerEndpoint SecurityExploitationMalwarehttps://runtimerebel.com/blog/laravel-lang-php-packages-compromised-credential-stealer-alerthttps://runtimerebel.com/blog/laravel-lang-php-packages-compromised-credential-stealer-alertMultiple Laravel-Lang PHP packages have been compromised to deliver a cross-platform credential stealer. Learn how to detect and mitigate this supply chain threat.Sat, 23 May 2026 12:28:26 GMTLaravel LangPHPCredential StealerSupply Chain AttackComposerhttps://runtimerebel.com/blog/nx-console-18-95-0-compromise-vs-code-extension-credential-stealerhttps://runtimerebel.com/blog/nx-console-18-95-0-compromise-vs-code-extension-credential-stealerSecurity researchers have identified a compromised version of the Nx Console VS Code extension (18.95.0) containing a malicious credential stealer.Tue, 19 May 2026 09:18:11 GMTNx ConsoleVS CodeSupply Chain AttackRwl Angular ConsoleCredential Stealerhttps://runtimerebel.com/blog/shai-hulud-supply-chain-attack-malicious-npm-and-mistral-packageshttps://runtimerebel.com/blog/shai-hulud-supply-chain-attack-malicious-npm-and-mistral-packagesThe Shai-Hulud campaign targets developers with over 300 signed npm and PyPI packages impersonating TanStack and Mistral to steal sensitive credentials.Tue, 12 May 2026 12:48:53 GMTShai HuludNPMPyPISupply Chain AttackMistral AITanStackCredential Stealerhttps://runtimerebel.com/blog/pcpjack-credential-stealer-cloud-system-exploitation-spreadhttps://runtimerebel.com/blog/pcpjack-credential-stealer-cloud-system-exploitation-spreadPCPJack, a new credential stealer, leverages 5 unspecified CVEs to achieve worm-like spread across cloud, container, developer, and financial service environments…Thu, 07 May 2026 20:32:23 GMTPCPJackCredential StealerCloud SecurityWormTeamPCPhttps://runtimerebel.com/blog/backdoored-pytorch-lightning-package-drops-credential-stealerhttps://runtimerebel.com/blog/backdoored-pytorch-lightning-package-drops-credential-stealerA malicious PyTorch Lightning package on PyPI delivers a credential stealer, targeting browser data, environment variables, and cloud service credentials.Mon, 04 May 2026 20:35:32 GMTPyTorch LightningPyPICredential StealerSupply Chain AttackPythonMalware