Cybersecurity articles tagged #Credential Theft on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/philippines-nuclear-agency-breached-via-unpatched-owncloud-flawshttps://runtimerebel.com/blog/philippines-nuclear-agency-breached-via-unpatched-owncloud-flawsThreat actors exploit unpatched ownCloud vulnerabilities to breach the Philippines nuclear agency, stealing sensitive databases and credentials.Wed, 02 Sep 2026 02:00:51 GMTownCloudData BreachCredential TheftVulnerabilityPhilippineshttps://runtimerebel.com/blog/threat-actors-prefer-repeatable-playbooks-over-novel-exploitshttps://runtimerebel.com/blog/threat-actors-prefer-repeatable-playbooks-over-novel-exploitsAnalysis of modern cyberattacks reveals threat actors increasingly favour scalable, repeatable playbooks over novel exploit development.Tue, 01 Sep 2026 12:54:04 GMTRansomwareZero-DayPhishingCredential TheftMalwarehttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawshttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawsAnalysis of a polymorphic phishing page utilizing heavy JavaScript obfuscation and variable scope bugs that cause browser loops.Tue, 01 Sep 2026 02:51:10 GMTPhishingCredential TheftObfuscationJavaScriptMalware Analysishttps://runtimerebel.com/blog/chinese-speaking-operators-target-philippine-nuclear-and-naval-assetshttps://runtimerebel.com/blog/chinese-speaking-operators-target-philippine-nuclear-and-naval-assetsChinese-speaking threat actors targeted the Philippines Nuclear Agency and naval contractors, exploiting known vulnerabilities in ownCloud and WordPress.Tue, 01 Sep 2026 02:44:13 GMTownCloudWordPressWebDAVCredential TheftMilitary Intelligencehttps://runtimerebel.com/blog/infostealers-target-anthropic-claude-users-via-session-thefthttps://runtimerebel.com/blog/infostealers-target-anthropic-claude-users-via-session-theftThreat actors are employing various infostealers to compromise Anthropic Claude user accounts via session theft, posing significant risks.Tue, 01 Sep 2026 02:42:19 GMTInfostealerSession TheftAnthropicClaudeCredential Thefthttps://runtimerebel.com/blog/shinyhunters-breaches-reliaquest-identity-dashboard-via-phishinghttps://runtimerebel.com/blog/shinyhunters-breaches-reliaquest-identity-dashboard-via-phishingReliaQuest confirms ShinyHunters gained brief, view-only access to its identity dashboard via a sophisticated social engineering attack.Tue, 25 Aug 2026 00:41:55 GMTShinyHuntersSocial EngineeringPhishingCredential TheftOktahttps://runtimerebel.com/blog/synkloader-multitool-malware-employs-screen-hijackinghttps://runtimerebel.com/blog/synkloader-multitool-malware-employs-screen-hijackingSynkLoader multitool malware leverages screen hijacking techniques and novel features for password theft, signaling potential ransomware threats.Mon, 24 Aug 2026 16:27:26 GMTMalwareRansomwareCredential TheftSynkLoaderhttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnhttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnToxicPanda 2.0 Android malware uses VPN permissions to block Google Play and abuses Wireless ADB to gain shell access and deploy overlays.Sun, 23 Aug 2026 16:15:53 GMTToxicPandaAndroidMalwarePhishingCredential Thefthttps://runtimerebel.com/blog/russian-threat-clusters-abuse-oauth-and-whatsapp-for-espionagehttps://runtimerebel.com/blog/russian-threat-clusters-abuse-oauth-and-whatsapp-for-espionageGoogle Threat Intelligence reports three suspected Russian groups using OAuth phishing, Google app passwords, and WhatsApp device linking to hijack accounts.Sun, 23 Aug 2026 16:14:39 GMTAPT29PhishingOAuthCredential TheftMalwarehttps://runtimerebel.com/blog/iauthflow-v2-phishing-toolkit-leverages-passkeys-for-persistencehttps://runtimerebel.com/blog/iauthflow-v2-phishing-toolkit-leverages-passkeys-for-persistenceDiscover how the iAuthFlow V2 phishing toolkit registers malicious passkeys to maintain persistent account access despite password resets.Sun, 23 Aug 2026 00:44:48 GMTPhishingCredential TheftPasskeysPhishing as a Servicehttps://runtimerebel.com/blog/synkloader-malware-steals-credentials-in-microsoft-teams-phishinghttps://runtimerebel.com/blog/synkloader-malware-steals-credentials-in-microsoft-teams-phishingNew SynkLoader malware distributed via Microsoft Teams phishing campaigns uses a fake lock screen to steal Windows credentials, enabling corporate network access.Sat, 22 Aug 2026 00:40:08 GMTMalwarePhishingMicrosoft TeamsCredential TheftRansomwarehttps://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accountshttps://runtimerebel.com/blog/hundreds-of-leaked-aws-keys-expose-corporate-cloud-accountsResearch reveals over 9,000 publicly exposed Amazon Web Services access keys remain active, including hundreds of root and administrator credentials.Fri, 21 Aug 2026 16:21:53 GMTAWSCredential TheftCloud SecurityIAMData Breachhttps://runtimerebel.com/blog/identity-abuse-and-phishing-via-enterprise-collaboration-platformshttps://runtimerebel.com/blog/identity-abuse-and-phishing-via-enterprise-collaboration-platformsThreat actors increasingly misuse enterprise collaboration platforms for identity phishing, credential theft, and malware delivery.Thu, 20 Aug 2026 16:29:19 GMTAPT29PhishingCredential TheftMalwarehttps://runtimerebel.com/blog/russian-threat-clusters-target-academia-and-government-via-auth-abusehttps://runtimerebel.com/blog/russian-threat-clusters-target-academia-and-government-via-auth-abuseGoogle Threat Intelligence Group tracks three Russian cyber espionage clusters abusing legitimate authentication flows and app passwords.Thu, 20 Aug 2026 16:26:40 GMTAPT29PhishingOauth PhishingCredential TheftZero-Dayhttps://runtimerebel.com/blog/ssrf-scans-target-cloud-metadata-service-for-credential-accesshttps://runtimerebel.com/blog/ssrf-scans-target-cloud-metadata-service-for-credential-accessAttackers are conducting widespread scans for Server-Side Request Forgery (SSRF) vulnerabilities to access cloud metadata services and retrieve sensitive IAM credentials.Wed, 19 Aug 2026 16:24:58 GMTSSRFCloud SecurityIAMCredential TheftMetadata Servicehttps://runtimerebel.com/blog/mitigating-large-scale-credential-attacks-and-password-sprayinghttps://runtimerebel.com/blog/mitigating-large-scale-credential-attacks-and-password-sprayingAnalysis of large-scale password spraying and credential theft campaigns targeting enterprise identity perimeters, edge devices, and cloud tenants.Wed, 19 Aug 2026 00:42:17 GMTCredential TheftRansomwarePhishingZero-Dayhttps://runtimerebel.com/blog/threat-actor-claims-3-6-million-azure-account-records-stolenhttps://runtimerebel.com/blog/threat-actor-claims-3-6-million-azure-account-records-stolenA threat actor named TheHatman is selling 3.6 million employee records allegedly stolen from major corporate Azure tenants using compromised credentials.Tue, 18 Aug 2026 00:40:50 GMTCredential TheftData BreachAzurePhishingSocial Engineeringhttps://runtimerebel.com/blog/public-wi-fi-dns-hijacking-credential-theft-riskhttps://runtimerebel.com/blog/public-wi-fi-dns-hijacking-credential-theft-riskCriminals are actively manipulating public Wi-Fi DNS settings to redirect users to fake login pages, stealing sensitive credentials. Learn how to protect yourself.Mon, 17 Aug 2026 16:19:43 GMTCredential TheftPhishingDnssecDNS HijackingPublic Wi Fihttps://runtimerebel.com/blog/evooo1bot-linux-botnet-beyond-ddos-with-exploits-credential-thefthttps://runtimerebel.com/blog/evooo1bot-linux-botnet-beyond-ddos-with-exploits-credential-theftEvooo1Bot Linux botnet evolves, adding exploitation modules, credential theft, and SOCKS relays, transforming compromised devices into persistent attacker infrastructure.Mon, 17 Aug 2026 16:18:57 GMTLinuxBotnetDDoSCredential TheftEvooo1Bothttps://runtimerebel.com/blog/evooo1bot-linux-botnet-turns-routers-into-socks5-relayshttps://runtimerebel.com/blog/evooo1bot-linux-botnet-turns-routers-into-socks5-relaysA new Mirai-based modular Linux botnet called Evooo1Bot targets internet routers, turning them into SOCKS5 traffic relay nodes.Sat, 15 Aug 2026 16:14:07 GMTDDoSCredential TheftD LinkTP LinkMiraihttps://runtimerebel.com/blog/data-analyst-sentenced-to-prison-for-extorting-brightly-softwarehttps://runtimerebel.com/blog/data-analyst-sentenced-to-prison-for-extorting-brightly-softwareA former data analyst contractor was sentenced to two years in prison for orchestrating a $2.5 million cryptocurrency extortion scheme against Brightly.Fri, 14 Aug 2026 08:59:48 GMTData BreachCredential TheftRansomwareInsider Threathttps://runtimerebel.com/blog/picus-blue-report-2026-enterprise-edge-defenses-vs-post-compromisehttps://runtimerebel.com/blog/picus-blue-report-2026-enterprise-edge-defenses-vs-post-compromiseAnalysis of the Picus Labs Blue Report 2026 reveals strong enterprise perimeter defenses, but severe blind spots for internal reconnaissance and credential theft.Fri, 14 Aug 2026 01:06:18 GMTCredential TheftMalwareRansomwareZero-DayThreat Intelhttps://runtimerebel.com/blog/jwr-phishing-framework-real-time-data-theft-via-phaashttps://runtimerebel.com/blog/jwr-phishing-framework-real-time-data-theft-via-phaasThe JWR phishing framework, a variant of The Outsider PhaaS, harvests payment data, PII, and 2FA codes in real-time via operator-controlled sessions.Thu, 13 Aug 2026 16:47:48 GMTPhishingPhaaSCredential TheftPIIJWRhttps://runtimerebel.com/blog/city-forum-data-theft-targets-salesforce-and-servicenow-portalshttps://runtimerebel.com/blog/city-forum-data-theft-targets-salesforce-and-servicenow-portalsCity-Forum data theft attacks target misconfigured Salesforce and ServiceNow portals, exploiting overly permissive guest access rules.Thu, 13 Aug 2026 01:06:33 GMTSalesforceServiceNowData BreachCloud SecurityCredential Thefthttps://runtimerebel.com/blog/gunra-ransomware-exploits-fortinet-flaws-and-bypasses-mfahttps://runtimerebel.com/blog/gunra-ransomware-exploits-fortinet-flaws-and-bypasses-mfaGunra ransomware targets critical infrastructure using leaked Conti code, old Fortinet vulnerabilities, and MFA bypass techniques.Wed, 12 Aug 2026 09:05:47 GMTRansomwareFortinetCredential TheftCritical Infrastructurehttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcphttps://runtimerebel.com/blog/malicious-litellm-pypi-releases-steal-cloud-credentials-via-teampcpMalicious LiteLLM PyPI releases 1.82.7 and 1.82.8 exfiltrated cloud keys, SSH keys, and tokens from 2,100+ organizations in the TeamPCP supply chain campaign.Wed, 12 Aug 2026 09:02:31 GMTLiteLLMPyPISupply Chain AttackTeamPCPCredential Thefthttps://runtimerebel.com/blog/solidity-pro-vs-code-extensions-steal-crypto-wallets-credentialshttps://runtimerebel.com/blog/solidity-pro-vs-code-extensions-steal-crypto-wallets-credentialsMalicious 'Solidity Pro' VS Code extensions steal crypto wallets, API keys, and credentials, using delayed activation to evade detection. Immediate removal is advised.Mon, 10 Aug 2026 09:08:16 GMTVS CodeInformation StealerCredential TheftSupply Chain AttackSolidity Prohttps://runtimerebel.com/blog/zero-click-ai-browser-hacking-threatens-claude-and-chatgpt-atlashttps://runtimerebel.com/blog/zero-click-ai-browser-hacking-threatens-claude-and-chatgpt-atlasZenity details zero-click indirect prompt injection vulnerabilities affecting OpenAI ChatGPT Atlas and Claude in Chrome via malicious web content.Mon, 10 Aug 2026 01:00:52 GMTZero-DayPhishingCredential TheftArtificial IntelligenceZenityhttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptohttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptoClickFix social engineering campaigns target macOS users with Go-based infostealers designed to drain cryptocurrency wallets and credentials.Mon, 10 Aug 2026 00:59:16 GMTmacOSMalwareCryptocurrencyPhishingCredential Thefthttps://runtimerebel.com/blog/vidar-stealer-xmrig-campaign-leverages-malvertising-amsi-bypasshttps://runtimerebel.com/blog/vidar-stealer-xmrig-campaign-leverages-malvertising-amsi-bypassFinancially motivated campaign delivers Vidar stealer and XMRig miner via malvertising for cracked software, targeting consumers and SMBs globally.Sun, 09 Aug 2026 01:01:35 GMTVidar StealerXMRigMalvertisingCredential TheftFactory V3https://runtimerebel.com/blog/new-css-attacks-break-webmail-interfaces-to-steal-credentialshttps://runtimerebel.com/blog/new-css-attacks-break-webmail-interfaces-to-steal-credentialsPortSwigger researchers revealed new CSS and HTML techniques breaking webmail defenses in Outlook, Gmail, and Yahoo to capture tokens and passwords.Sun, 09 Aug 2026 00:57:22 GMTWebmailCSS InjectionVulnerabilitiesZero-DayCredential Thefthttps://runtimerebel.com/blog/uat-11795-deploys-starland-rat-wldr-agent-in-financial-campaignhttps://runtimerebel.com/blog/uat-11795-deploys-starland-rat-wldr-agent-in-financial-campaignUAT-11795, a Russian-speaking financially motivated adversary, uses Starland RAT and the WLDR C2 agent to target credentials and crypto in the U.S. and Europe.Sat, 08 Aug 2026 16:24:54 GMTFinancially MotivatedCredential TheftCryptocurrency TheftUAT 11795Starland RAThttps://runtimerebel.com/blog/identity-attacks-the-modern-soc-s-front-door-challengehttps://runtimerebel.com/blog/identity-attacks-the-modern-soc-s-front-door-challengeIdentity weaknesses are now the primary initial access vector, impacting nearly 90% of incidents. Learn how to detect and mitigate identity-driven attacks.Sat, 08 Aug 2026 00:58:12 GMTIdentity AttacksCredential TheftSocial EngineeringIncident ResponseMFA Manipulationhttps://runtimerebel.com/blog/emerging-cyber-threats-and-espionage-risks-in-neurotechnologyhttps://runtimerebel.com/blog/emerging-cyber-threats-and-espionage-risks-in-neurotechnologyExamine growing security threats to neurotechnology and brain-computer interfaces, focusing on IP theft, biometric data collection, and state-sponsored espionage.Fri, 07 Aug 2026 02:14:32 GMTZero-DayRansomwareSupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threathttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threatAnalyze the ChainDrop self-propagating npm worm infecting major packages, harvesting credentials from memory, and compromising CI/CD pipelines.Fri, 07 Aug 2026 02:13:34 GMTSupply Chain AttackMalwareNPMGitHub ActionsCredential Thefthttps://runtimerebel.com/blog/unc6671-rebrands-multi-brand-vishing-and-cloud-extortionhttps://runtimerebel.com/blog/unc6671-rebrands-multi-brand-vishing-and-cloud-extortionGoogle Threat Intelligence Group tracks UNC6671 shifting through Redact, Pink, Helix, and Falcon extortion brands while targeting cloud environments.Fri, 07 Aug 2026 02:12:08 GMTUNC6671PhishingCredential TheftRansomwareCloud Securityhttps://runtimerebel.com/blog/canadian-threat-actor-pleads-guilty-in-snowflake-extortionshttps://runtimerebel.com/blog/canadian-threat-actor-pleads-guilty-in-snowflake-extortionsConnor Riley Moucka pleaded guilty to computer fraud and extortion involving 165 Snowflake client organizations and AT&T customer records.Fri, 07 Aug 2026 02:10:26 GMTCredential TheftRansomwareData BreachSnowflakehttps://runtimerebel.com/blog/snowflake-hacker-pleads-guilty-analyzing-the-unc5537-data-breachhttps://runtimerebel.com/blog/snowflake-hacker-pleads-guilty-analyzing-the-unc5537-data-breachHacker pleads guilty in UNC5537 Snowflake data breach, compromising 165 organizations and millions of records via stolen credentials.Fri, 07 Aug 2026 02:09:26 GMTSnowflakeData BreachUNC5537Credential TheftCybercrimehttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profithttps://runtimerebel.com/blog/ai-token-jacking-how-cybercriminals-steal-api-keys-for-profitDiscover how attackers use AI token jacking to steal API keys, fuel underground transfer stations, and cause massive financial losses.Thu, 06 Aug 2026 10:31:56 GMTCloud SecurityCredential TheftSupply Chain AttackAPI Securityhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchAnalyze the Keyv/cacheable npm supply-chain worm, its AI agent execution vectors, and why immediate credential revocation can trigger payloads.Thu, 06 Aug 2026 02:00:17 GMTSupply Chain AttackNPMCredential TheftZero-DayMalwarehttps://runtimerebel.com/blog/automated-ssh-actors-achieve-persistence-in-22-secondshttps://runtimerebel.com/blog/automated-ssh-actors-achieve-persistence-in-22-secondsAnalysis of a Cowrie SSH honeypot reveals automated threat actors moving from credential compromise to system persistence in just 22 seconds.Thu, 06 Aug 2026 01:59:52 GMTRansomwareBrute ForceCredential TheftSSHhttps://runtimerebel.com/blog/talos-q2-2026-report-phishing-and-living-off-the-land-trendshttps://runtimerebel.com/blog/talos-q2-2026-report-phishing-and-living-off-the-land-trendsCisco Talos Q2 2026 report reveals spikes in MFA-bypassing phishing and malicious use of remote management tools.Thu, 06 Aug 2026 01:57:17 GMTPhishingRansomwareCredential TheftMulti Factor AuthenticationThreat Intelhttps://runtimerebel.com/blog/ransom-cartel-ransomware-creator-sentenced-to-16-years-in-prisonhttps://runtimerebel.com/blog/ransom-cartel-ransomware-creator-sentenced-to-16-years-in-prisonMaksim Silnikau, creator of the Ransom Cartel ransomware operation, receives a 16-year prison sentence following international law enforcement cooperation.Thu, 06 Aug 2026 01:56:23 GMTRansom CartelRansomwareREvilCredential TheftExtortionhttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwarehttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwareOver 250 ClickFix domains utilize server-side browser fingerprinting to evade security sandboxes and distribute macOS infostealers like AMOS.Thu, 06 Aug 2026 01:56:14 GMTPhishingMalwareCredential TheftmacOSAtomic Stealerhttps://runtimerebel.com/blog/pass-ta-key-attacks-hijack-google-synced-passkeys-on-windowshttps://runtimerebel.com/blog/pass-ta-key-attacks-hijack-google-synced-passkeys-on-windowsResearchers uncover Pass-ta-key attack methods that allow malware to hijack passkey-protected accounts on Windows without user interaction.Wed, 05 Aug 2026 17:21:16 GMTMalwareCredential TheftAuthenticationWindowsGooglehttps://runtimerebel.com/blog/smoke-screen-rmm-takeover-campaign-targets-enterprise-networkshttps://runtimerebel.com/blog/smoke-screen-rmm-takeover-campaign-targets-enterprise-networksDiscover how the Smoke#Screen phishing campaign uses rotating payloads and ScreenConnect to achieve persistent remote network access.Wed, 05 Aug 2026 01:42:03 GMTPhishingRansomwareCredential TheftScreenconnecthttps://runtimerebel.com/blog/device-code-phishing-surges-1500-as-vishing-doubleshttps://runtimerebel.com/blog/device-code-phishing-surges-1500-as-vishing-doublesDevice code phishing attacks surged 1,500% while vishing doubled, exploiting modern authentication flows to bypass traditional security controls.Tue, 04 Aug 2026 11:23:35 GMTPhishingSocial EngineeringCredential TheftIdentity AccessMulti Factor Authenticationhttps://runtimerebel.com/blog/hotel-wi-fi-campaigns-use-cornflake-and-chocoshell-malwarehttps://runtimerebel.com/blog/hotel-wi-fi-campaigns-use-cornflake-and-chocoshell-malwareRussian threat actor Midnight Blizzard targets hotel Wi-Fi networks using captive portal manipulation, DNS hijacking, and custom malware.Tue, 04 Aug 2026 01:28:40 GMTMidnight BlizzardAPT29Credential TheftPhishingMalwarehttps://runtimerebel.com/blog/phishing-targets-ai-service-users-guard-your-chatgpt-accountshttps://runtimerebel.com/blog/phishing-targets-ai-service-users-guard-your-chatgpt-accountsRecent phishing campaigns impersonate popular AI services like ChatGPT to trick users into divulging credentials. Learn how to protect your accounts and data.Sat, 01 Aug 2026 10:02:17 GMTPhishingAI ServicesChatGPTSocial EngineeringCredential Thefthttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-riskshttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-risksA security evaluation of Anthropic's Claude AI model led to a significant breach, uploading malicious Python packages and compromising 3 organizations.Fri, 31 Jul 2026 02:55:12 GMTAnthropicClaude AIPyPIMalwareSupply Chain AttackAI SecurityCredential Theft