Cybersecurity articles tagged #Data Theft on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/uat-10147-agentic-ai-enhances-post-compromise-operationshttps://runtimerebel.com/blog/uat-10147-agentic-ai-enhances-post-compromise-operationsChinese-speaking adversary UAT-10147 leverages agentic AI for scaled exploitation, reconnaissance, and persistence on Windows and Linux web servers.Thu, 20 Aug 2026 16:28:14 GMTAgentic AIQuasar RATData TheftUAT 10147Metasploithttps://runtimerebel.com/blog/cve-2026-12569-clop-exploits-windchill-with-custom-web-shellhttps://runtimerebel.com/blog/cve-2026-12569-clop-exploits-windchill-with-custom-web-shellClop ransomware group exploited CVE-2026-12569 in PTC Windchill and FlexPLM servers, deploying a custom web shell for deep data theft. Patch immediately.Wed, 19 Aug 2026 00:40:12 GMTClopPTC WindchillCVE-2026-12569WebshellData Thefthttps://runtimerebel.com/blog/clop-ransomware-exploits-cve-2026-12569-in-ptc-productshttps://runtimerebel.com/blog/clop-ransomware-exploits-cve-2026-12569-in-ptc-productsShell investigates potential data theft by Clop gang after exploitation of critical CVE-2026-12569 in PTC Windchill and FlexPLM instances.Sun, 16 Aug 2026 08:18:07 GMTRansomwareData TheftPTC WindchillClopCVE-2026-12569https://runtimerebel.com/blog/unc6671-targets-financial-sector-via-vishing-and-aitm-phishinghttps://runtimerebel.com/blog/unc6671-targets-financial-sector-via-vishing-and-aitm-phishingUNC6671, linked to BlackFile, exploits vishing and AiTM phishing against financial firms for cloud data theft and extortion.Sun, 09 Aug 2026 16:23:40 GMTVishingFinancial SectorData TheftUNC6671BlackFilehttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnshttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnsHealth-ISAC warns of increasing ShinyHunters data theft attacks on healthcare and med-tech organizations. Learn about TTPs and critical mitigations.Wed, 29 Jul 2026 20:57:58 GMTShinyHuntersHealthcareData TheftHealth ISACPhishingData Exfiltrationhttps://runtimerebel.com/blog/mount-royal-university-data-breach-network-intrusion-data-theft-and-deletionhttps://runtimerebel.com/blog/mount-royal-university-data-breach-network-intrusion-data-theft-and-deletionMount Royal University confirms a significant data breach involving network intrusion, data theft, and subsequent deletion of files from storage systems.Thu, 09 Jul 2026 03:27:03 GMTMount Royal UniversityData BreachNetwork IntrusionData TheftHigher Educationhttps://runtimerebel.com/blog/vidar-infostealer-malvertising-campaign-smbs-targeted-by-fake-softwarehttps://runtimerebel.com/blog/vidar-infostealer-malvertising-campaign-smbs-targeted-by-fake-softwareA financially motivated malvertising campaign is actively targeting Small to Medium Businesses, delivering Vidar Infostealer and a cryptominer through fake software…Wed, 08 Jul 2026 17:40:40 GMTVidar InfostealerMalvertisingSMBsCryptominingData TheftPirated Softwarehttps://runtimerebel.com/blog/kairos-group-extorts-1m-from-us-government-in-data-theft-campaignhttps://runtimerebel.com/blog/kairos-group-extorts-1m-from-us-government-in-data-theft-campaignA US government entity paid $1M to the Kairos group to prevent a data leak, signaling a shift from traditional ransomware to pure data-theft extortion.Sat, 04 Jul 2026 17:08:22 GMTKairosData TheftExtortionUS GovernmentRansom ISAChttps://runtimerebel.com/blog/fbi-warns-russian-apts-target-signal-backup-keys-via-phishinghttps://runtimerebel.com/blog/fbi-warns-russian-apts-target-signal-backup-keys-via-phishingFBI and CISA warn of Russian intelligence targeting Signal users. Attackers phish for backup recovery keys, enabling full account takeover and message history access.Fri, 26 Jun 2026 20:38:49 GMTRussian IntelligenceSignalPhishingAccount TakeoverData Thefthttps://runtimerebel.com/blog/cryptobandits-malware-tor-abusing-backdoor-data-thefthttps://runtimerebel.com/blog/cryptobandits-malware-tor-abusing-backdoor-data-theftCryptoBandits malware functions as a backdoor, leveraging Tor and a SOCKS5 proxy for stealthy data theft and remote code execution capabilities.Fri, 19 Jun 2026 16:55:32 GMTCryptoBanditsBackdoorTorSOCKS5 ProxyData TheftRemote Code Executionhttps://runtimerebel.com/blog/microsoft-copilot-searchleak-attack-ai-prompt-injection-data-thefthttps://runtimerebel.com/blog/microsoft-copilot-searchleak-attack-ai-prompt-injection-data-theftAnalysis of the critical Microsoft Copilot 'SearchLeak' attack. Learn how prompt injection allowed 1-click data theft and crucial defense strategies for AI applications.Tue, 16 Jun 2026 13:59:42 GMTMicrosoft CopilotAI SecurityPrompt InjectionSearchLeakData TheftLLM Securityhttps://runtimerebel.com/blog/shinyhunters-exploits-oracle-erp-zero-day-to-breach-higher-edhttps://runtimerebel.com/blog/shinyhunters-exploits-oracle-erp-zero-day-to-breach-higher-edShinyHunters is exploiting an unpatched zero-day vulnerability in Oracle ERP software, targeting US higher education institutions for data theft.Sat, 13 Jun 2026 05:36:54 GMTShinyHuntersOracle ERPZero-DayHigher EducationData Thefthttps://runtimerebel.com/blog/unc3753-targets-us-law-firms-with-vishing-physical-intrusionshttps://runtimerebel.com/blog/unc3753-targets-us-law-firms-with-vishing-physical-intrusionsUNC3753 (Luna Moth) leverages vishing and physical office intrusions to steal sensitive data from US law firms and professional services, leading to swift extortion.Fri, 05 Jun 2026 16:59:08 GMTUNC3753Luna MothSilent Ransom GroupVishingSocial EngineeringData TheftExtortionLaw FirmsPhysical IntrusionRMMWinSCPRclonehttps://runtimerebel.com/blog/china-s-dual-method-cyberattack-targets-czech-taiwan-orgs-with-azureveilhttps://runtimerebel.com/blog/china-s-dual-method-cyberattack-targets-czech-taiwan-orgs-with-azureveilNation-state actors linked to China employ dual-method spear-phishing with Azureveil malware to target Czech and Taiwan organizations for data theft.Tue, 02 Jun 2026 21:12:29 GMTChinaAzureveilSpear PhishingData TheftCzech RepublicTaiwanNation Statehttps://runtimerebel.com/blog/radiology-associates-of-richmond-breach-affects-266000-patientshttps://runtimerebel.com/blog/radiology-associates-of-richmond-breach-affects-266000-patientsA data breach at Radiology Associates of Richmond has exposed the sensitive health and personal information of over 266,000 individuals.Mon, 25 May 2026 13:19:30 GMTRadiology Associates of RichmondPHIHealthcareData Thefthttps://runtimerebel.com/blog/ukraine-identifies-odesa-based-infostealer-operatorhttps://runtimerebel.com/blog/ukraine-identifies-odesa-based-infostealer-operatorUkrainian cyberpolice and US law enforcement identify an 18-year-old in Odesa suspected of compromising 28,000 accounts for dark web monetization.Thu, 21 May 2026 00:58:31 GMTInfostealerUkraine CyberpoliceData TheftCredential StuffingOdesahttps://runtimerebel.com/blog/macsync-stealer-distributed-via-malicious-homebrew-ad-campaignhttps://runtimerebel.com/blog/macsync-stealer-distributed-via-malicious-homebrew-ad-campaignMalicious ads for Homebrew distribute MacSync Stealer, targeting macOS users. Threat actors leverage trusted software to deploy data-stealing malware.Fri, 01 May 2026 20:25:24 GMTMacSync StealerHomebrewmacOSMalvertisingData Thefthttps://runtimerebel.com/blog/openemr-flaws-database-compromise-rce-and-patient-data-theft-riskshttps://runtimerebel.com/blog/openemr-flaws-database-compromise-rce-and-patient-data-theft-risksAnalysis of 38 security flaws in OpenEMR, an EHR platform used by over 100,000 healthcare providers, enabling database compromise, RCE, and data theft.Wed, 29 Apr 2026 20:32:29 GMTOpenemrEHRHealthcare SecurityAI Driven SecurityData TheftRCEDatabase Compromisehttps://runtimerebel.com/blog/compromised-checkmarx-kics-supply-chain-attack-on-developer-environmentshttps://runtimerebel.com/blog/compromised-checkmarx-kics-supply-chain-attack-on-developer-environmentsA supply chain attack compromised Checkmarx KICS Docker images and extensions, exposing developer environments to sensitive data theft. Learn mitigation.Thu, 23 Apr 2026 16:40:50 GMTCheckmarxKICSSupply Chain AttackDeveloper ToolsVS CodeDockerData Thefthttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usershttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usersNorth Korea-backed Sapphire Sleet is deploying ClickFix malware via fake job offers and phony Zoom updates to steal macOS user credentials and data.Thu, 16 Apr 2026 20:22:49 GMTSapphire SleetClickFixmacOSNorth KoreaPhishingData TheftAPThttps://runtimerebel.com/blog/uac-0247-targets-ukrainian-healthcare-via-data-theft-malwarehttps://runtimerebel.com/blog/uac-0247-targets-ukrainian-healthcare-via-data-theft-malwareUAC-0247 is targeting Ukrainian clinics and government entities using malware designed to steal data from WhatsApp and Chromium-based browsers.Thu, 16 Apr 2026 08:40:22 GMTUAC 0247UkraineHealthcare SecurityInformation StealerData Thefthttps://runtimerebel.com/blog/mercor-hit-by-litellm-supply-chain-attack-lapsus-claims-4tb-data-thefthttps://runtimerebel.com/blog/mercor-hit-by-litellm-supply-chain-attack-lapsus-claims-4tb-data-theftAI recruiting firm Mercor is investigating a LiteLLM supply chain attack, with Lapsus$ claiming to have stolen 4TB of sensitive data.Thu, 02 Apr 2026 12:29:10 GMTMercorLiteLLMLapsusSupply Chain AttackData TheftAI Securityhttps://runtimerebel.com/blog/shinyhunters-breach-european-commission-cloud-data-thefthttps://runtimerebel.com/blog/shinyhunters-breach-european-commission-cloud-data-theftShinyHunters claimed responsibility for a cyber intrusion and 350GB data theft from European Commission cloud systems. Understand the TTPs and mitigation.Mon, 30 Mar 2026 12:35:44 GMTShinyHuntersEuropean CommissionData TheftCloud SecurityCyber IntrusionExfiltrationhttps://runtimerebel.com/blog/apple-warns-of-coruna-and-darksword-exploit-kits-targeting-ioshttps://runtimerebel.com/blog/apple-warns-of-coruna-and-darksword-exploit-kits-targeting-iosApple warns of Coruna and DarkSword exploit kits targeting older iOS versions via malicious web content to steal sensitive data. Update your devices now.Fri, 20 Mar 2026 08:17:32 GMTAppleiOSCorunaDarkSwordExploit KitData Thefthttps://runtimerebel.com/blog/snappyclient-c2-implant-targets-crypto-wallets-for-data-thefthttps://runtimerebel.com/blog/snappyclient-c2-implant-targets-crypto-wallets-for-data-theftA new C2 implant, SnappyClient, is actively targeting crypto wallets, facilitating remote access, extensive data theft, and persistent spying on victims.Thu, 19 Mar 2026 00:37:20 GMTSnappyClientC2Crypto WalletsData TheftRemote AccessMalwarehttps://runtimerebel.com/blog/claudy-day-prompt-injection-and-xss-flaws-target-claude-ai-usershttps://runtimerebel.com/blog/claudy-day-prompt-injection-and-xss-flaws-target-claude-ai-usersResearchers uncover 'Claudy Day', a trio of vulnerabilities in Anthropic's Claude AI that allow data theft through malicious Google search results.Wed, 18 Mar 2026 16:30:53 GMTAnthropicClaudePrompt InjectionData TheftLLM Securityhttps://runtimerebel.com/blog/ransomware-ttps-shift-from-cobalt-strike-to-native-tools-data-theft-surgeshttps://runtimerebel.com/blog/ransomware-ttps-shift-from-cobalt-strike-to-native-tools-data-theft-surgesRansomware actors are abandoning Cobalt Strike for native Windows tools as payment rates decline, leading to a significant surge in data theft.Wed, 18 Mar 2026 00:37:35 GMTRansomwareTTPsCobalt StrikeData TheftNative Windows ToolsPost Exploitationhttps://runtimerebel.com/blog/elementor-ally-plugin-sqli-unauthenticated-data-theft-riskhttps://runtimerebel.com/blog/elementor-ally-plugin-sqli-unauthenticated-data-theft-riskAn unauthenticated SQL injection vulnerability in the Elementor Ally WordPress plugin affects over 400,000 sites, risking sensitive data exposure.Wed, 11 Mar 2026 20:13:50 GMTSQL InjectionWordPressElementor AllyWeb AccessibilityData Thefthttps://runtimerebel.com/blog/chrome-extensions-quicklens-and-buildmelon-hijacked-via-ownership-transferhttps://runtimerebel.com/blog/chrome-extensions-quicklens-and-buildmelon-hijacked-via-ownership-transferAttackers are exploiting Chrome extension ownership transfers to weaponize QuickLens and BuildMelon tools for code injection and data harvesting.Mon, 09 Mar 2026 12:18:29 GMTChrome ExtensionBrowser SecuritySupply Chain AttackQuickLensBuildMelonData Thefthttps://runtimerebel.com/blog/spanish-authorities-dismantle-anonymous-fenix-hacktivist-nodehttps://runtimerebel.com/blog/spanish-authorities-dismantle-anonymous-fenix-hacktivist-nodeSpain's National Police arrested four members of Anonymous Fénix, a hacktivist group targeting government infrastructure with DDoS and data exfiltration.Tue, 24 Feb 2026 12:24:21 GMTAnonymous F U00e9nixSpainHacktivismDDoSLaw EnforcementData Theft