ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

infostealer

2 mentions in 7 days · 6 in 30 days · 7 total · first seen · last

Search everything

Timeline

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security Labs · 1d agoResearch in the wild1

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog · 5d agoPhishing & fraud

The 12 Best Antivirus Software for Mac, Compared and Priced

GBHackers ranks 12 Mac antivirus products, naming Bitdefender best overall and noting Gen Digital owns Norton, Avast, and Avira.

GBHackers scored twelve Mac antivirus products, ranking Bitdefender first at 8.8/10, followed by Intego, Malwarebytes, and ESET. The piece highlights that Gen Digital owns Norton, Avast, and Avira following the NortonLifeLock-Avast merger, so three of the twelve options share one corporate owner. It advises comparing year-two renewal prices rather than discounted first-year pricing and notes macOS already ships XProtect, Gatekeeper, and automatic malware removal. The 2026 Mac threat model described is infostealers harvesting passwords, cookies, and wallets via cracked software, fake installers, and malicious search ads.

GBHackers · 8d agoIndustry 2 sources

Hackers are stealing Claude tokens from subscribers

Infostealer malware is stealing Claude login sessions, letting attackers mint OAuth tokens and burn subscribers' paid usage largely undetected.

Anthropic confirmed a bad actor used common infostealer malware to steal Claude login sessions from users' computers and consume their paid usage. A UK consultant saw idle token usage climb, and Anthropic suspended his account, invalidated sessions and Claude Code tokens, and issued a £44.49 partial refund on his $200-per-month plan. Multiple other users on Reddit and GitHub reported similar theft; Anthropic signed out affected users and issued refunds, but still lacks itemized usage reporting to help users detect misuse.

TechCrunch · AI · 8d agoAI safety & security in the wild1

The story behind the intelligence

Cisco Talos newsletter features adversary-engagement podcast, flags AI guardrail 'safety penalty' slowing defenders, and recaps McKesson breach and PaperCut patching headlines.

The Threat Source newsletter spotlights the Beers with Talos podcast, in which researcher Azim Khodjibaev describes maintaining eight dark-web personas to identify prolific cybercriminals and support disruption efforts. Talos also argues frontier AI guardrails impose an AI 'safety penalty', citing a July 2026 incident where Hugging Face's primary cloud LLM refused to analyze forensic breach data and delayed response. Recapped headlines include ShinyHunters claiming theft of 284 million patient records from McKesson via vishing and Okta account takeover, Anthropic warning Claude users about infostealer malware, and PaperCut issuing emergency patches for chained vulnerabilities.

Cisco Talos · 13d agoIndustry

Infostealers are hijacking Claude accounts at users’ expense

Malwarebytes reports infostealers are stealing Claude session cookies to hijack Anthropic accounts and consume victims' usage at their expense.

Anthropic warned that infostealer malware operators are harvesting Claude session cookies from infected machines. Attackers replay the stolen cookies to take over users' accounts and consume their usage quotas, affecting the victims' own access. The activity involves observed account hijacking rather than a flaw in Claude itself.

Malwarebytes Labs · 16d agoMalware in the wild

Malicious Ads Infostealer League

Malicious advertisements delivered an infostealer in a widespread malvertising campaign.

The report describes malicious advertisements that distribute an information-stealer to users who click or interact with the ads. Infostealers typically harvest saved browser passwords, session cookies, and cryptocurrency wallet data from infected machines. The specific malware family, ad networks abused, and victim counts are not stated in the headline.

Infosecurity Magazine · Aug 16, 2026Malware in the wild

Appears with

vendor Anthropic 3product Claude 2vendor Malwarebytes 2ai model Claude 2organization MITRE 1product Blackpass 1ai model Hugging Face cloud LLM 1product Cursor 1organization Beers with Talos 1product GitHub 1product Infodig 1product NodeZero 1product Okta 1product Styx 1product Xleet 1product Claude Code 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.