In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
Organization
SpyCloud
- Mentions · 7d0
- Mentions · 30d0
- All mentions14
- First seenSep 9, 2026
- Last mentionedSep 25, 2026
Timeline
14 articles · newest firstAI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.
75
EvilTokens made phishing-as-a-service look easy. Then it got taken down
Law enforcement takes down EvilTokens PhaaS kit that compromised 12,000 inboxes using AI-powered device-code phishing to bypass MFA.
85
Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
84
Microsoft disrupts AI-assisted platform that compromised 12,000
Microsoft seized EvilTokens, an AI-chatbot BEC platform that compromised 12,000 accounts across 10,000 organizations.
75
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
76
Stolen passwords are exposing America’s water providers to hackers
SpyCloud research found infostealer malware stole credentials from 1,787 US water providers, including 250 with operational-network and remote-access exposure.
55
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
77
Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.
74
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
Microsoft-led disruption hits EvilTokens PhaaS after it compromised 12,000+ accounts at 10,000+ organizations; two UK suspects arrested.
73
Another worry for water systems: infostealer exposure
SpyCloud study finds nearly 20% of U.S. water/wastewater organizations have active infostealer credential exposure.
75
Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials
New Remus Windows infostealer removes syscall hooks to evade EDR, stealing browser credentials, crypto wallets, and AI tool data via ClickFix lures and EtherHiding C2.
58
SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise
SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.
32
SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise
SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.
32
Related CVEs
by mentions- CVE-2026-42542<1%7.5TDengine: In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single…
Appears with
- Microsoftorganization · 8
- Microsoftvendor · 7
- Coinbaseorganization · 6
- Health-ISACorganization · 6
- OpenAIorganization · 6
- Cloudflareorganization · 6
- Railwayorganization · 5
- TRM Labsorganization · 5
- Storm-2992threat actor · 4
- Microsoft 365product · 3
- EvilTokensmalware · 3
- Metropolitan Police Serviceorganization · 3
- EvilTokensorganization · 3
- The Shadowserver Foundationorganization · 3
- SpyCloudvendor · 3
- SpyCloud Identity Threat Reportproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.