Railway says intruder may have read customer environment secrets
A subset of Railway users may have had decrypted API keys and credentials exposed; the company urges rotation and has revoked its own tokens.
74
Product
Google Cloud Platform
- Mentions · 7d0
- Mentions · 30d2
- All mentions4
- First seenSep 23, 2026
- Last mentioned20d ago
Timeline
4 articles · newest firstPhishing campaign uses stolen GCP access to bill victims for LLMs
Attackers phished MFA codes, linked foreign projects to victim billing, and kept Gemini prompts hidden from the organization.
74
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
64
How One Kubernetes YAML Can Hand Over a GCP Organization
A design flaw in Google's Kubernetes Config Connector allows attackers with namespace access to take over an entire GCP organization using a single YAML file.
75
Appears with
- Googlevendor · 4
- Wizorganization · 3
- Amazon Web Servicesvendor · 1
- Google Kubernetes Config Connectorproduct · 1
- Recorded Futureorganization · 1
- GitHubvendor · 1
- Railwayvictim · 1
- NordStellarorganization · 1
- GitLabvendor · 1
- GitHubproduct · 1
- Google Adsproduct · 1
- Vidarmalware · 1
- AWSproduct · 1
- GitLabproduct · 1
- Miasmamalware · 1
- Geminiai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.