57
57
60
57
57
UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications
60
57
57
57
57
57
57
57
57
57
57
57
57
60
57
57
57
57
Medical device maker Boston Scientific says a cyberattack is causing a ‘global disruption’ to its operations
Boston Scientific says a cyberattack has caused global disruption to its operations, with no confirmation yet on device impact or data exfiltration.
Boston Scientific, a major medical device manufacturer, disclosed that a cyberattack is causing global disruption to its operations. The company has not confirmed whether medical devices are affected or whether any customer data was exfiltrated. The investigation appears to be ongoing, and healthcare-sector exposure raises patient-safety and supply-chain concerns.
72
Terabytes of credentials leaked in massive supply-chain attack
Compromise of an AI software package led to scraping and exfiltration of terabytes of credentials from about 2,500 users.
A supply-chain attack involving a compromised AI software package resulted in data being scraped and exfiltrated. Roughly 2,500 users were affected, with terabytes of credentials leaked. The article provides limited technical detail on the package or attackers involved.
74
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.
78
57
57
57
57
57
57
57
57
57
57
57
57
57
57