Search: “cloud credentials”

3 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 912 Ransomware 899 Malware 644 Data breach 620 Threat actor 324 Exploit / PoC 313 Phishing & fraud 277 Industry 199 Policy & legal 194 AI tools & infra 68 AI safety & security 64 Advisory 34 Tools 33 Research 31

SeverityAll critical 1891 high 1455 medium 831 low 278 info 201

Hackers Steal Active Directory Password Hashes Without Attacking Domain Controllers Directly

Attackers use the DCSync technique to impersonate domain controllers and harvest AD password hashes and Kerberos keys without directly compromising domain controllers, Trellix warns.

Per Trellix, threat actors increasingly abuse Active Directory replication via DCSync, using privileged credentials to invoke DRSGetNCChanges and retrieve NTLM password hashes and Kerberos key material without running code on domain controllers. Capturing the krbtgt account hash enables forging Golden Tickets for persistent, highly privileged domain access. Because malicious replication traffic mimics legitimate DRS/RPC activity, defenders should monitor Windows Security Event ID 4662, restrict replication permissions, and investigate replication requests from non-domain-controller systems.

GBHackersSep 10, 12:00 UTC · 6d agoResearch in the wild 2 sources2

Google Password Manager Attacks Could Let Malware Hijack Passkey

Unit 42 details three attack paths letting Windows malware silently sign into passkey-protected accounts via Chrome's Google Password Manager without user verification.

Palo Alto Networks Unit 42 described three post-compromise attack paths—Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key—against Chrome's Google Password Manager cloud authenticator on TPM-equipped Windows systems. The attacks can silently obtain valid authentication assertions, install attacker-controlled user-verification keys, or extract the 32-byte Security Domain Secret used to decrypt synced passkey private keys, enabling reusable access from the attacker's own environment. No CVE was assigned and no exploitation in the wild was reported; demonstrations were validated against Chrome 142 and parts of the architecture are corroborated by Chromium source. GitHub enforced the User Verified flag check, while eBay accepted a test assertion lacking it before fixing its validation gap after disclosure.

The Hacker NewsAug 11, 20:22 UTC · Aug 11, 2026Research

Risky Bulletin: Expired cards can be used for new transactions

Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.

University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.

Risky Business NewsAug 24, 04:40 UTC · 23d agoResearch1