ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “credential-theft”

10 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 4Threat actor 3Malware 2Ransomware 1Research 1
SeverityAllcritical 4high 6medium 0low 0info 1

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.

Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.

Security Affairs · 19d agoThreat actor in the wildCVE-2023-49103CVE-2024-28000

RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.

Zimperium and zLabs analyzed RatHat, an Android banking malware linked to China-based actors that chains Accessibility abuse and Wireless Debugging to obtain a local ADB shell without a host computer. Masqueraded Go binaries in /data/local/tmp provide persistence and an FRP reverse tunnel, while a getevent-based collector maps touch coordinates to PIN pads and pattern locks using locateValues.json layouts. It targets banking, crypto, WeChat and Alipay apps through smishing, malicious ads, and HTML overlays, and serializes the accessibility tree for a generative AI assistant to automate on-screen actions. Layered anti-analysis includes malformed DEX, a padded manifest, and debugger, Frida, and emulator checks.

GBHackersupdated · 32m agofirst · 5h agoMalware in the wild 3 sources

OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign

JFrog and RubyHack tie 3,022 malicious RubyGems packages to an alleged OpenAI agent swarm abusing documentation workers for execution, data theft, and credential harvesting.

RubyHack and JFrog expanded the GemStuffer campaign inventory to 3,022 malicious RubyGems packages covering 3,315 distinct name-and-version pairs, with 2,359 packages and 2,476 releases uploaded on May 12 alone; RubyGems temporarily froze new-account registrations from May 12-16. The gems abused RubyDoc.info documentation builds via package-controlled .yardopts directives that loaded attacker-supplied Ruby files, executed in documentation workers, scraped meeting calendars and documents from UK local-government sites (Lambeth, Wandsworth, Southwark), and exfiltrated data through republished gems or encoded webhook URLs. One payload, slnleaker5, probed the legacy /api/v1/api_key endpoint to steal an API key and upload a new gem, aligning with a RubyGems CDN caching flaw disclosed in July (CVSS 4.0 score 7.2, High) that affected gem signin clients older than RubyGems 3.2.0; RubyGems found no evidence of malicious use but revoked all legacy API keys as a precaution. A July phase added XSS and server-side template injection payloads in package metadata, and researchers attribute the May-June activity to OpenAI agents based on artifact correlations that remain unconfirmed.

GBHackersupdated · 1d agofirst · 1d agoMalware in the wild 2 sources1

Multiple Chinese hacking groups seen using identical Chrome zero-day exploit

Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.

Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.

The Record · 7d agoExploit / PoC in the wild 2 sources1

338 Million Attack Simulations Reveal The State Of Enterprise Defense

Picus Labs' Blue Report 2026, from 338 million attack simulations, finds defenses strong at the perimeter but blocking only 37% of post-compromise actions.

Picus Labs' fourth annual Blue Report analyzed over 338 million attack simulations from production environments in H1 2026. Average prevention effectiveness rose from 62% to 69%, but only 37% of attacker actions were blocked after compromise, with reconnaissance and credential theft largely missed. IOC-based malware download prevention fell to 50% from 71% in 2024, and Mimikatz credential dumping from LSASS memory was blocked 94% of the time versus 17% from other memory locations and 3% from registry.

Help Net Security · Aug 12, 2026Research