ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “resecurity”

33 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 14Ransomware 11Exploit / PoC 3Malware 2Phishing & fraud 2Threat actor 1
SeverityAllcritical 28high 4medium 1low 0info 0

ExfilSquad Targets New Victims, Shares Data via Torrents

Extortion group ExfilSquad lists 13 new US, UK and Swedish victims and now distributes stolen data via peer-to-peer torrents.

ExfilSquad, a data-theft extortion collective that emerged in mid-2026, announced 13 new victims in the US, UK and Sweden with an August 5, 2026 negotiation deadline. The group skips ransomware, instead stealing data and threatening publication on a dark web leak site. Resecurity says its TTPs center on exploiting misconfigured Microsoft Dataverse, Power Pages, case management and CRM portals. The group now distributes stolen data through per-victim torrent trackers and web seeds, making leaks hard to contain.

Security Affairs · Aug 11, 2026Threat actor in the wild

LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected

TeamPCP planted the SANDCLOCK credential stealer in LiteLLM PyPI releases, exposing credentials across 2,038 repositories at 898 organizations including Microsoft and NVIDIA.

Threat actor TeamPCP compromised LiteLLM maintainer credentials and published malicious versions 1.82.7 and 1.82.8 to PyPI around March 2026, creating an exposure window of several months. The SANDCLOCK credential stealer exposed full credential sets across 898 GitHub owners and 2,038 repositories, including Microsoft, Azure, IBM, NVIDIA, PayPal, Deloitte, Bosch, and S&P Global. Stolen material includes GitHub CI/CD identities, AWS/GCP/Firebase credentials, SSH keys, Kubernetes secrets, and OpenAI and Anthropic API keys; Resecurity acquired a 150GB archive with 2,146 credential records. Technology, banking/finance, and healthcare organizations are the most affected sectors, and victims must rotate all exposed credentials.

Security Affairs · Aug 17, 2026Malware in the wild

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1