Search: “password-managers”

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.

Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.

The Hacker News·updated Sep 10, 12:56 UTC · 6d ago·first Sep 10, 07:12 UTC · 6d agoVulnerability in the wild 4 sourcesCVE-2026-59821CVE-2026-59822CVE-2026-42271+2 CVEs

Switching Password Managers in 2026

An Apple password-management engineer (writing personally) explains switching password managers via iOS direct app-to-app export, crediting FIDO Credential Exchange for passkey portability.

Ricky Mondello, an Apple engineer in password management and authentication (writing personally, not for Apple), demonstrates moving 100 items from 1Password to Apple Passwords via the iOS system export, which transfers passwords, passkeys, verification codes, and notes directly between apps with Face ID confirmation and no intermediate files. He credits the FIDO Alliance's Credential Exchange format (first draft May 2024, now an open spec) and iOS 26/macOS 26 for enabling phishing-resistant credential transfer between apps like 1Password, Bitwarden, Dashlane, DuckDuckGo, and Devolutions. The post is advice rather than news, recommending bulk transfer on the existing device, switching AutoFill to the new app, and treating the new manager as the source of truth.

Lobsters · security·Sep 8, 13:55 UTC · 8d agoIndustry1

Google Password Manager Attacks Could Let Malware Hijack Passkey

Unit 42 details three attack paths letting Windows malware silently sign into passkey-protected accounts via Chrome's Google Password Manager without user verification.

Palo Alto Networks Unit 42 described three post-compromise attack paths—Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key—against Chrome's Google Password Manager cloud authenticator on TPM-equipped Windows systems. The attacks can silently obtain valid authentication assertions, install attacker-controlled user-verification keys, or extract the 32-byte Security Domain Secret used to decrypt synced passkey private keys, enabling reusable access from the attacker's own environment. No CVE was assigned and no exploitation in the wild was reported; demonstrations were validated against Chrome 142 and parts of the architecture are corroborated by Chromium source. GitHub enforced the User Verified flag check, while eBay accepted a test assertion lacking it before fixing its validation gap after disclosure.

The Hacker News·Aug 11, 20:22 UTC · Aug 11, 2026Research

Product showcase: Enpass Password Manager breaks away from the proprietary cloud model

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Industry

Your passkeys can now move between password managers on Android

Google enabled direct password and passkey transfers between Android password managers, initiated from the destination app without unencrypted file exports.

Android now supports moving passwords and passkeys directly between password managers without exporting them to a file, replacing the previous unencrypted-export workflow. The transfer is initiated in the receiving app, which hands off to Android to detect installed managers and request authorization in the source app. The feature works today with Google Password Manager, 1Password, Bitwarden, and Dashlane, with more partners promised but unnamed. Google says data moves between apps in seconds and calls the handoff secure, without detailing the protections.

Help Net Security·Sep 10, 16:00 UTC · 5d agoTools

Product showcase: mSecure makes one vault do more than remember passwords

Product showcase reviews mSecure password manager's AES-256 zero-knowledge vault with passkeys, 2FA storage, and multi-device sync options.

mSecure is a password manager and data vault for iOS, Android, macOS, and Windows using AES-256 encryption and a zero-knowledge architecture, with sync via mSecure Cloud, Wi-Fi, iCloud, or Dropbox, plus local-only storage. It supports passkeys, one-time passwords, a Security Center for weak/reused passwords, and a configurable password generator. Recovery features include two-factor authentication, auto-lock, a Self-Destruct option after failed unlock attempts, and iCloud backups on iOS.

Help Net Security·Sep 15, 05:30 UTC · 1d agoTools1

Rockwell Automation OTTO Fleet Manager

CISA warns Rockwell Automation OTTO Fleet Manager (CVE-2026-75112, CVSS 6.8) uses insufficiently costly password hashing, easing offline brute-force attacks.

CISA published ICS advisory ICSA-26-239-03 for Rockwell Automation OTTO Fleet Manager versions 2.36.2 and earlier (CVE-2026-75112, CVSS v3 6.8). The flaw involves use of a password hash with insufficient computational effort, reducing the cost for an attacker to perform offline brute-force attacks against stored password hashes. Deployments span critical manufacturing and transportation systems sectors worldwide, with company headquarters in the United States.

CISA Advisories·Aug 27, 12:00 UTC · 20d agoAdvisoryCVE-2026-75112

Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT

Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.

Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.

Palo Alto Unit 42·Aug 17, 13:18 UTC · Aug 17, 2026Phishing & fraud in the wild1

NIS2 compliance: Fixing IAM and access control before the 2026 audit

EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.

EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.

Help Net Security·Sep 1, 00:00 UTC · 15d agoIndustry

Boost Engagement with Free Passkeys by Wordfence

Wordfence 9 introduces free passkey support, letting WordPress users log in without passwords and reducing authentication friction.

Wordfence announced that version 9 of its WordPress security plugin introduces passkeys. The feature removes the need for users to remember or copy passwords from a manager. Wordfence is offering the passkey capability for free.

Wordfence·Sep 15, 19:55 UTC · 18h agoTools

The 20 Most Common Passwords Hackers Target in 2026

Huntress details the 20 most common passwords of 2026 and how attackers use brute force, spraying, and credential stuffing against weak credentials.

Huntress published an awareness piece based on NordPass's seventh annual list of the 200 most commonly used passwords, compiled from exposed data in cyberattacks across 44 countries. The top passwords remain simple sequences and variants such as "123456", "admin", "password", and "P@ssw0rd", all crackable in under a second. The article explains four password attack types: brute force, password spraying, credential stuffing, and dictionary attacks. Huntress cites its own data showing more than 1 in 4 IT professionals consider employees' password habits their biggest weakness, and recommends avoiding common passwords, not reusing credentials, and combining letters, numbers, and symbols.

Huntress·Sep 10, 13:00 UTC · 6d agoPhishing & fraud

UK Government Begins Moving 23 Million Users Away From Passwords

UK government rolls out passkeys for GOV.UK One Login, giving 23 million users phishing-resistant passwordless access to public services.

The UK government has begun deploying passkeys across GOV.UK One Login for more than 23 million users, replacing passwords and SMS one-time codes with FIDO2 cryptographic credentials. A trial saw over 300,000 people adopt passkeys, and nearly one in ten daily authentications already use them, cutting SMS verification costs by almost £600 per day. Passkeys remain optional, with password-based sign-in retained as a fallback, and the NCSC endorses the approach as phishing-resistant.

Cyber Security News·Sep 14, 16:52 UTC · 1d agoPolicy & legal

LastPass enhancements improve visibility, governance, and control

LastPass releases SaaS monitoring enhancements, Mobile Smart Scanner, and auto-enrolled dark web monitoring across its password management products.

LastPass announced enhancements to SaaS Monitoring and SaaS Protect in its Business Max offering, including Persistent Monitoring that keeps visibility active through the browser extension even when users are signed out, fully released as of July. It launched Mobile Smart Scanner to convert printed, handwritten, or screenshot passwords into vault credentials, and began phasing in automatic enrollment of all consumer accounts in dark web monitoring. The company also completed its transition to a Unified Admin Console, added company-wide onboarding links, and passed SOC 2 and ISO 27001/27701 audits with zero findings for the second consecutive year.

Help Net Security·Sep 1, 00:00 UTC · 15d agoTools

Microsoft Copilot reveals secret input that allowed it to be hacked

Microsoft disclosed a hidden input in Copilot that let attackers steal passwords from users who clicked a crafted link.

Microsoft revealed that Copilot contained a secret, undocumented input parameter that allowed the assistant to be compromised. Attackers could abuse the hidden input to steal passwords when a target clicked a malicious link. The disclosure highlights hidden-parameter risks in widely deployed AI assistants.

Ars Technica · Security·Aug 18, 13:00 UTC · 29d agoAI safety & security in the wild1

Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs

Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.

Microsoft Threat Intelligence observed attackers abusing Microsoft Teams external collaboration to impersonate IT/helpdesk staff, persuading employees to grant screen control via Quick Assist or RMM tools. Operators deploy malicious MSI packages via silent msiexec, run encrypted JavaScript implants through portable Node.js, and persist via EdgeUpdate Run keys or Startup folder entries. The Node.js backdoor uses HTTPS long-polling C2, captures screenshots, enumerates Active Directory, and moves laterally over WinRM (TCP 5985) to domain controllers and certificate authorities. Initial access maps to MITRE ATT&CK T1566.003 (Spearphishing via Service); no Teams vulnerability is exploited.

GBHackers·Sep 8, 13:28 UTC · 8d agoPhishing & fraud in the wild

Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America

Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.

Unit 42 identified two campaigns in Latin America whose operators used commercial LLMs (Claude, GPT-4.1) behind a self-hosted NextChat interface to generate and debug post-exploitation scripts. Cluster CL-CRI-1131 compromised a transportation organization, Mexican federal ministries, and water utilities in Mexico and Ecuador, using native Windows tools and Volume Shadow Copies to dump the SAM registry hive and NTDS.dit. Cluster CL-CRI-1163 targeted Brazilian financial organizations with job-themed phishing, custom RATs, and a Go-based reverse SOCKS5 tunneling utility called SockTz, with nine versions deployed within roughly two hours. Trend Micro tracks related AI-augmented activity as SHADOW-AETHER-040 and SHADOW-AETHER-064.

GBHackers·updated Sep 10, 08:06 UTC · 6d ago·first Sep 10, 06:02 UTC · 6d agoThreat actor in the wild 2 sources1

Password spraying campaign targets AWS root user accounts across 150+ organizations

Datadog researchers observed a password spraying campaign attempting to authenticate as AWS root users across 150+ organizations.

Datadog Security Research observed a large-scale password spraying campaign attempting to authenticate as AWS root user accounts across more than 150 organizations. The campaign targeted root credentials rather than standard IAM users, and no confirmed compromises are stated in the report. Root account access would grant full control of affected AWS environments, making this a significant credential-attack campaign for cloud defenders.

Datadog Security Labs·Aug 31, 00:00 UTC · 16d agoThreat actor in the wild

UK Government Enables Passkey Login for 23 Million Users to Fight Phishing Attacks

UK Government enables optional passkey login for GOV.UK One Login, offering 23 million users phishing-resistant FIDO authentication.

The UK government has rolled out passkey authentication for GOV.UK One Login, the single sign-on for services like tax, State Pension, and driver's license renewals, available to over 23 million users. Passkeys are device-bound, unlocked via fingerprint, Face ID, or device PIN, and the government reports they are up to eight times faster than password plus two-step verification. During the initial trial over 300,000 users adopted passkeys, with nearly one in ten daily sign-ins already using them, saving roughly £600 per day in SMS costs. The NCSC endorses passkeys as phishing-resistant credentials that cannot be intercepted or reused, and biometric data never leaves the user's device.

GBHackers·Sep 15, 05:48 UTC · 1d agoPolicy & legal

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm Center·Aug 31, 20:00 UTC · 15d agoAI safety & security1

When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Threat Intelligence details attacks on exposed AI workloads exploiting LiteLLM gateways for credential harvesting, persistence, and cryptomining.

Microsoft Threat Intelligence examines attacks targeting exposed AI workloads, including exploitation of LiteLLM gateway deployments. Post-exploitation activity includes credential harvesting, establishing persistence, and cryptomining. The post urges defenders to secure AI infrastructure gateways and control points; the available text does not name threat actors, CVEs, or provide IOCs.

Microsoft Security Blog·Aug 26, 16:43 UTC · 20d agoExploit / PoC in the wild

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.

During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.

Wordfence·Aug 27, 17:41 UTC · 19d agoVulnerability

Attackers use passkey-themed scams to hijack Microsoft 365 accounts

Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.

Microsoft Security Research has tracked active cloud intrusions since May in which attackers posing as IT helpdesk staff lured employees with fake passkey/MFA enrollment requests. Attacks used adversary-in-the-middle phishing pages, device-code authentication flows, and Teams messages from compromised accounts. Attackers registered their own MFA methods, enumerated tenants via Microsoft Graph, and accessed SharePoint, OneDrive, and Exchange Online data, throttling activity below 1000 files/emails per hour.

CSO Online·updated 11:58 UTC · 2h ago·first Sep 11, 09:51 UTC · 5d agoThreat actor in the wild 10 sources1

ChatGPT advanced account security adds passkeys and hardware keys

OpenAI launches Advanced Account Security for ChatGPT and Codex, replacing passwords with passkeys or hardware keys and disabling email/SMS recovery.

The opt-in setting disables password sign-in plus email and SMS account recovery for ChatGPT and Codex accounts, allowing only passkeys, hardware security keys, and user-held recovery keys, with shortened sessions and automatic exclusion of enrolled accounts' conversations from model training. OpenAI partnered with Yubico to offer discounted bundles of the YubiKey C Nano and C NFC, while any FIDO2/WebAuthn-compliant key or software passkey is supported, mirroring standards adopted by Google, Microsoft, and GitHub. Individual members of Trusted Access for Cyber using the most permissive models must enable the setting from June 1, 2026, or their organizations can attest to phishing-resistant authentication in their single sign-on.

Help Net Security·Aug 24, 04:21 UTC · 23d agoAI industry

Attackers are going after prominent individuals through OAuth phishing, FBI warns

FBI IC3 warns of ongoing OAuth consent phishing since late 2025 targeting prominent individuals to gain persistent, password-free account access.

Attackers register malicious applications with legitimate OAuth providers, impersonate journalists, academics, event organizers, or government officials on messaging apps and email, and lure targets into approving permission requests on real Microsoft or Google login pages. Once approved, the attacker's application can read and send emails and access sensitive files within granted permissions, bypassing both passwords and MFA. The FBI notes password changes do not revoke this access; victims must invalidate the OAuth token in application security settings, and no attribution or victim list has been disclosed.

Help Net Security·Sep 2, 00:00 UTC · 14d agoPhishing & fraud in the wild

Chrome adopts what may be the best protection yet against account takeovers

Chrome adopts device-bound session credentials that tie login sessions to a specific device, defending against cookie-theft account takeover attacks.

Chrome is adopting device-bound session credentials, which bind authenticated sessions to the physical device rather than to transferable cookies. The mechanism targets a common account takeover technique in which attackers steal session cookies and replay them on other machines. Ars Technica characterizes it as possibly the strongest protection yet against this class of takeover, which has become increasingly common.

Ars Technica · Security·Aug 11, 20:59 UTC · Aug 11, 2026Tools