Railway breach may have exposed customer API keys and secrets
After an October 21 disclosure, Railway paused builds, rotated platform credentials, and told customers to rotate secrets.
Stories per day · 30 days
1 RSS
Relatedaokigahara2api-keys2credential-theft2infostealer2ai-coding-tools1artex1azure1bot-impersonation1cequence1credential-harvesting1credential-scanning1cryptocurrency1gheist1github1github-actions1key-vault1llm-compromise1llmjacking1
19 stories, newest first · one card per story
Stories tagged #cloud-credentials
Threat actors use ARTEX AI to steal Azure Key Vault secrets
Microsoft says one agent went from GitHub searches to Key Vault access in five minutes, using stolen service principals.
Threat Actors Use LLMJacking to Monetize Compromised Cloud Models
Mandiant documented LLMJacking intrusions where threat actors hijacked enterprise LLM access for fraudulent charges exceeding $1M cumulatively across multiple sectors.
2
Attacker impersonates 32 AI bots while scanning for credentials
CQ Prime says the scanner has run since late September, reached many Cequence customers in one day, and almost all requests failed.
1
Gheist harvests secrets through malicious GitHub Actions workflows
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
2
Aokigahara infostealer collects AI coding-tool tokens and cloud credentials
Check Point says it searches local app storage rather than exploiting a flaw in the targeted AI assistants.
2
Aokigahara infostealer targets browsers, cloud keys, and AI apps
Check Point says the stealer also grabs Claude, ChatGPT Desktop, Codex, Cursor, and cloud and Git credentials.
1
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 says DPRK-linked actors use Web3 smart contracts as C2 for npm worms stealing cloud credentials.
5
Hackers Don’t Need to Break Into the Cloud When They Can Steal the Keys
Wiz says Lumma, RedLine, and Vidar stealers are harvesting cloud, code, and AI credentials.
2
Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
2
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
4
Exposed Vite servers are being probed for AWS and Azure credentials
F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.
4
Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Mass-scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS/Azure credentials, .env files, and Terraform state.
Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials
F5 honeypots record mass scanning of exposed Vite dev servers exploiting CVE-2026-39364 to harvest AWS and Azure cloud credentials.
Hackers Can Turn Vulnerable LiteLLM AI Gateways Into Root Access and Cloud Credential Theft
Wiz found multiple LiteLLM AI gateway flaws, including a CVE-2026-59822 MCP auth bypass added to CISA KEV, enabling root code execution and cloud credential theft.
4
LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials
Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.
4
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.
1
U.S. CISA adds a MLflow flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited MLflow SSRF flaw CVE-2026-64849 (CVSS 9.3) to its KEV catalog; attackers are stealing cloud credentials from exposed instances.
2
Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.
2