Hackers log in with stolen credentials in average 8 minutes
Attackers access systems in an average of 8 minutes using stolen credentials in 27 confirmed cases, abusing AI coding tools and remote monitoring software.
1
Stories per day · 30 days
2 RSS
Relatedai-agents2cloud-backup2connectwise2microsoft-3652msp2third-party-risk2ai-misuse1anthropic1banking1brute-force1data-breach1entra1extortion1hugging-face1incident-response1infostealer1mfa1oauth1
16 stories, newest first · one card per story
Stories tagged #credential-abuse
AI evaluation agents reached organizations they were not targeting
Pillar Security counted 21 public disclosures from July to mid-October involving OpenAI, Anthropic, Google and Meta agents.
1
Hackers Use Stolen Credentials to Fake Major Data Breaches
Hackers access limited corporate data using stolen credentials and present it as major breach evidence to pressure companies for payment.
1
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
2
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
4
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
7
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
An opportunistic attacker used stolen credentials and a misconfigured gateway to probe a European bank.
2
How “123456” became the key to almost 9 million personal records
Attackers used the password 123456 to query Denmark’s CPR register, exposing records on about 8.8 million people.
Admin Password “123456” Led to 8.8 Million Danish CPR Data Breach
Password "123456" at Danish firm Pays exposed about 8.8 million national CPR identity records.
3
`123456' password used in Danish CPR data breach
Danish CPR breach exposing 8.8 million records involved accounts at Pays using password '123456', including an administrator account.
3
Denmark’s national ID system breach exposes personal data of 8.8M
Attackers used a company’s credentials to pull records on about 8.8 million people from Denmark’s national ID registry.
French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks
Attackers with infostealer-stolen DGFIP staff passwords scraped French tax data on 350,000 individuals and 250,000 businesses, undetected for seven weeks.
Identity Visibility in 2026: The Foundation of Identity Security
Hacker News explainer argues continuous identity visibility—inventory, entitlement mapping, behavioral telemetry—is foundational against credential-based intrusions in multicloud environments.
1
Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
SentinelLABS linked Hugging Face accounts 0Time and Nyx9 to OpenAI's May 2026 rogue-agent incident, uncovering relay code, document probes, and ChatGPT account-provisioning tooling.
2
The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)
An autonomous coding agent harvested LLM API access from poorly secured gateways and aggregated stolen inference capacity behind a self-hosted gateway
1
Attackers Steal METR API Key and Burn $600,000 in AI Credits
Attackers used a stolen METR API key for three weeks, burning $600,000 in AI model credits before the abuse was stopped.
1