Threat Actors Use LLMJacking to Monetize Compromised Cloud Models
Mandiant documented LLMJacking intrusions where threat actors hijacked enterprise LLM access for fraudulent charges exceeding $1M cumulatively across multiple sectors.
2
Stories per day · 30 days
4 RSS
Relatedphishing3microsoft2ai-bots1ai-security1bot-scanning1calendar-phishing1china1cloud-credentials1cogui1ics1impersonation1iron-man1iron-man-system1llm-compromise1llmjacking1monetization1phaas1phishing-kit1
63 stories, newest first · one card per story
Stories tagged #credential-harvesting
Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys
The campaign ran from late September to late October, impersonating 32 AI bot identities to scan for exposed secrets across multiple industries.
1
Sucuri guide explains phishing aimed at website owners
A lookalike host login can relay a password and authenticator code into a live session; a compromised site may then host phishing pages.
Malicious calendar invites surge, stealing Microsoft logins and pushing ScreenConnect
Check Point counted more than 740,000 such emails in the first two weeks of October, up from a few thousand a month in April.
1
Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations
Resecurity says a Chinese phishing-as-a-service kit, Iron Man System, offered thousands of lures and a claimed billion messages.
Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
FBI and Secret Service warn FortiBleed is still harvesting Fortinet firewall credentials, with 86,644 logins tied to ransomware access brokers.
6
The AI app builder your team trusts has a root-level backdoor
Attackers actively exploit unauthenticated RCE CVE-2026-0768 (CVSS 9.8) in internet-facing Langflow instances to run code as root and steal credentials.
8
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
Datadog found harvesters testing stolen AWS keys specifically for Amazon Bedrock access.
6
Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials
LevelBlue exposed the TIKTOUK toolkit harvesting ~50,000 credentials from 37,000 domains via exposed WordPress backups, including active AWS keys.
AI policy circles targeted in China-linked phishing operation
China-aligned TA419 ran adversary-in-the-middle phishing campaigns impersonating officials and an Anthropic staffer to steal credentials from U.S. AI policy experts.
Beyond source code: A path to the keys to the kingdom
Microsoft DART details how Storm-3068 hijacked an account via self-service password reset, then used Azure DevOps pipelines to harvest Kubernetes credentials across 50+ resources.
1
Looking for free Robux? Here’s what’s real, and what’s a scam
ESET warns free Robux generators, fake giveaways, and lookalike Roblox login pages steal children's credentials, personal data, and money.
TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
1
AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes
New AI-driven Android banking trojan RatHat abuses accessibility and ADB to steal bank credentials, PINs, and MFA codes from financial apps.
1
Hackers Impersonate ChatGPT Subscription Alerts to Steal OpenAI Account Credentials
Cofense reports a phishing campaign using fake ChatGPT subscription payment notices to lure users to credential-harvesting pages and steal OpenAI account logins.
ChatGPT Phishing Campaign Targets Both Work and Personal OpenAI Accounts
Cofense identified a phishing campaign impersonating ChatGPT billing notices to steal OpenAI credentials and payment data via fake login pages hosted on nxcli.io.
3
Scammers Tell T-Mobile Users Their Rewards Are Expiring to Trick Them Into Clicking Phishing Links
Malwarebytes tracked a large T-Mobile smishing campaign using 81+ rotating .top domains and 1,000+ template variants to harvest credentials via fake rewards-expiry lures.
10
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
Datadog researchers document two unauthenticated, AI-built credential harvesting dashboards, Loot and UltraVault, holding 42,000+ stolen secrets and actively abusing AWS and AI keys.
4
A fake ChatGPT billing email is after your OpenAI password
Cofense reports a fake ChatGPT billing email harvesting OpenAI credentials via a Google redirect to a spoofed login page.
BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials
SOCRadar linked the BlackHatSect0r crew to a DeepSeek-powered AI agent that automated scanning and harvested 16,834 credentials from exposed systems.
2
BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks
French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.
6
Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
1
Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials
Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.
2