n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
1
Stories per day · 30 days
5 RSS
Relatedphishing2account-fraud1akamai1aws1classiscam1extortion1fake-shops1group-ib1n0n1open-banking1opencode1poshmark1sms-pumping1
19 stories, newest first · one card per story
Stories tagged #credential-stuffing
Scammers rebuild fake shopping sites within hours of a takedown
Akamai says one retail scam used more than 1,200 look-alike .shop domains on one IP to harvest card data.
Fraudsters use open-banking links to test stolen cards, Group-IB says
Group-IB says a spend platform paid aggregator fees while attackers checked credentials and phished via its own notices.
1
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan
Roundup: hackers stole data on 8.8 million Danes, and Oracle confirmed a 20-million-patient health breach.
16
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
SecurityWeek roundup: PoeLLM botnet resolves C&C via GitHub poem, GhostAction hit 772 repos, CrowdStrike links Chinese actor to Korean bank breaches.
5
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
A suspected Chinese operator used the ARTEX AI pentest tool to steal data from South Korean financial firms.
10
FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
FBI and Secret Service say FortiBleed compromised over 86,000 Fortinet firewalls in 194 countries.
4
ASOS Hacked as Attackers Abuse Customer Notification Platform to Threaten Data Leak
ASOS probes unauthorized customer alerts that threatened a data leak; the Snowflake claim is unverified.
1
Domino’s customers targeted in credential stuffing attacks
Domino's reset a small number of UK accounts after credential-stuffing logins that used reused passwords.
2
South Korea Orders Investigation Into AI-Powered Cyberattacks on Major Banks
South Korea's president ordered an investigation into breaches at major banks exposing ~65,000 customers' data; infrastructure tied to AI pen-testing framework ARTEX AI.
5
Follow the thread: a new dashboard to investigate account abuse
Cloudflare opened an Early Access dashboard for investigating account abuse and credential stuffing.
9
Nearly two-thirds of tested websites fail every bot test
DataDome reports malicious bot traffic jumped 124% year over year, while 65% of tested websites detected none of ten simulated bots.
Telus Warns Customers of Account Breaches
Telus warns customers that attackers used compromised credentials to access accounts and personal data between February 2025 and June 2026.
2
Risky Bulletin: Anthropic agents went hacking again
Anthropic disclosed a fourth incident where an Opus 4.6 agent escaped a CTF test environment and hacked an external system; newsletter briefs cover multiple breaches.
2
Credential Theft: How Attackers Steal & Use Stolen Credentials
Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.
The 20 Most Common Passwords Hackers Target in 2026
Huntress details the 20 most common passwords of 2026 and how attackers use brute force, spraying, and credential stuffing against weak credentials.
4
From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline
Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.
2
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
METR disclosed attackers stole an API key and burned about $600,000 in inference credits, plus a second probing campaign against its infrastructure.
3
Password spraying campaign targets AWS root user accounts across 150+ organizations
Datadog researchers observed a password spraying campaign attempting to authenticate as AWS root users across 150+ organizations.
2