Attackers use AntiFox AI agents in AWS credential-theft attacks
Arctic Wolf says Alibaba-hosted AntiFox instances planted an IIS webshell and obtained some production AWS secrets.
Stories per day · 30 days
15 RSS
Relatedsupply-chain27phishing21infostealer12llmjacking10pypi10ai-agents8github8litellm8cloud7deepseek7github-actions7microsoft7openai7api-keys6aws6ghostaction6railway6zero-day6
261 stories, newest first · one card per story
Stories tagged #credential-theft
Remus stealer ads claim Gmail access survives password changes
Hudson Rock found no controlled test or Gmail zero-day behind the seller's persistence claims.
Fireworks says hackers stole billing and AI data in October breaches
A second October 23 cloud-host intrusion reached development machines, and Notion cut Fireworks off after possible customer-data access.
Railway breach leads to $740,000 in fraudulent AI charges
Attackers stole environment secrets from at most about 100,000 workspaces after two infrastructure flaws.
1
Patched Outlook flaw CVE-2026-124194 leaks NTLMv2 hashes in attacks
Opening a crafted message can leak an NTLMv2 hash without the usual external-content warning; it is not zero-click.
GhostFrame ESXi implant linked to Settra ransomware, Insikt says
The implant needs existing root access, masquerades as vmhostd, and can harvest Windows credentials from guest VMs.
iVerify says spyware infections are reaching people without public profiles
The firm reports 1.07 infections per 1,000 iOS consumer scans in 2026, with three in four detections tied to criminal credential and cryptocurrency theft.
Attackers used Qubole AWS credentials to raid customer clouds
From October 14 to 26 the actor assumed trusted roles, harvested secrets and downloaded S3 data from dozens of victims.
GBHackers weekly bulletin lists 50 stories from November 2–6
The roundup's lead blurbs cite bank theft, exploited WordPress and Zyxel flaws, and an Android TV botnet takedown.
Mirax Android malware spreads via fake streaming apps
Mirax banking trojan steals credentials through accessibility abuse and remote control in infections across META region.
2
Agent steals OpenAI and DeepSeek keys and 5,132 student records
VECERT says the operator used 1,438 FOFA accounts to find exposed secrets and run a campus-card fraud bot.
Malicious Ruby gem strutil-core installs a credential-stealing worm
Socket found no public dependents and confirmed no victims; RubyGems removed both versions within about five hours.
1
RevStealer spreads through 100+ domains and hijacked YouTube channels
The stealer takes browser secrets, game accounts, and wallets, then deletes itself after sending the data.
4
Abe Office Malware Injects Into Chrome To Decrypt App-Bound Cookies
The RAT uses browser injection to bypass Chrome's App-Bound Encryption for cookie decryption.
2
GhostAction variant steals secrets via workflows in tens of thousands of GitHub repos
Accounts henrywoo and kitao added the workflow on October 8; it exfiltrates secrets over HTTP and scans Git history.
Attackers adopt ARTEX pentest framework within three months
WorkOS confirmed a test agent escaped isolation and retrieved customer data; named groups have used ARTEX in breaches.
1
ARTEX AI agents steal gaming logins and Apple certificates
Check Point says agents took over 190,000 Honor of Kings credential sets; about 3.3 percent, roughly 6,000, still worked.
Tata Motors iRA apps have credential theft flaws
CERT-In rates four flaws in Tata Motors iRA 2.0 and iRA.ev apps as high severity allowing credential theft and owner impersonation.
1
Gorbag Hackers Exploit WinRAR Vulnerability to Steal Credentials From Ukrainian Government Agencies
Gorbag uses CVE-2025-8088 in WinRAR to deliver BeautyStealer for credential theft from Ukrainian targets since February 2025.
AI access key theft surges in WorkOS Northflank Trigger.dev breaches
Hackers steal AI access tokens from developer platforms using frameworks like Artex to monetize stolen keys.
1
Google Warns of LLMJacking Attacks Generating Over $100,000 Daily
Attackers hijack enterprise LLM access to run up massive fraudulent charges before access is revoked.
1
Hackers launch LLMJacking attacks, generating $1M cloud bills
Attackers abuse stolen LLM credentials via LLM Mixers, reselling access while passing bills to victims across continents.
1
Cybercriminals hijack enterprise LLM access for $100,000 daily charges
GTIG warns of LLMjacking campaigns reselling stolen enterprise model access through underground services, causing fake cloud bills over $100,000 daily.
1
Northflank breach leads to abuse of customers' AI API keys
Customers must assume environment variables were decrypted; Northflank has not said how attackers got in or how many were affected.
1