Tag

credential theft

5 stories

CyberStrikeAI Agents Drive Windows Domain Takeovers

Hackers are using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand. CyberStrikeAI Framework in Live Intrusions CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already…

Saugata DattaNov 2, 20264 min read83

Data Breach

Supply-chain Breach: How a Leaked LiteLLM Master Key Let Attackers Push a Malicious PyPI Release

LiteLLM disclosed a serious supply-chain incident that began with a single accidentally published configuration file and escalated into a malicious package release that could execute whenever Python started. The exposure of an Agent Platform master key in late May 2026 went unrevoked and, months later, an attacker used it to extract high-privilege GitHub tokens, override release safeguards, and publish a trojaned LiteLLM package to PyPI. The fallout forced an emergency…

Saugata DattaOct 24, 20265 min read182

Cybersecurity

Firewall Fallout: How k0t Exploited Exposed Edge Devices to Harvest 70,000+ Credentials

Security teams woke up to a coordinated campaign that systematically targeted internet-facing firewalls and VPN appliances, resulting in the exposure of more than 70,000 credentials and LDAP dumps. Researchers from Group-IB and NyxLab attribute the activity to an operator tracked as k0t (also known as CryptoFeel, Member19, and QazWsxShop). The intrusions—detected largely between February and June 2026—rely less on high-value targeting and more on mass enumeration of exposed devices, leaving…

Saugata DattaOct 23, 20264 min read209

Data Breach

Bitwarden CLI Compromised in Supply Chain Attack via GitHub Actions

Socket and other researchers have confirmed that the Bitwarden CLI package published to npm — @bitwarden/cli version 2026.4.0 — was compromised in a supply chain attack that abused a GitHub Action in Bitwarden’s CI/CD pipeline. The malicious release injected a file named bw1.js into the package, exposing tokens, cloud credentials, SSH keys and other sensitive artifacts. While Bitwarden’s Chrome extension, MCP server and other official distribution channels are reported unaffected,…

Saugata DattaApr 24, 20264 min read557

Cybersecurity

Clipboard Trap: ClickFix Now Abuses Windows Terminal to Deliver Lumma Stealer

A newly observed wave of ClickFix social-engineering attacks has shifted tactics, hijacking Windows Terminal as its execution environment to deliver credential-stealing malware. Security researchers from Microsoft and other vendors tracked this campaign in early 2026 and reported a reliable pattern: victims are manipulated into pasting an obfuscated command from their clipboard into a legitimate-looking terminal window, which then decodes and executes a multi-stage payload that ultimately harvests browser-saved credentials. Why…

Saugata DattaMar 7, 20264 min read927

CyberStrikeAI Agents Drive Windows Domain Takeovers

Supply-chain Breach: How a Leaked LiteLLM Master Key Let Attackers Push a Malicious PyPI Release

Firewall Fallout: How k0t Exploited Exposed Edge Devices to Harvest 70,000+ Credentials

Bitwarden CLI Compromised in Supply Chain Attack via GitHub Actions

Clipboard Trap: ClickFix Now Abuses Windows Terminal to Deliver Lumma Stealer

Free Tools: IP, DNS, SSL