Cyber security
Passkey phishing hijacks Microsoft 365 for data theft
Passkey-themed phishing is hijacking Microsoft 365 accounts through vishing calls. Attackers steal session tokens and exfiltrate data over days, not minutes.
#threat-intel
17 stories tagged threat-intel.
Cyber security
Shai-Hulud worm now scans 469 credential paths: what to rotate
The Shai-Hulud npm infostealer worm expanded from 189 to 469 credential-scanning paths across dev machines, CI/CD, cloud, and AI tool configs after the [email protected] compromise. Rotate everything.
Cyber security
Fire Ant turns Cisco routers into credential theft platforms
Fire Ant, a China-nexus espionage group, expanded from VMware hypervisors to Cisco IOS XR routers and TACACS servers, hijacking the network trust layer to steal credentials and blind security logging across connected environments.
Cyber security
arrayref Rust supply chain attack drops build-time malware
A Rust supply chain attack compromised arrayref with 245 million downloads, injecting build-time malware that steals browser credentials. Check your cache now.
Cyber security
AmnesiaStealer turns Mac browsers into live attacker drones
AmnesiaStealer is a new macOS infostealer that clones Chromium profiles and hands attackers live remote control of authenticated browser sessions via CDP.
Cyber security
ChainDrop npm worm hits 1,300 packages, steals cloud secrets
ChainDrop is a self-propagating npm worm that hit 1,300 packages with 2 billion monthly downloads, stealing cloud credentials from CI/CD runners.
Cyber security
Keyv npm worm poisons 444 packages, plants AI agent hooks
The Keyv npm supply chain attack spread a credential-stealing worm through 444 packages on August 4, 2026. The worm planted execution hooks in Claude Code and VS Code, harvesting CI secrets via Ethereum blockchain C2.
Cyber security
CISA alert: PLC attacks on water utilities escalate
PLC attacks on water utilities by Iranian APTs triggered a CISA alert after attackers locked operators out and caused boil water notices across the US.
Cyber security
Coordinated PLC attacks hit water systems in 7 states
PLC attacks on water utilities spread to 7 states after 30 Minnesota systems were hit. CISA says remove exposed controllers from the internet now.
Cyber security
Cl0p exploits PTC Windchill RCE in exposed PLM
Cl0p affiliates exploit unauthenticated RCE in internet-exposed PTC Windchill and FlexPLM to steal data. Patch, segment, and block external access now.
Cyber security
Citrix Bleed 2 turns ransomware into identity theft
Citrix Bleed 2 is now an Anubis ransomware access path. Patch NetScaler, kill sessions, and hunt RMM plus credential abuse.
Cyber security
Langflow RCE turns AI app endpoints into miner bait
Langflow RCE is being used to mine Monero on exposed AI app endpoints. Patch, isolate, and treat public workflows as production attack surface.
Cyber security
VS Code Tasks supply chain attack needs new checks
VS Code Tasks supply chain attack is a package hijack pattern that can run outside npm lifecycle scripts, so scan editor configs now.
Cyber security
Signal backup recovery keys become the weak link for ops
Signal backup recovery keys can expose historical chats after one phishing win. Treat messenger backups like identity infrastructure now.
Cyber security
FortiBleed FortiGate credentials need action now
FortiBleed FortiGate credentials are an active edge risk: rotate VPN and admin access now, then hunt for persistence.
Cyber security
FortiBleed credential theft reaches the firewall edge
FortiBleed credential theft turns compromised FortiGate firewalls into sniffers. Rotate secrets and hunt traffic capture now.
Cyber security
Mastra npm supply chain attack hits AI build rooms
Mastra npm supply chain attack exposed AI build pipelines through more than 140 packages, so treat installs as secret exposure events.