Railway Incident May Have Exposed Customer API Keys and Database Secrets
Railway says an unauthorized party may have accessed customer environment variables, including some decrypted secrets. Customers are being urged to rotate credentials immediately while the cloud platform investigates...
Malicious LiteLLM 1.107.0 Package Steals Credentials and Opens RAT Channel
LiteLLM 1.107.0 was compromised on PyPI and in container images, delivering a credential stealer plus a remote-code loading mechanism. Anyone who installed the release should isolate affected systems,...
Lookalike Microsoft Teams Domain Caught Harvesting Employee Login Credentials
Researchers have flagged a newly registered domain, teams-cloud[.]live, that closely mimics the Microsoft Teams sign-in page and interface to trick employees into handing over their credentials. One subdomain...
Attackers Hijack Linux Sudo Prompts to Steal Government Credentials
A campaign targeting government and state-linked infrastructure altered Linux shell profiles to capture sudo passwords while commands continued to work normally. The activity also deployed SysGoRAT, web shells...
Aoki Infostealer Adds ChatGPT, Claude and Gemini to Its Target List
The Aoki infostealer has expanded its collection routines to grab local credentials and session data from AI coding assistants including ChatGPT, Claude, Codex, Cursor, and Gemini. Researchers warn...
Fake WatchGuard VPN Download Page Steals Credentials, Then Hands Over the Real Installer
A phishing site impersonating WatchGuard's VPN software portal harvested login credentials through a fake prompt before quietly delivering the genuine, digitally signed installer, a technique designed to leave...
Fake Academic Invites Hide a Live MFA-Bypassing Phishing Kit Targeting Google Accounts
Cisco Talos has detailed a phishing operation, tracked as UAT-11985, that uses real-time WebSocket connections to relay victims' Google logins step by step, letting operators intercept MFA challenges...
Fake CAPTCHA Prompts Are Hiding Malware in Your Browser Cache, Microsoft Warns
Microsoft Threat Intelligence has uncovered a ClickFix variant that pre-stages a disguised VBScript payload inside the browser cache before a victim ever pastes a command into the Windows...