Filtered by tag: credential theft × Clear
Microsoft Warns of Active Password Stealing Attack Exploiting the Microsoft 365 Service Disruption
Matched: health
Microsoft warned of a phishing campaign exploiting the November 12 Microsoft 365 outage. Emails impersonate service health notices, cite real incident ID EX1550543, and claim messages will be deleted within 24 hours unless recipients click a recovery link. Three sender domains were identified, with links redirecting through SendGrid to a suspicious site. Microsoft recommends verifying disruptions via the admin center and reviewing Safe Links policies.
Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools
Matched: health
A malicious Ruby gem called strutil-core (v1.0.1) stole credentials from 51 sources and planted backdoors in AI coding tools like Claude and Cursor. Live on RubyGems for roughly five hours in November 2026, it ran a payload during installation that harvested cloud keys, tokens, and crypto wallets, then sent data to attacker-controlled servers. It also added persistence hooks into AI tool config files and could delete a victim's home folder if a stolen GitHub token was revoked.
Hackers Deploy ArmorSteal Malware Through Fake Software Downloads to Steal Credentials and Mine Crypto
Matched: health
Hackers are spreading Python-based malware called ArmorSteal through fake download pages impersonating tools like Chocolatey and Microsoft Activation Scripts. Victims are tricked into running PowerShell commands that install the real software while silently dropping malware into a disguised Windows folder. The kit steals passwords, crypto wallets, Discord tokens, and browser data, while also mining Monero. It evades detection by shutting down when monitoring tools are open and checking if it's running in a cloud sandbox.
Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials
Matched: health
Hackers compromised 333 Tor exit nodes beginning October 2, redirecting SSH connections to interception servers to steal credentials using Ebury, an OpenSSH backdoor. The affected relays represented roughly 10% of Tor's exit nodes. Attackers redirected port 22 traffic while passing other traffic normally. Users who ignored host-key warnings and used password authentication exposed their credentials. A researcher discovered the campaign via SSH fingerprint testing and reported it to Tor's network health team, which flagged affected relays by October 4. All identified servers were shut down October 5.
Russian Hacker Breaches Companies, Sells Their Access and Spies on Ukrainian Military Sites
Matched: health
A Russian-speaking hacker has been linked to a broad campaign breaching organizations across multiple sectors worldwide, including education, healthcare, finance, and government. The actor exploited exposed security appliances and public applications to harvest credentials and sell network access to ransomware groups. The operation also reportedly included surveillance activity targeting Ukrainian military websites.