#credential-theft

Storm-2561 is poisoning search results for enterprise VPN software, serving digitally signed fake installers that steal credentials and disappear without a trace — leaving victims convinced they simply had a bad download.

Source: Microsoft Threat Intelligence

ShinyHunters-linked campaigns exploit voice phishing and fake login portals to steal SSO credentials and MFA codes from cloud-based SaaS platforms.

Source: Mandiant (Google Threat Intelligence Group)

A targeted SEO poisoning operation is impersonating popular AI development tools like Gemini CLI and Claude Code, tricking users into downloading a Windows infostealer that executes PowerShell payloads in memory to steal credentials, OAuth tokens, and CI/CD secrets.

Source: EclecticIQ

Cybercriminals are now chaining up to six layers of URL rewrites from vendors including Cisco, Sophos, and Barracuda to make phishing links appear to originate from trusted security platforms — and it's working well enough to steal credentials and session tokens at scale.

Source: LevelBlue

A Brazilian banking trojan spreads via WhatsApp and Outlook, stealing credentials and using worm modules to propagate across victims’ contacts.

Source: Elastic Security Labs

A phishing campaign impersonating Meta’s verification system is tricking users into submitting passwords and live two-factor authentication tokens through Google Forms and fake “Meta Verified” pages. Stolen credentials are immediately reused to take over accounts belonging to both individuals and organisations.

Source: Cofense

Mirax Android malware campaigns used Meta ads and GitHub-hosted droppers to infect devices, turning them into SOCKS5 residential proxy nodes while stealing credentials via overlays.

Source: Cleafy Labs

Attackers built convincing phishing sites impersonating Starbucks' internal HR portal and used them to hijack 889 employee accounts, harvesting names, Social Security numbers, and financial account details over nearly a month.

Source: Bleeping Computer | DocumentCloud