Identity, Access & Credentials

WriteOut session isolation bug in Writer AI could leak session tokens across tenants enabling full account takeover.

BusySnake infostealer used by 'Armored Likho' reached government agencies and electrical power entities, targeting critical infrastructure.

China-linked actors used a Roundcube exploit chain to compromise university physics and engineering departments and harvest credentials.

FortiBleed credential theft connected to INC and Lynx ransomware shows large-scale credential harvesting used for intrusions. Mitigations include credential hygiene and network segmentation.

CVE-led SimpleHelp vulnerability exploited to deliver malware and harvest credentials. Patch or upgrade to mitigate.

VS Code extension flaws enable arbitrary code execution and cloud credential theft via malicious repos.

OAuth token theft in Klue supply chain enables access to Salesforce data; investigation ongoing.

Russian IAB-led campaign exploits FortiGate devices to harvest over 110 million credentials; high-risk for enterprises deploying Fortinet gear.

Spyder and MaXSS flaws in AI-powered Chrome extensions enable session hijacks and data access.

Fortinet credential theft campaign impacts half of internet-facing Firewalls and VPNs; urgency to rotate creds and patch exposed devices.

OAuth abuse via Klue integration enables CRM data exfiltration; review third-party app grants and tokens.

A three-stage path (SearchLeak) enables exfiltration of emails and MFA data via trusted Copilot links. Restrict Copilot usage and tighten monitoring.

High-profile exposure in password reset flow; emergency hotfix deployed; verify user impact and tighten auth checks.

A single-click payload can exfiltrate GitHub OAuth tokens from vulnerable repos via VS Code workflows.

Malicious code was injected into @redhat-cloud-services packages, enabling credential theft across developer environments. Immediate package revocation and scans advised.

Active exploitation of FortiClient EMS; apply hotfixes and verify endpoint integrity to prevent credential theft.

Mini Shai-Hulud supply-chain attack breached SAP-related NPM packages to steal credentials; review dependencies and monitor for credential theft.

Flawed Entra ID role could enable privilege escalation; Microsoft issued patches after discovery by researchers.

Europe's largest gym chain confirms a data breach exposing member data. Immediate actions include password resets and monitoring for fraud.