Credential Theft — Cybersecurity News

Credential-Stealing GitHub Actions Workflows Compromise 340+ Repositories

RedSide Security October 10, 2026 Cybersecurity 140 views

Attackers compromised maintainer accounts to inject credential-stealing GitHub Actions workflows into over 340 repositories, including the popular pyxel game engine.

Open Source Security CI/CD Security Credential Theft GitHub Actions Supply Chain Attack StepSecurity pyxel

Continue reading: Credential-Stealing GitHub Actions Workflows Compr…

McDonald’s, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records

RedSide Security August 16, 2026 Data Leaks & Breaches 439 views

A threat actor known as TheHatman is allegedly selling employee directories stolen from major enterprises through compromised Azure and Microsoft Entra credentials. The campaign reportedly exposes millions of records, including corporate emails, employee details, reporting structures, service accounts, and administrator information, creating significant risks for spear-phishing, privilege escalation, and further network compromise.

Cybersecurity Information Security Threat Intelligence Enterprise Security Cloud Security Infostealer Azure Credential Theft Microsoft Identity Security Data Breach

Continue reading: McDonald’s, Vodafone Hit by Azure Credential Theft…

Encrypted AI Reasoning Traces Can Leak Secrets Across API Sessions

RedSide Security August 12, 2026 AI Security 237 views

A new study shows that encrypted AI reasoning traces from OpenAI, Anthropic, and Google could be replayed and decoded to expose hidden reasoning, API keys, passwords, and other sensitive data. Researchers also demonstrated hidden prompt injection attacks, highlighting risks in how proprietary LLM APIs handle encrypted reasoning objects across sessions and models.

Cybersecurity Prompt Injection Threat Intelligence AI Security OpenAI Artificial Intelligence API Security LLM Security Google Gemini Credential Theft Anthropic AI Reasoning Reasoning Traces Data Leakage Model Security

Continue reading: Encrypted AI Reasoning Traces Can Leak Secrets Acr…

New "Pass-ta-key" Attack Steals Google Passkeys Without Passwords or Biometrics

RedSide Security August 04, 2026 Vulnerability 173 views

Researchers have disclosed three new attacks—Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—that allow malware on compromised Windows systems to hijack Google-synced passkeys without passwords or biometrics. The findings expose weaknesses in Chrome's Cloud Authenticator implementation rather than the underlying passkey cryptography.

Cybersecurity Windows Security Multi-Factor Authentication Credential Theft Google Chrome Google Passkeys Passkeys Cloud Authenticator Pass-ta-key Silver Pass-ta-key Golden Pass-ta-key Authentication TPM Unit 42

Continue reading: New "Pass-ta-key" Attack Steals Google Passkeys Wi…

Palo Alto PAN-OS Authentication Bypass Exploited to Deploy Qilin Ransomware

RedSide Security July 21, 2026 Cybercrime 232 views

Threat actors are exploiting CVE-2026-0257 in Palo Alto PAN-OS GlobalProtect to bypass authentication, gain VPN access, steal Active Directory credentials, and deploy Qilin ransomware. Security teams should patch immediately and rotate credentials if compromise is suspected.

Cybersecurity Threat Intelligence Authentication Bypass Active Exploitation Ransomware Palo Alto Networks PAN-OS GlobalProtect CVE-2026-0257 Qilin Ransomware VPN Security Credential Theft Active Directory Network Security Arctic Wolf

Continue reading: Palo Alto PAN-OS Authentication Bypass Exploited t…

Credential Theft — Cybersecurity News

Most Popular News

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

Top 10 High-Risk Vulnerabilities Of 2025 that Exploited in the Wild

Passwd: A walkthrough of the Google Workspace Password Manager

OpenAI Hardened ChatGPT Atlas Against Prompt Injection Attacks

Google Patches Actively Exploited Chrome Zero-Day (CVE-2026-2441)

Featured Posts

PCAPGraph: Threat Hunting at the Speed of Triage

Open-Source Network Discovery & Topology Mapping

RDPGraph: Turn Windows Event Logs into an Interactive RDP Attack Graph

Latest Posts

Credential-Stealing GitHub Actions Workflows Compromise 340+ Repositories

McDonald’s, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records

Encrypted AI Reasoning Traces Can Leak Secrets Across API Sessions

New "Pass-ta-key" Attack Steals Google Passkeys Without Passwords or Biometrics

Palo Alto PAN-OS Authentication Bypass Exploited to Deploy Qilin Ransomware