Ransomware Server Exposes Credential Theft and EDR-Killer Toolkit
A server tied to The Gentlemen exposed TukTuk C2, a credential-stealing prompt, EDR-killer research, exfiltrated Jira data, and healthcare credentials.
Reader edition
The Feed
Leaked AWS Administrator Key Funds Unauthorized AI Model Access
Fortinet traced one stolen AWS administrator key through a new IAM user, Marketplace agreements, and billable Bedrock model calls.
Attackers Used METR’s Exposed API Key for Credits Worth $600,000
A fail-open agent dashboard exposed one public-model key for three weeks, while noisy usage signals and absent spend limits delayed recognition.
Malicious Chrome and Edge Extensions Steal Wallet Secrets and Passwords
Socket found 19 browser extensions using automatic updates, rotating command servers and injected modules to steal wallet secrets, sessions and passwords.
Attackers Exploit Two SonicWall VPN Flaws; One Allows OS Commands
SonicWall confirmed active attacks against two SMA1000 flaws and told customers to hotfix, seek an IoC review, and rebuild systems when compromise is found.
BREEZE COMET Hijacks Brazilian Payment Systems for Fraud
Mandiant traced BREEZE COMET from vishing, rogue branch hardware and stolen cloud credentials to payment APIs used for hundreds of fraudulent transfers.
OpenAPI Code Generator Worm Hijacks Trusted Publishing
Ten malicious npm releases used trusted publishing, two install-time launch paths, and a credential-stealing worm. Defenders must isolate hosts before rotating tokens.
Attackers Exploit JFrog Artifactory to Create Administrator Tokens
CISA confirms exploitation of a critical Artifactory flaw and requires federal forensic triage. Self-hosted operators have six fixed-version floors to verify.
Malicious Repositories Make Amazon Kiro Send Local Secrets Off-Device
A crafted workspace can steer Kiro 0.7.45 from reading a local secret to placing it in a Powers registry request. Amazon fixed the reported behavior in 0.8.140.
Fire Ant Hijacks Cisco Routers to Steal Credentials and Erase Evidence
Fire Ant hid tunnels on Cisco routers, injected TACACS servers, and planted Linux backdoors. Sygnia's artifacts support checks of routers, authentication servers, and Linux hosts.
CISA Orders Forensic Checks for Exploited Microsoft SQL Server Flaw
CISA confirmed exploitation of a 2019 SQL Server flaw and now requires affected systems to be patched after evidence preservation and forensic triage.
Attackers Exploit PaperCut Servers to Install Remote Access
PaperCut confirms active exploitation of NG and MF servers. Release 3 patches the two-flaw chain; new log and service indicators help defenders investigate exposed hosts.
Hackers Use Nearly 2,000 WordPress Sites for Theft and Ransomware
StopAndProtect turns hacked WordPress sites into malware hosts, command servers, and stores for stolen files before selective ransomware deployment.