Latest Credential Theft news

Fake installers with step-by-step SmartScreen bypass instructions have been deploying RATs and crypto miners since late 2023. Elastic Security Labs tracked 27.88 XMR ($9,392) across four wallets. The operation uses a new .NET implant called CNB Bot alongside PureRAT and …

A new loader called DeepLoad steals credentials from the moment of infection and reinfected a cleaned host three days after remediation through hidden WMI persistence. ReliaQuest says the obfuscation layer was likely AI-generated.

Hijacked maintainer account pushed two poisoned Axios versions to npm, delivering a cross-platform RAT to macOS, Windows, and Linux. The library has 100 million weekly downloads. Both versions have been removed, but anyone who installed them should assume full compromise.

Three days after LiteLLM, TeamPCP hit the Telnyx Python SDK on PyPI. Malicious versions 4.87.1 and 4.87.2 hid a credential stealer inside WAV audio files. The RSA-4096 key is byte-for-byte identical to the LiteLLM payload.

Stolen Trivy credentials gave TeamPCP a PyPI publishing token for LiteLLM, the most popular LLM proxy in Python. Malicious versions ran on every Python process, not just LiteLLM imports, exfiltrating SSH keys, cloud credentials, and crypto wallets. Roughly 500,000 exfiltrations …