credential-theft
10 live · 57 on record · last incident 1 day ago
Live10
- liveWARDEN Stealer distributed via fake Grand Theft Auto VI download links
Breaches & attacks · Exploited · since 13 Nov 2026
Threat actors are using a Google Colab notebook to promote a fake Grand Theft Auto VI download that installs WARDEN Stealer. The malware targets saved passwords, browser cookies, gaming credentials, and cryptocurrency wallets.
Do:Do not download unauthorized game executables from untrusted sources or promotional links.
- liveExtortion Group Luna Moth Targets Law Firms With Microsoft Token Theft
Breaches & attacks · Exploited · since 12 Nov 2026
The Luna Moth extortion group launched a renewed campaign targeting law firms that refused previous ransom demands. Attackers used social engineering tactics specifically designed to steal Microsoft access tokens.
- liveAntiFox Hackers use AntiFox AI agents in AWS credential‑theft attacks
Breaches & attacks · Exploited · since 11 Nov 2026
Attackers are deploying the open‑source AntiFox AI agent platform on Alibaba Cloud instances to infiltrate web services and Amazon Web Services environments. The campaign has been used to steal AWS credentials, enabling further unauthorized access.
Do:Detect and block unauthorized AntiFox agents, rotate compromised AWS credentials, and monitor for suspicious activity
AI - liveYouHack YouHack data breach exposes 7,160,849 accounts
Breaches & attacks · Real loss · since 29 May 2013
The Russian-language hacking forum YouHack suffered a data breach exposing over seven million accounts containing email addresses, usernames, IP addresses, and password hashes. The compromised data was later redistributed as part of a larger data corpus.
- liveСберСпасибо СберСпасибо data breach exposes millions of user accounts
Breaches & attacks · Real loss · since 9 Mar 2023
An online data leak from Russian loyalty program СберСпасибо compromised millions of user accounts containing email addresses, phone numbers, and hashed bank card details. The exposed records date back to a 2023 security incident.
- liveQubole Hackers Exploit Qubole AWS Access to Breach Customer Accounts
Breaches & attacks · Real loss · since 26 Oct 2026 · updated 10 Nov 2026
Attackers used Qubole platform AWS access credentials to breach multiple customer accounts between October 14 and October 26. The intruders stole stored secrets and data from the affected environments.
Do:Audit AWS IAM roles and review logs for unauthorized access originating from Qubole integration credentials.
- liveGoogle Workspace Fake OpenAI and SpaceX events used in multi-platform phishing campaign
Breaches & attacks · Exploited · since 5 Nov 2026
Threat actors are distributing fake webinar and event invitations featuring OpenAI, SpaceX, and Anthropic lures. The campaigns use phishing-as-a-service platforms to harvest Microsoft and Google account credentials and session tokens.
Do:Warn employees to verify event invitations and enforce phishing-resistant MFA.
AI - livemSecure mSecure Password Manager Suffers Cyberattack Exposing Customer Data
Breaches & attacks · Real loss · since 4 Nov 2026
mSeven Software urged mSecure customers to reset master passwords, 2FA, and passkeys following a cyberattack. The incident resulted in the exposure of an encrypted customer database.
Do:Change master passwords, reset two-factor authentication, and remove passkeys as advised.
- liveRussia-Linked Spies Target Ukrainian War Crimes Investigations
Breaches & attacks · Real loss · since 3 Nov 2026
Russia-linked cyber spies targeted Ukrainian organizations near the front lines using simple malware. The attackers stole sensitive documents, login credentials, and investigative data.
- livecPGuard cPGuard update channel hijacked to deploy backdoors and steal password hashes
Supply chain · Real loss · Patched · since 2 Nov 2026 · updated 4 Nov 2026
Attackers breached the update system of the cPGuard security tool on November 2 to distribute a malicious script to customer Linux servers. The script deployed a backdoor and exfiltrated sensitive files including password hashes.
Do:Update cPGuard to version 5.88.25 or later and inspect servers for compromise.
Earlier47
- closed6.5Langflow CVE-2026-104314: IBM Langflow OSS Credential Disclosure Vulnerability
Patch now · Disclosed · since 29 Oct 2026 · CVE-2026-104314
AI - closedStolen staff logins are spreading attacks between K-12 school districts
Breaches & attacks · Exploited · since 29 Oct 2026
- closedSquareML Vendor Key Leak Exposes Denver Health Plan Member Data
Breaches & attacks · Real loss · since 27 Oct 2026
- closedKeystone hardware wallets Keystone to Destroy Hardware Wallets After Device Verification Key Theft
Breaches & attacks · Exploited · since 26 Oct 2026
- closedMicrosoft Authenticator CVE-2026-80097: Microsoft Authenticator flaw allowed permissionless Android apps to steal work tokens
Patch now · Disclosed · Patched · since 27 Oct 2026 · CVE-2026-80097
- closedAlternative für Deutschland Alternative für Deutschland Data Breach Exposes 345,439 Accounts
Breaches & attacks · Real loss · since 9 Sep 2026 · updated 28 Oct 2026
- closedGitHub Actions Gheist Campaign Uses Stolen GitHub Tokens to Exfiltrate Private Repository Secrets
Breaches & attacks · Exploited · since 26 Oct 2026 · updated 28 Oct 2026
- closedMicrosoft 365 Microsoft 365 Token-Replay Campaign Compromises 97 Accounts at 79 Organizations
Breaches & attacks · Exploited · since 22 Sep 2026
- closedLiteLLM LiteLLM Master Key Leak Leads to Malicious Package Release
Supply chain · Exploited · since 24 Oct 2026 · updated 26 Oct 2026
AI - closedLiteLLM LiteLLM 1.107.0 compromised via malicious Python startup hooks
Supply chain · Exploited · since 23 Oct 2026
AI - closedThreat Actor Used AI to Plan and Execute Cybercrime Activities
Breaches & attacks · Exploited · since 21 Oct 2026
AI - closedOpenCode Console OpenCode Console Breach Exposes Third-Party AI Provider API Keys
Breaches & attacks · Exploited · since 16 Oct 2026
AI - closedFake AI applications spread malware and steal enterprise sessions
Breaches & attacks · Exploited · since 15 Oct 2026
AI - closedClaude Code Desktop Anthropic Claude Code Desktop Preview Pane Credential Theft Flaw
Patch now · Disclosed · since 14 Oct 2026
AI - closed9.6MCP servers & tools CVE-2026-61559: Dynamic API URL redirection flaw in mcp-gitlab
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-61559
AI - closed9.8MCP servers & tools CVE-2026-61560: Authentication bypass and arbitrary file read in mcp-gitlab
Patch now · Disclosed · since 15 Sep 2026 · CVE-2026-61560
AI - closedClaude Opus 4.6 Claude Opus Checkpoint Gained Unauthorized Admin Access During Evaluation
Research · since 9 Sep 2026
AI - closed6.5GitHub Copilot GitHub Copilot and Visual Studio Code vulnerable to credential disclosure
Patch now · Disclosed · since 8 Sep 2026 · CVE-2026-81381
AI - closed8.7Stable Diffusion WebUI Credential Disclosure Vulnerability in Stable Diffusion WebUI
Patch now · Disclosed · since 28 Aug 2026 · CVE-2026-82288
AI - closed7.1Flowise CVE-2026-73604: Incomplete credential redaction in Flowise API
Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73604
AI - closedFlowise Flowise Unauthenticated TTS Credential Abuse
Patch now · Disclosed · since 4 Aug 2026
AI - closed9.2Flowise CVE-2026-70478: Flowise Unauthenticated OAuth2 Token Refresh Endpoint Allows Token Theft
Patch now · Disclosed · since 4 Aug 2026 · CVE-2026-70478
AI - closed6.5GitHub Copilot CVE-2026-47282: Credential disclosure vulnerability in GitHub Copilot
Patch now · Disclosed · since 14 Jul 2026 · CVE-2026-47282
AI - closedFlowise Flowise hardcoded CORS wildcard on TTS endpoint
Patch now · Disclosed · since 20 May 2026
AI - closedClaude Code + SDKs Threat Actor Used AI Agents to Breach Healthcare Organizations in Argentina
Breaches & attacks · Exploited · since 19 May 2026
AI - closed7.5Flowise CVE-2026-46440: FlowiseAI Exposes Basic Auth Credentials via API
Patch now · Disclosed · since 14 May 2026 · updated 8 Jun 2026 · CVE-2026-46440
AI - closedmarimo Threat Actor Used LLM Agent to Exfiltrate Database via marimo Notebook
Breaches & attacks · Exploited · since 10 May 2026
AI - closed2.7Langflow CVE-2026-6597: Langflow Information Leak via API Key Redaction
Patch now · Disclosed · since 20 Apr 2026 · CVE-2026-6597
AI - closed8.7Flowise CVE-2026-41278: Flowise Public Endpoints Expose Plaintext API Keys
Patch now · Disclosed · since 17 Apr 2026 · updated 23 Apr 2026 · CVE-2026-41278
AI - closedLiteLLM LiteLLM Releases Contain Credential Harvesting Malware
Supply chain · Exploited · since 25 Mar 2026
AI - closed8.5LangChain family CVE-2026-25750: URL parameter injection in Langchain Helm Charts exposing auth tokens
Patch now · Disclosed · since 4 Mar 2026 · CVE-2026-25750
AI - closed0.0Gradio CVE-2026-27167: Gradio Mocked OAuth Login Exposes Server Credentials
Patch now · Disclosed · since 1 Mar 2026 · updated 1 Mar 2026 · CVE-2026-27167
AI - closedLLM Desktop Applications AIKatz Extracts Authentication Tokens from LLM Desktop Apps
Research · since 2025 (approx.)
AI - closed8.1claude-code-router CVE-2025-57755: claude-code-router CORS Misconfiguration API Key Exposure
Patch now · Disclosed · since 21 Aug 2025 · CVE-2025-57755
AI - closedFBI Warns of AI Voice Cloning Campaign Targeting Officials
Breaches & attacks · Exploited · since 15 May 2025
AI - closedAWS Bedrock Threat Actors Hijack Cloud-Hosted LLMs via Stolen Credentials
Patch now · Exploited · since 6 May 2024
AI - closedGamma AI Presentation Tool Gamma Abused in Credential Phishing Campaign
Breaches & attacks · Exploited · since 15 Apr 2025
AI - closedLovable Lovable AI Jailbroken to Host Phishing Pages and Credentials Theft
Breaches & attacks · Exploited · since 9 Apr 2025
AI - closed7.5LiteLLM CVE-2025-0330: LiteLLM Langfuse API Key Leakage
Patch now · Disclosed · since 20 Mar 2025 · CVE-2025-0330
AI - closedYouTube Deepfake Video of YouTube CEO Neal Mohan Used in Credential Phishing Attacks on Creators
Breaches & attacks · Exploited · since 4 Mar 2025
AI - closedCommon Crawl Live API Keys Discovered in LLM Training Data Archive
Patch now · Disclosed · since 28 Feb 2025
AI - closedChatGPT FraudGPT-Enabled Phishing Campaign Spoofs ChatGPT Subscription
Breaches & attacks · Exploited · since 23 Feb 2025
AI - closedGmail AI-Driven Phishing Campaign Uses Deepfake Robocalls to Target Gmail Users
Breaches & attacks · Exploited · since 17 Feb 2025
AI - closedGmail AI-driven voice phishing scam attempts to breach security expert's Gmail
Breaches & attacks · Exploited · since 7 Oct 2024
AI - closed9.8Claude LLMjacking Attackers Abuse Cloud AI Services Using Stolen Credentials
Breaches & attacks · Real loss · since 6 May 2024 · CVE-2021-3129
AI - closed7.5Gradio CVE-2024-34510: Gradio credential leakage vulnerability on Windows
Patch now · Disclosed · since 5 May 2024 · CVE-2024-34510
AI - closedClearview AI Facial Recognition Tool Clearview AI code repository misconfiguration exposes production credentials and video samples
Breaches & attacks · Exploited · since 2020 (approx.)
AI