Topic
Malware families whose primary objective is harvesting credentials, wallets, documents and browser data for exfiltration.
ANSSI says stolen staff passwords let an attacker take data on about 600,000 French taxpayers and firms, and the theft went undetected for seven weeks. Its report blames password-only portals, a flat government network and a reset that left the attacker's session open.
Reality
ANSSI says an attacker used dozens of stolen DGFIP staff passwords on password-only portals to take data on over 600,000 French taxpayers and businesses. For other operators, the fixes are login checks on devices they do not manage and a password reset that also ends live sessions.
Reality
Australia's Signals Directorate says attackers are using stolen AI API keys, tokens and hijacked sessions to get into organisations' AI services. Its guidance tells customers to protect those credentials themselves. In one reported case, a stolen key ran up about US$600,000 in model credits over three weeks.
Reality
SOCRadar tied 5,434 infostealer records for AI tools to 1,500 corporate email addresses at 482 large enterprises. The report says those AI accounts belong under the same sign-on and session controls as a company's identity provider and code repositories.
Reality
SOCRadar found captured ChatGPT sessions at 358 of the 482 companies whose AI accounts turned up in 90 days of infostealer logs. The firm ties the spread to shadow AI, with employees opening work-email accounts that IT never sees.
Reality
n0n, a ransomware crew first seen September 18, listed over a dozen victims in four days and threatens to wipe the backups of those who refuse to pay. Whether it can depends on what its escalated admin accounts reach.
Reality
A seller using the name TheHatman is offering employee directory exports from nine named enterprises. Hudson Rock ties the theft to infostealer credentials, not a compromise of the provider.
Perspective Coverage
5 publishersReality
OpenSourceMalware flagged the campaign on August 15, 2026. The install hook fakes a clean native build while pulling a Windows stealer that goes after browser credentials and crypto wallets.
Reality
McAfee says the WeedHack stealer's control server is dead and its renter dashboard gone, but ten impersonation sites and the search rankings behind them are still delivering victims.
Perspective Coverage
3 publishersReality
Anthropic is signing affected users out, stripping saved payment methods and issuing refunds after someone began pulling Claude cookies out of ordinary stealer logs and spending other people's quota.
Perspective Coverage
7 publishersReality
Check Point's deobfuscation of 23 compiled V8 bytecode samples shows JSCeal replaying stolen cookies inside the victim's own browser profile, then stuffing local credentials at any password prompt until it holds a fresh OAuth token.
Reality
Hudson Rock and ADAMnetworks link the ads to an operation they call PasteSwitch, which hands Windows and macOS visitors different paste-this-command lures and swaps payloads on the backend depending on who arrives.
Perspective Coverage
5 publishersReality
Arctic Wolf Labs found injected iframes on real Ukrainian business sites showing a Ukrainian-language fake Cloudflare check that copies a Windows Installer command for the visitor to paste into Run. Its exposed panel logged 557 views.
Perspective Coverage
3 publishersReality
LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
Perspective Coverage
4 publishersReality
Kaspersky says the macOS stealer it first tracked as Mac.c has swapped script droppers for FAT Mach-O binaries in a chain found in September 2026, and its loader now reads shell commands out of a public iCloud calendar file.
Reality
LastPass and Delphos Labs say a single malware-as-a-service kit impersonated at least 40 companies on GitHub, and the kernel driver it delivered was Microsoft-attested and undetected by every engine on VirusTotal.
Reality
Island says the adversary-in-the-middle service runs on at least 755 domains against hundreds of organizations. The session it steals arrives after an authentication the identity provider records as entirely normal.
Reality
SpyCloud measured stolen-credential exposure across 10,000 EPA-registered water and wastewater organizations and found it at nearly one in five, with the sharpest single case sitting on a supplier's machine.
Reality
FlashPoint pulled 555 AI-service tokens out of a single 44,791-token stealer dump, 24 of them still valid, and five dollars is the Telegram bulk price because a copied session leaves the victim's own login working.
Reality
Japan, Germany, Australia and the US say one North Korean group infected 30,000 devices in more than 100 countries to steal $10.7 million, a thin cash yield that points at the identity documents it also took.
Reality
Security · September 17, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Security · September 7, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Security · September 9, 2026 · 1 publisher
Product · September 8, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Product · September 8, 2026 · 1 publisher
Security · September 4, 2026 · 1 publisher
Security · September 1, 2026 · 2 publishers
Leadership · August 31, 2026 · 1 publisher
Leadership · August 31, 2026 · 1 publisher
Product · August 31, 2026 · 1 publisher
Invest · August 28, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Security · August 24, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Security · August 21, 2026 · 2 publishers
Build · August 14, 2026 · 1 publisher