Stolen credentials

November 5, 2026

• Norad, Norway's development cooperation agency, says attackers abused 27 user accounts to log into its grant portal and may have taken names and email addresses of all 20,614 registered users from 12,511 organisations, plus application data for at least three organisations outside Norway. Norad cannot rule out that names of applicants in conflict zones and authoritarian states were extracted. Detected Friday October 30; crisis team activated, Datatilsynet and NSM notified, police report filed — and NSM says the attack resembles other recent incidents (Norad). · Incidents & Enforcement
• Crédit Mutuel Arkéa confirmed a "sophisticated attack" in which intruders went through a supplier's platform to reach the banking group and then used Arkéa's own account to transfer funds to other institutions, some converted to crypto. ZachXBT estimated more than $133 million; the bank declined to confirm the figure but "validated the order of magnitude," and disputes French reports that subsidiary Fortuneo was the entry point. Some assets are frozen (The Record). · Incidents & Enforcement
• ~69GB and 27 SQL Server backup databases left the Philippine Overseas Employment Administration in 24 minutes, staged through a Singapore server, with the operator using GodPotato/SeImpersonate and Impacket; the final destination is unknown (Dark Reading). · Incidents & Enforcement
• Two Canadians were indicted over 2016–2019 intrusions into US universities in New York, Tennessee, North Carolina and Massachusetts, using stolen credentials and malware to hijack supercomputing resources for Electroneum mining; one has been extradited (The Record, SecurityWeek). · Incidents & Enforcement

November 4, 2026

• The cPGuard update channel was hijacked to backdoor hosting servers. An attacker used compromised credentials to reach OpsShield's update CDN at 02:06 UTC on November 2 and pushed malicious versions 5.88.12–5.88.19 for about 12 hours; the script harvested Linux password hashes, root MariaDB/MySQL config, root shell history and root SSH authorized_keys/known_hosts, staging them to the licensing server via a compromised account. OpsShield says the actor retrieved 32 files per customer server, and told BleepingComputer nearly three thousand servers were impacted. Fix is 5.88.25+, then rotate everything (BleepingComputer, OpsShield advisory). · Supply Chain & Trusted Channels
• Huntress is investigating malicious Entra service principal sign-ins from 199.19.77[.]84, a Poland-based hosting IP, where the actor used valid app secrets to obtain Azure tokens in four customer tenants — consistent with a campaign Todyl reported the same day (Huntress). Responders in the thread flag the familiar problem that service principal logging gives defenders very little to work with. · Cloud, Identity & AI Abuse
• Stolen Amazon Bedrock keys from October's AI-platform breaches sat quiet for 4–7 days before 2.5 million calls, a window that was fully visible in CloudTrail — a usable detection gap for anyone rotating credentials after a vendor incident (write-up). · Cloud, Identity & AI Abuse

November 1, 2026

• FBI names TraderTraitor for the Binance heist and publishes its Ethereum addresses (Catalin Cimpanu), matching TRM Labs' high-confidence attribution to the North Korean group behind the $1.5 billion Bybit theft in February 2025. Binance's preliminary finding, disclosed Oct 30, is that the attacker reached a service container via a compromised DevOps engineer's laptop, with no evidence of private-key leakage; roughly $3 billion is frozen on-chain, including 1.567 billion USDT by Tether and 800 million USDC by Circle (CyberInsider, The Hacker News). Binance's latest update says 90% of the $6.3 billion has been replenished (DarkWebInformer); vxunderground's early call that this would turn out to be mundane social engineering rather than a browser zero-day chain looks well aimed. Earlier coverage. · Threat Activity

October 29, 2026

• A dataset covering 41,000+ DHS employees leaked after attackers obtained access to the Okta single sign-on service DHS uses. The "Icepick" data — published via DDoSecrets and researcher maia arson crimew, with a group calling itself the Department of Peace claiming the theft — contains names, work emails, cell numbers, job assignments and facility locations for ICE, CBP and other components, plus membership in internal access groups tied to undercover operations, wiretap programs, Palantir, Cellebrite and xAI's Grok. DHS, ICE and CBP did not respond to requests for comment (Straight Arrow News). · Cloud & Identity

October 25, 2026

• PingCAP confirmed an intrusion into TiDB maker's internal systems running September 9 to October 7, via a compromised GitHub account and exposed credentials. Source code was taken and customer-related records copied from internal analytics, storage and support systems; investigator NebuSec found no evidence that data inside customers' TiDB databases was accessed. Exported TiDB Cloud API-key values were encrypted, but credentials shared in support tickets were not — customers should rotate management API keys and anything pasted into support. (PingCAP) · Breaches & Data Exposure

October 22, 2026

• Microsoft now assesses that China-aligned Storm-0940 conducted the ConnectWise Cloud Backup compromise using ARTEX. Since September, the actor targeted hundreds of organizations globally; several attacks reached privileged cloud access, and multiple did so in under three hours. ARTEX used compromised, previously consented application credentials to enter Microsoft 365 without an interactive sign-in, followed by Graph reconnaissance, credential changes and privilege attempts. Successful authentication does not itself prove data access or exfiltration. The attribution and agentic workflow are new since earlier coverage; see Microsoft’s analysis. · Cloud, Identity & Threat Activity

October 21, 2026

• SafePay has breached at least 600 organizations since August 2024. A joint US, UK and German advisory calls it one of 2026’s most active ransomware groups. Initial access includes stolen or guessed credentials, phishing and exploited perimeter flaws such as CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766; operators then create or hijack accounts, disable defenses, use legitimate remote tools, exfiltrate data and encrypt systems. See the CISA advisory. · Threat Activity · also via phishing email, exposed service
• Stolen UpdraftCentral keys are being used to backdoor WordPress sites. TeamUpdraft detected unauthorized access to teamupdraft.com on October 18 and published customer response guidance; BleepingComputer connects the stolen keys to subsequent site compromises. · Cloud & Software Supply Chain

October 16, 2026

• GhostAction’s latest wave targeted more than 30,000 repositories after roughly 1,900 GitHub accounts were compromised. On October 8 and 9, the campaign reached repositories across 3,000 users and organizations and attempted to extract 3,174 secrets from public repositories’ CI environments. Hijacked maintainer accounts push deceptively named GitHub Actions workflows that scan current files and Git history for cloud, package-registry and AI-provider keys. Further waves appeared on October 10 and 12, materially expanding the campaign described previously (earlier coverage). The Hacker News summarizes GitGuardian’s findings. · Cloud, CI/CD & Supply Chain

October 14, 2026

• Denmark's CPR breach traced to the password 123456. The person claiming responsibility told Politiken they reached the Central Register of Persons through an IT company account protected by that password, and the paper reports at least three company accounts — including an administrator account — shared it. Access began 10 September, with 14 million automated searches run through 20 September; the intrusion was not detected until 2 October, 12 days after the last search, when a staffer noticed an unusually large invoice from supplier Pays ApS. Data on 8.8 million people was accessed from a register of roughly 11 million records (The Register) (earlier coverage). · Nordics & Europe

October 12, 2026

• Attackers are initiating fraudulent payouts with stolen payment API credentials from victims’ own allowlisted servers. CERT-In advisory CIAD-2026-0046 describes multiple campaigns against lenders, fintechs, payment providers, and wallet operators. Direct calls to disbursement and transfer APIs can bypass application workflows for KYC, approval, beneficiary verification, and transaction limits. Source-IP allowlisting should not be treated as transaction authorization. · Cloud & Identity

October 10, 2026

• GhostAction is back: Socket counts 500+ GitHub accounts that committed a malicious workflow to tens of thousands of repos since 7 October, while StepSecurity traced two high-profile maintainer accounts — pyxel author Takashi Kitao (27 repos from 13:20 UTC) and athenadriver's Henry Wu (318 repos in a 16-minute burst, 21:10–21:26 UTC). The workflow (security-audit.yml / github_actions_security.yml) triggers on any push or tag, checks out with fetch-depth: 0, and curls named Actions secrets plus AWS, Anthropic, OpenAI, OpenRouter, GitHub and GitLab keys found anywhere in working tree or git history to 193.32.204[.]199 over plain HTTP. Initial access is assessed as leaked PATs from infostealer logs; the 2025 round exfiltrated 3,325 secrets from 817 repos across 327 users (The Hacker News). · Supply Chain & CI/CD

October 6, 2026

• A legitimate company connection became the path into Denmark’s Central Person Register (CPR). Officials say unauthorized users obtained names, addresses and CPR numbers for about 8.8 million of roughly 11 million register entries, spanning current residents, emigrants and deceased people. Bulk automated lookups ran during September and were detected on October 2; the company’s access was revoked. Denmark’s CPR administration and The Record say no actor has been identified publicly. (discussion) · Cloud, Identity & Data Exposure

September 30, 2026

• French tax authority data theft went undetected for seven weeks, carried out with stolen staff credentials (The Hacker News). · Breaches

September 29, 2026

• JadePuffer (Microsoft: Storm-3168) used two compromised Azure service principals from the same tenant to map resources and then delete them — a destructive stage lasting seven minutes against more than 100 storage accounts plus Key Vaults, Function Apps, VMs and App Services, in an ~18-hour June operation. Azure resource locks and storage-account-level protections saved some accounts; SQL database deletion failed because the attacker used an unsupported API version. Credentials for one service principal had appeared in a public GitHub issue before the attack (BleepingComputer, The Hacker News). Roughly half an hour after the wipe, the actor returned for 30+ storage-key requests, most successful. · Cloud & Identity

September 22, 2026

• BigCommerce notified multiple merchants of breaches after attackers compromised credentials for third-party Ribon applications and used that access to inject malicious scripts into storefronts. BleepingComputer · Supply Chain & Developer Targeting

September 17, 2026

• NightEagle (APT-Q-95), previously focused on Asia, is now hitting Russian companies. Kaspersky's GERT found initial access via stolen VPN credentials from Cloudflare WARP and European VPS IP space, then the GhostContainer Exchange backdoor — assembled from Neo-reGeorg, a CVE-2020-0688 exploit and ysoserial's GhostWebShell — believed delivered by extracting Exchange crypto keys from the ASP.NET config and injecting into VIEWSTATE. It takes commands via x-owa-urlpostdata headers and patches amsi.dll and ntdll.dll to blind AMSI and event logging, with RDP plus tunnelling tools for lateral movement. Securelist. · Threat Activity

September 14, 2026

• Stolen police credentials opened Florida’s DAVID driver database. Florida says attackers used credentials taken from an officer’s personal device, The Record reports. BleepingComputer identifies the compromised account as belonging to a police-department employee with access to the FLHSMV system. ShinyHunters claims more than 2.8 million driver records, but the state’s confirmation establishes the access route, not necessarily the group’s full claimed scope. · Identity & Data Exposure

September 13, 2026

• Anthropic names seven China-based labs over illicit distillation, including Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax, in seven campaigns detected since February 2026. The described access routes are proxy or relay stations spinning up thousands of accounts on fake identities, stolen cards and harvested corporate API keys, transcripts bought from resellers, and — in some cases — labs rerouting their own users' requests to Claude to harvest the exchanges (The Hacker News, earlier coverage). · AI-Enabled Threat Activity

September 2, 2026

• Attackers stole a METR API key and burned roughly $600,000 in AI model credits before anyone noticed — for weeks. The nonprofit that evaluates frontier models for long-horizon agentic capability disclosed two separate intrusion attempts (The Register, Dark Reading). Credential hygiene and spend alerting on model APIs is now a real attack surface, not a billing concern (earlier coverage). · AI & Model Security

August 29, 2026

• North Korean remote workers are moving beyond IT into sales, marketing and medical roles. Huntress identified five suspected cases in 2026 by pivoting on shared VPN, proxy and hosting infrastructure; operatives used stolen or altered IDs to get hired and remotely controlled company-issued laptops (Huntress, Dark Reading). · Threat Activity

August 17, 2026

• French DGFiP tax authority confirms breach of 678,000 individuals. The Ministry of the Economy and Finance disclosed that an attacker used compromised credentials to access DGFiP systems and steal enterprise and personal tax data, putting a firm number on the incident forum actors flagged last week (BleepingComputer, SecurityWeek) (earlier coverage). · Breaches & Regulation

August 15, 2026

• France's tax authority (DGFiP) confirmed a late-June intrusion after an attacker gained VPN access to internal lookup tools; officials cite ~680,000 taxpayers while the seller now touts up to 2 million records (The Record, The Register, earlier coverage, discussion). · Data Breaches

July 27, 2026

• A Scattered Spider sentencing offered a rare inside look at TTPs — heavy reliance on stolen credentials, social engineering, compromised third-party infrastructure, and shared tooling, underscoring identity and account-recovery hardening (AITM Feed). · Threat Activity

July 23, 2026

• Chick-fil-A discloses credential-stuffing breach of Chick-fil-A One accounts (June 17–19), exposing names, membership/mobile-pay numbers, reward balances and the last four digits of stored cards (BleepingComputer). · Data Breaches

June 23, 2026

• Brazil's Emergency Alert System hijacked off a decade-old infostealer credential — an actor ("mizanthropiaz") pushed false alerts to hundreds of thousands across São Paulo, Rio, and Brasília after logging in with a username/password harvested by malware in 2016 and never rotated; reports describe no MFA, no IP allowlisting, no rate-limiting, and a static "2+2" CAPTCHA. A textbook case of identity hygiene failure at national scale. The Record · Threat Activity