Credential Leaks Intelligence
Infostealer malware campaigns (Lumma, RedLine, Vidar, StealC), combo list releases on dark web forums, credential stuffing operations, and enterprise exposure reports.
Credential Leaks — Archive & Latest
CL-STA-1178 Blinder Tunnel + Agent Tesla Q3 Surge: OTX Detection Pack for ShelbyLoader, GTA VI Lures, Langflow RCE and AWS Bedrock Key Testing
OTX shows CL-STA-1178 Blinder/ShelbyLoader, Agent Tesla email surge, GTA VI credential lures, Langflow RCE scans and AWS Bedrock key testing. High urgency.
K2F RAT via NIKKE Launcher Supply-Chain Compromise + GTA VI & Bank Phishing Credential Harvesting: OTX Pulse Analysis — Enterprise Detection Pack
CDN supply-chain compromise drops K2F credential stealer via NIKKE launcher; GTA VI phishing, fake bank-takedown cloaking, and AWS key validation campaigns active. Hunt now.
Phexia macOS Infostealer, NIKKE K2F Supply Chain RAT & VAPOR PANDA ARTEX: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Phexia macOS infostealer via ClickFix, NIKKE launcher supply-chain RAT, BO Team hypervisor compromise, GTA VI phishing, and VAPOR PANDA AI-driven espionage. Credential theft across all campaigns — hunt now.
SkyW4lker Phishing Kit + K2F Launcher RAT + Bank Phish Cloaking Network: OTX Pulse Analysis — Enterprise Detection Pack
Device-code phishing, supply-chain RAT, GTA VI lures, and cloaked bank phishing networks drive credential theft against US enterprises, gaming platforms, and financial institutions.
Claude Code-Brand Cursor Extension SSH Backdoor + Fake-Takedown Bank Phishing: OTX Detection Pack
CRITICAL: trojanized Claude Code Cursor extensions drop macOS SSH persistence while 248 look-alike domains phish 189 US banks with fake suspended-page cloaking.
KeyHunter LLM API Theft + Claude Code SSH Backdoor + Fake-Takedown Bank Phishing: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal LLM API key theft across cloud platforms, a malicious Claude Code Cursor extension with a persistent macOS SSH backdoor, and 248 bank-phishing domains using fake-takedown cloaking. Hunt now.
Gorbag GIFTEDCROOK/BeautyStealer Ukraine Espionage + Malicious Claude Code Extension SSH Backdoor + Gentlemen RaaS 'Azazel' GitLab CI/CD Credential Theft: OTX Detection Pack
OTX pulses expose a Russia-aligned Ukraine espionage crew, a trojanized Claude Code Cursor extension with SSH backdoor persistence, and a Gentlemen ransomware affiliate abusing GitLab secrets. Hunt now.
Black October Campaign: AI Platform Credential Theft & LLMjacking — OTX Detection Engineering Pack
Coordinated breaches hit nine AI developer platforms; attackers steal env-var credentials, run LLMjacking ops. Hunt now: 31.57.201.201, 38.246.114.118.
ChatGPT Plus Billing Phishing, Teams Help Desk AD Hijack & AI Platform LLMjacking: OTX Pulse Analysis — Credential Theft Detection Pack
OTX pulses reveal converging credential-theft operations: fake ChatGPT billing pages with live OTP interception, Teams-based IT help desk impersonation leading to AD compromise via ESC1/ESC8, and LLMjacking across nine AI developer platforms.
LLMJacking UNC6993 + AI Phishing Ops: OTX Pulse Analysis — Credential Theft Detection Pack
LLMJacking, AI billing phishing, Teams AD hijack, and AI platform credential breaches. Finance, retail, tech, transport targeted. Immediate identity and cloud billing controls required.
CyberStrikeAI LLM-Orchestrated C2 + VOLTA AI-Powered Infostealer: OTX Pulse Analysis — Credential Theft & LLMjacking Detection Pack
OTX pulses reveal AI-orchestrated attacks on education, VOLTA infostealer victim profiling via LLMs, ChatGPT billing phishing, Teams-based AD hijacking, and LLMjacking of 9 AI platforms. High urgency.
Kimsuky XenoRAT LNK Spear-Phish + AI Platform LLMjacking: OTX Credential-Theft Detection Pack
OTX pulses show Kimsuky XenoRAT spear-phish against South Korea and credential theft/LLMjacking across nine AI dev platforms. High urgency: block IOCs, hunt LNK/PowerShell/AutoIt, rotate tokens.
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 / CVE-2026-81578 — OTX Pulse Analysis
Zero-day exploitation of PaperCut MF 24.0.2 in Education: in-memory Java loader, web shell, trojanized Copilot binary delivering AdaptixC2, credential dumping. Patch and hunt now.
China Chopper & Godzilla WebShells on Zimbra: CVE-2026-73570 SNMP Command Injection — OTX Enterprise Detection Pack
Active unauthenticated command injection (CVE-2026-73570) against internet-facing Zimbra mail servers delivering China Chopper and Godzilla JSP webshells. High urgency: patch, hunt, and harden now.
Psychedelic Stealer ClickFix Campaign + MadApe Device Code Phishing + CVE-2026-73570: OTX Enterprise Detection Pack
Critical OTX pulses reveal active ClickFix infostealer infections in Ukraine, unpatched Zimbra command injection, and Microsoft 365 device code phishing targeting global enterprises.
MadApe Device-Code Phishing Kit + NetScaler & Zimbra Webshell Clusters: OTX Pulse Analysis — Credential Theft Detection Pack
OTX pulses reveal a converged credential-theft wave: MadApe device-code phishing, Citrix NetScaler and Zimbra webshell exploitation, and rogue AI relays. Hunt now.
TIKTOUK Credential Harvesting Toolkit + MadApe Device-Code Phishing: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose a WordPress credential-collection toolkit, NetScaler & Zimbra exploitation with webshells, M365 device-code phishing, and rogue AI relays. Hunt now.
MadApe Device Code Phishing Kit + Zimbra CVE-2026-73570 & NetScaler CVE-2026-88771 Exploitation: OTX Pulse Analysis — Enterprise Detection Pack
Multi-stage credential theft via Microsoft Device Code phishing (MadApe) and unauthenticated command injection on Zimbra (CVE-2026-73570) & NetScaler (CVE-2026-88771). 600+ OTX indicators. High urgency for identity and perimeter teams.
Kairos Botnet, Trojanized Claude Code Extension, Zimbra CVE-2026-73570 Exploitation, MadApe Phishing Kit, and PHP2Shell Extortion: OTX Threat Intelligence Briefing — Enterprise Detection Pack
Multiple active campaigns detected targeting enterprises via Go-based DDoS botnets, supply chain compromise of developer tools, unauthenticated Zimbra command injection, Microsoft Device Code phishing, and PHP2Shell extortion operations.
2CLoader, Vidar, Remus & MadApe: Credential-Theft Campaigns, Supply-Chain SSH Backdoor and Zimbra Exploitation — OTX Enterprise Detection Pack
OTX pulses expose a high-urgency credential-theft wave: 2CLoader delivering Vidar/Remus/XWorm, a trojanized Cursor extension planting SSH backdoors, active Zimbra CVE-2026-73570 exploitation, Kairos DDoS botnet, and MadApe device-code phishing targeting Israel.
MadApe Device Code Phishing Kit + njRAT QuickBooks Scam + Star Blizzard APT: OTX Credential-Theft Intelligence Bulletin — Enterprise Detection Pack
Live OTX data exposes Microsoft Device Code phishing kit MadApe, a 350-domain QuickBooks credential scam with njRAT tooling, Star Blizzard APT spear-phishing, Aurora ESXi ransomware, and PHP2Shell extortion. Hunt now.
NIK C2, MadApe Phishing Kit & Star Blizzard Credential Theft Wave: OTX Pulse Analysis — Enterprise Detection Pack
Five OTX pulses expose AI-enabled C2 frameworks, Microsoft Device Code phishing, FSB-linked credential theft, and ransomware ops. Immediate action required.
Lumma Stealer via ClickFix + Star Blizzard AiTM Phishing + n0n AI-Assisted Extortion: OTX Pulse Analysis — Enterprise Detection Pack
CRITICAL: Lumma/AMOS stealers via ChatGPT Custom GPT ClickFix lures, Star Blizzard AiTM credential theft, and n0n ransomware extortion. Block IOCs and hunt now.
CyberDakait Android Banking Trojans + Firefox Crypto-Wallet Impersonators: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal CyberDakait's 7 Android trojans targeting Indian banks, Firefox extensions stealing crypto seed phrases, and bid-lure phishing. High urgency — credential theft at scale.
Operation MASTER, MR ROBOT MaaS, and Lzveil Infostealers: OTX Pulse Analysis — Enterprise Detection Pack
GlobalProtect zero-day exploitation, Android banking MaaS targeting Indian financials, and SEO-poisoned infostealers converge in this week's OTX telemetry. Patch CVE-2026-0257 and hunt DNS tunneling now.
SkyW4lker Device-Code Phishing Kit + Poseidon RAT AI Harness Takeover: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose SkyW4lker OAuth device-code phishing bypassing MFA on Microsoft 365, Poseidon RAT hijacking AI pentest harnesses, and fake-bid credential lures.
ICMacOS Stealer-to-RAT Evolution + DarkCore Session-Hijacking RAT: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal GlowComa's ICMacOS macOS stealer evolving into a persistent RAT, plus DarkCore RAT hijacking browser sessions via stolen cookies. High urgency.
Lunex Stealer + Shai-Hulud npm Supply Chain: BYOVD Credential Theft & Native Addon Camouflage — Enterprise Detection Pack
OTX: LunexStealer hits Ukrainian users via BYOVD + fake CAPTCHA; Shai-Hulud npm supply chain hijacks 42 GitHub repos. Credential theft imminent — hunt now.
Aokigahara / Kamidere / Stygian AI-Tool Infostealer Wave: OTX Pulse Detection Pack
OTX pulse flags infostealers targeting browsers, wallets, VPNs and AI dev tools; credential/API-token theft risk is high for technology teams.
PureRAT + PureLogs Infostealer Campaign Hits Japanese Enterprises: OTX Pulse Analysis — Phishing-to-Process-Hollowing Detection Pack
OTX pulse exposes PureRAT/PureLogs campaign targeting Japanese orgs via Korean/Japanese phishing lures, Donut loader, process hollowing, and BYOVD. High urgency.
Psychedelic Stealer: Fake CAPTCHA-Driven Infostealer Campaign Targeting Ukrainian Businesses — OTX Pulse Analysis & Enterprise Detection Pack
Live OTX telemetry reveals a ClickFix-style fake CAPTCHA campaign compromising legitimate Ukrainian websites to deliver the Psychedelic infostealer via clipboard-hijacked MSI installer commands. Immediate credential-theft risk.
Year-End Credential Harvesting Campaign: SharePoint & DocuSign Impersonation Phishing Infrastructure — OTX Pulse Analysis
OTX tracks a year-end phishing campaign impersonating SharePoint and DocuSign to steal credentials from finance, tech, telecom, and aviation staff. Block IOCs now.
RemotePanel HVNC + BoundSiphon Browser Theft: ClickFix Dual-Payload Campaign — OTX Detection Engineering Brief
Live OTX pulses expose a ClickFix-delivered .NET dual-payload toolkit (RemotePanel HVNC + BoundSiphon App-Bound Encryption bypass) using BNB Smart Chain C2 resolution, plus year-end DocuSign/SharePoint phishing. Hunt now.
CARBONATO Docker Botnet + Year-End Phishing Lures: OTX Pulse Analysis — AI-Agent Malware & Credential Harvesting Detection Pack
OTX pulses reveal CARBONATO botnet exploiting exposed Docker daemons with AI-agent malware, alongside year-end phishing campaigns targeting finance/HR via SharePoint and DocuSign impersonation. Enterprise detection and response guidance included.
TRUST#GRAFT WordPress Admin PHP Backdoor + Year-End Phishing Credential Harvesting: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose TRUST#GRAFT ClickFix-style WordPress admin backdoor deployment and a year-end phishing wave targeting finance/tech. Credential theft imminent. Hunt now.
ClickFix & Armorsteal Credential-Theft Wave: DarkGate, Amadey, and WordPress Backdoor Campaigns — OTX Pulse Analysis & Detection Pack
OTX pulses reveal converging credential-theft campaigns: ClickFix fake CAPTCHAs, SEO-poisoned Armorsteal, WordPress PHP backdoors, and year-end phishing. High urgency for enterprise SOC teams.
SiriusQT, Stadia (StealC v2) & RemControl: MaaS Infostealer Resurgence — OTX Pulse Analysis & Enterprise Detection Pack
OTX pulses reveal a post-Endgame infostealer resurgence: SiriusQT RAT, StealC's return as Stadia, RemControl Android banking trojan, ClickFix loaders & Armorsteal. Hunt now.
Red Heron 'Kapibala' WordPress Exploitation Wave + BUGSTER AI-Enabled Credential Theft: OTX Pulse Analysis — Enterprise Detection Pack
Red Heron actor breached 18K+ government records via WordPress CVEs; BUGSTER used jailbroken AI for credential theft in India. Detection pack inside. HIGH urgency.
LiteLLM privcollect Supply-Chain Compromise + Lumma ClickFix finger.exe Chain: OTX Credential-Theft Detection Pack
OTX: LiteLLM PyPI/Docker compromise, Amazon ClickFix finger.exe chain, Red Heron WordPress breaches; credential-theft surge—hunt now.
k0t Edge Credential Harvesting + LiteLLM Supply Chain Infostealer Wave: OTX Pulse Analysis — Enterprise Detection Pack
Five OTX pulses expose converging credential-theft campaigns: k0t's 70K+ harvested edge-device credentials, the LiteLLM PyPI/Docker supply-chain infostealer, and ClickFix Lumma delivery. Immediate action required.
LLMjacking via GCP Phishing: Gemini API Abuse & Cloud Billing Hijack Campaign — OTX Detection Pack
Active phishing campaign uses typosquatted Google domains and sponsored ads to steal GCP credentials, disable org policies, and hijack Gemini API access for LLMjacking. Hunt now.
Wazza Device Code Phishing Kit + GCP LLMjacking Campaign: OTX Pulse Analysis — Microsoft 365 & Cloud Credential Theft Detection Pack
Active phishing campaigns targeting Microsoft 365 via Wazza device code kit and GCP accounts via malvertising — credential theft feeding OAuth abuse and LLM billing hijacking. High urgency.
APT28 'Swallowtail' Espionage Campaign: Hookedge Backdoor Hits NATO Defense Firms — OTX Pulse Detection Pack
APT28 (Forest Blizzard) targeted naval shipbuilders, law enforcement, and aerospace firms in two NATO states with the Hookedge backdoor via malicious Word docs. Credential theft confirmed. High urgency.
ConnectWise Cloud Backup / SkyKick M365 Credential Abuse: OTX Detection Pack — Microsoft Graph Token Access Across Hundreds of Tenants
OTX flags compromised ConnectWise/SkyKick vendor M365 API credentials used from 144.172.64.128 for Graph access across hundreds of tenants; high urgency for MSP and M365 defenders.
TraderTraitor FLATROOF/ROOFDECK, QuartzLine PDF Backdoor & SkyKick M365 Credential Abuse: OTX Pulse Detection Pack — 2026-10-19
OTX pulses flag DPRK TraderTraitor backdoors, the QuartzLine trojanized PDF viewer, YuanKong Android RAT, and abused ConnectWise/SkyKick M365 credentials. Hunt and block now.
PolinRider Infostealer: Compromised GitHub Accounts Poison Packagist Supply Chain — OTX Detection Pack
PolinRider operators hijacked a developer GitHub account to backdoor visanduma/nova-two-factor (700K+ downloads). Credential theft via supply chain. Hunt now.
Settra Ransomware + MeshAgent RMM: BYOVD Recovery-Inhibition Campaign — OTX Detection Pack
Settra ransomware hits retail/manufacturing via VPN or compromised creds, using MeshAgent RMM, BYOVD and recovery inhibition. Hunt now; pulse IOCs restricted.
PaperCut NG/MF AI-Orchestrated Exploitation: CVE-2026-81578/82078, Chisel SOCKS5, AD Credential Theft — OTX Detection Pack
OTX: exposed AI workbench shows PaperCut NG/MF exploitation, second RCE, reverse-SOCKS5 persistence and credential/AD theft across education victims; patch and hunt now.
KGB RAT, KREMLIN, Variola & ARMORY CASTLE: OTX Pulse Analysis — Infostealer, Browser Hijack, and Zero-Day Exploitation Detection Pack
OTX pulses reveal FUD RAT sales, Chrome extension banking theft in Brazil, AI-orchestrated PaperCut exploitation, a ClickFix implant, and a PRC-nexus BeyondTrust zero-day. Hunt now.
Agentic AI-Driven Spring Batch Intrusion + CoGUI/CoAceV/CoFish_Ws Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack
Live OTX pulses: LLM-agent orchestrated server takeover via exposed Spring Batch endpoint, and disruption of 3 Chinese-language phishing kits targeting Japanese finance & consumer brands. HIGH urgency.
Showing 50 of 480 reports. Archive expands automatically as new intel is generated.
Every Credential Leaks Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.