Credential Leaks Intelligence
Infostealer malware campaigns (Lumma, RedLine, Vidar, StealC), combo list releases on dark web forums, credential stuffing operations, and enterprise exposure reports.
Credential Leaks — Archive & Latest
PaperCut NG/MF AI-Orchestrated Exploitation: CVE-2026-81578/82078, Chisel SOCKS5, AD Credential Theft — OTX Detection Pack
OTX: exposed AI workbench shows PaperCut NG/MF exploitation, second RCE, reverse-SOCKS5 persistence and credential/AD theft across education victims; patch and hunt now.
KGB RAT, KREMLIN, Variola & ARMORY CASTLE: OTX Pulse Analysis — Infostealer, Browser Hijack, and Zero-Day Exploitation Detection Pack
OTX pulses reveal FUD RAT sales, Chrome extension banking theft in Brazil, AI-orchestrated PaperCut exploitation, a ClickFix implant, and a PRC-nexus BeyondTrust zero-day. Hunt now.
Agentic AI-Driven Spring Batch Intrusion + CoGUI/CoAceV/CoFish_Ws Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack
Live OTX pulses: LLM-agent orchestrated server takeover via exposed Spring Batch endpoint, and disruption of 3 Chinese-language phishing kits targeting Japanese finance & consumer brands. HIGH urgency.
Aoki Infostealer Targets AI Coding Assistant Credentials + CoGUI Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack
Aoki infostealer now harvests AI assistant API keys; fake Calendly/Meta phishing bypasses 2FA; AI agents breach servers. High urgency for credential-heavy environments.
ShellBot, Fisieredoor & VShell Credential-Theft Campaigns Targeting Linux SSH and Windows Database Servers: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Q3 2026 brute-force campaigns hitting Linux SSH and Windows MS-SQL/MySQL servers, deploying ShellBot, Fisieredoor, XMRig, HackBrowserData, and web shells. High urgency for exposed infrastructure.
CVE-2024-21762 FortiGate SSL-VPN Exploitation + MeshCentral RMM Persistence: Thai Telecom Intrusion — OTX Detection Pack
Active intrusion against Thai ISP 3BB via CVE-2024-21762 FortiGate SSL-VPN exploit, MeshCentral RMM for C2/persistence. Telecom sector. High urgency.
AgentTesla FTP Exfiltration + Storm-2561 Fake WatchGuard VPN Credential Phishing: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose AgentTesla phishing with FTP exfiltration and Storm-2561's fake WatchGuard VPN sites harvesting credentials via SEO poisoning. High urgency.
Brand Deal Phishing Campaign Targeting YouTube Creators: SSO Abuse & Google Credential Theft — OTX Pulse Detection Pack
OTX pulse exposes a sponsorship-scam phishing operation impersonating Nike, Spotify & Hollyland to hijack YouTube creator Google accounts via fake brand-deal portals. Hunt now.
KATARU IoT Botnet + Mirai-Style Telnet Brute-Force: OTX Pulse Analysis — Linux LPE Exploit & Detection Pack
KATARU IoT malware brute-forces Telnet credentials, deploys three public Linux LPE exploits, and establishes encrypted C2. IoT/OT networks at risk — hunt now.
Google Infrastructure Trust-Proxy Phishing Campaign + ScreenConnect Delivery: OTX Pulse Analysis — Enterprise Detection Pack
Global phishing campaign weaponizes six Google services as trust proxies to deliver ScreenConnect and harvest credentials. Manufacturing, government, finance, and NGO targets. Hunt now.
Casbaneiro Banking Trojan (Metamorfo/Ousaban) Distributed C2 Campaign: OTX Pulse Analysis — LATAM Financial Sector Detection Pack
Casbaneiro banking trojan targets LATAM finance users via phishing PDFs, HTA downloaders and AutoIt loaders with geofenced C2. High urgency for credential theft.
GRIMWEDGE/SUPERSTOMP Chrome-Windows 0-Day Chain + Djinn Stealer/TaskWeaver Credential Raid: OTX Detection Pack
OTX: UTA0560/JungleBamboo Chrome+Windows 0-day chain and Djinn Stealer/TaskWeaver credential raids; patch, hunt Node/Chrome artifacts, reset secrets.
KMON_NOC Credential Validation Platform Targeting AWS Keys for Amazon Bedrock LLM Access — OTX Pulse Analysis & Detection Pack
Credential harvesting platforms like KMON_NOC now validate stolen AWS keys specifically for Amazon Bedrock access. High urgency for cloud-native enterprises.
FLATROOF/ROOFDECK Trojanized Terraform Campaign, ARTEX Agentic-AI Attacks & AWS Bedrock Credential Testing: OTX Pulse Analysis — Enterprise Detection Pack
TraderTraitor trojanized Terraform providers, AI-driven ARTEX intrusions on Korean finance, and AWS key validation for Bedrock LLM abuse. High urgency.
Shai-Hulud ChainDrop npm Worm + AWS Bedrock Token-Jacking: OTX Pulse Analysis — Credential Theft Detection Pack
Shai-Hulud supply chain worm compromises TensorLake npm SDK; harvested AWS keys are being validated for Bedrock LLM access. High urgency credential theft activity.
FortiBleed FortiGate Credential Harvesting + Shai-Hulud npm Worm & AWS Bedrock Key-Jacking: OTX Detection Pack
FortiBleed cracks 86K+ FortiGate VPN creds, Shai-Hulud worm poisons npm SDKs, and stolen AWS keys are tested for Bedrock access. Enterprise hunt pack inside.
ClearFake, PhantomPolia & FortiBleed: EtherHiding Stealer Chains and 86K+ Compromised FortiGate Credentials — OTX Detection Pack
OTX pulses reveal Amatera/Remus stealer chains abusing BNB Chain & Ethereum smart contracts, 86K+ cracked FortiGate VPN creds, and a wormable npm supply-chain attack. Hunt now.
Fake AI Ads Browser-in-the-Browser + AWS Bedrock Token-Jacking: OTX Pulse Detection Pack
OTX pulses expose fake AI ads using Browser-in-the-Browser MFA theft and AWS key validators probing Bedrock; enterprise identity and cloud keys at high risk.
BigBear 2.0 Evilginx2 PhaaS + Fake AI Ads BitB Campaign: Credential Theft & Cloud Token-Jacking Wave — OTX Pulse Analysis
OTX pulses reveal Evilginx2 PhaaS, BitB fake-AI phishing, Langflow RCE scanning, and AWS key testing for Bedrock. Enterprise identity and cloud credentials at high risk.
CL-STA-1178 Blinder Tunnel + ShelbyLoader V2, Fake AI Ads Phishing Platform, and AWS Bedrock Token-Jacking: OTX Pulse Analysis — Credential Theft Detection Pack
OTX pulses reveal Iranian CL-STA-1178 hitting Iraqi critical infrastructure, a BitB phishing platform impersonating AI ad products, and mass AWS key validation for Bedrock access. Hunt now.
Lunex MaaS BYOVD Campaign Targeting Ukraine: Kernel Callback Manipulation via AMD PDFWKRNL.sys (CVE-2023-20598) — OTX Detection Pack
LunexLoader abuses CVE-2023-20598 (AMD PDFWKRNL.sys) via BYOVD to blind EDR kernel callbacks and deploy LunexStealer against Ukrainian users. CRITICAL urgency.
ClickFix RAT Delivery via ChatGPT Custom GPTs & Gentlemen RaaS Insider 'Azazel': OTX Pulse Analysis — Enterprise Detection Pack
CRITICAL: ClickFix lures via malicious Custom GPTs drop Matanbuchus/Lumma/SectopRAT; Gentlemen affiliate Azazel leaks CI/CD-stolen data via LEAKNED. Hunt now.
BraZetsu IAB Framework, Psychedelic Stealer ClickFix Chain & GlassWorm VS Code Extensions: OTX Pulse Analysis — Enterprise Detection Pack
Three live OTX pulses expose an AI-enhanced IAB toolkit (BraZetsu), a fake-CAPTCHA ClickFix stealer hitting Ukraine, and GlassWorm credential-theft extensions in VS Code marketplaces. High urgency.
Contagious Interview Expands to Trojanized macOS Installers: DPRK OtterCookie Campaign — OTX Pulse Analysis & Detection Pack
DPRK's Contagious Interview campaign ships OtterCookie via 14 trojanized macOS apps (DMG/PKG) impersonating The Unarchiver, Sketch, and Bartender. HIGH urgency.
Node.js LOLBin Abuse, PaperCut MF Zero-Days & AI-Orchestrated Intrusions: AdaptixC2, AsukaStealer, GLUTTON OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Node.js ClickFix abuse by Woodgnat, PaperCut MF zero-days (CVE-2026-82078/81578) dropping AdaptixC2, and AI-agent-driven intrusions. Gov/tech/edu at risk. Hunt now.
Webshell Intrusion on Municipal Platforms + TA419 AiTM Credential Phishing: OTX Pulse Analysis — Detection & Hunt Pack
OTX pulses expose a webshell/timestomping intrusion against parks & rec platforms and TA419's frameless BitB AiTM phishing of US AI policy circles. High urgency for government and think tank defenders.
RemusStealer EtherHiding C2, StreamRat Banking Trojan & PamStealer macOS Campaign: OTX Pulse Analysis — Infostealer Detection Pack
OTX pulses reveal 5 active infostealer campaigns: RemusStealer Ethereum-based C2, StreamRat Android banking trojan, Vidar crypto-drainer, Kimsuky APT, and macOS PamStealer. High urgency.
Zer0day Stealer + ENIGMA Locker Build-Path Attribution: OTX Pulse Analysis — Rust Infostealer, HVNC, and Ransomware Detection Pack
OTX pulse links Zer0day Stealer, an HVNC remote-access tool, and ENIGMA Locker ransomware to one Rust developer via a leaked build path. High urgency for credential-heavy environments.
CVE-2026-88771 Citrix NetScaler Pre-Auth Command Injection: pitboss/NSPPE Web Shell and Credential-Theft Hunt Pack
Active NetScaler ADC/Gateway exploitation: pre-auth command injection, pitboss/NSPPE auth artifacts, update_c08937.pl retrieval, credential creation and exfil. Patch and hunt now.
Packagist iOS Spyware Chain (CVE-2025-31277/CVE-2025-43529) + RMM Phishing Credential Theft: OTX Pulse Analysis — Enterprise Detection Pack
CRITICAL: 13 malicious Packagist themes deliver iOS WebKit exploit spyware stealing crypto seeds; parallel phishing waves abuse MSP360/ScreenConnect RMM for persistent credential theft.
ClickFix-Custom-GPT Malvertising Chain Delivers Lumma, SectopRAT & AMOS + JSCeal V8 Bytecode Stealer: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses confirm ClickFix lures abusing ChatGPT Custom GPTs deliver Lumma/SectopRAT/AMOS, while JSCeal crypto stealer ships as compiled V8 bytecode. Hunt now.
DarkSword Exploit Chain via Fake iPhone Duo Preorder Pages: OTX Pulse Analysis — Safari Zero-Click Detection Pack
DarkSword exploit chain deployed via fake iPhone preorder pages. Safari zero-click compromise targets unpatched iOS devices. High urgency — patch and hunt now.
Fake VPN Chrome Extension Proxy Farm: OTX Pulse Analysis — Enterprise Browser Traffic Interception Detection Pack
31 fake VPN Chrome extensions intercept traffic via shared proxy codebase; 356K users at risk. Block C2 domains, audit extensions, reset sessions.
The Stealer Factory: Python-Based MaaS Infostealer Builder — OTX Pulse Analysis with Enterprise Detection Pack
A Python-based Malware-as-a-Service builder lets low-skill operators generate custom Windows infostealers via Nuitka/PyInstaller, using webhook exfiltration and anti-VM checks. High urgency for credential theft risk.
Kothamine RAT, Python MaaS Stealer Factory & ShinyHunters/UNC6240 PeopleSoft Exploitation: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Kothamine RAT abusing Tailscale tailcat for covert C2, a Python MaaS infostealer builder, and UNC6240 (ShinyHunters) mass-exploiting CVE-2026-35273 against Oracle PeopleSoft. Hunt now.
Lunex Stealer BYOVD Chain, Operation Master AdaptixC2 Pipeline & PureRAT Japan Campaign: OTX Pulse Analysis — Enterprise Infostealer Detection Pack
OTX pulses reveal BYOVD-delivered Lunex stealer hitting Ukrainian users, AdaptixC2 intrusion pipeline exploiting GlobalProtect, and PureRAT phishing in Japan. Act now.
APT-C-36 (Blind Eagle) GitHub Loader Campaign: AsyncRAT, DcRat, Remcos & XWorm Deployment Pipeline — OTX Detection Pack
Blind Eagle (APT-C-36) operator staging RAT loaders via GitHub, deploying AsyncRAT/DcRat/Remcos/XWorm against Colombian government targets. High urgency.
DARKLANTERN, SPEAKINGSTONE & ENDLESSDOORS: ZBT Router Firmware Implants in the Global Supply Chain — OTX Pulse Analysis & Detection Pack
Three firmware implants embedded in ZBT routers expose root shell access via unauthenticated UDP 9992 backdoor. Global supply chain reach across 11 countries. Critical urgency.
AnonyMousKIT AI-Powered PhaaS Supply Chain: 506-Domain Apple Activation Lock Phishing Network — OTX Detection Pack
OTX exposes AnonyMousKIT, an AI-driven PhaaS with 506 domains harvesting Apple ID credentials via SMS, WhatsApp, email & vishing. Gov/Edu targeted. HIGH urgency.
Dark Caracal GoCaracal Framework + Russian Evilginx OAuth Phishing Clusters: OTX Pulse Analysis — Credential Theft Detection Pack
OTX pulses reveal Dark Caracal's new GoCaracal modular espionage framework targeting Latin America and Russian clusters (UNC6293/UNC7005/UNC5976) running Evilginx OAuth/device-code phishing against academia and government. High urgency — credential theft at scale.
RemotePanel + BoundSiphon: ClickFix-Delivered Dual-Payload Toolkit for Persistent Access & Browser Credential Theft — OTX Detection Pack
OTX pulse details two undocumented .NET payloads — RemotePanel HVNC RAT and BoundSiphon browser stealer — deployed via ClickFix chains with blockchain-based C2 resolution. Immediate credential rotation advised.
MacSync macOS Stealer + HookBot/ERMAC Android Banking Leak: OTX Pulse Analysis — Credential-Theft Detection Pack
OTX flags MacSync targeting macOS crypto users/devs and HookBot/ERMAC source leak enabling Android banking panel sprawl. Hunt now; credential exposure likely.
CARBONATO Docker Botnet + PavinLoader/Amatera Stealer: OTX Pulse Analysis — Exposed Daemon Exploitation & ClickFix Credential Theft Detection Pack
OTX pulses reveal CARBONATO botnet abusing exposed Docker daemons and PavinLoader delivering Amatera Stealer via ClickFix. Credential theft focus. High urgency.
SectopRAT via Fake Claude Desktop Installers: Bing Malvertising, EtherHiding C2 & DLL Sideloading — OTX Detection Pack
FakeAgent campaign pushes trojanized Claude Desktop installers via Bing malvertising, delivering SectopRAT through DLL sideloading, EtherHiding blockchain C2, and scheduled task persistence.
ClickFix AS202412 Infostealer Chains + Red Heron WordPress Raids: OTX Detection Pack for DarkGate, Amadey, Matanbuchus
OTX pulses: ClickFix fake-CAPTCHA chains on AS202412 and Red Heron WordPress/gov record theft; credential exposure high-block IOCs, hunt now.
DarkMe RAT, RemControl Banking Trojan & ClickFix Loader Chains: OTX Pulse Analysis — Credential Theft Detection Pack
OTX pulses reveal credential theft surge: Water Hydra's DarkMe RAT, RemControl Android banking trojan, ClickFix loader chains, and Red Heron WordPress exploitation. Act now.
Vidar Stealer VM-Based String Obfuscation & Custom ChaCha20-Style Ciphers: OTX Pulse Analysis — Enterprise Detection Pack
Vidar infostealer deploys bytecode VM and custom ARX stream ciphers to defeat string analysis. Credential theft at scale — hunt now, rotate exposed identities within 24h.
Typosquatted AI Platform Malware Distribution: 'claude.ai.download-app.us' Credential-Harvesting Campaign — OTX Detection Pack
OTX pulse confirms adversaries abusing trusted AI platform branding (claude.ai typosquats) to distribute credential-harvesting malware across 8 critical sectors. Hunt now.
Mirage2FA PhaaS Kit: Microsoft 365 Session Hijacking via AiTM — OTX Pulse Analysis & Detection Pack
Mirage2FA phishing-as-a-service kit hijacks Microsoft 365 sessions via AiTM attacks, 4K+ US victims. Blocking, hunting, and identity response guidance inside.
Mirage2FA AiTM PhaaS + T-Mobile Smishing Credential Campaigns: OTX Pulse Analysis — Session Hijack Detection Pack
OTX pulses flag Mirage2FA AiTM phishing-as-a-service hijacking M365 sessions (4K+ US victims) and a T-Mobile rewards smishing wave. Credential/session theft — hunt now.
Showing 50 of 433 reports. Archive expands automatically as new intel is generated.
Every Credential Leaks Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.