Topic

Credential Theft: news, advisories and analysis

8 articlesUpdated 23 Oct 2026

CyberSecureToday covers Credential Theft across 8 articles published between 3 Sep 2026 and 23 Oct 2026. The coverage includes 5 vulnerability advisories and 3 incident or breach reports. 5 advisories are rated critical or high severity.

Stories on Credential Theft most often intersect with Data Breach, Infostealer and Supply chain, with Technology, Cloud & SaaS the most affected sector. The most recent story, “LiteLLM Pipeline Hijacked in Software Supply Chain Attack Deploying InfoStealer and RAT”, was published 23 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
LiteLLM Pipeline Hijacked in Software Supply Chain Attack Deploying InfoStealer and RAT
Attackers hijacked LiteLLM release workflows using leaked GitHub CLI OAuth tokens, publishing backdoored packages to PyPI and Docker Hub executing LLMjacking.
Mei-Lin Chen23 Oct 202614 min read
Cyber AttackGov & Defence
ANSSI: Infostealer Credentials and Weak MFA Let Attackers Drain French Tax Agency
ANSSI's DGFiP report: infostealer credentials, weak MFA and an unmonitored portal let attackers steal impots.gouv.fr and cadastre data undetected.
Tom Verhoeven3 Oct 20268 min read
Cyber AttackBanking & Fintech
Bitcoin Depot Discloses SEC Form 8-K Material Incident Following $3.6M Cryptocurrency Wallet Breach
Bitcoin Depot filed an SEC Form 8-K disclosing unauthorized access to IT systems and credential theft resulting in the exfiltration of 50.9 Bitcoin.
Daniel Okafor27 Sep 20268 min read
ThreatsCloud & SaaSHigh
Strands Agents Tools HTTP Request Authorization Flaw Enables Indirect Prompt Injection Credential Theft CVE-2026-18394
AWS resolves high-severity vulnerability CVE-2026-18394 in Strands Agents Tools, where indirect prompt injection forces AI agents to exfiltrate bearer credentials via malicious proxy parameters.
CST Editorial Desk22 Sep 202615 min read
ThreatsCloud & SaaSHigh
TASK#STOMP Malware Campaign Deploys Living-off-the-Land PowerShell Backdoor with Timestomping and Redundant Task Scheduler Persistence
Securonix uncovers TASK#STOMP campaign leveraging Living-off-the-Land VBScript stagers, masqueraded Scheduled Tasks, and resilient dual-PowerShell backdoors.
Daniel Okafor21 Sep 202615 min read
Cyber AttackCrypto & Web3
Trezor alerts 347,000 customers after third-party Brevo breach triggers targeted phishing wave
A cyberattack on email service provider Brevo compromised 347,000 Trezor customer records, fueling sophisticated phishing campaigns designed to steal crypto recovery seeds.
CST Editorial Desk11 Sep 20265 min read
ThreatsCloud & SaaSCritical
ChainDrop worm spreads through hundreds of npm packages, stealing CI/CD secrets
A self-propagating worm compromised hundreds of popular npm packages, harvesting cloud keys and CI tokens then using them to publish further poisoned releases.
Mei-Lin Chen5 Sep 20268 min read
ThreatsBanking & FintechHigh
Infostealers harvested 1.7 billion credentials in six months as Vidar and Lumma dominate
Researchers logged 7.4 million infected devices between January and June 2026 — a 27% jump — as the infostealer market matured into a fully automated criminal supply chain.
Mei-Lin Chen3 Sep 20267 min read