MacSync Stealer: A macOS Information Stealer
MacSync Stealer is a macOS-focused information stealer that collects credentials, cookies, SSH keys, AWS credentials, and other sensitive data. It uses ClickFix…
Tag: credential theft
Microsoft Ties 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, by correlating endpoint and network…
TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks
Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware,…
TWINLOOT: Python Implant Abusing Microsoft Services for C2
TWINLOOT is a modular Python implant hardened with PyArmor that uses SharePoint Online and Microsoft Teams TURN relays for command-and-control. It steals…
abe_payload.dll: DLL Payload for Credential Theft
abe_payload.dll is a DLL payload used by the StubMaker stealer to extract credentials from Chromium-based browsers by circumventing app-bound encryption (ABE) protections.
CTM360 Uncovers 3,000+ Recruitment Phishing URLs Using Browser-in-the-Browser Credential Traps
Cybersecurity researchers at CTM360 have exposed a large-scale, global recruitment-themed phishing campaign that leverages Browser-in-the-Browser (BitB) windows to steal Google and Facebook…
PDF Viewer: Malicious Browser Extension
PDF Viewer is a malicious browser extension used by Jewelbug that runs on Chrome and Firefox. It requests dangerous permissions to access…
AmnesiaStealer: New Rust-Based macOS Malware Hijacks Chromium Sessions for Live Browser Control
Cybersecurity researchers have uncovered a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that hijacks Chromium web browsers to steal session data and…
Enterprise Defenses Recover at the Edge but Collapse Inside: Picus Blue Report 2026
The Picus Blue Report 2026, based on over 338 million attack simulations in production environments, reveals a split in enterprise defense effectiveness.…
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Two malicious LiteLLM releases on PyPI, versions 1.82.7 and 1.82.8, were live for about 40 minutes on March 24, 2026, carrying credential-stealing…