Steal Credentials Archives

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

16Sep

By RBNo Comments

News

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

A previously unknown Brazilian banking malware operation that distributes a toolkit known as KREMLIN has been revealed by cybersecurity researchers. The activity is being monitored by Elastic Security Labs under the code REF9334. The threat actor has been active since at least May 2025 and has installed a malicious browser extension on Google Chrome and Microsoft Edge using lures that pose as twelve Brazilian banks. Security experts Cyril François and Andrew Pease stated in a technical paper shared with The Hacker News that the KREMLIN malware ecosystem uses malicious browser extensions, custom C++ installers, and multi-stage JavaScript loaders to steal credentials, session tokens, and sensitive data. Malicious browser extensions circumvent Chromium's integrity safeguards by alte...

MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack

7May

By RBNo Comments

News

MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack

In what has been called a "false flag" operation, a ransomware attack has been linked to the Iranian state-sponsored hacker outfit MuddyWater (also known as Mango Sandstorm, Seedworm, and Static Kitten). It has been discovered that the attack, which Rapid7 discovered in early 2026, uses Microsoft Teams and social engineering techniques to start the infection sequence. Evidence suggests that the outbreak is a targeted state-backed operation that poses as opportunistic extortion, despite the first appearance of the incident being compatible with a ransomware-as-a-service (RaaS) group operating under the Chaos brand. According to Rapid7's research provided with The Hacker News, the campaign was marked by a high-touch social engineering phase carried out via Microsoft Teams, where the a...

PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials

1May

By RBNo Comments

News

PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials

Threat actors have successfully compromised the well-known Python program Lightning in yet another software supply chain attack, pushing two malicious versions to steal credentials. The two harmful versions are 2.6.2 and 2.6.3, both of which were released on April 30, 2026, according to Aikido Security, OX Security, Socket, and StepSecurity. The Mini Shai-Hulud supply chain incident, which targeted SAP-related npm packages on Wednesday, is thought to be an extension of the campaign. As of this writing, the Python Package Index (PyPI) repository managers have placed the project in quarantine. An open-source Python framework called PyTorch Lightning offers a high-level PyTorch interface. On GitHub, the open-source project has received over 31,100 ratings. According to Socket, the m...

Researchers Expose New Polymorphic Attack That Clones Browser Extensions to Steal Credentials

11Mar

By RBNo Comments

News

Researchers Expose New Polymorphic Attack That Clones Browser Extensions to Steal Credentials

Researchers in cybersecurity have shown a new method that enables a malicious web browser extension to mimic any installed add-on. According to a report released last week by SquareX, "the polymorphic extensions make an exact duplicate of the target's icon, HTML popup, workflows, and even temporarily disables the legitimate extension, making it very convincing for victims to believe that they are providing credentials to the real extension." Threat actors might then misuse the credentials they have stolen to take over internet accounts and obtain private financial and personal data without authorization. All Chromium-based web browsers, such as Google Chrome, Microsoft Edge, Brave, Opera, and others, are vulnerable to the assault. The strategy relies on people often pinning exten...

New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials

28Aug

By RBNo Comments

News

New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials

Researchers in cybersecurity are alerting the public to a new campaign of QR code phishing, often known as quishing, which uses Microsoft Sway infrastructure to host phony websites. This underscores the misuse of trustworthy cloud services for malevolent intent. According to Jan Michael Alcantara, a researcher at Netskope Threat Labs, an attacker can help victims accept the content by employing genuine cloud applications, which give them legitimacy. A victim can also be convinced of the legitimacy of a Sway page by using their Microsoft 365 account, into which they are already logged in. Additionally, Sway can be shared via an iframe installed read more about New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials. Get up to date on the latest cybersecurity new...