Credential-Theft

Tensorlake npm Package Hijacked by Shai-Hulud Worm

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News Oct 08, 2026

The tensorlake npm package (version 0.5.144) was compromised as part of a supply chain attack delivering the Shai-Hulud credential-stealing worm, which harvests tokens, SSH keys, AWS credentials, and configuration files from AI developer tools including Anthropic Claude, Cursor, and Windsurf. The self-propagating worm republishes compromised packages under victim maintainer identities and uses an Ethereum smart contract for C2 resolution, with a destructive 'hostage token' mechanism triggered if victims revoke stolen GitHub tokens. The attack specifically targets AI/ML developer toolchains, making it directly relevant to teams building on or integrating with Tensorlake-based infrastructure.

PhantomRaven: LLM-Generated Info Stealer Built for Bug Bounty

ATLAS OWASP HIGH ▲ 8.2 CrowdStrike Blog Sep 16, 2026

CrowdStrike has identified PhantomRaven, an information stealer developed using large language models and framed under the guise of bug bounty hunting, highlighting the growing abuse of AI code generation for malware development. The case demonstrates how LLMs can be leveraged to lower the technical barrier for building functional credential-stealing tools. This development signals a significant shift in the threat landscape where AI-assisted malware authorship is becoming operationally viable for a wider range of actors.

Infostealer Logs Expose AI Session Tokens That Bypass MFA

ATLAS OWASP HIGH ▲ 8.5 The Hacker News Sep 14, 2026

Cybercriminals are harvesting JWT session tokens and API keys from infostealer logs to replay authentication against major AI platforms including OpenAI, Anthropic, and Google, effectively bypassing MFA entirely. Analysis of a 7 GB stealer dump revealed 1,843 unexpired tokens targeting AI services on the day of release, with 17.7% of all JWTs containing plaintext PII usable for follow-on social engineering. This attack pattern is particularly dangerous for AI platforms because stolen tokens grant full account access without triggering standard credential-based security controls.

APT29 Abuses Claude to Auto-Rebuild Malware on Detection

ATLAS OWASP CRITICAL ▲ 9.2 The Hacker News Sep 12, 2026

Russian state-sponsored group GTG-20006, linked to APT29/Midnight Blizzard, weaponised Anthropic's Claude to build autonomous AI workflows that detect when their malware is flagged by security products and automatically rebuild and redeploy it to evade static detections. The operation targeted over 20 government, defence, and diplomatic organisations across Ukraine, Europe, the Middle East, and Asia, using phishing, ClickFix lures, and DNS hijacking to deliver cross-platform implants. This represents a qualitative escalation in adversarial AI use: LLMs are no longer just writing malware stubs but orchestrating full detection-evasion feedback loops at machine speed.

AI Agent Builds Self-Expanding Stolen LLM Inference Supply Chain

ATLAS OWASP HIGH ▲ 9.2 SANS Internet Storm Center Sep 12, 2026

A researcher operating an AI honeypot captured a semi-autonomous coding agent conducting a full-cycle offensive operation: locating poorly secured LLM resale gateways, harvesting API credentials via web vulnerabilities, validating stolen inference capacity, and aggregating it behind an attacker-controlled unified gateway. The operation is notable not for novel individual techniques but for its feedback loop architecture — stolen inference capacity is used to fund and expand further credential theft, creating a partially self-sustaining supply chain. The honeypot inadvertently received ~43 KB of the agent's control-plane data, including its AGENTS.md playbook, collected API keys, reconnaissance scripts, and the operator's unproxied egress IP.

Infostealer Malware Hijacks Claude Sessions via Cookie Theft

ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Aug 31, 2026

Anthropic has confirmed that infostealer malware families including Vidar, LummaC2, StealC, and RedLine are being used to steal authenticated Claude browser sessions, granting attackers API-level access without needing credentials or 2FA. The attack bypasses standard authentication controls entirely by harvesting session cookies from compromised endpoints, allowing threat actors to consume victims' Claude usage quotas and potentially access stored payment data. Anthropic is revoking sessions and issuing refunds, but the incident highlights a systemic risk for AI service accounts when endpoint security is weak.

AI Gateways Targeted: LiteLLM, RAGFlow, Kestra Compromised

ATLAS OWASP HIGH ▲ 8.5 Microsoft Security Blog Aug 27, 2026

Microsoft Security Research documented active intrusions targeting three distinct AI infrastructure components — a LiteLLM gateway, a RAGFlow retrieval platform, and a Kestra workflow orchestrator — revealing a pattern of attackers treating AI control planes as high-value targets for credential theft and compute abuse. Across all three cases, attackers converged on the same objectives: stealing model-provider API keys, establishing persistence, and monetising compromised compute resources. The findings signal that AI-specific middleware and orchestration layers require the same security rigour as traditional enterprise critical infrastructure.

RedC2 4.0 AI-Assisted Backdoor Hidden in npm Packages

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Aug 22, 2026

Fourteen trojanized npm packages posing as calendar and streak utilities have been discovered delivering RedShell, the Linux beacon component of RedC2 4.0 — a commercially sold, AI-assisted command-and-control framework. The packages are functional by design, lowering suspicion while silently launching a detached backdoor process on import with no install hook required. RedC2 4.0 supports credential theft, in-memory execution, tunneling, and multi-beacon operations, making successful deployment a significant post-exploitation risk for any Linux environment that consumes affected packages.

CVE-2026-64849: MLflow SSRF Exploited to Steal Cloud Credentials

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News Aug 19, 2026

A critical unauthenticated SSRF vulnerability in MLflow (CVE-2026-64849, CVSS 9.3) is being actively exploited within hours of CVE assignment, allowing attackers to proxy requests through exposed Tracking Servers to cloud metadata endpoints and exfiltrate credentials and secrets. Threat intelligence from watchTowr's honeypot telemetry confirms indiscriminate scanning of internet-facing MLflow instances targeting well-known internal IP ranges. Organisations running MLflow versions below 3.15.0 are at immediate risk and should treat this as a critical, time-sensitive patching priority.

LiteLLM PyPI Poisoning Exposes 2,500+ Orgs via CI Secrets

ATLAS OWASP CRITICAL ▲ 9.1 The Hacker News Aug 14, 2026

Two malicious LiteLLM releases (versions 1.82.7 and 1.82.8) were uploaded to PyPI on March 24 and remained live for approximately 40 minutes, carrying credential-stealing code that harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords. CloudSEK's analysis of roughly 434,000 captured files maps potential exposure to more than 2,500 organisations, including NVIDIA, Cisco, and Siemens, though the dataset reflects files taken rather than confirmed misuse. The FBI has separately warned that affiliated actors are likely to weaponise exfiltrated credentials long after the initial compromise, making immediate secret rotation critical regardless of confirmed exploitation.

CVE-2026-58073: Veeam and Terraform MCP Critical Flaws Patched

ATLAS OWASP CRITICAL ▲ 6.5 The Hacker News Aug 10, 2026

HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities, with the most critical being a CVSS 10.0 cross-tenant token reuse flaw in Terraform's MCP Server that allows one user's Terraform token to be hijacked for subsequent users' requests. The Veeam Service Provider Console carries a 9.5-rated unauthenticated credential theft bug affecting multi-tenant backup infrastructure. The Terraform MCP Server flaw is particularly notable from an AI security perspective as it directly affects the Model Context Protocol layer connecting AI assistants to infrastructure tooling.

Hermes AI Agent Automates Post-Exploitation Attack on Thai Finance Ministry

ATLAS OWASP HIGH ▲ 7.8 BleepingComputer Jul 26, 2026

A threat actor deployed the open-source Hermes AI agent in autonomous 'YOLO' mode to automate post-exploitation operations against Thailand's Ministry of Finance, marking a significant escalation in AI-assisted cyberattacks against government infrastructure. Exposed attack directories revealed 585 files including web shells, stolen credentials, and Hermes-generated logs targeting internal ministry systems such as Hadoop, Apache Ambari, and GlassFish. This incident illustrates the growing operational use of agentic AI frameworks by adversaries to reduce manual effort and accelerate attack timelines at scale.

Dolphin X RAT Uses AI Profiler to Rank and Score Victims

ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jul 24, 2026

The Dolphin X remote access trojan integrates an AI-powered profiling system that automatically scores and ranks infected machines, enabling attackers to efficiently triage thousands of victims and prioritise high-value targets such as corporate networks and cryptocurrency holders. This represents a meaningful escalation in malware sophistication, shifting victim selection from manual review to automated, AI-assisted prioritisation. Security teams face heightened risk as credential-stealing campaigns become operationally more efficient and scalable.

OpenClaw AI Assistant Flaws Enable WhatsApp-to-Host RCE

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News Jul 11, 2026

Three high-severity vulnerabilities in OpenClaw, a personal AI assistant, have been chained to enable remote code execution on the host system via a WhatsApp message, requiring no prior foothold. The flaws—covering OS command injection, incomplete input filtering, and path traversal—allow sandbox escape, credential theft, and privilege escalation. All three have been patched in OpenClaw version 2026.6.6, but unpatched deployments remain at significant risk.

Amazon Q Extension Credential Theft via MCP Injection

ATLAS OWASP HIGH ▲ 8.5 Dark Reading Jul 05, 2026

A vulnerability in the Amazon Q Visual Studio Code extension allows adversaries to plant malicious repositories that execute arbitrary code and exfiltrate cloud credentials. The flaw highlights escalating risks associated with Model Context Protocol (MCP) integrations embedded within AI-powered developer tools. This attack vector represents a growing threat surface as AI coding assistants gain privileged access to developer environments and cloud infrastructure.

Credential-Theft

Stay ahead of the threat.