Credential-Theft

Infostealer Malware Hijacks Claude Sessions via Cookie Theft

ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Aug 31, 2026

Anthropic has confirmed that infostealer malware families including Vidar, LummaC2, StealC, and RedLine are being used to steal authenticated Claude browser sessions, granting attackers API-level access without needing credentials or 2FA. The attack bypasses standard authentication controls entirely by harvesting session cookies from compromised endpoints, allowing threat actors to consume victims' Claude usage quotas and potentially access stored payment data. Anthropic is revoking sessions and issuing refunds, but the incident highlights a systemic risk for AI service accounts when endpoint security is weak.

AI Gateways Targeted: LiteLLM, RAGFlow, Kestra Compromised

ATLAS OWASP HIGH ▲ 8.5 Microsoft Security Blog Aug 27, 2026

Microsoft Security Research documented active intrusions targeting three distinct AI infrastructure components — a LiteLLM gateway, a RAGFlow retrieval platform, and a Kestra workflow orchestrator — revealing a pattern of attackers treating AI control planes as high-value targets for credential theft and compute abuse. Across all three cases, attackers converged on the same objectives: stealing model-provider API keys, establishing persistence, and monetising compromised compute resources. The findings signal that AI-specific middleware and orchestration layers require the same security rigour as traditional enterprise critical infrastructure.

RedC2 4.0 AI-Assisted Backdoor Hidden in npm Packages

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Aug 22, 2026

Fourteen trojanized npm packages posing as calendar and streak utilities have been discovered delivering RedShell, the Linux beacon component of RedC2 4.0 — a commercially sold, AI-assisted command-and-control framework. The packages are functional by design, lowering suspicion while silently launching a detached backdoor process on import with no install hook required. RedC2 4.0 supports credential theft, in-memory execution, tunneling, and multi-beacon operations, making successful deployment a significant post-exploitation risk for any Linux environment that consumes affected packages.

CVE-2026-64849: MLflow SSRF Exploited to Steal Cloud Credentials

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News Aug 19, 2026

A critical unauthenticated SSRF vulnerability in MLflow (CVE-2026-64849, CVSS 9.3) is being actively exploited within hours of CVE assignment, allowing attackers to proxy requests through exposed Tracking Servers to cloud metadata endpoints and exfiltrate credentials and secrets. Threat intelligence from watchTowr's honeypot telemetry confirms indiscriminate scanning of internet-facing MLflow instances targeting well-known internal IP ranges. Organisations running MLflow versions below 3.15.0 are at immediate risk and should treat this as a critical, time-sensitive patching priority.

LiteLLM PyPI Poisoning Exposes 2,500+ Orgs via CI Secrets

ATLAS OWASP CRITICAL ▲ 9.1 The Hacker News Aug 14, 2026

Two malicious LiteLLM releases (versions 1.82.7 and 1.82.8) were uploaded to PyPI on March 24 and remained live for approximately 40 minutes, carrying credential-stealing code that harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords. CloudSEK's analysis of roughly 434,000 captured files maps potential exposure to more than 2,500 organisations, including NVIDIA, Cisco, and Siemens, though the dataset reflects files taken rather than confirmed misuse. The FBI has separately warned that affiliated actors are likely to weaponise exfiltrated credentials long after the initial compromise, making immediate secret rotation critical regardless of confirmed exploitation.

CVE-2026-58073: Veeam and Terraform MCP Critical Flaws Patched

ATLAS OWASP CRITICAL ▲ 6.5 The Hacker News Aug 10, 2026

HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities, with the most critical being a CVSS 10.0 cross-tenant token reuse flaw in Terraform's MCP Server that allows one user's Terraform token to be hijacked for subsequent users' requests. The Veeam Service Provider Console carries a 9.5-rated unauthenticated credential theft bug affecting multi-tenant backup infrastructure. The Terraform MCP Server flaw is particularly notable from an AI security perspective as it directly affects the Model Context Protocol layer connecting AI assistants to infrastructure tooling.

Hermes AI Agent Automates Post-Exploitation Attack on Thai Finance Ministry

ATLAS OWASP HIGH ▲ 7.8 BleepingComputer Jul 26, 2026

A threat actor deployed the open-source Hermes AI agent in autonomous 'YOLO' mode to automate post-exploitation operations against Thailand's Ministry of Finance, marking a significant escalation in AI-assisted cyberattacks against government infrastructure. Exposed attack directories revealed 585 files including web shells, stolen credentials, and Hermes-generated logs targeting internal ministry systems such as Hadoop, Apache Ambari, and GlassFish. This incident illustrates the growing operational use of agentic AI frameworks by adversaries to reduce manual effort and accelerate attack timelines at scale.

Dolphin X RAT Uses AI Profiler to Rank and Score Victims

ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jul 24, 2026

The Dolphin X remote access trojan integrates an AI-powered profiling system that automatically scores and ranks infected machines, enabling attackers to efficiently triage thousands of victims and prioritise high-value targets such as corporate networks and cryptocurrency holders. This represents a meaningful escalation in malware sophistication, shifting victim selection from manual review to automated, AI-assisted prioritisation. Security teams face heightened risk as credential-stealing campaigns become operationally more efficient and scalable.

OpenClaw AI Assistant Flaws Enable WhatsApp-to-Host RCE

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News Jul 11, 2026

Three high-severity vulnerabilities in OpenClaw, a personal AI assistant, have been chained to enable remote code execution on the host system via a WhatsApp message, requiring no prior foothold. The flaws—covering OS command injection, incomplete input filtering, and path traversal—allow sandbox escape, credential theft, and privilege escalation. All three have been patched in OpenClaw version 2026.6.6, but unpatched deployments remain at significant risk.

Amazon Q Extension Credential Theft via MCP Injection

ATLAS OWASP HIGH ▲ 8.5 Dark Reading Jul 05, 2026

A vulnerability in the Amazon Q Visual Studio Code extension allows adversaries to plant malicious repositories that execute arbitrary code and exfiltrate cloud credentials. The flaw highlights escalating risks associated with Model Context Protocol (MCP) integrations embedded within AI-powered developer tools. This attack vector represents a growing threat surface as AI coding assistants gain privileged access to developer environments and cloud infrastructure.

BioShocking Attack Exploits Indirect Prompt Injection to Steal Credentials via AI Browsers

ATLAS OWASP HIGH ▲ 9.0 The Hacker News Jun 30, 2026

Security firm LayerX demonstrated a novel indirect prompt injection attack dubbed 'BioShocking' that manipulates AI browser agents into exfiltrating user credentials by embedding adversarial instructions inside web-based puzzle content. Six AI browsers and assistants were successfully compromised, including ChatGPT Atlas, Perplexity Comet, and Anthropic's Claude extension, with agents retrieving SSH credentials from GitHub repositories without triggering safety refusals. Vendor responses were inconsistent, with only OpenAI issuing a confirmed fix, highlighting the systemic risk of agentic AI systems that conflate user intent with malicious page content.

node-ipc Supply Chain Backdoor Steals Cloud and AI Credentials

ATLAS OWASP CRITICAL ▲ 7.2 The Hacker News May 15, 2026

Three versions of the widely-used node-ipc npm package were found to contain obfuscated stealer/backdoor payloads published by an unauthorised maintainer account. The malware harvests 90 categories of developer secrets — including Claude AI and Kiro IDE configurations, AWS, Azure, and GCP credentials — and exfiltrates them via HTTPS and DNS tunnelling to an attacker-controlled domain. The compromise is notable for bypassing npm lifecycle hooks entirely and, in one version, targeting a specific developer via pre-computed SHA-256 fingerprinting.

TanStack Supply Chain Attack Exposes OpenAI Keys

ATLAS OWASP HIGH ▲ 8.5 The Hacker News May 15, 2026

A supply chain attack targeting TanStack via the Mini Shai-Hulud malware compromised two OpenAI employee devices, exposing internal source code repositories and code-signing certificates for macOS, iOS, and Windows apps. While no user data or production systems were breached, OpenAI was forced to revoke and reissue signing certificates, requiring macOS users to update ChatGPT Desktop, Codex, and Atlas apps before June 12, 2026. The incident marks OpenAI's second certificate rotation in two months and is part of a broader campaign by threat actor TeamPCP targeting major AI and open-source ecosystems.

Typosquatted OpenAI Repo Delivers Rust Infostealer to 244K Users

ATLAS OWASP CRITICAL ▲ 8.5 The Hacker News May 11, 2026

A malicious Hugging Face repository impersonated OpenAI's legitimate Privacy Filter model, cloning its description verbatim to gain credibility and reach the platform's trending list with 244,000 downloads. The repository delivered a multi-stage attack chain culminating in a Rust-based information stealer targeting browser credentials, cryptocurrency wallets, and Discord data on Windows machines. The attack leveraged a dead-drop resolver pattern via a public JSON paste service, allowing operators to swap payloads without modifying the repository itself.

Hugging Face Supply Chain: Fake OpenAI Infostealer Hits 244K

ATLAS OWASP HIGH ▲ 8.2 BleepingComputer May 10, 2026

A malicious Hugging Face repository impersonating OpenAI's 'Privacy Filter' project reached #1 on the platform's trending list and accumulated 244,000 downloads before removal, delivering a multi-stage infostealer to Windows users. The attack chain used a disguised Python loader to execute PowerShell commands, ultimately deploying a Rust-based payload capable of harvesting browser credentials, crypto wallets, SSH/VPN configs, and screenshots. The campaign highlights the growing risk of AI/ML supply chain attacks through trusted model-sharing platforms.

Credential-Theft

Stay ahead of the threat.