🎯 Credential and data theft

The items that name it 3

• MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
  article2026-09-30

  Targeted browser cookies and credentials, cryptocurrency wallets, and Telegram session data

• M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
  writeup2026-07-14

  Payload targets browser saved passwords and cookies (Chrome, Brave, Firefox, Edge), SSH keys, npm and GitHub tokens, AWS credentials, macOS Keychain, and cryptocurrency wallets; supports remote commands for file operations (Dirlist, GetFile, PutFile) and directory listing.

• Something Phishy in the /tmp Folder
  writeup2026-03-18

  MacSync scraped Chrome cookies, Safari data, Apple Keychain credentials, 200+ crypto wallets, notes, and documents from the compromised machine.