🎯 Credential theft

The items that name it 16

• David Gutierrez | Eng (@david_x_ai) on X
  threadas classification.key entities2026-10-26
• Prasenjit Sarkar (@stretchcloud) on X
  threadas classification.key entities2026-10-24
• Billy Lee (@billyozno) on X
  threadas techniques2026-10-21It is written here as Credential theft: SSH keys, cloud logins, browser passwords, AI tool configs and API keys.
• Broadcom Wi-Fi vulnerability leaves over 1.5 million Belgian gateways exposed
  articleas techniques2026-10-19It is written here as Credential theft: extraction of the Wi-Fi key in cleartext from NVRAM, then joining the network.
• Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
  articleas classification.key entities2026-10-13
• ♫Why♥Not♪ (@Python_s_) on X
  advisoryas techniques2026-10-09It is written here as Credential theft (GitHub, npm, AWS, Kubernetes, Vault).

  GitHub, npm, AWS, Kubernetes, Vault

• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeupas techniques2026-10-08

  Steals GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins, and AI tool configs (Claude, Cursor, Windsurf)

• Viral Maniar (@ManiarViral) on X
  threadas classification.key entities2026-10-07
• [tl;dr sec] #342 - Figma's Agentic Detection, Agent Identity, Uber's Agent-(E)DR
  articleas techniques2026-08-20

  A malicious local MCP server posing as a code quality scanner stole credentials; detected via YARA in the homelab demo.

• The AI agent sandbox escape that breached Hugging Face: what happened, and what to fix
  writeupas classification.key entities2026-07-27
• Security incident disclosure — July 2026
  articleas classification.key entities2026-07-16
• How Aikido Intel detects malware and vulnerabilities first
  articleas techniques2026-07-13

  Malware behavior targeting stored credentials, e.g. reading browser profile directories where saved passwords live, SSH keys, or cloud credentials.

• Orca Security: ITDR for the Cloud
  articleas techniques2026-07-03
• How the RaaS Business Model Actually Works
  articleas techniques2026-07-01

  Observed as part of post-exploitation activity in the SonicWall-to-Akira incident

• Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
  writeupas techniques2026-06-09

  Targets AWS keys, npm tokens, GitHub secrets, Kubernetes service accounts, HashiCorp Vault tokens, and SSH keys.

• 6 Months of Researching OAuth Application Attacks | Huntress
  writeupas techniques2025-02-10

  Initial access technique targeted by Huntress Unwanted Access capability