Identity Abuse & Auth News | Hexnode Threat Watch

Identity Abuse

Doxing-arrest-in-Spain

Spain’s Doxing Arrest Highlights Identity Risk From Aggregated Government Employee Data

Aug 20

7 min read

Langflow-CVE-2026-5027

Langflow CVE-2026-5027 Exploited Against AI Development Platforms

Aug 20

5 min read

school-district-cyberattack

Ex-school district employee jailed for hacks on former employer

Aug 20

4 min read

SimpleHelp-vulnerability

SimpleHelp Flaw Lets Attackers Create Rogue Technician Accounts

Aug 20

4 min read

INC-ransomware

INC Ransomware Emerges as a Major RaaS Threat in 2026

Aug 20

4 min read

malicious-npm-packages

Malicious PostCSS-Themed npm Packages Deliver Windows RAT

Aug 20

4 min read

GitHub-actions-checkout-update

GitHub actions/checkout Blocks Common Pwn Request CI/CD Attack Patterns

Aug 20

3 min read

Bajaj-Auto-ransomware-incident

Bajaj Auto Ransomware: Operations Normal, Enterprise Risk Remains

Aug 19

3 min read

CVE-2026-46817

CVE-2026-46817 Actively Exploited: Oracle E-Business Suite Patch Priority

Aug 19

3 min read

ChocoPoC-malware

ChocoPoC Malware: Trojanized GitHub Exploits Target Security Researchers

Aug 19

4 min read

Medtronic-data-breach

Medtronic Data Breach: 3.8 Million Affected After ShinyHunters Attack

Aug 19

4 min read

Veil-malware

Veil Malware: How Attackers Use Blogspot to Deliver Fileless Payloads

Aug 19

5 min read

Injective-SDK-npm-compromise

Injective SDK npm Compromise: Supply-Chain Attack Steals Wallet Keys

Aug 19

3 min read

CrashStealer-macOS-malware

CrashStealer macOS Malware: Fake Apple CrashReporter Steals Credentials

Aug 19

4 min read

Fairlife-ransomware

Fairlife Ransomware Attack: Production Disruption and Recovery Lessons

Aug 19

4 min read

Estee-Lauder-breach

Estée Lauder Oracle E-Business Breach: Enterprise Patch and Identity Lessons

Aug 19

5 min read

South-Korea-data-breach

South Korea Diplomatic Breach: Lessons for Identity Security

Aug 19

5 min read

Origin-Energy-data-breach

Origin Energy Data Breach: Customer Identity Exposure and Enterprise Security Lessons

Aug 19

4 min read

Certighost

Certighost CVE-2026-54121 PoC Released: AD CS Domain Takeover Defense Guide

Aug 19

5 min read

Pass-ta-key

Pass-ta-key Attacks: Why Endpoint Security Still Matters in a Passkey World

Aug 19

3 min read

XCSSET-v40

XCSSET v40 Targets macOS Developers: Securing the Software Supply Chain

Aug 19

5 min read

Shai-Hulud-PyPI-attack

New Shai-Hulud attack trojanizes 19 science-focused PyPI packages

Aug 19

5 min read

City-Forum Targets Salesforce and ServiceNow Portal

City-Forum Targets Salesforce and ServiceNow Portals

Aug 17

10 min read

Healthcare Software Breach Exposes 3.8 Million Patient Records

Healthcare Software Breach Exposes 3.8 Million Patient Records

Aug 13

6 min read

Polish Energy Plant Breach How a Private APN Opened a Path Into OT

Polish Energy Plant Breach: How a Private APN Opened a Path Into OT

Aug 11

10 min read

bdthemes supply chain attack

BdThemes Supply Chain Attack Creates Rogue WordPress Admins

Aug 11

7 min read

CVE-2026-18577 How Attackers Used N-centrals Take Control to Plant a Cloudflare Tunnel Backdoor

CVE-2026-18577: How Attackers Used N-central’s Take Control to Plant a Cloudflare Tunnel Backdoor

Aug 10

11 min read

CVE-2026-8037 Progress LoadMaster Flaw Added to CISA KEV

CVE-2026-8037: Progress LoadMaster Flaw Added to CISA KEV

Aug 10

9 min read

metabase sql injection

Metabase SQL Injection Zero-Day: Patch Now, Rotate Credentials

Aug 10

6 min read

Ransom Cartel Sentencing Reveals the Business Model Behind Enterprise Extortion

Ransom Cartel Sentencing Reveals the Business Model Behind Enterprise Extortion

Aug 7

7 min read

TP-Link Omada Vulnerabilities Expose Risks in Zero-Touch Provisioning

TP-Link Omada Vulnerabilities Expose Risks in Zero-Touch Provisioning

Aug 7

8 min read

khunt Toolkit Runs Inside Oracle Database After SQL Injection

khunt Toolkit Runs Inside Oracle Database After SQL Injection

Aug 7

7 min read

snowflake data theft

Snowflake Data Theft Case: Guilty Plea Exposes MFA Gaps

Aug 6

5 min read

Inside AISIs AI Cyber Evaluation Incident

Inside AISI’s AI Cyber Evaluation Incident: How Claude Mythos 5 Targeted an Open-Source Project

Aug 5

8 min read

amgen data breach

Amgen Data Breach: What the Disclosure Confirms and Omits

Aug 5

6 min read

adobe campaign classic vulnerability

Adobe Campaign Classic Vulnerability: Inside CVE-2026-48449’s CVSS 10 Flaw

Aug 5

5 min read

teamcity rce

TeamCity RCE: What Enterprises Need to Know About CVE-2026-63077

Aug 4

5 min read

KT Rogue Femtocell Breach Mobile Network Security and Identity Lessons for Enterprises

KT Rogue Femtocell Breach: Mobile Network Security and Identity Lessons for Enterprises

Aug 3

5 min read

Adform Script Compromise Shows How Trusted Web Supply Chains Reach Endpoints

Adform Script Compromise Shows How Trusted Web Supply Chains Reach Endpoints

Aug 3

5 min read

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

Aug 3

6 min read

Arch Linux AUR Malware Campaign Halts Package Adoption and Pushes

Arch Linux AUR Malware Campaign Halts Package Adoption and Pushes

Aug 3

8 min read

CISA Water Sector PLC Warning

CISA Water Sector PLC Warning: What the Minnesota OT Attacks Reveal

Jul 31

7 min read

Cisco FMC CVE-2026-20316

Cisco FMC CVE-2026-20316: Static Credential Flaw Exploited as a Zero-Day

Jul 30

7 min read

cve 2026 42897

CVE-2026-42897: OWAReaper Mailbox Persistence

Jul 30

5 min read

Fake Claude App Delivers SectopRAT Through Bing Ads

Fake Claude App Delivers SectopRAT Through Bing Ads: What Enterprises Need to Know

Jul 28

9 min read

ontrac data breach

OnTrac Data Breach After Network Hack: Things to Learn

Jul 28

6 min read

hermes ai agent attack

Hermes AI Agent Attack: What Autonomous Post-Exploitation Means for Enterprise Security

Jul 28

5 min read

Kratos Phishing Platform Takedown Microsoft Account Security Lessons for Enterprises

Kratos Phishing Platform Takedown: Microsoft Account Security Lessons for Enterprises

Jul 27

6 min read

Upbound Cyber Incident How Stolen Customer Data Fueled $13M in Lease Fraud

Upbound Cyber Incident: How Stolen Customer Data Fueled $13M in Lease Fraud

Jul 27

5 min read

CVE-2026-50522 SharePoint RCE

CVE-2026-50522 SharePoint RCE: Why Patching Is Not Enough

Jul 27

6 min read

Dolphin X Malware AI-Powered Victim Ranking Raises Enterprise Endpoint Risk

Dolphin X Malware: AI-Powered Victim Ranking Raises Enterprise Endpoint Risk

Jul 27

5 min read

hugging face breach

Hugging Face Breach Shows Why AI Pipelines Need Strong Identity and Runtime Controls

Jul 23

5 min read

rubygems malware

SleeperGem RubyGems Attack Targets Developer Machines and Software Supply Chains

Jul 23

5 min read

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

Jul 21

6 min read

UTA0533 SonicWall SMA Malware Toolkit

Inside UTA0533 SonicWall SMA Malware Toolkit: ROOTRUN, KNUCKLEBALL and ORANGETAIL

Jul 21

8 min read

clicklock macos malware

ClickLock macOS Malware: How a Password-Coercion Attack Steals Credentials and Persists

Jul 21

6 min read

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Jul 20

5 min read

okobot malware

OkoBot Malware Uses ClickFix and Fake GitHub Repositories

Jul 17

6 min read

Spanish BEC Takedown Shows How Executive Impersonation Still Moves Millions

Spanish BEC Takedown Shows How Executive Impersonation Still Moves Millions

Jul 15

4 min read

openclaw ai agent

OpenClaw AI Agent Attacks Show Why Trust Boundaries Matter More Than Ever

Jul 15

6 min read

fake github repositories

Fake GitHub Repositories Push BoryptGrab Infostealer: What Enterprises Should Know

Jul 15

6 min read

Compromised-jscrambler-npm-Releases-Drop-Rust-Infostealer-During-Install-and-Runtime

Compromised jscrambler npm Releases Drop Rust Infostealer During Install and Runtime

Jul 14

5 min read

Mount Royal University Breach What Happened and What Organizations Can Learn

Mount Royal University Breach: What Happened and What Organizations Can Learn

Jul 14

7 min read

OpenMandriva Sabotage

OpenMandriva Sabotage: What Linux Fleet Owners Can Learn About Package Trust

Jul 13

6 min read

Fake-Payment-SDKs-Turn-Developer-Dependencies-Into-Credential-Theft

Fake Payment SDKs Turn Developer Dependencies Into Credential Theft

Jul 10

5 min read

Fake Brand Interviews Use Browser-in-the-Browser Phishing to Steal Google Credentials

Jul 9

5 min read

accenture data breach

Accenture Data Breach Confirmed: Claimed DevOps Secrets Raise Enterprise Security Concerns

Jul 8

6 min read

kairos Ransomware

Kairos Ransomware: Why Extortion Defense Must Go Beyond Encryption

Jul 7

6 min read

Scattered-Spider-Case-Keeps-Identity-Driven-Intrusions-in-the-Spotlight

Scattered Spider Case Keeps Identity-Driven Intrusions in the Spotlight

Jul 7

5 min read

Google FBI NetNut Takedown

Google FBI NetNut Takedown: What Enterprises Should Learn from the NetNut Residential Proxy Disruption

Jul 6

5 min read

fortinet credential theft

FortiBleed Credential Theft Linked to Lynx Ransomware Operations

Jul 3

7 min read

Citrix NetScaler Exploit CVE-2026-8451 Reportedly Targeted Within 24 Hours of Disclosure

Citrix NetScaler Exploit: CVE-2026-8451 Reportedly Targeted Within 24 Hours of Disclosure

Jul 3

6 min read

naic breach

NAIC Breach: Why Logs and Configuration Data Still Matter

Jul 2

8 min read

Kubota Data Breach

Kubota Data Breach: Month-Long Network Access May Have Exposed Employee and Dependent Data

Jul 2

5 min read

nissan data breach

Nissan Data Breach: PeopleSoft Zero-Day Puts HR Identity Data at Risk

Jul 1

6 min read

Fake-Shop-Receipts-Bring-Callback-Phishing-Into-Trusted-Order-Histories

Fake Shop Receipts Bring Callback Phishing Into Trusted Order Histories

Jul 1

5 min read

Exposed-Display-Controllers-Show-Why-Device-Fleets-Need-Patch-Discipline

Exposed Display Controllers Show Why Device Fleets Need Patch Discipline

Jul 1

4 min read

Operation Navy Ghost Malicious PyPI Packages Backdoor Telegram Bot Server

Operation Navy Ghost: Malicious PyPI Packages Backdoor Telegram Bot Servers

Jul 1

5 min read

ptc windchill vulnerability

PTC Windchill Vulnerability Added to CISA KEV After Web Shell Exploitation

Jun 30

7 min read

India .bank.in Leak Identity Risks for Financial Institutions

India .bank.in Leak Highlights Identity and Phishing Risks for Financial Institutions

Jun 30

6 min read

Poland SIM Swapping Bust Highlights the Growing Risk of Telecom Account Takeovers

Poland SIM Swapping Bust Highlights the Growing Risk of Telecom Account Takeovers

Jun 26

7 min read

Xsolis Data Breach Impacts Nearly 1.4 Million People After a Targeted Phishing Attack

Xsolis Data Breach Impacts Nearly 1.4 Million People After a Targeted Phishing Attack

Jun 25

5 min read

gravity smtp vulnerability

Gravity SMTP Vulnerability Exploitation Raises Email Credential Exposure Risks

Jun 22

6 min read

Klue OAuth Breach Exposes the Hidden Risk of SaaS Integration Trust

Klue OAuth Breach Exposes the Hidden Risk of SaaS Integration Trust

Jun 22

6 min read

Gentlemen Ransomware Uses BYOVD EDR Killers to Disable Endpoint Defense

Gentlemen Ransomware Uses BYOVD EDR Killers to Disable Endpoint Defenses

Jun 19

6 min read

mastra npm compromise

Mastra npm Supply-Chain Attack Compromises 144 AI Framework Packages

Jun 18

6 min read

arch linux aur compromise

Arch Linux AUR Compromise Linked to Atomic Arch Supply-Chain Attack

Jun 17

6 min read

Miasma Source Leak Raises Copycat Risk for Developer Supply-Chain Attacks

Miasma Source Leak Raises Copycat Risk for Developer Supply-Chain Attacks

Jun 17

5 min read

gemini phishing

Google Lawsuit Targets Alleged Gemini Phishing Operation Behind Outsider Smishing Kit

Jun 16

6 min read

Velvet Ant Hides in PAM and OpenSSH to Turn Linux Authentication Into a Backdoor

Velvet Ant Hides in PAM and OpenSSH to Turn Linux Authentication Into a Backdoor

Jun 16

6 min read

Maine Data Breach Portal Abuse Exposes Identity Verification Gaps

Maine Data Breach Portal Abuse Shows Why Security Reporting Systems Need Strong Identity Verification

Jun 15

6 min read

oracle peoplesoft breach

ShinyHunters Claims Oracle PeopleSoft Data Theft Across 100+ Organizations

Jun 11

7 min read

WinRAR Vulnerability CVE-2025-8088

WinRAR Vulnerability CVE-2025-8088 Exploited Against Ukrainian Organizations

Jun 11

6 min read

Microsoft Exchange Email Spoofing Ghost-Sender Exposes a Trust Gap in Hybrid Email Environments

Microsoft Exchange Email Spoofing: Ghost-Sender Exposes a Trust Gap in Hybrid Email Environments

Jun 10

6 min read

SolarWinds Serv-U KEV Listing Turns File Transfer Availability Into an Urgent Patch Priority

SolarWinds Serv-U KEV Listing Turns File Transfer Availability Into an Urgent Patch Priority

Jun 9

6 min read

dentaquest data breach

DentaQuest Data Breach Exposes 2.6 Million Accounts and Raises Healthcare Identity Risk

Jun 9

6 min read

magecart stripe abuse

Magecart Skimmer Abuses Stripe API and Google Tag Manager to Steal Checkout Data

Jun 9

6 min read

Polyfill Remnants Turn Trusted Brand Websites Into Credential Prompt Risk

Jun 8

5 min read

Miasma Malware Hits Red Hat npm Packages in Developer Credential Theft Campaign

Red Hat npm Packages Compromised by Miasma Credential-Stealing Malware

Jun 5

8 min read

Dashlane Brute Force Attack Highlights Password Vault Identity Risks

Dashlane Brute Force Attack Highlights Password Vault Identity Risks

Jun 2

5 min read