Identity Abuse & Auth News | Hexnode Threat Watch

Identity Abuse

infostealer logs

AI Token Theft and MFA Bypass: Lessons From Infostealer Logs

Sep 11

6 min read

litellm exposed admin key

LiteLLM Exposed Admin Key: What Wiz Research Found

Sep 11

9 min read

AdaptHealth data breach

AdaptHealth Data Breach: Contractor Account Compromise, Cloud Apps, and Healthcare IAM Lessons

Sep 10

7 min read

autonomous ai cyberattack

Autonomous AI Cyberattack: Credential Theft in Under Six Hours

Sep 9

6 min read

ted backdoor

Ted Backdoor Hijacks HAProxy to Intercept Web Traffic

Sep 7

7 min read

French Hospital Fine Shows How One Compromised Account Can Expose an Entire Patient System

French Hospital Fine Shows How One Compromised Account Can Expose an Entire Patient System

Sep 4

6 min read

mckesson breach

McKesson Breach: How a Vishing Call Turned Into an Okta and Salesforce Incident

Sep 1

6 min read

Keycloak CVE-2026-18963 Critical Account Takeover Patch and IAM Defense Guide

Keycloak CVE-2026-18963: Critical Account Takeover Patch and IAM Defense Guide

Sep 1

5 min read

Doxing-arrest-in-Spain

Spain’s Doxing Arrest Highlights Identity Risk From Aggregated Government Employee Data

Aug 20

7 min read

Langflow-CVE-2026-5027

Langflow CVE-2026-5027 Exploited Against AI Development Platforms

Aug 20

5 min read

school-district-cyberattack

Ex-school district employee jailed for hacks on former employer

Aug 20

4 min read

SimpleHelp-vulnerability

SimpleHelp Flaw Lets Attackers Create Rogue Technician Accounts

Aug 20

4 min read

INC-ransomware

INC Ransomware Emerges as a Major RaaS Threat in 2026

Aug 20

4 min read

malicious-npm-packages

Malicious PostCSS-Themed npm Packages Deliver Windows RAT

Aug 20

4 min read

GitHub-actions-checkout-update

GitHub actions/checkout Blocks Common Pwn Request CI/CD Attack Patterns

Aug 20

3 min read

Bajaj-Auto-ransomware-incident

Bajaj Auto Ransomware: Operations Normal, Enterprise Risk Remains

Aug 19

3 min read

CVE-2026-46817

CVE-2026-46817 Actively Exploited: Oracle E-Business Suite Patch Priority

Aug 19

3 min read

ChocoPoC-malware

ChocoPoC Malware: Trojanized GitHub Exploits Target Security Researchers

Aug 19

4 min read

Medtronic-data-breach

Medtronic Data Breach: 3.8 Million Affected After ShinyHunters Attack

Aug 19

4 min read

Veil-malware

Veil Malware: How Attackers Use Blogspot to Deliver Fileless Payloads

Aug 19

5 min read

Injective-SDK-npm-compromise

Injective SDK npm Compromise: Supply-Chain Attack Steals Wallet Keys

Aug 19

3 min read

CrashStealer-macOS-malware

CrashStealer macOS Malware: Fake Apple CrashReporter Steals Credentials

Aug 19

4 min read

Fairlife-ransomware

Fairlife Ransomware Attack: Production Disruption and Recovery Lessons

Aug 19

4 min read

Estee-Lauder-breach

Estée Lauder Oracle E-Business Breach: Enterprise Patch and Identity Lessons

Aug 19

5 min read

South-Korea-data-breach

South Korea Diplomatic Breach: Lessons for Identity Security

Aug 19

5 min read

Origin-Energy-data-breach

Origin Energy Data Breach: Customer Identity Exposure and Enterprise Security Lessons

Aug 19

4 min read

Certighost

Certighost CVE-2026-54121 PoC Released: AD CS Domain Takeover Defense Guide

Aug 19

5 min read

Pass-ta-key

Pass-ta-key Attacks: Why Endpoint Security Still Matters in a Passkey World

Aug 19

3 min read

XCSSET-v40

XCSSET v40 Targets macOS Developers: Securing the Software Supply Chain

Aug 19

5 min read

Shai-Hulud-PyPI-attack

New Shai-Hulud attack trojanizes 19 science-focused PyPI packages

Aug 19

5 min read

City-Forum Targets Salesforce and ServiceNow Portal

City-Forum Targets Salesforce and ServiceNow Portals

Aug 17

10 min read

Healthcare Software Breach Exposes 3.8 Million Patient Records

Healthcare Software Breach Exposes 3.8 Million Patient Records

Aug 13

6 min read

Polish Energy Plant Breach How a Private APN Opened a Path Into OT

Polish Energy Plant Breach: How a Private APN Opened a Path Into OT

Aug 11

10 min read

bdthemes supply chain attack

BdThemes Supply Chain Attack Creates Rogue WordPress Admins

Aug 11

7 min read

CVE-2026-18577 How Attackers Used N-centrals Take Control to Plant a Cloudflare Tunnel Backdoor

CVE-2026-18577: How Attackers Used N-central’s Take Control to Plant a Cloudflare Tunnel Backdoor

Aug 10

11 min read

CVE-2026-8037 Progress LoadMaster Flaw Added to CISA KEV

CVE-2026-8037: Progress LoadMaster Flaw Added to CISA KEV

Aug 10

9 min read

metabase sql injection

Metabase SQL Injection Zero-Day: Patch Now, Rotate Credentials

Aug 10

6 min read

Ransom Cartel Sentencing Reveals the Business Model Behind Enterprise Extortion

Ransom Cartel Sentencing Reveals the Business Model Behind Enterprise Extortion

Aug 7

7 min read

TP-Link Omada Vulnerabilities Expose Risks in Zero-Touch Provisioning

TP-Link Omada Vulnerabilities Expose Risks in Zero-Touch Provisioning

Aug 7

8 min read

khunt Toolkit Runs Inside Oracle Database After SQL Injection

khunt Toolkit Runs Inside Oracle Database After SQL Injection

Aug 7

7 min read

snowflake data theft

Snowflake Data Theft Case: Guilty Plea Exposes MFA Gaps

Aug 6

5 min read

Inside AISIs AI Cyber Evaluation Incident

Inside AISI’s AI Cyber Evaluation Incident: How Claude Mythos 5 Targeted an Open-Source Project

Aug 5

8 min read

amgen data breach

Amgen Data Breach: What the Disclosure Confirms and Omits

Aug 5

6 min read

adobe campaign classic vulnerability

Adobe Campaign Classic Vulnerability: Inside CVE-2026-48449’s CVSS 10 Flaw

Aug 5

5 min read

teamcity rce

TeamCity RCE: What Enterprises Need to Know About CVE-2026-63077

Aug 4

5 min read

KT Rogue Femtocell Breach Mobile Network Security and Identity Lessons for Enterprises

KT Rogue Femtocell Breach: Mobile Network Security and Identity Lessons for Enterprises

Aug 3

5 min read

Adform Script Compromise Shows How Trusted Web Supply Chains Reach Endpoints

Adform Script Compromise Shows How Trusted Web Supply Chains Reach Endpoints

Aug 3

5 min read

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

Aug 3

6 min read

Arch Linux AUR Malware Campaign Halts Package Adoption and Pushes

Arch Linux AUR Malware Campaign Halts Package Adoption and Pushes

Aug 3

8 min read

CISA Water Sector PLC Warning

CISA Water Sector PLC Warning: What the Minnesota OT Attacks Reveal

Jul 31

7 min read

Cisco FMC CVE-2026-20316

Cisco FMC CVE-2026-20316: Static Credential Flaw Exploited as a Zero-Day

Jul 30

7 min read

cve 2026 42897

CVE-2026-42897: OWAReaper Mailbox Persistence

Jul 30

5 min read

Fake Claude App Delivers SectopRAT Through Bing Ads

Fake Claude App Delivers SectopRAT Through Bing Ads: What Enterprises Need to Know

Jul 28

9 min read

ontrac data breach

OnTrac Data Breach After Network Hack: Things to Learn

Jul 28

6 min read

hermes ai agent attack

Hermes AI Agent Attack: What Autonomous Post-Exploitation Means for Enterprise Security

Jul 28

5 min read

Kratos Phishing Platform Takedown Microsoft Account Security Lessons for Enterprises

Kratos Phishing Platform Takedown: Microsoft Account Security Lessons for Enterprises

Jul 27

6 min read

Upbound Cyber Incident How Stolen Customer Data Fueled $13M in Lease Fraud

Upbound Cyber Incident: How Stolen Customer Data Fueled $13M in Lease Fraud

Jul 27

5 min read

CVE-2026-50522 SharePoint RCE

CVE-2026-50522 SharePoint RCE: Why Patching Is Not Enough

Jul 27

6 min read

Dolphin X Malware AI-Powered Victim Ranking Raises Enterprise Endpoint Risk

Dolphin X Malware: AI-Powered Victim Ranking Raises Enterprise Endpoint Risk

Jul 27

5 min read

hugging face breach

Hugging Face Breach Shows Why AI Pipelines Need Strong Identity and Runtime Controls

Jul 23

5 min read

rubygems malware

SleeperGem RubyGems Attack Targets Developer Machines and Software Supply Chains

Jul 23

5 min read

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

Jul 21

6 min read

UTA0533 SonicWall SMA Malware Toolkit

Inside UTA0533 SonicWall SMA Malware Toolkit: ROOTRUN, KNUCKLEBALL and ORANGETAIL

Jul 21

8 min read

clicklock macos malware

ClickLock macOS Malware: How a Password-Coercion Attack Steals Credentials and Persists

Jul 21

6 min read

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Jul 20

5 min read

okobot malware

OkoBot Malware Uses ClickFix and Fake GitHub Repositories

Jul 17

6 min read

Spanish BEC Takedown Shows How Executive Impersonation Still Moves Millions

Spanish BEC Takedown Shows How Executive Impersonation Still Moves Millions

Jul 15

4 min read

openclaw ai agent

OpenClaw AI Agent Attacks Show Why Trust Boundaries Matter More Than Ever

Jul 15

6 min read

fake github repositories

Fake GitHub Repositories Push BoryptGrab Infostealer: What Enterprises Should Know

Jul 15

6 min read

Compromised-jscrambler-npm-Releases-Drop-Rust-Infostealer-During-Install-and-Runtime

Compromised jscrambler npm Releases Drop Rust Infostealer During Install and Runtime

Jul 14

5 min read

Mount Royal University Breach What Happened and What Organizations Can Learn

Mount Royal University Breach: What Happened and What Organizations Can Learn

Jul 14

7 min read

OpenMandriva Sabotage

OpenMandriva Sabotage: What Linux Fleet Owners Can Learn About Package Trust

Jul 13

6 min read

Fake-Payment-SDKs-Turn-Developer-Dependencies-Into-Credential-Theft

Fake Payment SDKs Turn Developer Dependencies Into Credential Theft

Jul 10

5 min read

Fake Brand Interviews Use Browser-in-the-Browser Phishing to Steal Google Credentials

Jul 9

5 min read

accenture data breach

Accenture Data Breach Confirmed: Claimed DevOps Secrets Raise Enterprise Security Concerns

Jul 8

6 min read

kairos Ransomware

Kairos Ransomware: Why Extortion Defense Must Go Beyond Encryption

Jul 7

6 min read

Scattered-Spider-Case-Keeps-Identity-Driven-Intrusions-in-the-Spotlight

Scattered Spider Case Keeps Identity-Driven Intrusions in the Spotlight

Jul 7

5 min read

Google FBI NetNut Takedown

Google FBI NetNut Takedown: What Enterprises Should Learn from the NetNut Residential Proxy Disruption

Jul 6

5 min read

fortinet credential theft

FortiBleed Credential Theft Linked to Lynx Ransomware Operations

Jul 3

7 min read

Citrix NetScaler Exploit CVE-2026-8451 Reportedly Targeted Within 24 Hours of Disclosure

Citrix NetScaler Exploit: CVE-2026-8451 Reportedly Targeted Within 24 Hours of Disclosure

Jul 3

6 min read

naic breach

NAIC Breach: Why Logs and Configuration Data Still Matter

Jul 2

8 min read

Kubota Data Breach

Kubota Data Breach: Month-Long Network Access May Have Exposed Employee and Dependent Data

Jul 2

5 min read

nissan data breach

Nissan Data Breach: PeopleSoft Zero-Day Puts HR Identity Data at Risk

Jul 1

6 min read

Fake-Shop-Receipts-Bring-Callback-Phishing-Into-Trusted-Order-Histories

Fake Shop Receipts Bring Callback Phishing Into Trusted Order Histories

Jul 1

5 min read

Exposed-Display-Controllers-Show-Why-Device-Fleets-Need-Patch-Discipline

Exposed Display Controllers Show Why Device Fleets Need Patch Discipline

Jul 1

4 min read

Operation Navy Ghost Malicious PyPI Packages Backdoor Telegram Bot Server

Operation Navy Ghost: Malicious PyPI Packages Backdoor Telegram Bot Servers

Jul 1

5 min read

ptc windchill vulnerability

PTC Windchill Vulnerability Added to CISA KEV After Web Shell Exploitation

Jun 30

7 min read

India .bank.in Leak Identity Risks for Financial Institutions

India .bank.in Leak Highlights Identity and Phishing Risks for Financial Institutions

Jun 30

6 min read

Poland SIM Swapping Bust Highlights the Growing Risk of Telecom Account Takeovers

Poland SIM Swapping Bust Highlights the Growing Risk of Telecom Account Takeovers

Jun 26

7 min read

Xsolis Data Breach Impacts Nearly 1.4 Million People After a Targeted Phishing Attack

Xsolis Data Breach Impacts Nearly 1.4 Million People After a Targeted Phishing Attack

Jun 25

5 min read

gravity smtp vulnerability

Gravity SMTP Vulnerability Exploitation Raises Email Credential Exposure Risks

Jun 22

6 min read

Klue OAuth Breach Exposes the Hidden Risk of SaaS Integration Trust

Klue OAuth Breach Exposes the Hidden Risk of SaaS Integration Trust

Jun 22

6 min read

Gentlemen Ransomware Uses BYOVD EDR Killers to Disable Endpoint Defense

Gentlemen Ransomware Uses BYOVD EDR Killers to Disable Endpoint Defenses

Jun 19

6 min read

mastra npm compromise

Mastra npm Supply-Chain Attack Compromises 144 AI Framework Packages

Jun 18

6 min read

arch linux aur compromise

Arch Linux AUR Compromise Linked to Atomic Arch Supply-Chain Attack

Jun 17

6 min read

Miasma Source Leak Raises Copycat Risk for Developer Supply-Chain Attacks

Miasma Source Leak Raises Copycat Risk for Developer Supply-Chain Attacks

Jun 17

5 min read

gemini phishing

Google Lawsuit Targets Alleged Gemini Phishing Operation Behind Outsider Smishing Kit

Jun 16

6 min read

Velvet Ant Hides in PAM and OpenSSH to Turn Linux Authentication Into a Backdoor

Velvet Ant Hides in PAM and OpenSSH to Turn Linux Authentication Into a Backdoor

Jun 16

6 min read

Maine Data Breach Portal Abuse Exposes Identity Verification Gaps

Maine Data Breach Portal Abuse Shows Why Security Reporting Systems Need Strong Identity Verification

Jun 15

6 min read

oracle peoplesoft breach

ShinyHunters Claims Oracle PeopleSoft Data Theft Across 100+ Organizations

Jun 11

7 min read

WinRAR Vulnerability CVE-2025-8088

WinRAR Vulnerability CVE-2025-8088 Exploited Against Ukrainian Organizations

Jun 11

6 min read

Microsoft Exchange Email Spoofing Ghost-Sender Exposes a Trust Gap in Hybrid Email Environments

Microsoft Exchange Email Spoofing: Ghost-Sender Exposes a Trust Gap in Hybrid Email Environments

Jun 10

6 min read

SolarWinds Serv-U KEV Listing Turns File Transfer Availability Into an Urgent Patch Priority

SolarWinds Serv-U KEV Listing Turns File Transfer Availability Into an Urgent Patch Priority

Jun 9

6 min read

dentaquest data breach

DentaQuest Data Breach Exposes 2.6 Million Accounts and Raises Healthcare Identity Risk

Jun 9

6 min read

magecart stripe abuse

Magecart Skimmer Abuses Stripe API and Google Tag Manager to Steal Checkout Data

Jun 9

6 min read

Polyfill Remnants Turn Trusted Brand Websites Into Credential Prompt Risk

Jun 8

5 min read

Miasma Malware Hits Red Hat npm Packages in Developer Credential Theft Campaign

Red Hat npm Packages Compromised by Miasma Credential-Stealing Malware

Jun 5

8 min read

Dashlane Brute Force Attack Highlights Password Vault Identity Risks

Dashlane Brute Force Attack Highlights Password Vault Identity Risks

Jun 2

5 min read