credentials news
7 stories
Hundreds of leaked AWS keys give full control over corporate accounts
Over 9,300 Amazon Web Services (AWS) access keys, publicly exposed between August 2022 and August 2026, remain active and valid, according to research from Truffle Security. The firm has been tracking these exposures for four years, identifying 817 keys linked to companies, with 526 of these being AWS root keys.
Malware injected into popular Rust packages to steal developer credentials
The Rust Security Response Team has disclosed a supply chain attack that injected malware into several popular Rust packages, turning routine software builds into a mechanism for delivering infostealer malware to developers' machines. The incident was initially reported to the Rust team by Nextron Systems' research team.
NadMesh Botnet Targets Exposed AI Services for Cloud Credentials
A new botnet, named NadMesh, has been observed actively targeting exposed artificial intelligence (AI) services to steal cloud credentials. Written in Go, NadMesh is specifically designed to operate within cloud environments, focusing its efforts on acquiring AWS keys and Kubernetes tokens from vulnerable AI platforms.
FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices
The cybersecurity landscape is grappling with the fallout from "FortiBleed," a widespread credential abuse campaign targeting internet-exposed FortiGate devices. Public reports emerged in June 2026 detailing extensive datasets containing Fortinet-related URLs, device records, usernames, and credentials. This activity is not attributed to a single new vulnerability but rather the reuse of…
Telco giant KDDI says data breach affects over 12 million people
Japanese telecommunications company KDDI has reported a significant data breach impacting an email platform used by five internet service providers (ISPs) in the country, potentially exposing the personal information of over 12 million individuals. The breach, discovered on June 17, led to unauthorized access to email addresses and passwords of current and former customers, as well as those…
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts
A sophisticated phishing campaign is actively targeting marketing professionals with deceptive job offers, aiming to compromise their Google account credentials. The attackers are impersonating well-known brands to lend credibility to their fraudulent recruitment efforts.
FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems
A campaign dubbed "FortiBleed" has exposed administrative and VPN credentials for an estimated 73,932 FortiGate firewall systems globally. The compromised data, reportedly originating from a Russian-speaking threat group, has impacted organizations across critical sectors including government, telecommunications, financial services, healthcare, manufacturing, and multinational corporations.