Russian-linked APT28 ran credential-harvesting attacks in 2025 using fake Microsoft, Google, and VPN login pages, PDF lures, and legitimate web servic

MCP servers, which are important to the fast-developing AI stack, have a credentials problem. more

 Microsoft’s cybersecurity researchers have uncovered a growing wave of phishing scams using QR codes hidden inside emails, PDF files, and fake CAPTCHA pages. Instead of clicking suspicious links, victims scan QR codes that secretly redirect them to fraudulent websites designed to steal login credentials and session data. The attacks spread quickly because they bypass many traditional security filters and often appear harmless at first glance.  Known as “quishing,” these scams hide malicious links inside QR codes, avoiding the usual warning signs tied to suspicious URLs. Emails often create urgency through fake compliance notices, security alerts, or missed-message warnings, encouraging users to scan the code without carefully checking the sender. According to Microsoft, attackers are impersonating HR teams, IT departments, managers, and office administrators to make messages appear legitimate.  Once scanned, users are routed through several webpages before landing on counterfeit login portals built to capture usernames, passwords, and even live session tokens capable of bypassing some two-factor authentication protections. Researchers say more than 35,000 users across approximately 13,000 organizations worldwide have already been targeted, with cases continuing to rise. Many people trust QR codes because they are commonly used for menus, payments, and sign-ins, making them less likely to question the risks behind scanning one. Cybercriminals are exploiting that familiarity to trick users into exposing sensitive information. A recent case highlighted by Digit.in demonstrated how convincing these scams can be. Employees reportedly received emails appearing to come from an Office 365 administrator claiming several messages were awaiting approval. Instead of links, the email included a QR code directing users elsewhere. Investigators tested the QR code using a freshly wiped mobile device across Android and iOS platforms to minimize potential risks.  While the QR codes in that case did not install malware or alter device settings, the test showed how easily similar scams could deceive unsuspecting users. Security professionals warn that scanning unfamiliar QR codes on devices containing banking apps, work credentials, personal photos, or confidential files can expose users to serious threats without obvious warning signs. Experts recommend avoiding QR codes sent through unsolicited emails, verifying senders carefully, and checking linked addresses before entering passwords.  As cybercriminals increasingly rely on social engineering instead of direct hacking, simple actions like scanning a QR code are becoming new entry points for digital attacks.

 In today's cybersecurity landscape, stolen credentials represent a paramount threat, with infostealers harvesting 4.17 billion credentials in 2025 alone. A Lunar survey reveals that 85% of organizations view them as a high or very high risk, ranking them among the top three priorities for 62% of enterprises. Yet, many still rely on basic, checkbox-style monitoring tools that fail to address the evolving sophistication of attacks.  Traditional breach monitoring focuses narrowly on data breaches while overlooking infostealer logs, combolists, and underground marketplaces. These tools suffer from high latency, stale data, and a lack of automation or forensic details like compromised accounts, infected devices, or stolen session cookies. Only 32% of surveyed enterprises use dedicated solutions, while 17% have none, leaving critical blind spots.IBM reports credential-related breaches cost $4.81-4.88 million on average.  Modern infostealers like LummaC2 and AMOS bypass MFA and EDR by targeting active session tokens from unmanaged devices, enabling attackers to access accounts without passwords. Monthly checks cannot match the speed and scale of these threats, which evade detection through non-forensic data and ultra-low prices (ULPs) on dark web forums. This "breach monitoring paradox" persists even among knowledgeable teams. To counter this, organizations must adopt continuous, normalized monitoring across breaches, stealer logs, and channels for a deduplicated exposure view. Targeted automation reduces false positives, prioritizing high-risk identities and sessions.Integrating behavioral analysis and session integrity checks detects post-authentication anomalies. AWS environments highlight similar issues, where manual monitoring fails against dynamic changes and 24/7 threats.  Redefining breach monitoring as an ongoing program—beyond one-off products—delivers visibility, context, and automated playbooks. In 2026, with AI-powered attacks rising and detection times averaging 132 days, proactive strategies are essential. Enterprises ignoring this shift risk catastrophic losses amid infostealer proliferation.

DORA Article 9 makes credential security a binding operational resilience obligation for EU financial entities, mandating phishing-resistant MFA, least-privilege access, and cryptographic key protection while treating credential compromise as an operational resilience failure that can trigger rapid reporting and supervisory action. Passwork offers a self-hosted, ISO/IEC 27001‑certified credential vault that enforces FIDO2/WebAuthn MFA, role-based access, encrypted credential storage, and tamper-evident audit logs to help institutions demonstrate compliance and manage third‑party risk. #DORA #Ficoba

Data protection provider Commvault Systems Inc. today announced a new partnership and technology integration with privileged access management firm Delinea Inc. that connects the Commvault Cloud platform...

Windows administrators from numerous organizations report widespread account lockouts triggered by false positives in the rollout of a new Microsoft Entra ID's "leaked credentials" detection app calle...

In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published hundreds of gigabytes of data they claimed was obtained…

Exposed credentials continue to spread through code and internal systems, increasing risk as leaks persist longer and reach more tools.

Cybersecurity researchers discovered a vulnerability in McHire, McDonald's chatbot job application platform, that exposed the chats of more than 64 million job applications across the United States.