# Credential theft Published articles for Credential theft. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks DevFeed: [CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks]() Original publisher: [Read original article]() Author: Anne Aarness - Chris Prall Published: 2026-09-12T11:17:51.295154Z Content type: article Language: en Sources: [Blog]() Topics: [Endpoint Security & XDR](), [supply-chain-security](), [Security](), [Open Source](), [Software](), [Artificial Intelligence](), [Claude](), [codex]() Tags: [agentic](), [ai](), [codex](), [credential-theft](), [developer](), [developers](), [development](), [endpoint-security-xdr](), [malicious-packages](), [open-source](), [open-source-packages](), [persistence](), [security](), [software-supply-chain](), [supply-chain]() ### AI overview The article describes CrowdStrike's Real-Time Supply Chain Attack Protection, embedded in the Falcon sensor, which detects and blocks malicious open-source packages before their code executes on enterprise endpoints. It explains how AI-assisted and agentic applications have expanded software supply chain risk beyond developer workstations to endpoints across the organization. ### Source excerpt Real-Time Supply Chain Attack Protection, embedded into the Falcon sensor, blocks malicious open-source packages at download to protect the endpoint. ## Android malware creates a hidden copy of your banking app DevFeed: [Android malware creates a hidden copy of your banking app]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-11T12:14:55Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Malware](), [App]() Tags: [android](), [app](), [credential-theft](), [fraud](), [malware](), [mobile](), [news](), [phishing](), [profile](), [security](), [transactions]() ### AI overview Gigabud is an Android banking Trojan that creates a work profile and clones a banking app so operators can conduct fraudulent transactions separately from malware detected in the personal profile. ### Source excerpt The Gigabud banking Trojan can clone a banking app into a separate work profile on an Android device to help hide fraudulent transactions. ## Detect and disrupt AI-themed attacks with Microsoft Defender DevFeed: [Detect and disrupt AI-themed attacks with Microsoft Defender]() Original publisher: [Read original article]() Author: Rob Lefferts Published: 2026-09-10T16:00:00Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [Malware](), [Threat Research](), [spoofing](), [Microsoft]() Tags: [adversary-in-the-middle-aitm](), [ai](), [attacks](), [chatgpt](), [claude](), [copilot](), [credential-theft](), [deepseek](), [defender](), [github](), [malware](), [microsoft](), [phishing](), [security](), [social-engineering]() ### AI overview Microsoft describes AI-themed phishing, malvertising, credential theft, and malware campaigns that impersonate popular AI services and tools. It argues that attackers are exploiting trust and urgency around AI brands rather than compromising the referenced services. ### Source excerpt See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post Detect and disrupt AI-themed attacks with Microsoft Defender appeared first on Microsoft Security Blog. ## How WhatsApp Implemented Passkey Authentication for Faster, Phishing-Resistant Sign-In DevFeed: [How WhatsApp Implemented Passkey Authentication for Faster, Phishing-Resistant Sign-In]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-27T17:00:00Z Content type: article Language: en Sources: [Android Developers Blog]() Topics: [Passkeys](), [Authentication](), [Security, Privacy and Abuse Prevention](), [Cryptography](), [Android]() Tags: [api](), [authentication](), [credential-theft](), [cryptography](), [developer](), [google](), [meta](), [sign-in](), [whatsapp]() ### AI overview The article describes how WhatsApp implemented passkey-based authentication to provide faster sign-ins and reduce phishing and credential-theft risks. It explains the use of public-private key cryptography, biometric or screen-lock authentication, and Android's Credential Manager API. ### Source excerpt Posted by Niharika Arora, Senior Developer Relations Engineer, Tracy Agyemang, Product Marketing Manager, Google and Mayank Manuja, Android Engineer, Meta WhatsApp is the world's largest messaging platform, serving billions of users globally. It is the default communication tool for people across diverse regions, connecting users through private, reliable, and secure messaging. "What excites me most is the sheer scale of WhatsApp's impact. Even a small improvement to WhatsApp touches billions of users worldwide," says Mayank Manuja, an Android Engineer on the WhatsApp Registration and Access team who led the design and implementation of passkey-based authentication for WhatsApp. Building for an audience of this magnitude requires navigating a vast range of network conditions, device capabilities, and levels of digital literacy. Recognizing the potential early, WhatsApp committed to adopting passkeys in 2023, becoming one of the first major consumer apps to integrate the technology. By implementing passkeys, WhatsApp aimed to provide a fast, phishing-resistant option that significantly reduces user friction while providing robust protection against account takeovers and credential theft. A user creating a passkey on WhatsApp for faster, more secure sign-ins. The Decision to Adopt Passkeys For WhatsApp, offering multiple access methods is key to making it easier for users to stay connected and regain access when needed. Passkeys offer users a streamlined, one-tap login experience that eliminates phishing risks and functions reliably even in regions where OTP message delivery can be inconsistent. Underneath, passkeys leverage public-private key cryptography to replace manual entry with biometric or screen lock authentication. This workflow drastically improves sign-in speeds by reducing the process to a single tap via a unified, bottom-sheet interface that keeps users engaged within the app's context. The benefits are twofold: passkeys offer users a streamlined login e ## How WhatsApp Upgraded to Secure, Seamless Sign-In for 1 Billion Users with Passkeys DevFeed: [How WhatsApp Upgraded to Secure, Seamless Sign-In for 1 Billion Users with Passkeys]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-27T17:00:00Z Content type: article Language: en Sources: [Android Developers Blog](), [Android Developers Blog]() Topics: [Passkeys](), [Authentication](), [Security, Privacy and Abuse Prevention](), [Cryptography](), [Android](), [App](), [API]() Tags: [android](), [api](), [app](), [authentication](), [credential-theft](), [cryptography](), [phishing](), [scale](), [whatsapp]() ### AI overview WhatsApp's adoption of passkeys provides a fast, phishing-resistant sign-in method for its large global user base. The article explains how passkeys use public-private key cryptography with biometric or screen-lock authentication, reduce reliance on inconsistent SMS OTP delivery, and simplify implementation through Android's Credential Manager API. ### Source excerpt Posted by Niharika Arora, Senior Developer Relations Engineer, Tracy Agyemang, Product Marketing Manager, Google and Mayank Manuja, Android Engineer, Meta WhatsApp is the world's largest messaging platform, serving billions of users globally. It is the default communication tool for people across diverse regions, connecting users through private, reliable, and secure messaging. "What excites me most is the sheer scale of WhatsApp's impact. Even a small improvement to WhatsApp touches billions of users worldwide," says Mayank Manuja, an Android Engineer on the WhatsApp Registration and Access team who led the design and implementation of passkey-based authentication for WhatsApp. Building for an audience of this magnitude requires navigating a vast range of network conditions, device capabilities, and levels of digital literacy. Recognizing the potential early, WhatsApp committed to adopting passkeys in 2023, becoming one of the first major consumer apps to integrate the technology. By implementing passkeys, WhatsApp aimed to provide a fast, phishing-resistant option that significantly reduces user friction while providing robust protection against account takeovers and credential theft. A user creating a passkey on WhatsApp for faster, more secure sign-ins. The Decision to Adopt Passkeys For WhatsApp, offering multiple access methods is key to making it easier for users to stay connected and regain access when needed. Passkeys offer users a streamlined, one-tap login experience that eliminates phishing risks and functions reliably even in regions where OTP message delivery can be inconsistent. Underneath, passkeys leverage public-private key cryptography to replace manual entry with biometric or screen lock authentication. This workflow drastically improves sign-in speeds by reducing the process to a single tap via a unified, bottom-sheet interface that keeps users engaged within the app's context. The benefits are twofold: passkeys offer users a streamlined login e ## Identity Abuse Through Trusted Communication Channels DevFeed: [Identity Abuse Through Trusted Communication Channels]() Original publisher: [Read original article]() Author: Bill Batchelor Published: 2026-08-20T10:00:25Z Content type: article Language: en Sources: [Unit 42]() Topics: [Security](), [Authentication](), [Social engineering](), [Software as a service](), [Incident response]() Tags: [authentication](), [credential-theft](), [identity](), [identity-theft](), [incident-response](), [malware](), [mfa](), [phishing](), [remote-access-software](), [saas](), [security](), [social-engineering](), [threat-research]() ### AI overview Unit 42 examines how attackers abuse trusted enterprise communication and collaboration platforms for identity phishing, impersonation, credential theft, malware delivery and social engineering. The article describes how compromised identities can make malicious activity appear legitimate within authenticated collaboration sessions and offers recommendations for detecting and defending against these attacks. ### Source excerpt Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42. ## N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it DevFeed: [N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it]() Original publisher: [Read original article]() Author: Zander Mackie Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Malware](), [Model Context Protocol](), [MCP Server](), [Credential theft](), [Persistence](), [C2](), [Linux](), [AI Infrastructure](), [Go Language]() Tags: [ai-infrastructure](), [c2](), [credential-theft](), [go](), [linux](), [malware](), [mcp](), [mcp-server](), [persistence]() ### AI overview Datadog Security Research analyzes an active N4D Mesh Controller malware campaign targeting exposed MCP servers and other internet-facing services. The article documents a newer UPX-packed go-titan loader-to-agent chain, rotated infrastructure, Linux persistence mechanisms, automated MCP tool discovery and command execution, and broad scanning across databases, container platforms, application servers, and AI infrastructure. ### Source excerpt Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence. ## Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) DevFeed: [Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-18T19:05:33Z Content type: article Language: en Sources: [Unit 42]() Topics: [Credential theft](), [password spraying](), [MFA](), [Microsoft](), [Incident response]() Tags: [credential-based-attacks](), [credential-theft](), [general](), [high-profile-threats](), [identity](), [incident](), [incident-response](), [mfa](), [microsoft](), [password-spraying](), [thehatman]() ### AI overview This threat brief examines large-scale credential attacks, including password spraying campaigns and claimed credential theft from Microsoft Entra tenants. It provides guidance for identifying suspicious login activity, auditing remote access logs, and hardening internet-exposed edge devices. ### Source excerpt In August 2026, the actor TheHatman claimed to have stolen large volume of credentials from organizations' Microsoft Entra tenants. We provide guidance on mitigating large-scale credential attacks. The post Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) appeared first on Unit 42. ## Inside the Modern SOC: The Identity Front Door DevFeed: [Inside the Modern SOC: The Identity Front Door]() Original publisher: [Read original article]() Author: Sharon Maydar Published: 2026-08-07T23:00:01Z Content type: article Language: en Sources: [Unit 42]() Topics: [Incident response](), [MFA](), [Vulnerabilities]() Tags: [ai](), [attacks](), [authentication](), [credential-theft](), [identity](), [incident-response](), [inside-the-modern-soc](), [insights](), [mfa](), [phishing](), [soc](), [social-engineering](), [unit-42-incident-response-report](), [vulnerabilities]() ### AI overview The article examines identity-based initial access, including credential theft, MFA manipulation, session hijacking, phishing, and social engineering. It describes how attackers expand access through persistence, privilege escalation, and lateral movement, challenging SOC teams to correlate signals across environments. ### Source excerpt Identity-based attacks drive 90% of incidents. Learn how modern attackers exploit identities and what SOC leaders can do to respond. The post Inside the Modern SOC: The Identity Front Door appeared first on Unit 42. ## Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload DevFeed: [Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload]() Original publisher: [Read original article]() Author: Pratul Yadav Published: 2026-07-06T09:43:40Z Content type: article Language: en Sources: [Confluent: Data in motion]() Topics: [Kafka](), [configuration](), [Authentication](), [passwords](), [TLS (Transport Layer Security)]() Tags: [authentication](), [config](), [configuration](), [confluent-platform](), [credential-theft](), [cryptographic](), [deep-dive](), [kafka](), [operational](), [password](), [production](), [tls]() ### AI overview This article explains Kafka authentication with SASL PLAIN and SASL SCRAM, focusing on login modules, credential storage, and configuration hot-reload. It compares their security and operational characteristics and describes how hot-reload enables credential changes without restarting brokers. ### Source excerpt Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload ## Laravel Lang Supply Chain Advisory DevFeed: [Laravel Lang Supply Chain Advisory]() Original publisher: [Read original article]() Author: Brian Clark Published: 2026-05-23T16:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Laravel](), [Composer](), [Credential theft](), [Malware](), [PHP](), [passwords](), [ssh](), [CI/CD](), [Cloud](), [Kubernetes](), [GitHub]() Tags: [application-security](), [article](), [awareness](), [ci-cd](), [cloud](), [code](), [credential-theft](), [developer](), [devops](), [devrel](), [github](), [kubernetes](), [laravel](), [php](), [scm](), [secrets](), [security](), [security-labs](), [snyk-open-source](), [snyk-security-intel](), [ssh](), [supply-chain](), [supply-chain-security](), [tech](), [tokens](), [vulnerability-insights]() ### AI overview The article examines a Laravel Lang supply-chain attack in which hundreds of historical Packagist releases for four community-maintained Laravel localization libraries were republished with malicious code. The injected Composer hook executes on PHP requests, downloads a second stage, and runs a credential stealer targeting cloud keys, Kubernetes and Vault secrets, CI/CD tokens, SSH material, environment files, browser data, password-manager vaults, crypto wallets, and messaging tokens. ### Source excerpt Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, putting Composer installs at risk of credential theft and secret exfiltration. ## Malicious node-ipc versions published to npm in suspected maintainer account compromise DevFeed: [Malicious node-ipc versions published to npm in suspected maintainer account compromise]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-05-15T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Node.js](), [incident](), [releases](), [CI/CD]() Tags: [article](), [awareness](), [ci](), [ci-cd](), [credential-theft](), [developer](), [devops](), [enablement](), [incident](), [javascript](), [kubernetes](), [node](), [node-js](), [releases](), [scm](), [secrets](), [security](), [security-labs](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Multiple malicious node-ipc versions were published to npm with an obfuscated credential-stealing payload in the CommonJS bundle. The article describes a suspected maintainer-account compromise and advises affected teams to treat exposed secrets as potentially compromised and remediate vulnerable dependency paths. ### Source excerpt On May 14, 2026, multiple malicious versions of the popular npm package node-ipc were published to the npm registry. Current public reporting identifies node... ## PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale DevFeed: [PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale]() Original publisher: [Read original article]() Author: Alex Delamotte Published: 2026-05-07T10:00:17Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [pcpjack](), [Credential theft](), [Malware](), [cloud-infrastructure](), [Security](), [Docker](), [Kubernetes](), [web applications](), [MongoDB](), [Redis](), [VirusTotal](), [ransomware]() Tags: [cloud](), [credential-theft](), [database](), [docker](), [kubernetes](), [malware](), [open-source](), [pcpjack](), [ransomware](), [redis](), [security](), [teampcp](), [virustotal](), [web-applications]() ### AI overview SentinelLABS describes PCPJack as a credential-theft framework that spreads across exposed cloud infrastructure, removes TeamPCP-related artifacts, harvests credentials from cloud, container, developer, productivity, and financial services, and exfiltrates the data. The framework targets services including Docker, Kubernetes, Redis, MongoDB, and vulnerable web applications, with suspected monetization through fraud, spam, extortion, or resale of stolen access rather than cryptomining. ### Source excerpt Cloud attack framework skips cryptomining, harvests financial, messaging, and enterprise credentials for fraud, spam, and potential extortion. ## Chainguard customers safe from new npm worm and xinference supply chain attack DevFeed: [Chainguard customers safe from new npm worm and xinference supply chain attack]() Original publisher: [Read original article]() Published: 2026-04-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Malware](), [npm](), [Credential theft](), [Library](), [chainguard libraries](), [chainguard containers](), [GitHub]() Tags: [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-malware](), [credential-theft](), [github](), [malicious-packages](), [malware](), [npm](), [npm-malware](), [npm-worm](), [packages](), [pypi-malware](), [supply-chain](), [worm](), [xinference]() ### AI overview The article reports npm and PyPI malware attacks affecting 25 packages with more than 60,000 combined monthly downloads. It explains that Chainguard customers were protected because Chainguard builds from verifiable source code and rejects packages that rely on install-time scripts. ### Source excerpt New npm and PyPI malware hit many popular packages. Chainguard customers stayed protected by blocking install scripts and rebuilding only verified source code. ## Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise DevFeed: [Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise]() Original publisher: [Read original article]() Author: Luca Beurer-Kellner; Aleksei Kudrinskii; Marco Milanta; Kristian Bonde Nielsen; Hemang Sarkar; Liran Tal Published: 2026-02-05T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Agent Skills](), [Security](), [supply-chain-security](), [prompt injection](), [AI Agent](), [Credential theft](), [Malware](), [Claude Code](), [cursor](), [OpenClaw](), [API keys](), [backdoor]() Tags: [agent](), [agent-skills](), [ai](), [api-keys](), [awareness](), [backdoor](), [blog](), [credential-theft](), [developer](), [malware](), [prompt-injection](), [security](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Snyk's ToxicSkills audit examined 3,984 AI agent skills and found that 36.82% had at least one security flaw. The research identified malware, credential theft, prompt injection, exposed secrets, backdoors, and data exfiltration affecting users of OpenClaw, Claude Code, and Cursor. ### Source excerpt Snyk's ToxicSkills research reveals 36% of AI agent skills contain security flaws, including 1,467 vulnerable skills and active malicious payloads targeting OpenClaw, Claude Code, and Cursor users. ## Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS DevFeed: [Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS]() Original publisher: [Read original article]() Author: Daniel Alexander Parkes, Anthony D'Atri Published: 2025-12-18T00:00:00Z Content type: tutorial Language: en Sources: [Ceph Blog]() Topics: [Security](), [Amazon S3](), [Credential theft](), [configuration](), [GitHub](), [CI/CD](), [App]() Tags: [amazon-s3](), [app](), [aws](), [blog-post](), [ceph](), [ci-cd](), [code](), [configuration](), [credential-theft](), [en-article](), [en-blog-post](), [github](), [rgw](), [s3](), [security]() ### AI overview This tutorial explains how to replace long-lived S3 credentials in Ceph Object Gateway (RGW) applications with temporary credentials issued through Security Token Service (STS). It uses the Uber breach to illustrate how stolen static keys can enable persistent unauthorized access, and discusses credentials stored in configuration files, scripts, and CI/CD variables. ### Source excerpt Introduction: The USD 148 Million Lesson ¶ In late 2016, Uber learned that intruders had accessed a trove of personal data stored in an Amazon S3 bucket. The entry point was painfully mundane: attackers accessed Uber's source code on GitHub using stolen credentials, found an AWS credential, and used it to access Uber's data. That single, long-lived credential exposed data on roughly 57 million users and 600,000 drivers. The breach was bad; the duration risk was worse. Static access keys do not expire. Once leaked, they remain active until someone notices, locates every instance in use, and rotates them. That makes credential theft uniquely dangerous in cloud and S3-style storage, because an attacker can repeatedly return, automate access, and quietly expand their footprint. Uber ultimately agreed to a $148 million multistate settlement related to how the incident was handled and disclosed. The exact dollar figure is not the main lesson, though. The lesson is this: a single static key can turn a small mistake into a durable breach. If you are running the Ceph Object Gateway (RGW), you face the same dynamic: S3 credentials in an application configuration file config.yaml, embedded in scripts, or stored in CI/CD variables. Each one is a long-lived credential that, once copied, can be used from anywhere the S3 endpoint is reachable. This post shows you how to eliminate static credentials using Security Token Service (STS) with temporary credentials that expire automatically. By the end, you'll understand how to implement the same security model that prevented these breaches from being even worse, and how to adapt it for Ceph RGW. The Static Credential Problem ¶ Let's take a look at some examples of how most applications access S3 storage today: # app-config.yaml (application config file) s3: endpoint: https://s3.example.com access_key: AKIA1234567890ABCDEF secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY bucket: production-data Or with the credentials embedded direc ## ECS on EC2: Covering Gaps in IMDS Hardening DevFeed: [ECS on EC2: Covering Gaps in IMDS Hardening]() Original publisher: [Read original article]() Published: 2025-10-02T18:18:59Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [Amazon Elastic Container Service](), [Amazon EC2](), [Security](), [Amazon Web Services](), [Containers](), [Credential theft]() Tags: [aws](), [containers](), [credential-theft](), [credentials](), [ec2](), [ecs](), [hardening](), [security](), [sensitive-data]() ### AI overview This article examines security gaps in Amazon ECS workloads running on EC2, focusing on task isolation and restricting access to the EC2 Instance Metadata Service. It discusses how weak isolation can expose credentials and sensitive data and outlines the need for more comprehensive hardening guidance. ### Source excerpt Introduction # AWS ECS is a widely-adopted service across industries. To illustrate the scale and ubiquity of this service, over 2.4 billion Amazon Elastic Container Service tasks are launched every week (source) and over 65% of all new AWS containers customers use Amazon ECS (source). There are two primary launch types for ECS: Fargate and EC2. The choice between them depends on factors like cost, performance, operational overhead, and the variability of your workload. ## Rolling out Santa without freezing productivity: Tips from securing Figma's fleet DevFeed: [Rolling out Santa without freezing productivity: Tips from securing Figma's fleet]() Original publisher: [Read original article]() Author: Aaron Osborne Published: 2025-07-02T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Endpoint security](), [Security](), [Authorization](), [macOS](), [Credential theft](), [App](), [Tooling](), [Malware](), [Script](), [Extension]() Tags: [authorization](), [browser](), [credential-theft](), [endpoint-security](), [macos](), [malware](), [open-source](), [santa](), [security](), [workflows]() ### AI overview Figma describes rolling out Santa, an open-source binary authorization tool, across its employees' macOS laptops to improve endpoint security without disrupting productivity. The article covers monitoring-based ruleset development, user self-service for unblocking, file access authorization for browser cookies, and a staged rollout. ### Source excerpt We scaled Santa, an open-source binary authorization tool, across all Figmates' laptops to boost endpoint security while keeping workflows seamless. Here's how we tackled the challenges and ensured a smooth rollout. ## How I gained commit access to Homebrew in 30 minutes DevFeed: [How I gained commit access to Homebrew in 30 minutes]() Original publisher: [Read original article]() Author: Remind Published: 2018-08-07T00:00:00Z Content type: article Language: en Sources: [Remind]() Topics: [Homebrew](), [Security](), [supply chain attacks](), [Jenkins](), [GitHub](), [Environment Variables](), [OAuth](), [GitHub API](), [incident]() Tags: [backdoor](), [credential-theft](), [curl](), [environment-variables](), [github](), [homebrew](), [incident](), [jenkins](), [npm](), [permissions](), [rubygems](), [security](), [supply-chain-attacks]() ### AI overview A security researcher describes gaining commit access to Homebrew repositories through a GitHub API token exposed in a publicly accessible Jenkins environment. The access was tested and then reported to Homebrew maintainers, highlighting risks to package-manager infrastructure and software supply chains. ### Source excerpt This issue was publicly disclosed on the Homebrew blog at https://brew.sh/2018/08/05/security-incident-disclosure/ Since the recent NPM, RubyGems, and Gentoo incidents, I've become increasingly interested, and concerned, with the potential for package managers to be used in supply chain attacks to distribute malicious software. Specifically with how the maintainers and infrastructure of these projects can be targeted as an attack vector. On Jun 31st, I went in with the intention of seeing if I could gain access to Homebrew's GitHub repositories. About 30 minutes later, I made my first commit to Homebrew/homebrew-core. Let's get leaky My initial strategy going in was based on credential theft; find if there were any credentials leaked by members of the Homebrew GitHub org. An OSSINT tool from Michael Henriksen called gitrob makes automating this search really easy. I ran it across the Homebrew organization, but ultimately didn't come up with anything interesting. Next, I took a look at previously disclosed issues on https://hackerone.com/Homebrew. From there, I found that Homebrew runs a Jenkins instance that's (intentionally) publicly exposed at https://jenkins.brew.sh. After some digging, I noticed something interesting; builds in the "Homebrew Bottles" project were making authenticated pushes to the BrewTestBot/homebrew-core repo: This got me thinking, "where are the credentials stored?". I noticed the "Environment Variables" link on the left, which led to an exposed GitHub API token: I tested it locally to see what scopes the token had: $ curl https://api.github.com/user/repos -u $GITHUB_API_TOKEN:x-oauth-basic | jq '.[] | {repo: .full_name, permissions: .permissions}' { "repo": "BrewTestBot/homebrew-core", "permissions": { "admin": true, "push": true, "pull": true } } { "repo": "Homebrew/brew", "permissions": { "admin": false, "push": true, "pull": true } } { "repo": "Homebrew/formulae.brew.sh", "permissions": { "admin": false, "push": true, "pull": true } } { " ## ReactOS Website Migrated to New Login System and Upgraded Components DevFeed: [ReactOS Website Migrated to New Login System and Upgraded Components]() Original publisher: [Read original article]() Published: 2018-07-04T00:00:00Z Content type: release Language: en Sources: [Front Page on ReactOS Website]() Topics: [ReactOS](), [Website](), [passwords](), [Database](), [hashing](), [Credential theft](), [jira]() Tags: [account](), [change](), [credential-theft](), [database](), [free](), [hashing](), [jira](), [open-source](), [os](), [password](), [react](), [reactos](), [service](), [website](), [win32](), [winapi]() ### AI overview The ReactOS Website was migrated to a new login system, its components were upgraded, and its user database was moved and cleaned of unused accounts. The article advises users to change their passwords and notes that some newer accounts may require a password reset. ### Source excerpt Today, the ReactOS Website has been migrated to a new Login system and all components have been upgraded to their latest versions. In the course of that, the user database has also been moved and cleaned from accounts that have never been used. Such large migrations hardly go without issues, so if you notice anything wrong, please report a bug in our JIRA bugtracker. You are also advised to change your password in the Self-Service, even if it's just to the same one.