topic

Identity & Passwords

Passwords, MFA, passkeys and credential theft.

Want to defend against threats like these? Get hands-on cybersecurity training at Skillmate

16 posts, newest first

#Identity

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

Chainalysis, an American blockchain analysis firm, confirmed a cybersecurity incident where an external actor accessed non-sensitive customer data, including user IDs, full names, email addresses, and organization role...

SkillmateOct 31, 2026

#Identity
Passkeys Are Better Than Passwords. But They Are Not Enough
Attackers have found ways to exploit the authentication process around passkeys, focusing on opportunities outside the direct passkey...
SkillmateOct 31, 2026
#CloudSecurity
#Identity
#AISecurity
26,400 Exposed Cloud and AI Credentials Found in Public Gitee Repositories
Independent researcher Ben Zimmermann discovered 26,400 valid credentials for cloud and AI services in public repositories on Gitee, a...
SkillmateOct 30, 2026
#Malware
#Android
#Identity
New MR ROBOT Malware-as-a-Service Targets Indian Bank Customers
A new Android malware-as-a-service operation, MR ROBOT, has been found targeting Indian bank customers, intercepting text messages and...
SkillmateOct 29, 2026
#CloudSecurity
#Identity
#Microsoft
Microsoft Urges Entra ID Admins to Migrate Users to Passkeys
Microsoft has advised Entra ID administrators to migrate their users to passkeys to prevent sign-in disruptions after the retirement of SMS...
SkillmateOct 29, 2026
#AISecurity
#Identity
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
A threat actor used bots posing as representatives from OpenAI, Anthropic, and Meta to scan for exposed data. Earlier attacks and coverage...
SkillmateOct 29, 2026
#Identity
DreamHost forces password resets in ongoing "incident"
DreamHost has forced password resets for its email and FTP/SFTP users following an incident that disrupted the File Manager interface. The...
SkillmateOct 27, 2026
#Identity
Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
SOC teams often overlook critical events between high-priority alerts, allowing adversaries to stealthily gather credentials over days or...
SkillmateOct 26, 2026
#Vulnerabilities
#NetworkDevices
#Identity
Hackers Exploit Fortinet and Palo Alto Networks Firewalls, Expose 70,000+ Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign targeting exposed Fortinet and Palo Alto Networks firewalls,...
SkillmateOct 24, 2026
#Identity
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
PaaS provider Railway disclosed anomalous activity related to customer environment variables, suggesting unauthorized third parties may...
SkillmateOct 23, 2026
#Identity
#Ransomware
#Vulnerabilities
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
In November 2024, ransomware attackers exploited a 'Password1' password to breach the network of Data Cymru, a Welsh local government data...
SkillmateOct 22, 2026
#Ransomware
#NetworkDevices
#Identity
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) reports that the SafePay ransomware gang has breached over 600 critical...
SkillmateOct 22, 2026
#Identity
#CloudSecurity
Why security tools lose sight of the credential
A developer found an AWS key in a repository, leading to questions about its current status and usage across different security tools. The...
SkillmateOct 22, 2026
#DataBreaches
#Identity
Zeabur Security Breach Exposes 3.2 Million Environment Variables
Zeabur, a developer hosting platform, disclosed a cybersecurity incident where an attacker compromised its infrastructure using leaked...
SkillmateOct 21, 2026
#Identity
#CloudSecurity
The password nobody owns: Taking machines to zero standing privilege (ZSP)
In August 2025, an actor tracked as UNC6395 used stolen OAuth and refresh tokens from the Salesloft Drift integration to extract data from...
SkillmateOct 21, 2026
#Identity
#Malware
#SupplyChain
GhostAction Attackers Use Fake Font to Steal Credentials in 94 GitHub Repos
The threat actor behind the GhostAction supply chain attack expanded their tactics by injecting a credential stealer disguised as a fake...
SkillmateOct 20, 2026

skillmate

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

Passkeys Are Better Than Passwords. But They Are Not Enough

26,400 Exposed Cloud and AI Credentials Found in Public Gitee Repositories

New MR ROBOT Malware-as-a-Service Targets Indian Bank Customers

Microsoft Urges Entra ID Admins to Migrate Users to Passkeys

Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

DreamHost forces password resets in ongoing "incident"

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Hackers Exploit Fortinet and Palo Alto Networks Firewalls, Expose 70,000+ Credentials

Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation

Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account

CISA: SafePay ransomware hit over 600 critical infrastructure orgs

Why security tools lose sight of the credential

Zeabur Security Breach Exposes 3.2 Million Environment Variables

The password nobody owns: Taking machines to zero standing privilege (ZSP)

GhostAction Attackers Use Fake Font to Steal Credentials in 94 GitHub Repos