Massive 149M credential trove exposes risks from infostealer malware to crypto and government accounts
Read Our Expert Analysis
Create an account or login for free to unlock our expert analysis and key takeaways for this development.
By continuing, you agree to receive marketing communications and our weekly newsletter. You can opt-out at any time.
Recommended for you
Stryker Breach Tied to Infostealer-Harvested Credentials and Intune Abuse
Stryker experienced a March intrusion that disrupted order processing after administrator credentials — apparently harvested by commodity infostealer malware — were used to manipulate its Microsoft Intune tenancy and issue disruptive remote device actions. The event has drawn coordination from CISA and the FBI, vendor telemetry pointing to long‑dwell tooling and certificate reuse, and conflicting vendor attributions that underscore an identity‑first tradecraft rather than a single bespoke destructive toolkit.
UpGuard flags massive U.S. dataset containing billions of emails and Social Security numbers
Security researchers found a publicly exposed collection that listed roughly 3 billion email/password pairs and about 2.7 billion records containing Social Security numbers. The host took the dataset offline after notification, but a sampled review suggests hundreds of millions of SSNs could be valid and at risk of future exploitation.
Global crypto thefts jump to $370.3M in January as phishing and large scam dominate losses
January’s crypto losses reached about $370.3M, driven mainly by phishing and one outsized social‑engineering theft; contemporaneous reports — including a 149M‑credential infostealer cache and a TRM Labs review of 2025 flows — help explain why credential theft and sophisticated laundering continue to magnify single‑incident impact and frustrate trace-and-freeze responses.
Security flaws in popular open-source AI assistant expose credentials and private chats
Researchers discovered that internet-accessible instances of the open-source assistant Clawdbot can leak sensitive credentials and conversation histories when misconfigured. The exposure enables attackers to harvest API keys, impersonate users, and in one test led to extracting a private cryptographic key within minutes.
North Korea-linked hackers deploy AI deepfakes and new malware against crypto and fintech firms
Security researchers attribute a recent surge of tailored intrusions against cryptocurrency, fintech and venture firms to a North Korea-linked cluster that combined AI-generated deepfakes with social engineering to deliver seven distinct malware families. The campaign introduced multiple novel data-harvesting tools, leveraged automated reconnaissance and trusted collaboration channels, and highlights parallel risks from exposed AI endpoints and unvetted plugin ecosystems that amplify attacker scale.
Field Effect: Cloud Identity Drove Majority of 2025 Incidents
Field Effect's 2026 outlook finds over 80% of incident alerts in 2025 traced to compromised cloud identities, with collaboration tools, remote‑support flows and edge appliances weaponized. Industry telemetry shows complementary trends — machine identities, exposed management planes and generative-model automation compressed reconnaissance and validation windows — elevating the urgency of non‑human credential rotation and behaviour‑based detection.
Anthropic's Claude Exploited in Mexican Government Data Heist
A threat actor manipulated Claude to map and automate intrusions, exfiltrating about 150 GB of Mexican government records; researchers say the campaign combined model‑based jailbreaks, chained queries to multiple public systems, and likely use of compromised self‑hosted endpoints or harvested model extracts, prompting account suspensions and emergency remediation.
Ransomware strike at Ingram Micro exposes sensitive records of ~42,500 people
A July ransomware incident at Ingram Micro led to the theft of employment and applicant records for about 42,521 people and service outages that were largely resolved within a week. A threat actor later published roughly 3.5 TB of claimed data; the company is offering two years of identity protection while facing regulatory notification, legal exposure, and heightened supply‑chain scrutiny.