AI agents keep access to company data after their work is done 2026-10-02 at 07:30 By Anamarija Pogorelec IT teams responsible for identity security are concerned about AI agents’ ongoing access to company systems and the actions they take on users’ behalf, according to a Delinea’s 2026 Identity Security Report: The AI Enforcement Gap. “Written […]
AI agents keep access to company data after their work is done Read More »
Hardcoded MCP credentials found in public GitHub files 2026-09-18 at 08:30 By Anamarija Pogorelec Hardcoded API keys, access tokens and other credentials used by AI coding tools have been found in publicly accessible MCP configuration files on GitHub, according to research from Hush Security’s The State of MCP Configuration: The Identity Security Gaps report. The […]
Hardcoded MCP credentials found in public GitHub files Read More »
98% of fraudulent hires have company credentials by the time they’re caught 2026-09-18 at 08:00 By Anamarija Pogorelec A 90-day period between hiring and onboarding is creating a blind spot in enterprise identity security, according to HYPR’s State of HR Identity Fraud Detection report. “Adversaries no longer need to breach a network when they can […]
98% of fraudulent hires have company credentials by the time they’re caught Read More »
Product showcase: mSecure makes one vault do more than remember passwords 2026-09-15 at 08:30 By Anamarija Pogorelec mSecure is a password manager and data vault for storing credentials and other sensitive information. It is available for iOS, Android, macOS, and Windows, with data synchronization across supported devices. The app uses AES-256 encryption and a zero-knowledge […]
Product showcase: mSecure makes one vault do more than remember passwords Read More »
Product showcase: GitGuardian Honeytoken catches credential theft as it happens 2026-09-10 at 08:30 By Help Net Security Credential harvesting on developer machines has widened. Earlier infostealers worked from a short list of known targets, mostly browser stores and a few cloud credential paths. The families active now cast a much wider net. Shai-Hulud, for instance, […]
Product showcase: GitGuardian Honeytoken catches credential theft as it happens Read More »
This Key Will Self-Destruct: An Open Standard for Revocable API Keys 2026-09-09 at 13:00 By Matt Honea Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. The post This Key Will Self-Destruct: An Open Standard for Revocable API Keys appeared first on […]
This Key Will Self-Destruct: An Open Standard for Revocable API Keys Read More »
Product showcase: Doppler secures secrets for humans, pipelines, and AI agents 2026-09-08 at 08:00 By Help Net Security Every engineering team has spent years trying to keep credentials out of source code. Then AI agents moved the problem. Coding agents review code, agents run workflows, and MCP servers broker access to databases, cloud providers, and […]
Product showcase: Doppler secures secrets for humans, pipelines, and AI agents Read More »
NIS2 compliance: Fixing IAM and access control before the 2026 audit 2026-09-01 at 08:00 By Help Net Security The NIS2 Directive places direct obligations on organizations across supply chain risk management, incident reporting, and board-level accountability. October brings a new wave of legally binding deadlines across the EU, as member states move from transposition into […]
NIS2 compliance: Fixing IAM and access control before the 2026 audit Read More »
Threat actors are posing as AI crawlers to hunt for exposed credentials 2026-08-31 at 17:54 By Sinisa Markovic Attackers are disguising automated scanning as traffic from AI crawlers operated by OpenAI, Anthropic, Google, Perplexity and other companies while searching websites for exposed credentials and configuration files, according to GreyNoise. (Source: GreyNoise) “Every program that visits […]
Threat actors are posing as AI crawlers to hunt for exposed credentials Read More »
Product showcase: Enpass Password Manager breaks away from the proprietary cloud model 2026-08-10 at 08:00 By Anamarija Pogorelec Enpass is a password manager that stores passwords, passkeys, payment cards, identities, secure notes, software licenses, and other sensitive information in encrypted vaults. Vaults remain on the device or in a cloud storage service selected by the […]
Product showcase: Enpass Password Manager breaks away from the proprietary cloud model Read More »
Buying TikTok followers can expose users to scams and account theft 2026-08-03 at 07:00 By Anamarija Pogorelec Buying TikTok followers, likes, or views could do more than inflate engagement metrics. According to Malwarebytes, many services selling social media growth operate through deceptive practices that can expose customers to scams, stolen accounts, and financial loss. The […]
Buying TikTok followers can expose users to scams and account theft Read More »
Exposed credentials are giving attackers a head start many organizations don’t see 2026-07-30 at 07:00 By Anamarija Pogorelec Compromised credentials can remain active long after passwords are created, leaving organizations trying to identify exposed accounts before attackers can use them. The 2026 Credential Risk Report from Enzoic shows growing awareness of the problem, but monitoring […]
Exposed credentials are giving attackers a head start many organizations don’t see Read More »
Claude can now sign into websites with 1Password without exposing your credentials 2026-07-17 at 12:17 By Anamarija Pogorelec 1Password has introduced 1Password for Claude, a beta integration that lets Anthropic’s AI assistant complete browser tasks requiring authentication without accessing users’ passwords or other secrets. The integration is available to paid Claude subscribers (Pro, Max, Team, […]
Claude can now sign into websites with 1Password without exposing your credentials Read More »
Ransom demands are down, email is the top way attackers get in 2026-07-16 at 08:00 By Mirko Zorz An employee opens an email that looks like any other, clicks a link, and gives up a password without noticing. A stolen login opens a door deeper in the network. Files stop opening a few days later. […]
Ransom demands are down, email is the top way attackers get in Read More »
Threat actor impersonated hundreds of brands on GitHub to push infostealer malware 2026-07-15 at 16:52 By Zeljka Zorz A financially motivated threat actor is impersonating hundreds of brands on GitHub and pushing a smash-and-grab infostealer masquerading as legitimate downloads of popular software, Arctic Wolf threat researchers have warned. “The 292 impersonated repositories span security tooling, […]
Threat actor impersonated hundreds of brands on GitHub to push infostealer malware Read More »
Fake OAuth client IDs are helping attackers slip past sign-in logs 2026-07-13 at 15:10 By Mirko Zorz Attackers running account enumeration against Microsoft cloud tenants have added a step that keeps their probing out of the usual telemetry. They spoof the OAuth client ID, the globally unique identifier assigned to an application and passed as […]
Fake OAuth client IDs are helping attackers slip past sign-in logs Read More »
SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) 2026-06-30 at 13:25 By Zeljka Zorz Attackers are exploiting CVE-2026-48558, a recently patched authentication bypass vulnerability in SimpleHelp RMM, to drop the novel Djinn Stealer malware on victim computers. The malware is capable of targeting Windows, macOS, and Linux systems, and “collects credentials associated with cloud […]
SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) Read More »
FortiBleed: 86,000 Fortinet Device Credentials Compromised 2026-06-19 at 13:48 By Ionut Arghire The large-scale credential theft campaign hit roughly half of the internet-accessible Fortinet firewalls and VPNs. The post FortiBleed: 86,000 Fortinet Device Credentials Compromised appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
FortiBleed: 86,000 Fortinet Device Credentials Compromised Read More »
74,000 Fortinet firewall credentials exposed in FortiBleed data leak 2026-06-18 at 15:10 By Zeljka Zorz A Russian-speaking cybercriminal group has stolen credentials contained in the configuration files of nearly 74,000 Fortinet firewalls and VPN gateways around the world. The data was accidentally exposed by the group on a server, along with other artifacts and tools, […]
74,000 Fortinet firewall credentials exposed in FortiBleed data leak Read More »
Microsoft Entra pushes passkeys, tightens identity security 2026-06-02 at 15:47 By Anamarija Pogorelec Microsoft has released multiple identity and network access capabilities for Entra, its family of identity and network access products that help organizations implement a zero trust security strategy, over the last 30 days. Features reaching general availability Identity and authentication updates Phishing-resistant […]
Microsoft Entra pushes passkeys, tightens identity security Read More »