Vercel breach exposes the OAuth gap most security teams cannot detect, scope or contain

One employee at Vercel adopted an AI tool. One employee at that AI vendor got hit with an infostealer. That combination created a walk-in path to Vercel’s production environments through an OAuth gr [...]

OpenAI lures private equity firms with guaranteed returns in race against Anthropic

OpenAI is sweetening the deal for private equity firms with a guaranteed 17.5 percent minimum return to win them over for enterprise joint ventures.<br /> The article OpenAI lures private equity [...]

Fake Reddit sites found pushing Lumma Stealer malware

Hackers are faking Reddit threads and WeTransfer files to try and trick users into downloading malware. [...]

Microsoft takes legal action against Lumma Stealer after 400,000 devices infected

Microsoft, DoJ, and FBI, disrupt the infostealer's infrastructure, seizing sites and more. [...]

Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke

Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards.The accounts Anthropic flagged were card-billed, self-serve [...]

Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke

Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards.The accounts Anthropic flagged were card-billed, self-serve [...]

How recruitment fraud turned cloud IAM into a $2 billion attack surface

A developer gets a LinkedIn message from a recruiter. The role looks legitimate. The coding assessment requires installing a package. That package exfiltrates all cloud credentials from the developerâ [...]

This devious phishing site repurposes legitimate web elements like CAPTCHA pages for malware distribution

Lumna Stealer uses trusted platforms, base64 encoding and modular malware delivery. [...]

For the 2nd time in weeks, Microsoft packages laced with credential stealer

73 packages run self-replicating stealer as soon as they're opened by an AI agent. [...]