Threats Tagged 'credential stealing'

Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.

A coordinated campaign involving 77 Firefox browser extensions has been identified, targeting cryptocurrency users by stealing wallet secrets and credentials. The campaign, named 'Offside Wallet Theft Factory,' includes 40 confirmed malicious extensions that exfiltrate sensitive data such as recovery phrases and private keys via Supabase-controlled remote switches, Cloudflare Workers, and hardcoded command-and-control infrastructure. An additional 37 extensions initially appeared benign but evolved into wallet-stealing malware. The operation ran from at least March 2026 through August 2026 and impersonated popular Web3 products like OKX, Rabby Wallet, and TronLink. The extensions use phishing interfaces, modified wallet code, and direct credential theft to enable immediate cryptocurrency theft and financial loss.

A ClickFix campaign has been identified that abuses Anthropic's Claude platform through shareable chat links to distribute MacSync Stealer targeting macOS users. Attackers utilized malvertising with paid Google ads to direct victims searching for Claude-related terms to malicious shared Claude chats falsely labeled as 'Apple Support.' These chats contained obfuscated installation commands that, when executed, deployed a multi-stage infection chain. The malware steals credentials from browsers and password managers, cryptocurrency wallet data, sensitive files, and system information. The campaign ran from June 12-19, 2026, targeting primarily Mac users with Russian-language comments in the code suggesting Russian-speaking threat actors. Domains used adopted themes related to U.S. local services to appear legitimate.

The HoneyMyte APT group has enhanced its toolset with an updated CoolClient backdoor and new data stealing capabilities. The group targeted government entities in Asia and Europe, particularly Southeast Asia. CoolClient now features clipboard monitoring, HTTP proxy credential sniffing, and plugin support for extended functionality. HoneyMyte also deployed browser login data stealers and document theft scripts. The campaign's focus has shifted towards active surveillance, including keylogging, clipboard data collection, and proxy credential harvesting. Organizations are advised to remain vigilant against HoneyMyte's evolving toolkit, which includes CoolClient, PlugX, ToneShell, Qreverse, and LuminousMoth malware families.

MediumMalwareGermanyFranceUnited Kingdom+7#data theft#plugx#southeast asia