Threats Tagged 'leaked'

This writeup describes a vulnerability chain starting from leaked account credentials leading to remote code execution (RCE) on a web server. The attacker discovered exposed functions without rate limiting that allowed enumeration of valid accounts and credential leakage. Using the leaked credentials, the attacker gained account access and found a file upload feature that accepted .shtml files. Leveraging Server-Side Includes (SSI) support, the attacker executed server-side commands and bypassed firewall restrictions to achieve RCE. The vulnerabilities were responsibly disclosed and patched.

A large collection of 142,000 attacker files was leaked, revealing detailed offensive operations by a threat actor. The leak includes agent transcripts, shell histories, reconnaissance data, exploit tools, stolen credentials, and victim evidence. Notably, the operator integrated AI coding agents into their attack workflow, bypassing approval checks and automating tasks via Telegram. The data dump also shows compromise of nearly 9,000 WordPress sites, a large reconnaissance corpus of 3.4 million hosts, cryptojacking activity, and an experimental blockchain-based command and control project. This leak provides insight into how AI agents are being used alongside traditional offensive tools at scale. No direct patch or remediation information is available from the source.

Flying Eagle Android RAT: Leaked Source Code, 170 Servers, and a Successor Called Night Dragon Source: https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon

On June 16, 2026, the full attendance list of Peter Thiel's private society, "Dialog," was leaked due to the list being hard-coded in the HTML of the official dialog.org website. The leak exposed the names of numerous influential individuals who were members of the society. The issue was subsequently fixed by the website owners. There is no indication of malicious activity related to the leak, and the list was preserved by a third party for archival purposes.

A user reported finding a trojan named "Servicehost.exe" on their PC, detected by Malwarebytes and identified via VirusTotal. The user is concerned that this malware may have recorded or leaked private calls. The report is based on a Reddit post linking to VirusTotal scan results, but no detailed technical or vendor advisory information is available. There is no confirmation of active exploitation or specific capabilities beyond the user's concern and VirusTotal detections.

Recent security news highlights that GitLab has surpassed Bitbucket in the number of leaked secrets, raising concerns about credential exposure in code repositories. Additionally, Microsoft has introduced Copilot Studio Security to enhance AI-assisted development security, and Amazon has improved its global DNS infrastructure. While no specific vulnerabilities or exploits are detailed, the increased leakage of secrets from GitLab repositories signals a growing risk of credential compromise. European organizations relying on GitLab for code hosting may face elevated risks of unauthorized access or data breaches if secrets are not properly managed. Mitigation requires enforcing strict secret scanning, adopting robust access controls, and integrating security tools that detect leaked credentials early. Countries with significant software development sectors and high GitLab adoption, such as Germany, France, and the UK, are more likely to be impacted. Given the medium severity rating and absence of direct exploits, the threat level is assessed as medium, emphasizing vigilance and proactive secret management. Defenders should prioritize secret hygiene, monitor repository exposures, and leverage new security tools to reduce risk.

MediumNewsGermanyFranceNetherlands+2#infosecnews#reddit#leaked

A threat actor known as "888" claims to have leaked sensitive LG Electronics data, including source code, configuration files, and hardcoded credentials, via a supply chain compromise through a contractor access point. The leak, currently unconfirmed by LG, could enable attackers to persist within LG systems, conduct lateral movement, and launch sophisticated phishing campaigns using exposed SMTP credentials. Source code exposure may reveal vulnerabilities in LG IoT devices, potentially impacting millions globally. The threat actor has a history of targeting major corporations and monetizing breaches via ransomware or data sales. This incident highlights risks associated with supply chain security and contractor access management. European organizations using LG products or connected to LG supply chains should be vigilant. The severity is assessed as high due to the sensitivity of leaked data and potential for widespread impact.

HighMalwareGermanyFranceItaly+7#netsec#reddit#high-priority

SysLeaks for Attackers is a newly launched data leak search service aimed at penetration testers and red teamers, providing access to leaked usernames, email addresses, plaintext passwords, and platform information tied to domain names. The service requires users to register with company emails from offensive security firms and excludes leaks from the last 14 days to give affected companies a grace period. Although it is in beta with usage limits, it aggregates leaked credentials that could be exploited for credential stuffing, phishing, or lateral movement. While no direct exploits or vulnerabilities are reported, the availability of such a service increases the risk of targeted attacks using real leaked credentials. European organizations could be impacted if their domains appear in the database, especially in countries with high adoption of targeted sectors or where offensive security firms operate extensively. Mitigation should focus on enhanced credential hygiene, monitoring for leaked credentials, and restricting access to sensitive systems. Given the nature of the service and its potential to facilitate attacks, the suggested severity is medium.

MediumBreachGermanyFranceNetherlands+4#netsec#reddit#leaked

The Eclipse Foundation revoked leaked Open VSX tokens after their exposure was discovered by Wiz. These tokens could have allowed unauthorized access to Open VSX services, potentially enabling malicious actors to manipulate or disrupt the open-source extension registry. Although no known exploits are currently active in the wild, the incident highlights risks related to leaked credentials in software supply chains. European organizations relying on Open VSX for development or distribution of extensions should be aware of the potential for unauthorized access and take immediate steps to verify token security. The threat is considered high severity due to the sensitive nature of the tokens and the potential impact on software integrity and availability. Mitigation involves auditing token usage, rotating credentials, and enhancing monitoring for suspicious activity. Countries with strong open-source ecosystems and significant software development sectors, such as Germany, France, and the Netherlands, are likely to be most affected. Vigilance is required to prevent exploitation and maintain trust in open-source infrastructure.

HighNewsGermanyFranceNetherlands+3#infosecnews#reddit#high-priority

A data breach involving House Democrats’ Resume Bank DomeWatch has resulted in the leak of thousands of Capitol Hill job applicants' personal data. The exposed information likely includes sensitive personal details submitted during the application process for government positions. Although no active exploits are known, the breach poses risks related to identity theft, phishing, and reputational damage. The leak was reported via Reddit and covered by an external news source, indicating limited public discussion so far. European organizations are indirectly affected, mainly through potential targeting of applicants or affiliated entities. Mitigation involves enhanced data protection policies, monitoring for misuse of leaked data, and improving access controls on recruitment databases. Countries with strong ties to US government operations or with significant diplomatic presence in Washington, D. C.are more likely to be impacted. The severity is assessed as medium due to the sensitivity of the data and the potential for misuse, despite the lack of direct system compromise or active exploitation.

MediumBreachGermanyFranceBelgium+4#infosecnews#reddit#leaked