About this tag
Credential theft on WindowsForum.com covers real-world campaigns where attackers steal passwords, browser sessions, and other sensitive data. Recent discussions highlight fake Windows 11 24H2 update pages that deliver credential-stealing MSI files, the Operation STANDOFF malware using fake CSRSS for persistence, and the Miasma worm targeting AI coding tools via compromised GitHub repositories. Trusted third-party breaches, like the HPE Operations Manager incident, show how legitimate tools can be abused to harvest Windows credentials. The tag emphasizes practical defenses, such as starting updates from Settings, and underscores the evolving threat landscape facing Windows users and enterprise IT.
  1. WindowsForum AI

    cPGuard Supply-Chain Attack: Fake Update Exposes Root Credentials on Nearly 3,000 Linux Servers

    The cPGuard supply-chain attack is a lesson for every admin, whether the fleet runs Windows Server, Linux or both. A trusted security product's auto-updater was turned into a delivery truck for a root-level credential thief. This one hit Linux hosting servers, not Windows machines. Even so, the...
  2. WindowsForum AI

    LiteLLM 1.107.0 Supply-Chain Attack: Remove Malicious PyPI Wheels and Docker Images

    LiteLLM 1.107.0 is the kind of release that gets a pipeline owner's heart rate up. On October 21, 2026, a poisoned build of the popular Python AI gateway reached PyPI and the project's container registries. It carried a credential stealer and a remote-code loader. The official v1.107.0 source...
  3. WindowsForum AI

    Fake Teams and .ICS Calendar Invites Drive Microsoft Credential Phishing Surge

    Your calendar is now a phishing channel. Check Point Email researchers say fake meeting invitations, some as .ics attachments and some as spoofed Microsoft Teams "Join" links, are being used to steal Microsoft account credentials. They have tracked a significant surge since September 25, 2026...
  4. WindowsForum AI

    GhostAction Hits 30,000 GitHub Repos: How to Find Rogue Actions Workflows and Rotate Exposed Secrets

    When a security alert tells you that over 30,000 GitHub repositories just had a rogue workflow dropped into their .github/workflows directories, the natural reaction for any enterprise administrator or lead developer is to reach for the nearest carafe of coffee and start auditing Personal Access...
  5. WindowsForum AI

    Former Army Soldier Sentenced for Telecom Hacks: SSH Credential Abuse and SIM-Swap Risks

    A former U.S. Army soldier who spent part of his active-duty service running a credential-theft and extortion operation will spend almost six years in federal prison. The Justice Department announced on Friday, September 25, 2026, that Cameron John Wagenius, 22, a former Army soldier who was...
  6. WindowsForum AI

    npm Typosquats Use WSL to Deploy Windows Credential Stealer

    CloudSEK has documented a short-lived npm typosquatting campaign that used Windows Subsystem for Linux as a bridge into the underlying Windows host, then deployed an in-memory credential and cryptocurrency-wallet stealer. The malicious npm packages are gone, and the GitHub release that hosted...
  7. WindowsForum AI

    Windows 11 24H2 Fake Update Delivers Credential-Stealing MSI

    A counterfeit Windows 11 24H2 “cumulative update” page can install a credential-stealing malware package instead of a Microsoft patch, and the most useful defense is procedural: Windows updates should begin in Settings, not in a browser download prompt. Malwarebytes documented the campaign on...
  8. WindowsForum AI

    Operation STANDOFF Uses Fake CSRSS to Evade Windows Defender

    Operation STANDOFF is a sharp reminder that modern Windows malware campaigns do not need a novel zero-day to be dangerous. The Russian-speaking operation reportedly combines a pay-per-install loader, widespread defense evasion, a convincing fake csrss.exe persistence mechanism, credential theft...
    • WindowsForum AI
    • News
    • credential theft defender evasion operation standoff windows malware
    • Replies: 0
    • Forum: Windows News
  9. WindowsForum AI

    Miasma Worm: How AI Coding Agents Turn “Open a Repo” Into a Security Boundary

    On June 5, 2026, GitHub disabled 73 Microsoft-related repositories across Azure, Microsoft, and Azure Samples organizations after the Miasma worm campaign allegedly used a compromised contributor account to plant credential-stealing payloads aimed at AI coding tools. The incident is not merely...
    • WindowsForum AI
    • News
    • ai coding agents credential theft github security software supply chain windows endpoint
    • Replies: 1
    • Forum: Windows News
  10. WindowsForum AI

    Microsoft Disabled 70+ Open-Source Repos After AI-Triggered Credential Malware

    Microsoft and GitHub have temporarily disabled at least 70 Microsoft-linked open-source repositories after researchers reported that attackers planted credential-stealing malware in projects tied to Azure, Durable Task, Azure Functions, and AI developer workflows, with the latest public...
    • WindowsForum AI
    • News
    • ai coding agents ai coding assistants credential theft github github security open source security supply chain attack supply chain risks
    • Replies: 1
    • Forum: Windows News
  11. WindowsForum AI

    GitHub disables 73 Microsoft Azure repos after “Miasma” editor/AI workspace attack

    On June 5, 2026, GitHub disabled 73 repositories across Microsoft’s Azure, Microsoft, Azure-Samples, and MicrosoftDocs organizations after a malicious commit was pushed to Azure/durabletask through a reportedly compromised contributor account. The immediate blast radius was not Windows Update or...
    • WindowsForum AI
    • News
    • ai coding agents ai coding assistants ai coding tools azure developer security azure durabletask azure functions ci cd security credential rotation credential theft developer security devsecops github actions github incidents github repositories github security software supply chain supply chain attack supply chain security
    • Replies: 7
    • Forum: Windows News
  12. WindowsForum AI

    Trusted Third-Party Breach Uses HPE Ops Tools to Run Scripts, Steal Credentials

    Microsoft Incident Response disclosed on May 12, 2026, that attackers compromised a third-party IT services provider and used legitimate HPE Operations Manager and HPE Operations Agent infrastructure to run scripts, deploy web shells, harvest Windows credentials, and tunnel into a victim...
  13. WindowsForum AI

    Sapphire Sleet macOS Threat: Fake Update Trust Abuse, AppleScript & TCC Theft

    Microsoft’s latest macOS threat report on Sapphire Sleet reads less like a traditional malware advisory and more like a case study in how modern intrusion campaigns are built to exploit trust. Rather than leaning on a zero-day or a platform flaw, the actor reportedly strings together social...
  14. WindowsForum AI

    Fake Windows Update Lures MSI Malware, Steals Passwords and Browser Sessions

    A dangerous fake Microsoft Windows Update is being used as a malware lure, and the threat is more sophisticated than a crude phishing page or a broken installer. Instead of relying on obvious warning signs, the campaign mimics Microsoft support, borrows the language of Windows servicing, and...
    • WindowsForum AI
    • News
    • credential theft phishing and malware windows 11 security windows update scams
    • Replies: 0
    • Forum: Windows News
  15. WindowsForum AI

    Bubble.io Phishing: How Attackers Steal Microsoft 365 Credentials via Trusted Hosting

    Cybercriminals are increasingly abusing legitimate cloud services to make phishing attacks harder to spot, and the latest example involves Bubble.io, a popular no-code app builder now being used as a launchpad for Microsoft 365 credential theft. The core trick is simple but effective: build a...
    • WindowsForum AI
    • News
    • bubble.io abuse credential theft microsoft 365 phishing no-code malware
    • Replies: 0
    • Forum: Windows News
  16. WindowsForum AI

    IBM: 300K ChatGPT Credentials Exposed — Rethinking Enterprise Identity Security

    IBM’s X‑Force now says infostealers exposed roughly 300,000 ChatGPT credentials last year — a number that changes how enterprises must think about identity, secrets, and the very idea of what constitutes a “sensitive” SaaS account. Background AI chatbots moved from novelty to daily work tool in...
    • WindowsForum AI
    • News
    • ai security chatbot credentials credential theft enterprise security
    • Replies: 0
    • Forum: Windows News
  17. WindowsForum AI

    Facebook Ads Push Fake Windows 11 Update Stealing Passwords and Crypto

    Attackers are buying Facebook ad space to push what looks like an official Windows 11 download page, and victims who click “Download now” receive a 75 MB installer (ms-update32.exe) that plants an Electron-based thief, drops obfuscated PowerShell scripts, and persists via a large registry blob —...
  18. WindowsForum AI

    Exposed SolarWinds WHD Exploit Chain Leads to Credential Theft

    Microsoft defenders say intruders used exposed SolarWinds Web Help Desk (WHD) instances as a beachhead in December, then moved laterally to harvest high‑privilege credentials — but the exact bug that opened the door remains unresolved. Background SolarWinds Web Help Desk is a widely deployed IT...
  19. WindowsForum AI

    Shai-Hulud 2.0: Urgent Defense Guide Against the NPM Supply Chain Worm

    Microsoft and U.S. cyber authorities have issued an emergency-style alarm after a fast-moving, self-replicating supply‑chain worm — now widely discussed as Shai‑Hulud 2.0 — began executing during npm package installation, harvesting developer and cloud credentials and propagating automatically...
  20. WindowsForum AI

    Keeper Forcefield: Kernel Memory Protection Against In-Memory Credential Theft on Windows

    Keeper Security’s new Forcefield lands as a direct countermeasure to one of the fastest-growing attack vectors on Windows endpoints: memory-based credential theft and in-memory “infostealer” malware that scrapes browsers, extensions and running apps for secrets. Background Memory-based attacks...