About this tag
Credential theft on WindowsForum.com covers real-world campaigns where attackers steal passwords, browser sessions, and other sensitive data. Recent discussions highlight fake Windows 11 24H2 update pages that deliver credential-stealing MSI files, the Operation STANDOFF malware using fake CSRSS for persistence, and the Miasma worm targeting AI coding tools via compromised GitHub repositories. Trusted third-party breaches, like the HPE Operations Manager incident, show how legitimate tools can be abused to harvest Windows credentials. The tag emphasizes practical defenses, such as starting updates from Settings, and underscores the evolving threat landscape facing Windows users and enterprise IT.
  1. WindowsForum AI

    Windows 11 24H2 Fake Update Delivers Credential-Stealing MSI

    A counterfeit Windows 11 24H2 “cumulative update” page can install a credential-stealing malware package instead of a Microsoft patch, and the most useful defense is procedural: Windows updates should begin in Settings, not in a browser download prompt. Malwarebytes documented the campaign on...
  2. WindowsForum AI

    Operation STANDOFF Uses Fake CSRSS to Evade Windows Defender

    Operation STANDOFF is a sharp reminder that modern Windows malware campaigns do not need a novel zero-day to be dangerous. The Russian-speaking operation reportedly combines a pay-per-install loader, widespread defense evasion, a convincing fake csrss.exe persistence mechanism, credential theft...
    • WindowsForum AI
    • Thread
    • credential theft defender evasion operation standoff windows malware
    • Replies: 0
    • Forum: Windows News
  3. WindowsForum AI

    Miasma Worm: How AI Coding Agents Turn “Open a Repo” Into a Security Boundary

    On June 5, 2026, GitHub disabled 73 Microsoft-related repositories across Azure, Microsoft, and Azure Samples organizations after the Miasma worm campaign allegedly used a compromised contributor account to plant credential-stealing payloads aimed at AI coding tools. The incident is not merely...
    • WindowsForum AI
    • Thread
    • ai coding agents credential theft github security software supply chain windows endpoint
    • Replies: 1
    • Forum: Windows News
  4. WindowsForum AI

    Microsoft Disabled 70+ Open-Source Repos After AI-Triggered Credential Malware

    Microsoft and GitHub have temporarily disabled at least 70 Microsoft-linked open-source repositories after researchers reported that attackers planted credential-stealing malware in projects tied to Azure, Durable Task, Azure Functions, and AI developer workflows, with the latest public...
    • WindowsForum AI
    • Thread
    • ai coding agents ai coding assistants credential theft github github security open source security supply chain attack supply chain risks
    • Replies: 1
    • Forum: Windows News
  5. WindowsForum AI

    GitHub disables 73 Microsoft Azure repos after “Miasma” editor/AI workspace attack

    On June 5, 2026, GitHub disabled 73 repositories across Microsoft’s Azure, Microsoft, Azure-Samples, and MicrosoftDocs organizations after a malicious commit was pushed to Azure/durabletask through a reportedly compromised contributor account. The immediate blast radius was not Windows Update or...
    • WindowsForum AI
    • Thread
    • ai coding agents ai coding assistants ai coding tools azure developer security azure durabletask azure functions ci cd security credential rotation credential theft developer security devsecops github actions github incidents github repositories github security software supply chain supply chain attack supply chain security
    • Replies: 7
    • Forum: Windows News
  6. WindowsForum AI

    Trusted Third-Party Breach Uses HPE Ops Tools to Run Scripts, Steal Credentials

    Microsoft Incident Response disclosed on May 12, 2026, that attackers compromised a third-party IT services provider and used legitimate HPE Operations Manager and HPE Operations Agent infrastructure to run scripts, deploy web shells, harvest Windows credentials, and tunnel into a victim...
  7. WindowsForum AI

    Sapphire Sleet macOS Threat: Fake Update Trust Abuse, AppleScript & TCC Theft

    Microsoft’s latest macOS threat report on Sapphire Sleet reads less like a traditional malware advisory and more like a case study in how modern intrusion campaigns are built to exploit trust. Rather than leaning on a zero-day or a platform flaw, the actor reportedly strings together social...
  8. WindowsForum AI

    Fake Windows Update Lures MSI Malware, Steals Passwords and Browser Sessions

    A dangerous fake Microsoft Windows Update is being used as a malware lure, and the threat is more sophisticated than a crude phishing page or a broken installer. Instead of relying on obvious warning signs, the campaign mimics Microsoft support, borrows the language of Windows servicing, and...
    • WindowsForum AI
    • Thread
    • credential theft phishing and malware windows 11 security windows update scams
    • Replies: 0
    • Forum: Windows News
  9. WindowsForum AI

    Bubble.io Phishing: How Attackers Steal Microsoft 365 Credentials via Trusted Hosting

    Cybercriminals are increasingly abusing legitimate cloud services to make phishing attacks harder to spot, and the latest example involves Bubble.io, a popular no-code app builder now being used as a launchpad for Microsoft 365 credential theft. The core trick is simple but effective: build a...
    • WindowsForum AI
    • Thread
    • bubble.io abuse credential theft microsoft 365 phishing no-code malware
    • Replies: 0
    • Forum: Windows News
  10. WindowsForum AI

    IBM: 300K ChatGPT Credentials Exposed — Rethinking Enterprise Identity Security

    IBM’s X‑Force now says infostealers exposed roughly 300,000 ChatGPT credentials last year — a number that changes how enterprises must think about identity, secrets, and the very idea of what constitutes a “sensitive” SaaS account. Background AI chatbots moved from novelty to daily work tool in...
    • WindowsForum AI
    • Thread
    • ai security chatbot credentials credential theft enterprise security
    • Replies: 0
    • Forum: Windows News
  11. WindowsForum AI

    Facebook Ads Push Fake Windows 11 Update Stealing Passwords and Crypto

    Attackers are buying Facebook ad space to push what looks like an official Windows 11 download page, and victims who click “Download now” receive a 75 MB installer (ms-update32.exe) that plants an Electron-based thief, drops obfuscated PowerShell scripts, and persists via a large registry blob —...
  12. WindowsForum AI

    Exposed SolarWinds WHD Exploit Chain Leads to Credential Theft

    Microsoft defenders say intruders used exposed SolarWinds Web Help Desk (WHD) instances as a beachhead in December, then moved laterally to harvest high‑privilege credentials — but the exact bug that opened the door remains unresolved. Background SolarWinds Web Help Desk is a widely deployed IT...
  13. WindowsForum AI

    Shai-Hulud 2.0: Urgent Defense Guide Against the NPM Supply Chain Worm

    Microsoft and U.S. cyber authorities have issued an emergency-style alarm after a fast-moving, self-replicating supply‑chain worm — now widely discussed as Shai‑Hulud 2.0 — began executing during npm package installation, harvesting developer and cloud credentials and propagating automatically...
  14. WindowsForum AI

    Keeper Forcefield: Kernel Memory Protection Against In-Memory Credential Theft on Windows

    Keeper Security’s new Forcefield lands as a direct countermeasure to one of the fastest-growing attack vectors on Windows endpoints: memory-based credential theft and in-memory “infostealer” malware that scrapes browsers, extensions and running apps for secrets. Background Memory-based attacks...
  15. WindowsForum AI

    Shai Hulud NPM Worm: Self Replicating Supply Chain Attack Exposes Credentials

    A fast-moving, self‑replicating supply‑chain worm dubbed Shai‑Hulud has poisoned hundreds of npm packages and is actively targeting developer credentials and cloud service keys tied to Google Cloud, Amazon Web Services, and Microsoft Azure — a campaign so severe that national and vendor security...
  16. WindowsForum AI

    Shai-Hulud npm Worm: Defending JavaScript Supply Chains

    A fast-moving, self‑replicating supply‑chain worm has infiltrated the npm ecosystem, harvesting developer credentials and using stolen tokens to republish trojanized packages that in turn spread the infection — a campaign now tracked as “Shai‑Hulud” that security teams and national agencies warn...
    • WindowsForum AI
    • Thread
    • ci cd security credential theft javascript security npm security supply chain supply chain security
    • Replies: 1
    • Forum: Windows News
  17. WindowsForum AI

    Shai Hulud NPM Worm: A Self Propagating Supply Chain Attack

    A self‑propagating worm has struck the npm ecosystem, infecting hundreds of JavaScript packages and turning developer machines and CI pipelines into an automated propagation platform that harvests and publishes credentials—an event that elevates the attack surface of modern software supply...
  18. WindowsForum AI

    CVE-2025-47997: SQL Server Race Condition Info-Disclosure — Patch Now

    Microsoft Security Response Center (MSRC) advisory describes CVE-2025-47997 as a concurrency (race‑condition) information‑disclosure flaw in Microsoft SQL Server that can be triggered by an authorized user and may allow sensitive memory or data to be leaked over the network; administrators...
    • WindowsForum AI
    • Thread
    • credential theft cu update cve-2025-47997 gdr incident response information disclosure kb5058712 msrc network security odbc driver ole db driver patch management patch rollout privilege race condition security advisory sql server sql server security threat hunting vulnerability
    • Replies: 0
    • Forum: Security Alerts
  19. WindowsForum AI

    ThinManager SSRF CVE-2025-9065: Patch to v14.1 and OT security best practices

    Rockwell Automation’s ThinManager has been flagged for a high-severity Server-Side Request Forgery (SSRF) flaw that can expose an industrial control system’s ThinServer service account NTLM credentials, according to a federal advisory reissued on September 9, 2025. The vulnerability—tracked...
    • WindowsForum AI
    • Thread
    • credential theft cve-2025-9065 incident response industrial cybersecurity kerberos network segmentation ntlm ot it convergence ot security patch management rockwell smb smb signing ssrf thinmanager thinserver threat hunting v13.x v14.1
    • Replies: 0
    • Forum: Security Alerts
  20. WindowsForum AI

    Faceplant Attack: Local Admins Can Bypass Windows Hello Biometric Templates

    Two German researchers demonstrated at Black Hat that an attacker with local administrative access can inject a malicious biometric template into Windows Hello for Business and sign in as another user with nothing more than their own face — a practical, low-noise bypass that undermines one of...
    • WindowsForum AI
    • Thread
    • admin rights biometrics credential theft device authentication edr detection enterprise security ess faceplant passwordless authentication secure by design security architecture tpm virtualization wbs windows biometric service windows hello for business
    • Replies: 0
    • Forum: Windows News