GoKawiil
Tech News
Hackers are increasingly stealing login credentials for AI services and reselling access to the underlying computing power on black markets, according to reporting on the trend. The demand reflects how costly and scarce AI computing resources have become as model usage grows.
Cisco Talos researchers identified a new infostealer strain, internally dubbed Volta-Autodoxer, that after harvesting credentials, cookies and financial data compiles the stolen information and sends it to commercial LLMs. The AI is prompted to act as an intelligence analyst, producing a structured, citation-backed profile of the victim to help attackers prioritize high-value targets. Talos says it detected the malware via its new CAIRN framework but has not confirmed it is being used in active attacks.
Cofense reports an ongoing phishing campaign, active since September, that impersonates Anthropic by offering fake early access to a supposed new AI social media tool. Victims who click through are routed via GoTo Webinar links to a spoofed Zoom sign-in page designed to harvest Google or Microsoft account credentials through SSO.
The Florida Department of Highway Safety and Motor Vehicles confirmed that a hacker used compromised login credentials to access driver's license and motor vehicle records, including document images, on September 4, 2026. The agency is notifying affected residents and offering one year of free credit monitoring, though it says it lacks current contact information for some former Florida residents whose data was exposed.
Security researchers have identified a new Android malware strain called Hirudo that replaces legitimate banking apps with modified versions. These tampered apps disable built-in security checks, allowing the malware to capture users' bank account credentials.
Mandiant detailed an August 4, 2026 Akira ransomware intrusion in which an affiliate brute-forced a SonicWall SSL VPN account that had no multi-factor authentication, gaining access within minutes. The attacker then used RDP to reach the domain controller, enumerate Active Directory, and steal credentials and file-share data, though the ransomware payload itself failed to deploy. Mandiant's 2025 data shows compromised credentials caused 21% of ransomware incidents with a known entry point, and RDP was used for lateral movement in about 85% of cases.
ASOS revealed that hackers impersonated a trusted contact to obtain an employee’s login details, which were then used to access data on third-party platforms. The breach exposed customer names, contact information, and some non-sensitive account data, but not payment details or passwords. The company has secured affected systems and is investigating with external support and authorities.
Cybersecurity firm SpyCloud analyzed over 66,000 public-facing systems tied to roughly 10,000 EPA-registered water and wastewater organizations and discovered that infostealer malware had already harvested login credentials from 1,787 of them. At least 250 of those organizations had exposed credentials that could grant access to operational networks controlling physical pumps and water flow. In one case, malware on a device belonging to a metering technology vendor exposed passwords for 167 utilities that relied on its services.
Google's Threat Intelligence Group disclosed a credential-harvesting operation where attackers compromised cloud infrastructure and deployed a multi-agent AI framework that scanned for vulnerabilities, fixed its own errors, and rotated IP addresses largely without human input. The entire campaign, which compromised thousands of third-party credentials, took less than six hours to execute. Separately, Microsoft found AI-assisted phishing messages reaching click-through rates of 54%, compared to roughly 12% for conventional campaigns.
Google's Threat Intelligence Group reports that attackers are moving from simple AI-assisted coding to fully autonomous, multi-agent systems that plan and execute entire attacks with little human input. In one case, a financially motivated actor compromised cloud infrastructure and used an AI coding chatbot with markdown-based agent instructions to build and run a mass credential-harvesting operation in under six hours. Separately, researchers found an exposed command-and-control server running a framework called 'Recon' that autonomously managed reconnaissance and tens of thousands of harvested credentials.
METR, a nonprofit that evaluates risks in frontier AI models, revealed it suffered two cybersecurity incidents this year. In March, attackers stole an API key used for public-model inference and used it for weeks to run up a large number of credits, while in May attackers unsuccessfully probed an exposed endpoint attempting to reach internal data.