#credentialstealer — Public Fediverse posts

Arch Linux AUR Packages Targeted in Credential Stealer Campaign

Malicious actors have hijacked over 400 Arch Linux AUR packages, quietly altering their build scripts to deploy a sneaky Rust credential stealer in a campaign dubbed Atomic Arch. By targeting abandoned packages and preserving their original names and histories, the attackers cleverly evaded detection.

https://osintsights.com/arch-linux-aur-packages-targeted-in-credential-stealer-campaign?utm_source=mastodon&utm_medium=social

#ArchLinux #Aur #CredentialStealer #Rust #SupplyChain

#npm-Wurm #ShaiHulud: Angriff der Klone | Security https://www.heise.de/news/npm-Wurm-Shai-Hulud-Angriff-der-Klone-11299094.html #OpenSource #DDoS #Malware #CredentialStealer

#SupplyChain-Angriff auf #TanStack: 42 Pakete kompromittiert | Developer https://www.heise.de/news/Supply-Chain-Angriff-auf-TanStack-42-Pakete-kompromittiert-11290715.html #npm #MiniShaiHulud #Patchday #CredentialStealer

Oh no. Here we go again! Another wave of compromised #npm packages. Check your dependencies! This time it even deletes your home directory, if it does not find any secrets 😱

https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

And it appears that the worm is quite successful again: https://github.com/search?q=sha1-hulud&type=repositories

#ShaiHulud #Malware #CredentialStealer #SupplyChain #SupplyChainAttack #InfoSec

Here’s how potent Atomic credential stealer is finding its way onto Macs - Ads prominently displayed on search engines are impersonatin... - https://arstechnica.com/security/2025/09/potent-atomic-credential-stealer-can-bypass-gatekeeper/ #credentialstealer #malvertising #security #biz⁢ #atomic #apple #macos #amos

Rhadamanthys Stealer has it's own web, I had missed that completely.

Yet another sign that the Stealer market is growing, maturing and getting increasingly professional and an important part of the ecosystem.

#ThreatIntelligence #Stealer #CredentialStealer #Malware

Any thoughts on how many Credential Stealer families rely on using the Telegram API Bot endpoint for exfiltrating / copying information from infected devices?

Trying to assess the potential for leveraging that observation for some simple detection rules of potential stealer infections.

Any hot takes?

[ #ThreatIntel #DetectionEngineering #CredentialStealer ]