Latest cybersecurity reporting from selected sources.

GitBait phishing kit abuses GitHub Pages and the SheetBest API to steal Mexican banking credentials

Microsoft researchers warn of a large-scale phishing campaign using fake compliance emails to steal credentials, targeting 35,000 users across 13,000 organizations worldwide

Deep#Door Python RAT uses tunneling and obfuscation to evade detection and steal credentials

Malicious npm packages spread via worm-like propagation and steal developer credentials

Newly identified malicious campaigns are linked to virtual private servers modified by APT28 to operate as malicious DNS servers

A large-scale credential theft campaign targeting senior executives has been linked to a previously unknown automated phishing platform called Venom

This modern infostealer adopted server-side decryption of stolen credentials to bypass security controls

Venom Stealer malware-as-a-service automates ClickFix social engineering, credential and crypto exfiltration

Tax-season phishing floods deliver RMM malware, credential theft, BEC and tax-form scams

Socket and Endor Labs discovered a new TeamPCP campaign leading to the delivery of credential-stealing malware

Python package LiteLLM compromised with credential-stealing malware linked to TeamPCP threat group

New phishing campaign dubbed Operation DoppelBrand targeted major financial firms like Wells Fargo

VoidLink, a Linux-based C2 framework, facilitates credential theft, data exfiltration across clouds

Multi-stage attack begins with fake message relating to business requests and evades detection with link hidden in a PDF

An eSentire report showed credential theft accounted for 74% of all observed cyber threats in 2025

Phishing attacks have been identified using fake PayPal alerts to exploit remote monitoring and management tools

Cybersecurity researchers issue warning over a surge in attacks designed to trick Facebook users into handing over login credentials

A new macOS malware chain using staged scripts and a Go-based backdoor has been attributed to FlexibleFerret, designed to steal credentials and maintain system access

Socura finds 460,000 compromised credentials belonging to FTSE 100 company employees

Atroposia is a newly discovered modular RAT that uses encrypted channels and advanced theft capabilities to target credentials and crypto wallets