Cybercrime | CSO Online

Stolen AI credentials feed growing LLM proxy economy

More than 80,000 proxy servers have been observed cloaking the origin of traffic to frontier models, likely using AI credentials harvested via information stealers, phishing campaigns, and supply-chain attacks.

By Lucian Constantin

Sep 28, 20266 mins

APIsAccess ControlCybercrime

Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’

By Evan Schuman

Sep 21, 20267 mins

Artificial IntelligenceCybercrimeHacking

New npm malware finds a way around install script defenses

By Shweta Sharma

Sep 21, 20263 mins

Code SecurityCybercrimeMalware

Articles

GhostCode attackers abuse device codes to take over Microsoft 365 accounts

A new phishing kit abuses a legitimate Microsoft device authorization flow to steal authentication tokens, register attacker-controlled devices and gain persistent access to a victim’s Microsoft 365 environments.

By Shweta Sharma

Sep 18, 2026 4 mins

AuthenticationMultifactor AuthenticationPhishing

You don’t have to join the hack-back program to inherit its risk

Washington's new private offensive cyber program gives vetted vendors an untested criminal shield while leaving substantial residual risk in private hands. Underwrite that exposure before the operating rules arrive in October.

By Collin Hogue-Spears

Sep 16, 2026 9 mins

GovernmentHackingLaws and Regulations

Hundreds of OpenAI agents attack RubyGems platform

Analyst argues that OpenAI’s depiction of the agents as ‘benign’ may pose a greater threat than the attack itself, generating SOC AI alert fatigue.

By Evan Schuman

Sep 15, 2026 6 mins

CyberattacksCybercrimeRuby

Threat actors are coming for your AI assets to operationalize their use of AI

Threat groups are leveraging stolen AI credentials and victim cloud environments to launch distillation attacks and build AI-powered exploitation and post-exploitation pipelines.

By Lucian Constantin

Sep 15, 2026 6 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Cybersecurity needs a new operating model

Why AI is changing how organizations achieve cyber resilience.

By Stephen Gates, Horizon3.ai

Aug 6, 2026 5 mins

CyberattacksSecurity

India’s STPI serves TerminalFix-style attack via fake Cloudflare check

A government organization providing cloud infrastructure to Indian companies is inadvertently distributing malware.

By Gyana Swain

Sep 11, 2026 5 mins

CyberattacksGovernmentGovernment IT

Anthropic finds evidence of a fourth AI escaping from containment

After plowing through four million more chat transcripts, though, it hasn’t found any further incidents.

By Maxwell Cooter

Sep 11, 2026 2 mins

Artificial IntelligenceCyberattacksCybercrime

Attackers use passkey-themed scams to hijack Microsoft 365 accounts

Microsoft says threat actors posing as IT helpdesk staff are tricking employees into phishing and device-code attacks that lead to persistent cloud access.

By Shweta Sharma

Sep 11, 2026 4 mins

CybercrimeSecuritySocial Engineering

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

By compromising BIG-IP APM systems, attackers may gain access to credentials, SSO tokens and trusted pathways into downstream applications.

By Shweta Sharma

Sep 10, 2026 4 mins

CybercrimeMalwareSecurity

ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel

Cross-account task execution exposed Gmail data without user awareness, raising new concerns for enterprise AI security.

By Gyana Swain

Sep 9, 2026 5 mins

Artificial IntelligenceData BreachIT Governance

ShinyHunters claims Florida DMV breach, puts data on the clock

The ransomware group claims it breached the state’s DAVID database and has threatened to publish the allegedly stolen records after a September 11 deadline.

By Shweta Sharma

Sep 9, 2026 4 mins

CybercrimeMalwareRansomware