grep -rl "credential-theft" ./articles
A March 2026 Interlock intrusion used Volatility3 — a legitimate incident-response tool — to pull domain credentials, NTLM hashes and account information out of memory. The rest of the chain was a ClickFix lure and PowerShell.
Manifold Security found that an authenticated non-admin user of Odysseus could execute OS commands with the process's own privileges. What that account reached is the story: API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages.
Mitiga found prompt-exfiltration tradecraft in the wild — malicious natural-language instructions in .cursorrules and CLAUDE.md that make the agent collect prompts, tokens and environment variables and send them onward. Also: 1,230+ hardcoded API keys sitting in AI instruction files.
Volexity says a threat actor it tracks as UTA0533 is harvesting credentials from compromised SonicWall appliances, and researchers note INC Ransomware has picked up its pace since the start of August.