u/Malwarebeasts

*Headline clarification - the breach involves many Stripe vendors but does not necessarily indicates a Stripe breach!

On August 18th, 2026, a data release occurred on the illicit forum pwnforums. The threat actor known as Satanic published sensitive information extracted from hundreds of vendors utilizing the Stripe payment platform.

The initial dump released on August 18th contained detailed information pertaining to 669 specific vendors, alongside 1,033 compromised API keys. The volume of the data is reported as 33GB.

Hudson Rock researchers spoke to the threat actors minutes after the release of the data. During this exchange, they claimed that the released data represents only a fraction of their total haul. According to the actor, they possess approximately 20,000 compromised Stripe APIs, which they intend to release in subsequent batches.

deep dive into the high profile organizations compromised in this campaign and detail the exact secrets, tokens, and configurations that likely fueled downstream extortion by groups like Vect ransomware (TeamPCP).

Companies breached include Mercor, Cisco, S&P Global, Telnyx, Telnyx, and the European Commission

Over the past week, a threat actor operating under the moniker “TheHatman” has flooded cybercrime forums with massive internal employee directories belonging to several Fortune 500 companies. The actor claims these dumps were extracted directly from the organizations’ Azure Tenants.

Our researchers have obtained and analyzed a staggering 153GB RAR archive. This massive corpus contains exactly 433,909 files. Through our analysis, we have successfully attributed 118,829 CI runner dumps to 2,488 affected corporate domains. Whenever a developer machine, production server, or CI/CD pipeline executed the compromised LiteLLM package, the threat actors successfully harvested the live environment memory and configurations mid-execution.

Is the 'Cyber-AI Industrial Complex' creating a dangerous distraction for CISOs?

Out of thousands of AI-discovered vulnerabilities, only 1% end up being exploited in the wild. the same exploitation rate as human-found bugs.

This raises a huge question about priority: If AI isn't unleashing a wave of hyper-dangerous, novel zero-days, why are security budgets being steered away from core hygiene and toward edge-case AI threat vectors, all while ransomware & data breaches hit new records?

Curious to hear from defenders and CISOs:

1. Are AI security tools actually giving your team ROI, or just adding noise to your backlog?
2. How are you balancing the pressure to fund "next-gen AI defense" with patching fundamental exposure?

Hudson Rock researchers discovered a sophisticated ClickFix campaign operating on a subdomain belonging to the popular digital asset platform, Artlist. Our investigation traced the breach to an early Infostealer infection of an ex-Artlist employee.

Following the widespread reports of the Argentine Football Association hack, Hudson Rock researchers traced the hack to an Infostealer infection of an AFA employee back in 2025. The infection provided the hackers with the credentials required to carry out the hack.

grifting in any other industry is all good, prices continue to climb regardless of what ponzi mechanism is introduced to sustain prices, only in crypto do we have to sacrifice people all the time while inflicting massive losses to ourselves at the process (bitconnect, luna, ftx, celsius, alon hiring a chief legal officer, etc and now saylor with mstr and strc. I'm missing a bunch but you get the idea)

• Following Hudson Rock’s initial ethical disclosure of the FortiBleed campaign, which exposed 75,000 compromised Fortinet firewalls, deeper analysis into the threat actor infrastructure reveals a chilling reality regarding modern cryptographic attacks.
• The attackers bypassed traditional encryption by renting a massive, decentralized GPU cluster via Vast.ai, weaponizing the hardware boom created by the GenAI industry.
• Operating 36 enterprise class GPUs managed via Telegram, the operators achieved commoditized super-computing power, capable of cracking hundreds of billions of hashes per second on a minuscule budget.
• Compromised edge devices are serving as devastating beachheads, enabling attackers to pivot laterally into connected supply chains and third-party vendors.
• Initial access to Fortinet servers has long been commoditized data fueled by infostealer logs, but this campaign scales it to an industrial level.

The past few days following our publication on the Fortinet compromises have been an absolute whirlwind. We knew the data was critical, but the global reaction has been unprecedented. Here is a recap of what has been happening behind the scenes since the story broke.

We first broke the story on this subreddit, so /r/pwnhub members got it first 🤝

Originally discovered by security researcher Volodymyr “Bob” Diachenko and subsequently analyzed by Hudson Rock, this dataset exposes a massive, automated operation. Threat actors successfully targeted 73,932 unique firewall URLs across 194 countries, resulting in 21,632 unique affected domains.

According to Diachenko’s investigative report, this campaign is orchestrated by a multi-operator, Russian-speaking cybercriminal group. The operation’s footprint is staggering: the attackers executed an estimated 1.16 billion credential attempts against over 320,000 FortiGate targets, alongside an additional 2.1 billion brute-force attempts directed at over 160,000 MSSQL servers.

The group’s methodology goes beyond simple credential reuse. They actively intercept SSL VPN authentication hashes and crack them using a massive, dedicated 45-GPU cluster managed via Hashtopolis. Once the perimeter is breached, the operators systematically pivot directly into internal Active Directory environments to establish deep network persistence.

This aggressive methodology has led to severe, real-world consequences. Diachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey. Most alarmingly, this includes a Turkish NATO defense contractor from which classified defense documents were successfully exfiltrated by the group.

The scale of this breach touches nearly every sector of the global economy, sparing no industry. The threat actors have built a verified database of working credentials for some of the largest enterprises on the planet.

Among the victims discovered in this dataset are massive multinational corporations, including:

• Foxconn
• Samsung
• Comcast
• Siemens
• Lenovo
• PwC
• Accenture
• Oracle
• …and thousands of others, including major government entities and critical infrastructure providers.

Read more + check if your domain is impacted by this leak -https://www.hudsonrock.com/blog/fortibleed-75000-fortinet-firewalls-compromised-global-enterprises-exposed-claim-your-ethical-disclosure

This isn't widely reported yet and their website is currently down. The method is pretty straightforward - hackers are taking credentials from infostealer infections, take over legitimate businesses, and converting them into a clickfix Infostealer delivery tool that results in more credentials they can use again.

In this case South Asian University was hacked via credentials from an April 2026 infection to deliver clickfix via game cracks (??? dumb delivery method fr)

https://preview.redd.it/p66qub7j9p7h1.png?width=726&format=png&auto=webp&s=14a2d40075f43cd3d22928eed4d6a78ddea5897e

https://preview.redd.it/b5beuyol9p7h1.png?width=893&format=png&auto=webp&s=b39a7e7851716f3bae3e5349b413d442d9469e85

You can read more about this method - From Victim to Vector: How Infostealers Turn Legitimate Businesses into Malware Hosts - https://www.infostealers.com/article/from-victim-to-vector-how-infostealers-turn-legitimate-businesses-into-malware-hosts/

https://preview.redd.it/4s9rr8in9p7h1.png?width=1520&format=png&auto=webp&s=d93500b1c618fe7e6fef6d9ca3555be37ab2fb54

Big breach: Danish pharmaceutical giant Novo Nordisk is currently being blackmailed for $50 million and $25 million simultaneously by two separate threat actors. Neither ransom was paid, and the data is now dropping. While one actor appears to have a smaller 50 GB haul, the group FulcrumSec has leaked a massive 1.3 Terabytes of core intellectual property.

The Initial Access is Embarrassingly Stupid: For a company worth $400 billion, the lack of basic frontend security hygiene is stunning. FulcrumSec gained entry by simply looking at client-side JavaScript left completely exposed on two public subdomains. They found an Azure Container Registry token and a GitHub Personal Access Token sitting right there in the plaintext frontend bundles.

https://preview.redd.it/ihs7q9kr4p7h1.png?width=611&format=png&auto=webp&s=9c2f9a1cf0413949cb331d2de1c342a67351b7de

>

Hardcoded Keys & Lateral Movement: Once inside GitHub and Azure DevOps, the attackers had access to over a thousand private repositories packed with production secrets. They moved laterally across AWS, Okta, and HuggingFace entirely undetected for months.

https://preview.redd.it/jj0rwhol4p7h1.png?width=1017&format=png&auto=webp&s=9fb9ed4834aa9e29c2cc542af9cd17167113ef4c

>

Stolen Data Includes:

• Trade Secret Manufacturing Recipes: Exact scaling, purification, chromatography steps, and amino acid sequences for Semaglutide (Ozempic/Wegovy) and Amycretin (their massive upcoming pipeline drug that added $80B to their market cap in one day).
• Proprietary Molecules & Hidden Drug Programs: Full chemical structures (SMILES) for 41,144 molecules, including complete data on 5 entirely undisclosed drug programs (PKM2, CDK8/CDK19, HRI, BPGM, ACSL5) that Novo never publicly filed.
• AI Models & Datasets: 33 trained AI models and 75 datasets (~1.06 TB total), including chemical language models (PubChemBERT-giant) and cell imaging foundations. Advanced models are actively being held back for private sale to competitors.
• Source Code & Clinical Trial Infrastructure: 4,748 total repositories exposing data architecture, alongside PII for 163,234 employees and pseudonymized data for ~11,500 clinical trial patients.

The Deception: Novo Nordisk's security team began rotating some credentials a few weeks in, but never detected the attackers in their enterprise Okta or HuggingFace accounts. Corporate leadership actually engaged with the cybercriminals for several weeks, going through "data verification" steps. It turned out to be a social engineering play by Novo to buy time to prepare internally for a public disclosure on June 11, at which point they went dark and refused to pay.

🔗 Where to track the situation:

• Great detailed overview of the timeline by "Dissent Doe, PhD" on DataBreaches: https://databreaches.net/2026/06/16/one-threat-actor-demanded-50-million-from-novo-nordisk-another-one-demanded-25-million-neither-got-paid/

https://preview.redd.it/n4n6xhfy4p7h1.png?width=946&format=png&auto=webp&s=2179b0c67a67d0e1307ee7777e3e7cab25793518

• Ransomware.live Novo Nordisk victim page tracking the leak status and group details: https://www.ransomware.live/id/Tm92byBOb3JkaXNrQGZ1bGNydW1zZWM

https://preview.redd.it/5ezpr4615p7h1.png?width=1862&format=png&auto=webp&s=f71057bf3df4d3407f95b02afd8711c758436733

The darknet already hosts a mature, structured market for pre-verified accounts and identity manipulation services. Threat actors actively trade bypassed accounts on dedicated cybercrime forums, treating access to restricted models as a standard, highly liquid commodity. Initial access brokers simply create the accounts using illicit methods and sell the login details to buyers globally.

Reddit users share their experiences after getting infected by Infostealers, they describe the mental drain, sense of intrusion, blackmail attempts, and money theft through AI subscriptions. I compiled threads and comments into a blog along with common recommendations for every day users to avoid getting infected.

As initially discovered by OX Security and further analyzed by SafeDep, the Megalodon campaign targeted GitHub Actions. By exploiting weak branch protections and utilizing throwaway or compromised accounts, the attackers deployed workflows designed to drain every secret a runner could reach – including AWS keys, GCP OAuth tokens, SSH private keys, and GitHub OIDC tokens – as well as to deploy additional infostealers to further compromise the targeted environments.

While the mechanics of the CI/CD injection are well-documented, the origin of the compromised GitHub accounts used to push the malware has remained a question mark. To solve this, Hudson Rock analyzed the list of usernames associated with the affected repositories that were observed pushing the infostealer.

By cross-referencing these GitHub usernames against our vast cybercrime intelligence database, we made a startling discovery: 331 out of 978 unique usernames (over 33%) were direct matches to computers infected by infostealers.

Upon deeper manual investigation, we realized that number is actually near 100%. 

A recent internal data leak from “The Gentlemen” ransomware-as-a-service (RaaS) group has provided the cybersecurity community with a rare, unfiltered look into their daily operations. Exposed on underground forums, the internal communications shed light on exactly how ransomware affiliates organize, breach, and extort global organizations.

But among the many technical details revealed in Checkpoint Research’s comprehensive analysis (“Thus Spoke… The Gentlemen”), one operational pattern stands out prominently: their heavy reliance on infostealer credential logs for initial access.