Snowflake isn’t an outlier, it’s the canary in the coal mine
Summary: Cisco Talos reports that adversaries used stolen Snowflake login credentials, harvested through information-stealing malware and not protected by MFA, to infiltrate customer accounts and steal sensitive data. Talos says its most recent Incident Response Quarterly Trends report found valid accounts to be the top infection vector, with MFA push notifications the top observed security weakness for the first time.
Bottom line: Infostealer operators sell enterprise credentials by the thousands in Telegram channels, and a single compromised set can lead to a multi-million-dollar ransom - a price Talos calls minute compared with the payout.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026