New White Paper on Preventing Credential Phishing, Theft and Abuse
Summary: Unit 42 released a white paper titled "Credential-Based Attacks: Exposing the Ecosystem and Motives Behind Credential Phishing, Theft and Abuse" covering how credential theft happens, what attackers do with stolen credentials, and how to prevent it. The paper notes that Shamoon 2 and the Sofacy threat actor group have made detailed use of credential theft, with phishing, keyloggers, and password reuse named as the most notable theft methods.
Bottom line: Stolen credentials give attackers remote access, entry to cloud resources that may have weaker protections than network-based ones, and the ability to move laterally, erase server data, and reconfigure servers so they cannot boot. The paper states that prevention of credential theft is too often overlooked.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026