Data-Theft

A vulnerability in GitPython allows environment variables to be exfiltrated when using `Repo.create_remote()` or `Remote.add()`, where attacker-supplied URLs are processed by `Git.polish_url()` expanding sensitive environment variables into the URL, which is then stored in `.git/config` and transmitted to an attacker-controlled host.

Russian state-sponsored threat actor UAC-0145 (Sandworm sub-cluster) is actively targeting Ukrainian organizations by using fake ClickFix CAPTCHAs on compromised websites to trick users into executing malicious PowerShell commands, leading to the deployment of data-stealing malware on Windows and Android devices.

An adversary can leverage the AWS `rds:StartExportTask` API to export sensitive RDS database snapshots or DB cluster data to an attacker-controlled Amazon S3 bucket, facilitating data exfiltration and potential data theft from organizations.

A high-severity SQL injection vulnerability, CVE-2026-14695, exists in SourceCodester Multi-Vendor Online Grocery Management System 1.0, allowing remote attackers to manipulate the 'Name' argument within the `save_client` function of `classes/Users.php` to execute arbitrary SQL commands, with a public exploit available.

This brief describes the detection of adversaries leveraging the `Get-Clipboard` PowerShell commandlet, identified through PowerShell Script Block Logging (EventCode 4104), to steal sensitive information such as credentials or PII from the Windows clipboard during the collection phase of an attack, potentially leading to unauthorized access and further compromise.

The threat groups Vect and TeamPCP have formally partnered since March 2026 to conduct widespread ransomware deployment and extortion campaigns by leveraging TeamPCP's credential harvesting and data theft capabilities, often initiated through supply chain compromises involving poisoned software updates and exploitation of critical vulnerabilities like CVE-2025-55182, leading to significant data exfiltration and encrypted systems across multiple sectors.

The financially motivated ShinyHunters ransomware group, operating its shinysp1d3r RaaS, has claimed icsecurity.com as a new victim, compromising over 2.7 million records via credential stuffing and exploitation of cloud services like Snowflake, with the intent to extort through data leakage.

Cyber extortion is increasingly relying on data theft rather than ransomware encryption, with threat actors like Bling Libra and TGR-CRI-1135 leveraging techniques like vishing and software supply chain compromise, fueled by regulatory compliance pressures and the impending weaponization of frontier AI models.

Attackers are leveraging indirect prompt injection against AI agents with access to private data, untrusted content, and external communication channels to steal sensitive information by embedding malicious instructions in content processed by the agent.

The MuddyWater group is disguising its cyber-espionage operations as Chaos ransomware attacks, using Microsoft Teams social engineering for initial access and establishing persistence, likely to complicate attribution and mask their true objectives.

This rule detects the use of wget on Linux systems to upload files to an external server, a tactic commonly used for data exfiltration.