AI Accounts Are Becoming the New Target for Infostealers
2026-09-28T20:51:36Z•cb6a881675a42fe95473fd978e2e7d0f9539a4d22201ba6689b655ed124ddf71
CVE-2026-48842CVE-2026-88771AI credentialsAPI keysAzureCISA KEVCitrix NetScalerJADEPUFFERRoundcubeSQL injectionStorm-3168active exploitationcloud identitycybercrimedata exposurehealthcareinfostealerremote code executionzero-day
What happened
Security Affairs reports active exploitation of multiple high-impact vulnerabilities, including Citrix NetScaler zero-days and CVE-2026-88771 added to CISA's KEV catalog, as well as in-the-wild exploitation of Roundcube SQL injection CVE-2026-48842. Additional reporting covers infostealer exposure of AI credentials and sessions, Azure attacks using stolen service principals linked to Storm-3168/JADEPUFFER, and a large DC Medicaid data exposure.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- cb6a881675a42fe95473fd978e2e7d0f9539a4d22201ba6689b655ed124ddf71
- Enrichment time
- 2026-09-28T20:51:36Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.