{"id":9665,"date":"2026-01-06T10:04:35","date_gmt":"2026-01-06T10:04:35","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/06\/threat-actors-hacked-global-companies-via-leaked-cloud-credentials-from-infostealer-infections\/"},"modified":"2026-01-06T10:04:35","modified_gmt":"2026-01-06T10:04:35","slug":"threat-actors-hacked-global-companies-via-leaked-cloud-credentials-from-infostealer-infections","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/06\/threat-actors-hacked-global-companies-via-leaked-cloud-credentials-from-infostealer-infections\/","title":{"rendered":"Threat Actors Hacked Global Companies via Leaked Cloud Credentials from Infostealer Infections"},"content":{"rendered":"

Threat Actors Hacked Global Companies via Leaked Cloud Credentials from Infostealer Infections
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Dozens of major global enterprises have been breached through a surprisingly simple yet devastating attack vector: stolen credentials extracted from infostealer malware. <\/p>\n

A threat actor operating under the nickname \u201cZestix\u201d and his alias \u201cSentap\u201d has been systematically accessing corporate cloud storage platforms, including ShareFile, Nextcloud, and OwnCloud, belonging to approximately 50 international organizations. <\/p>\n

The breaches span critical sectors such as aviation, defense robotics, healthcare, finance, and government infrastructure, exposing terabytes of sensitive data.<\/p>\n

The attack chain reveals a troubling reality in modern cybersecurity. Employees inadvertently download malicious files that execute infostealers like RedLine, Lumma<\/a>, and Vidar. <\/p>\n

These malware variants silently harvest all saved credentials and browser history from infected devices. Once extracted, these logs are aggregated into massive databases on the dark web. <\/p>\n

Zestix then searches through these repositories specifically looking for corporate cloud URLs and uses the stolen credentials to gain unauthorized access to enterprise systems.<\/p>\n

\n
\"The
The digital persona of \u2018Zestix,\u2019 a threat actor specializing in auctioning corporate cloud access (Source \u2013 Infostealers)<\/figcaption><\/figure>\n<\/div>\n

InfoStealers analysts and researchers noted<\/a> that the most critical vulnerability enabling these breaches was not a sophisticated zero-day exploit, but rather the fundamental absence of Multi-Factor Authentication (MFA). <\/p>\n

Organizations failed to implement this standard security control, allowing attackers to walk through the front door using only a valid username and password. <\/p>\n

Some credentials had been sitting in infostealer logs for years, creating a window of opportunity that organizations completely missed.<\/p>\n

\n
\"The
The \u2018Sentap\u2019 profile, an alias used by Zestix to sell additional compromised datasets (Source \u2013 Infostealers)<\/figcaption><\/figure>\n<\/div>\n

The scale of the compromises is alarming. Pickett and Associates, an engineering firm serving U.S. utility companies, lost 139.1 gigabytes including classified LiDAR files and transmission line maps. <\/p>\n

\n
\"The
The Pickett & Associates portal, accessed via stolen credentials (Source \u2013 Infostealers)<\/figcaption><\/figure>\n<\/div>\n

Intecro Robotics exposed 11.5 gigabytes of ITAR-controlled defense blueprints for military aircraft components. Iberia Airlines had 77 gigabytes leaked, containing aircraft maintenance programs and critical flight safety documentation. <\/p>\n

Brazilian military police health records belonging to Maida Health\u20142.3 terabytes in total\u2014were exposed, along with personal identification and medical information for active-duty personnel and their families.<\/p>\n

The Credential Harvesting Mechanism<\/strong><\/h2>\n

The infection cycle operates through a five-stage process that cybersecurity professionals must understand. First, an employee receives a seemingly legitimate file through email or downloads what appears to be standard software. <\/p>\n

\n
\"Stolen
Stolen blueprints for defense robotics components (Source \u2013 Infostealers)<\/figcaption><\/figure>\n<\/div>\n

Second, the infostealer<\/a> executes in memory, often avoiding detection by security tools because it operates within legitimate processes. Third, the malware enumerates browser storage, password managers, and cached credentials from applications like Outlook and Teams. <\/p>\n

Fourth, all harvested data is encrypted and transmitted to command-and-control servers<\/a>. Finally, threat actors parse through thousands of stolen credential databases, filtering specifically for corporate infrastructure like cloud file shares and ERP systems.<\/p>\n

What makes this approach particularly dangerous is its scale and low cost. Zestix operates as an Initial Access Broker, selling corporate access credentials for Bitcoin or Monero on underground forums. <\/p>\n

\n
\"Exposed
Exposed legal and financial directories (Source \u2013 Infostealers)<\/figcaption><\/figure>\n<\/div>\n

Organizations have failed not because they lack security awareness<\/a> programs, but because they have not enforced mandatory multi-factor authentication across all critical systems. <\/p>\n

The remedy is straightforward: immediate MFA deployment combined with monitoring for compromised credentials in infostealer logs before attackers exploit them.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Threat Actors Hacked Global Companies via Leaked Cloud Credentials from Infostealer Infections<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Threat Actors Hacked Global Companies via Leaked Cloud Credentials from Infostealer Infections Dozens of major global enterprises have been breached through a surprisingly simple yet devastating attack vector: stolen credentials extracted from infostealer malware. A threat actor operating under the nickname \u201cZestix\u201d and his alias \u201cSentap\u201d has been systematically accessing corporate cloud storage platforms, including […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-9665","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9665"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9665"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9665\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}