Zero-day and credential theft claims: what should teams watch now?

TL;DR: Dark web claims of a Hyper-V virtual machine escape zero-day for USD 100,000 to 200,000, a new Windows infostealer that harvests passwords, cookies, OAuth tokens and session data, and a MaaS platform that packages credential theft and remote access at scale were reported according to ZeroFox. The pattern shows how quickly exposed access paths can turn into account takeover and host compromise.

Editorial analysis by NHI Mgmt Group, based on content published by ZeroFox: “The Underground Economist: Volume 6, Issue 19”.

By the numbers:

• Kleptomania was advertised at USD 150 per month, USD 400 for three months, or USD 1,500 annually.
• Hermes was offered under a tiered subscription model ranging from USD 150 for 14-day access to USD 500 for 30-day premium access.

Key questions

Q: What breaks when attackers can steal MFA session tokens?

A: MFA stops being the control point once the attacker has a valid token or cookie.

Q: Why do browser-stored credentials increase risk in enterprise environments?

A: They increase risk because they place valuable credentials inside a user-centric storage layer that can be exposed through endpoint compromise, browser profile theft, sync abuse, or exported files.

Q: Where do hypervisor vulnerabilities fail in practice for security teams?

A: They fail when organisations assume the guest VM boundary is the only boundary that matters.

Practitioner guidance

• Harden session and token governance Treat browser cookies, OAuth tokens, refresh tokens and application session artefacts as privileged credentials with explicit issue, expiry and revocation rules.
• Prioritise hypervisor exposure reduction Patch and monitor host virtualization components, especially where breakout paths could expose root partition trust boundaries.
• Add detections for infostealer behaviour Look for browser credential harvesting, token exfiltration, clipboard theft, suspicious session replay and unusual post-login activity patterns.

Bottom line: The article shows a threat pattern where exploit sales, infostealers and malware-as-a-service all aim at the same prize: reusable access.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →