Threat Intelligence Feed — Tag: CREDENTIAL_THEFT

Malicious activity detected from 45.142.193.233 (, ASNone). 1187050 events observed across EtherNet/IP, TCP, TCP/SYN, TLS, TLS/1.0. AI verdict: HIGH.

High-confidence credential stuffing attacks targeting Cisco ASA SSL VPN login interfaces have been observed from US-based infrastructure (AS396356 Latitude.sh) between March 17-23, 2026. The threat actor demonstrates specific knowledge of Cisco WebVPN authentication mechanisms and poses significant …