UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications

Talos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608. The campaign is primarily leveraging a collection framework dubbed “NEXUS Listener.”

Part of the PlainSec briefing for 2026-04-02

Sources

Talos Intelligence

UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applicationsTalos is disclosing a large-scale automated credential harvesting campaign carried out by a threat cluster we currently track as UAT-10608. The campaign is primarily leveraging a collection framework dubbed “NEXUS Listener.”Part of the PlainSec briefing for 2026-04-02Sources

Talos Intelligence