Lack of MFA is Common Thread in Vast Cloud Credential Heist

An emerging threat actor known as Zestix or Sentap used infostealers to harvest credentials and breach file-sharing instances in attacks on about 50 enterprises, according to Hudson Rock. The researchers say the attacker relied on infostealers such as RedLine, Lumma, or Vidar to collect credentials from machines and logs, then used those credentials to sign into platforms like ShareFile, OwnCloud and Nextcloud with MFA not enabled.

They noted that some credentials were harvested recently, while others had sat in logs for years, waiting for exploitation, and that passwords were not rotated or sessions invalidated.

The breaches demonstrate that attackers can access sensitive data via widely used collaboration platforms without exploits if cloud gateways lack MFA, the report said, describing the scenario as “no exploits, no cookies — just a password.” Enabling MFA and improving password hygiene are emphasised as the most obvious mitigations, according to Hudson Rock, in a wake-up call to large organisations still not enforcing MFA on critical cloud gateways. January 7, 2026.