LeakySensey: Successful login with default admin/admin credentials

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•1

Detects successful remote logons to network devices (routers, VPNs, NAS) using the 'admin' account. This pattern is indicative of credential spraying or brute-force attacks targeting weak default credentials on externally facing management interfaces, often associated with botnets or threat actors performing reconnaissance and initial access operations.