Tag: account takeover
68 articles
Multifaceted Phishing Scheme Stunningly Damages Bitpanda
Thousands of Bitpanda users are reeling after a sophisticated phishing campaign spun up convincing lookalike sites—with disposable domains and SSL certificates—to harvest credentials and fuel criminal markets. The attack shows how industrialized phishing‑as‑a‑service turns takedown efforts into whack‑a‑mole, leaving customers, companies and regulators scrambling to restore digital trust.
Chrome extensions Exclusive: Malicious AI steal API keys
Before you add that shiny AI assistant to Chrome, pause: researchers found 30+ extensions secretly siphoning API keys, emails and other sensitive data from hundreds of thousands of users. What promised convenience turned into a fast track for credential theft and account takeover.
Password Reuse: Exclusive Risks of Effortless Workarounds
Password reuse is the digital equivalent of leaving a master key under the mat—effortless workarounds and recycled credentials give attackers a straightforward path to account takeover. Even helpful conveniences like autofill and brittle browser extensions can betray reused passwords, turning everyday browsing into a security shortcut.
FBI Issues Critical Alert on Dangerous QR Phishing
Dont let a quick scan be your undoing: the FBI warns that QR-enabled spear-phishing is turning everyday convenience into a precision tool for state-backed espionage, tricking victims into handing over credentials or approving authentications that give attackers persistent access.
Rey Exclusive: Inside the Best Scattered Lapsus$ Admin
When a reporter called his father and unmasked Rey, the public face of Scattered LAPSUS$ Hunters, it upended a group built on anonymity and exposed how social‑engineering, account takeovers and micropaid crowds power a new, scalable extortion playbook. The fallout forces a rare reckoning about motive, accountability—and the practical fixes defenders and regulators can’t ignore.
Android TV streaming box: Exclusive Dangerous botnet alert
Think twice before buying a bargain Android TV streaming box—some models quietly turn your home network into a botnet relay, routing illicit traffic that can slow your connection, invade your privacy and even expose you to legal risk. Here’s what to watch for so convenience doesn’t end up costing you more than you bargained for.
Android TV Streaming Box Danger: Exclusive Security Alert
If it sounds too good to be true, it probably is — investigative reporting reveals Superbox firmware can turn your Android TV into a hidden internet relay, exposing your home network to fraud and account-takeover schemes.
630M Passwords Stolen: Stunning, Alarming Credential Cost
Some 630 million passwords have been leaked to criminal marketplaces — a stark reminder that passwords are no longer sacred. Now’s the moment to stop reusing credentials, enable MFA, and push for faster detection and smarter defenses.
French Football Federation Exclusive: Damaging Data Breach
Imagine names, birthdates and contact details for more than two million amateur players suddenly exposed — that’s the frightening possibility tied to a suspected breach at the French Football Federation. Players and parents should be on alert for phishing and scams while the federation works to lock down access and notify those affected.
FBI Exclusive: Stunning $262M Costly Account Takeovers
Imagine waking to find your bank account emptied by someone who cloned your bank’s site — the FBI says over $262M has been lost to account takeover scams since January 2025. Learn how phishing, credential stuffing and fake reporting pages let criminals turn stolen logins into instant cash — and what you can do to stop them.
FBI Reveals Stunning Rise in Costly AI Phishing Scams
Imagine a voicemail that sounds exactly like your daughter begging for help — only its a scam. The FBI warns cheap AI tools are fueling a surge of hyper‑personalized phishing scams that have already cost victims hundreds of millions and can fool individuals, businesses, and banks alike.
Python-Based WhatsApp Worm Exclusive: Dangerous Stealer
What would you do if your WhatsApp started messaging your friends without you? Researchers warn the Delphi-based Eternidade Stealer is hijacking accounts and weaponizing contact lists—using social engineering and IMAP-resolved C2 to spread quickly and dodge static defenses.
Eternidade Stealer Trojan Exclusive Severe Cybercrime Surge
Eternidade Stealer is a new banking trojan that weaponizes Brazil’s favorite app, WhatsApp, turning ordinary messages into a fast-moving credential theft campaign. Researchers warn one click can unleash downloaders that harvest browser-stored credentials and cookies, making everyday chats unexpectedly risky for users and businesses.
2FA Phishing Kit: Exclusive Alert on Dangerous BitB Pop-ups
Think your 2FA push is safe? Browser-in-the-Browser phishing kits like Sneaky 2FA now mimic real browser dialogs to trick users into approving account takeovers, making powerful relay attacks cheap and easy to rent.
FTSE 100 Exclusive: Alarming 500,000 Stolen Credentials
Half a million stolen credentials tied to FTSE 100 staff have surfaced in criminal data stores — a blunt wake-up call that weak passwords and reused logins are leaving Britain’s biggest firms dangerously exposed. Socura’s findings show how easily attackers can impersonate insiders and turn simple credential theft into costly breaches unless boards treat cyber as a strategic priority.
Improve Collaboration: Best Must-Have Steps to Beat Fraud
When fraudsters thrive on delay, real-time intelligence sharing across banks, telcos, tech firms and government is the fastest way to stop them in their tracks. Getting there means practical steps, common standards and a culture that treats shared signals as the public good they are.
Quantum Route Redirect Phishing Kit: Stunningly Dangerous
The Quantum Route Redirect phishing kit quietly hijacks web traffic, rerouting victims to eerily convincing fake sites. Learn how this route redirect phishing attack works and what you can do to stay one step ahead.
I Paid Twice Phishing: Exclusive Scam Alert for Booking.com
Think you paid the hotel twice? A sophisticated I Paid Twice phishing campaign is hijacking Booking.com, Airbnb and Expedia bookings—using injected scripts and fake payment pages to trick travelers into handing over extra payments.
Most common passwords: Exclusive list of the worst
We all scoff at 123456, yet it still tops the charts because convenience and password reuse beat security. That complacency makes credential-stuffing cheap and effective, letting attackers turn one weak password into dozens of account takeovers.
SMS Fraud Losses: Exclusive 11% Relief by 2026
Juniper Research predicts an 11% drop in global SMS fraud losses by 2026 — about $9 billion less — good news, but with smishing, SIM farms and brittle phone-number trust still rampant, it may be just the first step in a much bigger fight to secure SMS.
Europol Exclusive: Alarming Rise in Caller ID Spoofing
Europol’s recent takedown ripped the curtain back on how caller ID spoofing and SIM farms let criminals rent anonymity at scale — a win that still reads like a warning. With fraudsters shifting to SIMless virtual numbers and VoIP farms, the phone number we trust as ID has become a commodity for scams.
MuddyWater Exclusive: Devastating 100+ Government Breach
A single compromised mailbox and an attacker-controlled VPN quietly became the battering ram for a MuddyWater espionage campaign that infiltrated more than 100 government networks across the Middle East and North Africa. Group‑IB’s analysis shows the actors used trusted email, credential harvesting, and stealthy lateral movement to maintain months-long access and siphon sensitive diplomatic and personnel data.
180,000 Records of PII Exposed: Exclusive Critical Leak
Heads up: roughly 180,000 customer records — including names, payment card details and other PII — were left in an unsecured repository, putting people at risk of fraud and companies on the hook for costly regulatory and reputational fallout.
180,000 Records Exposed: Stunning Security Failure
180,000 customer records — including payment card details and other PII — were left in an unsecured repository. This glaring misconfiguration shows how convenience can quickly turn into costly fraud, identity theft and regulatory headaches.