Tag: factor authentication
136 articles
phishing-as-a-service: Stunning Risky Surge
Phishing-as-a-service has exploded into a business — Netcraft found over 17,500 phishing domains spoofing 316 brands — turning credential theft into an off‑the‑shelf operation. Security teams and policymakers must act fast: harden authentication, automate detection, and disrupt the cross‑border plumbing that powers these disposable scams.
fake CAPTCHA pages: Exclusive Dangerous AI Phishing Threat
Think twice before clicking that checkbox — attackers are using AI to spin up lifelike fake CAPTCHAs that harvest credentials and turn a trusted security step into an easy phishing trap.
Scattered Spider: Shocking Arrests Spark Risky Fallout
Two teenagers have been arrested in the U.K. over last August’s Transport for London outages, with authorities linking them to the Scattered Spider hacking collective. The case highlights how young, tech‑savvy actors can trigger big disruptions—and why public systems, law enforcement and policy must adapt quickly.
Law Enforcement Request System: Stunning Risky Breach
Google just revealed that criminals created a fraudulent account in its Law Enforcement Request System (LERS), exposing a worrying gap in the trusted channel police and courts use to obtain sensitive user data. The incident sparks a necessary push to tighten verification, protect investigations, and rebuild public confidence in the systems meant to keep us safe.
HM Revenue & Customs Stunning Decline, But Risky Resurge
Good news: HMRC-branded email phishing fell sharply in early 2025, suggesting tech fixes and public awareness are having an impact — but don’t relax yet. Scammers are pivoting to SMS, social and AI-enhanced tricks, so stay sceptical, verify contacts and report anything suspicious.
recovery codes: Risky Mistake Sparks Stunning Breach
A single plaintext file of MFA recovery codes on a desktop turned a security convenience into an org‑wide breach tied to the SonicWall attacks — a stark reminder that strong tech fails when basic procedures are ignored. Treat recovery codes like passwords: store them encrypted or offline, enforce controls, and stop letting convenience hand attackers the keys.
customer records Shocking Insider Breach Risky Exposure
Nearly 700,000 FinWise customers now face the unsettling possibility that their personal data was accessed for more than a year by an ex-employee. Act now: monitor accounts, enable MFA, and demand clearer disclosures and stronger offboarding controls.
browser-based attacks: Critical Must-Have Defenses
We’ve hardened email — it’s time to treat browsers as the frontline: discover the six browser-based attacks every security team must prioritize now and the practical defenses to keep users, credentials, and networks safe.
Salesforce platforms: Must-Have Critical Security Guide
The FBI just flagged active campaigns targeting Salesforce platforms—if you rely on Salesforce for customer data, now’s the time to harden access, rotate tokens, and audit integrations. Take a few simple steps today to prevent data theft, detect suspicious exports, and reduce your risk before attackers strike.
phishing-as-a-service: Stunning Risky Threat
Think a thief who never touches the lock — VoidProxy is a phishing-as-a-service that intercepts live logins, relays MFA and session tokens in real time, and lets attackers quietly hijack Microsoft and Google accounts. Learn why layered defenses, hardware-backed keys, and session risk detection are now essential to stop these fast, stealthy takeovers.
Salty2FA: Exclusive Dangerous Phishing Threat
A new phishing kit called Salty2FA is turning multi-factor authentication into an exploitable step, automating interception of codes, cookies, and push prompts to bypass SMS and app-based 2FA. Organizations should treat 2FA as an architecture—move to phishing-resistant methods like FIDO2, tighten session controls, and ramp up detection before attackers rent this tool and hit your users.
unauthorized access incident: Stunning Risk — Act Now
Ugh — Plex warned of another password exposure. If you got notified, reset your password, enable MFA, and review connected devices right away.
cyber espionage Stunning Risk: Congressional Impersonation
Imagine someone posing as a U.S. congressman to tip the scales in trade talks — House investigators say Chinese cyber actors impersonated Rep. John Moolenaar to harvest documents and influence negotiations, a stark reminder that digital deception can shortcut diplomacy. It’s a wake-up call for stronger authentication, staff training, and rapid-response teams to protect the integrity of democratic decision-making.
crypto phishing Shocking Supply-Chain Nightmare
One phishing click that reset a maintainer’s 2FA let attackers slip backdoors into at least 18 popular npm packages — including debug and chalk — turning trusted libraries into supply-chain landmines. It’s a wake-up call: human error can ripple through the entire ecosystem, so stronger authentication, multi-person publishing, and tighter dependency hygiene can’t wait.
MFA rollout Disastrous: Must-Have Fixes for Delays
The rushed PACER MFA rollout has left lawyers on hold for hours and courts scrambling — a stark reminder that security upgrades need phased rollouts, better user support, and simple recovery options so access and justice aren’t delayed.
insider breaches: Must-Have Best Protection Guide
Insider breaches are alarmingly common—61% of U.S. companies hit with average losses of $2.7M—so it’s time to stop treating them as fringe risks and adopt practical, people-centered defenses like least privilege, strong identity controls and behavioral monitoring.
OAuth token theft: Must-Have Fixes After Risky Breach
When OAuth token theft let attackers roam across integrations, Salesloft temporarily pulled Drift offline to stop the bleeding and fully review security. It’s a wake-up call: short-lived tokens, tighter scopes and rapid rotation are essential to keep integrations—and customer data—safe.
password managers Must-Have Best Defense After 16B Leak
Imagine waking up to find every password you’ve ever used dumped online — that’s the reality of a 16 billion credential leak, and businesses can’t afford to rely on reused passwords. Adopt enterprise password managers, enforce strong MFA, and harden identity controls now before attackers turn those lists into breaches.
credential-theft campaign: Exclusive Salesforce Risk
Google warns of a credential-theft campaign that abused a Salesloft integration to phish Salesforce logins — a wake-up call that third-party apps can be your weakest link. Audit connected apps, enforce MFA, and tighten permissions now before attackers pivot from integrations into your CRM.
phishing attack Stunning Risky ZipLine Exposed
A new ZipLine phishing campaign uses a legitimate-looking White House photo and fake contact forms to trick employees at U.S. manufacturers into handing over credentials — opening the door to IP theft and ransomware. It’s a sharp reminder that a single authentic image can bypass defenses, so tighten verification, MFA, and training now.
VPS-based attacks: Critical Guide to Risky Threats
Attackers are increasingly using rented VPS hosts to make their logins look like legitimate data-center traffic, blurring the line between customer and criminal. SaaS teams and users need stronger passwords, phishing-resistant MFA, and behavior-based authentication to stop stealthy account takeovers.
Impersonation as a service: Stunning and Dangerous Threat
Imagine your password doesn’t matter because someone can perfectly impersonate you — that’s the new reality as “impersonation as a service” blends deepfakes, scraped data, and skilled social engineers to trick businesses and people into handing over money and secrets. The fix isn’t just tech: smarter verification, AI detection, and simple habits like out-of-band confirmation can blunt the threat if organizations and users start assuming anyone can be imitated.
Scattered Spider Stunning 10-Year Sentence: Risky Legacy
A 10-year federal sentence and $13 million restitution for a Scattered Spider member forces us to ask whether punishment alone will deter social‑engineering cybercrime—or if smarter identity safeguards, tougher account‑recovery and policy reforms are the real answer. It’s a wake‑up call to fix the systems and employee practices attackers exploit, not just lock up the perpetrators.
SIM-swap attacks: Must-Have Urgent Defenses
A major breach exposing SIM identifiers makes SIM‑swap attacks a real and urgent risk — but you can protect yourself now by switching from SMS to app- or hardware-based MFA, adding a carrier PIN or passphrase, and watching your accounts for suspicious activity.