Tag: multifactor authentication
47 articles
Microsoft Entra ID Shifts to Passkey Authentication Default
Microsoft is shaking things up with its Entra ID service by making passkey authentication the default method starting September 2026, and users currently relying on SMS or voice authentication will be automatically transitioned to passkeys. By February 1, 2027, SMS and voice authentication will be phased out, marking a significant shift towards more secure passkey technology.
Chinese Phishing Services Shift to Live Credential Interception Tactics
Cyber attackers are now using live administration panels to interact with victims in real-time, capturing one-time passcodes and instantly bypassing multifactor authentication protections. This new tactic allows them to neutralize security measures and steal sensitive information more effectively.
Biometric Authentication Fortifies Against Stolen Credential Attacks
In a world where stolen credentials can turn authentication systems against us, traditional multifactor authentication can become just another vulnerability to exploit. Biometric authentication offers a powerful solution, fortifying defenses against stolen credential attacks by making it virtually impossible for hackers to replicate your unique identity.
Microsoft Exclusive: Critical Entra ID Script Block 2026
Microsoft is tightening the Content Security Policy for Entra ID so login.microsoftonline.com will only run JavaScript from Microsoft-owned domains — a strong move to block unauthorized script injection that helps protect tokens and credentials. Rolling out in about a year, it’s a heads-up for admins: tighter security, but likely compatibility pain for third‑party integrations.
Proton Exclusive: Alarming 300M Records Compromised
More than 300 million records have surfaced on the dark web — a startling tally that often mixes new leaks, resurfaced data and partial overlaps. Here’s what that number really means for your emails, passwords and IDs, and the simple steps you can take right now to protect yourself.
data breaches: Stunning, Alarming Q3 — 23M Victims
Over 23 million people had personal data exposed in Q3, according to the ITRC — a wake-up call that privacy can’t be an afterthought as breaches across sectors put identities, finances and long-term security at risk.
Scattered Lapsus$ Hunters: Exclusive Risky Hiatus
After the FBI seized their site, teenage collective Scattered Lapsus$ Hunters vowed to go dark until 2026 — a defiant restart in a familiar retire-regroup-return cycle. Whether they stick to it or not, defenders should treat the pause as a chance to patch vulnerabilities, rotate credentials and strengthen defenses.
RMM software Must-Have Protections: Best Defenses
Remote monitoring tools like ScreenConnect make IT life easier—but when attackers hijack them through phishing or stolen credentials, that convenience becomes a powerful way to spread ransomware and steal data. Protect your RMM consoles with strong authentication, network segmentation, and vigilant monitoring before a single click turns into a network-wide crisis.
credential stuffing: Risky Scourge, Must-Have Defenses
Think one reused password can’t hurt? A £2.31m fine proves it can — credential stuffing uses recycled logins and bots to drain money, steal data and wreck trust, and regulators are now forcing companies to adopt MFA, breached-password checks and smarter anti-bot defenses.
data breach notices: Stunning Wave Risks 3.7M
About 3.7 million North Americans just received breach notices after incidents at Allianz Life, WestJet and a payroll software vendor — leaving many wondering what to do next and how to protect themselves. Read on for what happened, what to watch for, and simple steps you can take right now to guard your identity.
payment diversion fraud: Must-Have Critical Alert
Worried that the bank details in that email really belong to your solicitor? The NCA warns house buyers are being hit by payment diversion fraud—sometimes losing over £80,000—so always independently verify payment instructions and use secure channels to protect your sale.
AI generated code: Exclusive Warning on Risky Phishing
Microsoft disrupted an AI-powered phishing campaign that used SVG files disguised as PDFs to trick email and cloud preview viewers into stealing credentials, showing attackers can now auto-generate convincing scams at scale. Treat unexpected document previews and credential prompts with caution, enable MFA, and verify senders to stay one step ahead.
SonicWall SSL VPN Urgent Alert: Critical MFA Bypass Risk
Akira ransomware actors are rapidly exploiting SonicWall SSL VPN flaws to bypass MFA and spread payloads—proving MFA isn’t a silver bullet and that urgent patching, tighter segmentation, and better monitoring are essential to stop these fast-moving attacks.
Akira ransomware: Stunning High-Risk SonicWall Exploit
Heads up: Akira ransomware is actively exploiting three SonicWall vulnerabilities. If you run SonicWall gear, patch now and double-check your defenses to avoid compromise.
Zero trust: Must-Have Best Practices for SLED Security
As ransomware and credential-stuffing rise, SLED IT leaders are combining AI-driven zero trust with gamified training to tighten defenses and turn staff and students into an active line of defense.
remote access Risky Threats: Must-Have Defenses
Attackers are increasingly using misconfigured or abused remote-access tools to stage ransomware, so treating RDP, VPNs and apps like TeamViewer as frontline security priorities—with MFA, patching, segmentation and monitoring—is no longer optional.
JLR cyberattack: Exclusive Risky Extortion Claim
Jaguar Land Rover is probing claims by a group calling itself Scattered Spider that it stole data and issued an extortion demand. The incident highlights growing cyber risks for automakers — from customer privacy to vehicle software and supply-chain vulnerabilities.
Salesloft/Drift incident: Exclusive Risky Security Wake-Up
Cloudflare confirmed some customer data was exposed after the Salesloft/Drift breach, but key details and the full scope remain unclear — a stark reminder that third‑party compromises can ripple across the cloud ecosystem. Customers should watch for updates and take simple precautions now, like rotating credentials and enabling MFA, while investigations continue.
SSL VPN Urgent: Must-Have Best Defenses
Imagine someone pounding on invisible locks: a massive brute‑force campaign recently blasted SSL VPNs and RDP hosts with relentless login attempts, showing how one weak credential can lead to ransomware or data theft. If you run remote access services, enable MFA, rate‑limit logins, and segment networks now to stop attackers before they get in.
Salesloft Drift integration: Risky Must-Have Fixes
A widely used Salesloft–Drift integration meant to speed workflows is being abused to pivot into Google Workspace accounts—now’s the time to audit OAuth permissions, enforce least privilege, and revoke any unnecessary app access before attackers do.
multifactor authentication Risky Crisis, Must-Have Fix
Login attacks are skyrocketing, and the identity systems we trust—from MFA to identity providers—are under siege, eroding confidence and leaving security teams scrambling. Rebuilding trust will take pragmatic steps like phased passkey rollouts, phishing‑resistant methods, and smarter help‑desk controls that balance security with usability.
Social Security numbers: Stunning Risky Cloud Leak
A whistleblower alleges a Social Security Administration unit copied an SSA database containing Social Security numbers into an unauthorized, unsecured cloud—potentially exposing tens of millions of Americans to identity theft. This raises urgent questions about whether cost‑cutting pushed security and oversight to the breaking point.
phishing attack Stunning Risky ZipLine Exposed
A new ZipLine phishing campaign uses a legitimate-looking White House photo and fake contact forms to trick employees at U.S. manufacturers into handing over credentials — opening the door to IP theft and ransomware. It’s a sharp reminder that a single authentic image can bypass defenses, so tighten verification, MFA, and training now.
SIM swapping: Stunning Dangerous Threat Exposed
A federal judge just gave a 21‑year‑old tied to the Scattered Spider SIM‑swapping ring 10 years in prison and roughly $13 million in restitution, underscoring how devastating phone‑number takeovers can be. Protect yourself now by ditching SMS‑only authentication, enabling app or hardware MFA, and adding carrier account locks or port freezes.