Malwarebytes

JANUARY 10, 2024

We have seen several high-profile accounts that were taken over on X (formerly Twitter) only to be used for cryptocurrency related promotional activities, like expressing the approval of exchange-traded funds (ETFs). The @SECGov X account was compromised, and an unauthorized post was posted. You’re all set.

Accountability 87

Accountability Scams Hacking Cryptocurrency 87

Bleeping Computer

APRIL 30, 2024

UnitedHealth confirms that Change Healthcare's network was breached by the BlackCat ransomware gang, who used stolen credentials to log into the company's Citrix remote access service, which did not have multi-factor authentication enabled. [.]

Healthcare 133

Healthcare Accountability Hacking Authentication 133

Security Affairs

APRIL 12, 2024

Roku announced that 576,000 accounts were compromised in a new wave of credential stuffing attacks. Roku announced that 576,000 accounts were hacked in new credential stuffing attacks, threat actors used credentials stolen from third-party platforms. ” reads the press release published by the company.

Accountability 110

Accountability Passwords Data breaches Authentication 110

SecureWorld News

JANUARY 10, 2024

Securities and Exchange Commission's (SEC) account on X (formerly Twitter) was briefly compromised on Tuesday, January 9, sending shockwaves through the cryptocurrency market and raising serious questions about the agency's cybersecurity practices. Bud Broomhead, CEO of Viakoo, emphasized the broader lessons learned from the hack.

Accountability 89

Accountability Hacking Marketing Cryptocurrency 89

The Hacker News

JANUARY 10, 2024

The compromise of Mandiant's X (formerly Twitter) account last week was likely the result of a "brute-force password attack," attributing the hack to a drainer-as-a-service (DaaS) group.

Accountability 88

Accountability Hacking Authentication Passwords 88

Security Affairs

MAY 30, 2023

PyPI is going to enforce two-factor authentication (2FA) for all project maintainers by the end of this year over security concerns. Due to security concerns, PyPI will be mandating the use of two-factor authentication (2FA) for all project maintainers by the end of this year. ” reads the announcement.

Authentication 85

Authentication Accountability Hacking Malware 85

Security Affairs

SEPTEMBER 15, 2021

Microsoft announced that users can access their consumer accounts without providing passwords and using more secure authentication methods. Microsoft says the feature will be rolled out over the coming weeks, it already provides passwordless methods to enterprise users since March 2021, and plans to roll out it for Azure AD accounts.

Authentication 98

Authentication Accountability Passwords Phishing 98

Bleeping Computer

DECEMBER 22, 2022

​Comcast Xfinity customers report their accounts being hacked in widespread attacks that bypass two-factor authentication. These compromised accounts are then used to reset passwords for other services, such as the Coinbase and Gemini crypto exchanges. [.].

Accountability 103

Accountability Hacking Authentication Passwords 103

Security Affairs

MAY 2, 2024

Threat actors breached the Dropbox Sign production environment and accessed customer email addresses and hashed passwords Cloud storage provider DropBox revealed that threat actors have breached the production infrastructure of the DropBox Sign eSignature service and gained access to customer information and authentication data.

Hacking 99

Hacking Authentication Passwords Accountability 99

Krebs on Security

MAY 30, 2023

A number of Discord communities focused on cryptocurrency have been hacked this past month after their administrators were tricked into running malicious Javascript code disguised as a Web browser bookmark. Scavuzzo said the administrator’s account was hijacked even though she had multi-factor authentication turned on.

Hacking 286

Hacking Scams Accountability Cryptocurrency 286

Krebs on Security

JANUARY 21, 2022

Criminals ripping off other crooks is a constant theme in the cybercrime underworld; Accountz Club’s slogan — “the best autoshop for your favorite shops’ accounts” — just normalizes this activity by making logins stolen from users of various cybercrime shops for sale at a fraction of their account balances.

Hacking 290

Hacking Cybercrime Authentication Passwords 290

WIRED Threat Level

JANUARY 12, 2024

The US Securities and Exchange Commission and security firm Mandiant both had their X accounts breached, possibly due to changes to X’s two-factor authentication settings. Here’s how to fix yours.

Accountability 86

Accountability Hacking Authentication 86

Krebs on Security

MARCH 4, 2021

Over the past few weeks, three of the longest running and most venerated Russian-language online forums serving thousands of experienced cybercriminals have been hacked. “Initial analysis of the leaked data pointed to its probable authenticity, as at least a portion of the leaked user records correlated with our own data holdings.”

Cybercrime 363

Cybercrime Hacking Passwords Accountability 363

Graham Cluley

JANUARY 11, 2024

Anyone who works in computer security knows that they should have two-factor authentication (2FA) enabled on their accounts. A hacker might be able to guess, steal, or brute force the password on your accounts - but they won't be able to gain access unless they also have a time-based one-time password.

Accountability 90

Accountability Passwords Hacking Authentication 90

Security Affairs

AUGUST 31, 2023

Cisco is aware of attacks conducted by Akira ransomware threat actors targeting Cisco ASA VPNs that are not configured for multi-factor authentication. “This highlights the importance of enabling multi-factor authentication (MFA) in VPN implementations. . ” reads a post published by Cisco PSIRT. 200 and 162.35.92[.]242

Authentication 113

Authentication Ransomware VPN Hacking 113

Security Affairs

MARCH 2, 2023

TechCrunch was able to verify the authenticity of the data for a sample they analyzed, however it is unclear how recent the data is. The popular data breach notification service HaveIBeenPwned reported that the hack took place in December and impacted 565k user accounts, it also added that 83% of the records were already in HIBP database.

Accountability 82

Accountability Hacking Data breaches Passwords 82

Adam Levin

OCTOBER 8, 2019

The FBI is warning businesses about a new series of cyberattacks that can circumvent multi-factor authentication (MFA). In a Private Industry Notification (PIN), the FBI warned businesses that “cyber actors” had been observed, “circumventing multi-factor authentication through common social engineering and technical attacks.”

Authentication 210

Authentication Cyber Attacks Social Engineering Engineering 210

Krebs on Security

FEBRUARY 26, 2023

Media coverage understandably focused on GoDaddy’s admission that it suffered three different cyberattacks over as many years at the hands of the same hacking group. “This guy had access to the notes, and knew the number to call,” to make changes to the account, the CEO of Escrow.com told KrebsOnSecurity.

Hacking 268

Hacking Social Engineering Phishing Scams 268

Krebs on Security

MARCH 10, 2020

FBI officials last week arrested a Russian computer security researcher on suspicion of operating deer.io , a vast marketplace for buying and selling stolen account credentials for thousands of popular online services and stores. also is a favored marketplace for people involved in selling phony social media accounts.

Accountability 298

Accountability Advertising Hacking Cybercrime 298

Security Affairs

FEBRUARY 26, 2024

Recently the leak of a collection of files apparently stolen from the Chinese government hacking contractor, I-Soon, exposed Chinese hacking capabilities. Recently someone has leaked on GitHub [ 1 , 2 ] a collection of files apparently stolen from the Chinese hacking firm, I-Soon.

Hacking 109

Hacking Government Spyware Marketing 109

Security Affairs

APRIL 14, 2020

The details of around four million users are now being shared for free on underground hacking forums, according to ZDNet that has obtained samples from different sources, exposed records include usernames, email addresses, and hashed account passwords (bcrypt hashing algorithm). ” reads the post published Risk Based Security.

Accountability 139

Accountability Hacking Data breaches Passwords 139

Adam Levin

DECEMBER 30, 2020

In the latest wave of attacks, hackers are using credential stuffing, where credentials from previously compromised accounts are used to gain access to internet-enabled smart home devices. “As The post Hacked IoT Devices Livestreaming Swatting Attacks: FBI appeared first on Adam Levin.

IoT 300

IoT Hacking Internet Internet 300

Security Affairs

NOVEMBER 15, 2020

million Pluto TV user accounts on a hacking forum for free, he claims they were stolen by ShinyHunters threat actor. million Pluto TV user records, he also added that the service was hacked by ShinyHunters. SecurityAffairs – hacking, ShinyHunters). SecurityAffairs – hacking, ShinyHunters). A hacker has shared 3.2

Accountability 99

Accountability Hacking Data breaches Passwords 99

Security Affairs

APRIL 9, 2024

“An error in the account handler lets an attacker skip the PIN verification entirely and create a privileged user profile.” . “WebOS runs a service on ports 3000/3001 (HTTP/HTTPS/WSS) which is used by the LG ThinkQ smartphone app to control the TV. ” reads the advisory. Sweden, and Finland.

Hacking 126

Hacking Internet Internet Authentication 126

Security Affairs

MAY 6, 2020

Hackers have breached the online learning platform Unacademy and are selling the account information for close to 22 million users. Online learning platform Unacademy has suffered a data breach after a hacker gained access to their database and started selling the account information for close to 22 million users. Pierluigi Paganini.

Accountability 103

Accountability Hacking Data breaches Advertising 103

Krebs on Security

DECEMBER 13, 2022

Meanwhile, the hackers responsible are communicating directly with members through the InfraGard portal online — using a new account under the assumed identity of a financial industry CEO that was vetted by the FBI itself. Department of Defense. USDoD’s InfraGard sales thread on Breached.

Hacking 362

Hacking Energy and Utilities Cybercrime Accountability 362

Krebs on Security

JUNE 28, 2019

says it will soon force all Cloud Solution Providers (CSPs) that help companies manage their Office365 accounts to use multi-factor authentication. As it happened, the PCM employee was not using multi-factor authentication. And when that PCM employee’s account got hacked, so too did many other PCM customers.

Authentication 226

Authentication Accountability Data breaches Software 226

IT Security Guru

OCTOBER 26, 2023

Enter Two-Factor Authentication, or 2FA for short. Then, your account will ask for a secondary code, usually sent via SMS to your phone. Here’s a shocking stat: according to the Verizon Data Breach Investigations Report , 81% of hacking-related breaches leverage either stolen or weak passwords. What Exactly is 2FA?

Authentication 115

Authentication Passwords Mobile VPN 115

Security Affairs

JANUARY 19, 2022

A vulnerability in the implementation of multi-factor authentication (MFA) for Box allowed threat actors to take over accounts. A vulnerability in the implementation of multi-factor authentication (MFA) for Box allowed attackers to take over accounts without having access to the victim’s phone, Varonis researchers reported.

Accountability 115

Accountability Authentication Passwords Data breaches 115

CSO Magazine

JUNE 8, 2022

Microsoft will soon change the mandate to multi-factor authentication (MFA) with changes to Microsoft 365 defaults. As Microsoft points out, “When we look at hacked accounts, more than 99.9% don’t have MFA, making them vulnerable to password spray, phishing and password reuse. To read this article in full, please click here

Authentication 112

Authentication Passwords Phishing Accountability 112

Security Boulevard

JANUARY 27, 2024

Safeguarding our online accounts has never been more crucial. One of the most effective tools at our disposal is Two-Factor Authentication (2FA). Two-Factor Authentication is a security process in which users provide two different authentication factors to verify themselves.

Authentication 64

Authentication Accountability Hacking 64

Krebs on Security

AUGUST 1, 2018

What’s interesting about the incident is that it showcases once again why relying on mobile text messages (SMS) for two-factor authentication (2FA) can lull companies and end users into a false sense of security. APP-BASED AUTHENTICATION. “We point this out to encourage everyone here to move to token-based 2FA.”

Authentication 195

Authentication Mobile Passwords Accountability 195

Security Boulevard

MARCH 28, 2024

The post Apple OTP FAIL: ‘MFA Bomb’ Warning — Locks Accounts, Wipes iPhones appeared first on Security Boulevard. Rethink different: First, fatigue frightened users with multiple modal nighttime notifications. Next, call and pretend to be Apple support.

Accountability 132

Accountability Social Engineering Authentication Data privacy 132

Security Affairs

AUGUST 9, 2023

Cloud account takeover scheme utilizing EvilProxy hit over 100 top-level executives of global organizations EvilProxy was observed sending 120,000 phishing emails to over a hundred organizations to steal Microsoft 365 accounts. Proofpoint noticed a worrisome surge of successful cloud account compromises in the past five months.

Accountability 89

Accountability Phishing Authentication Architecture 89

Security Affairs

MAY 3, 2020

The company has over 4200 employees and accounts for over 90 million active users every month. The hacker claims to have hacked the company in March 2020, it has stolen just a small part of the company database. ZDNet confirmed the authenticity of the leaked data. SecurityAffairs – Tokopedia, hacking).

Accountability 114

Accountability Hacking Passwords Data breaches 114

Security Affairs

JANUARY 4, 2024

An internet outage impacted Orange Spain after a hacker gained access to the company’s RIPE account to misconfigure BGP routing. The hacker, who uses the moniker ‘Snow’, gained access to the RIPE account of Orange Spain and misconfigured the BGP routing causing an internet outage. I have fixed your RIPE admin account security.

Internet 111

Internet Internet Accountability Passwords 111

Security Affairs

FEBRUARY 18, 2023

Twitter has announced that the platform will allow using the SMS-based two-factor authentication (2FA) only to its Blue subscribers. To date, Twitter has offered three methods of 2FA : text message, authentication app, and security key. “At that time, accounts with text message 2FA still enabled will have it disabled.

Authentication 94

Authentication Accountability Media Hacking 94