Malwarebytes

NOVEMBER 4, 2024

In this blog post, we take a look at how criminals are abusing Bing and stay under the radar at the same time while also bypassing advanced security features such as two-factor authentication. The idea is about creating content that looks real, like a blog, but with malicious intent (monetization or other).

Engineering 133

Engineering Phishing Banking Authentication 133

Malwarebytes

JULY 30, 2024

If you were trying to download the popular Google Authenticator (a multi-factor authentication program) via a Google search in the past few days, you may have inadvertently installed malware on your computer. Fake site leads to signed payload hosted on Github The fraudulent site chromeweb-authenticators[.]com

Authentication 143

Authentication Computers and Electronics Social Engineering Malware 143

Krebs on Security

JANUARY 7, 2025

Lookout researchers discovered multiple voice phishing groups were using a new phishing kit that closely mimicked the single sign-on pages for Okta and other authentication providers. The image that Lookout used in its blog post for Crypto Chameleon can be seen in the lower right hooded figure. “ Annie.”

Phishing 336

Phishing Cryptocurrency Accountability Social Engineering 336

Schneier on Security

MARCH 25, 2022

I know him best for his work on authentication and covert channels, specifically as related to nuclear treaty verification. More blog posts. His work is cited extensively in Applied Cryptography. He has written a memoir of growing up dirt-poor in 1930s rural West Virginia.

Authentication 307

Authentication 307

Duo's Security Blog

JUNE 25, 2024

Duo’s Risk-Based Authentication (RBA) helps solve this by adapting MFA requirements based on the level of risk an individual login attempt poses to an organization. Risky authentications are stepped-up, and users are required to authenticate with a more secure factor. Will users get blocked?

Authentication 138

Authentication Risk Artificial Intelligence Engineering 138

Security Boulevard

MAY 15, 2025

And it may be important to run these tests either as a completely external user, modeling an anonymous threat actor, or as a valid authenticated user. The post Closing the Loop: Continuous API Security Testing – FireTail Blog appeared first on Security Boulevard.

Internet 52

Internet Internet Data breaches Authentication 52

The Last Watchdog

MARCH 1, 2023

The IT world relies on digital authentication credentials, such as API keys, certificates, and tokens, to securely connect applications, services, and infrastructures. Related: The coming of agile cryptography These secrets work similarly to passwords, allowing systems to interact with one another.

Authentication 222

Authentication CISO Passwords Software 222

Krebs on Security

OCTOBER 30, 2024

“Affected insurance providers can contact us to prevent leaking of their own data and [remove it] from the sale,” RansomHub’s victim shaming blog announced on April 16. A few days after BlackCat imploded, the same stolen healthcare data was offered for sale by a competing ransomware affiliate group called RansomHub.

Healthcare 298

Healthcare Insurance Computers and Electronics Data breaches 298

Duo's Security Blog

APRIL 3, 2025

While the enforcement of multi-factor authentication (MFA) makes logging in more secure, it inevitably runs the risk of adding steps to a process users already find annoying. While this may avoid authentication fatigue, it certainly risks and may even violate some security standards.

Authentication 52

Authentication Passwords Risk VPN 52

IT Security Guru

JUNE 13, 2024

These attackers appear to be using the stolen GitHub credentials of users who have not enabled two-factor authentication (2FA). Our data shows that between 93-97% of OX Security users have activated two-factor authentication (2FA), which helps keep accounts, data, and secrets private.

Backups 134

Backups Authentication Data breaches Social Engineering 134

The Last Watchdog

SEPTEMBER 24, 2024

About the essayist: Ambuj Kumar is Co-founder and CEO of Simbian , AI Agents for cybersecurity The post GUEST ESSAY: Massive NPD breach tells us its high time to replace SSNs as an authenticator first appeared on The Last Watchdog.

Authentication 216

Authentication Identity Theft Banking Data breaches 216

Troy Hunt

APRIL 6, 2020

That email would have been a reply to one you originally sent to me that would have sounded something like this: Hi, I came across your blog on [thing] and I must admit, it was really nicely written. I also have an article on [thing] and I think it would be a great addition to your blog. On a popular blog. Just the title.

Advertising 344

Advertising Internet Internet VPN 344

Krebs on Security

AUGUST 30, 2022

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. Image: Cloudflare.com. ” On July 28 and again on Aug. In an Aug.

Mobile 340

Mobile Phishing Authentication Accountability 340

Duo's Security Blog

OCTOBER 23, 2024

Available now in all paid Duo subscriptions The launch of Duo Mobile in the early 2010s changed how businesses enabled secure authentication. Other means of authentication outside of smartphones — hardware tokens, phone call authentication, SMS, etc. have proven to be either antiquated, expensive or vulnerable.

Authentication 116

Authentication Mobile Manufacturing Risk 116

Adam Shostack

JANUARY 2, 2025

Authentication is more frustrating to your customers when you dont threat model. When he did, they sent him a text message to authenticate him, and it says DO NOT share this access code with anyone. Ok, technically theres more lessons, which are in this blog post, but you know what I mean. Happier customers. Less frustration.

Banking 130

Banking Passwords Password Management Authentication 130

Duo's Security Blog

MAY 2, 2024

We are excited to have partnered closely with Microsoft in the co-development of Microsoft Entra ID External Authentication Methods, available in Public Preview May 2024! External Authentication Methods (EAM) enables frictionless integration of Duo’s full security feature set.

Authentication 144

Authentication Phishing Passwords Risk 144

Schneier on Security

MARCH 16, 2021

Andrew Appel and Susan Greenhalgh have a blog post on the insecurity of ES&S’s software authentication system: It turns out that ES&S has bugs in their hash-code checker: if the “reference hashcode” is completely missing, then it’ll say “yes, boss, everything is fine” instead of reporting an error.

Authentication 279

Authentication Software 279

The Last Watchdog

JULY 11, 2024

Related: Passwordless workpace long way off However, as users engage with more applications across multiple devices, the digital security landscape is shifting from passwords and password managers towards including passwordless authentication, such as multi-factor authentication (MFA), biometrics, and, as of late, passkeys.

Authentication 124

Authentication Passwords Malware Accountability 124

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That is true two-factor authentication: Something you have, and something you know (and maybe also even something you are).

Passwords 343

Passwords Mobile Authentication Banking 343

Security Affairs

MAY 5, 2025

In older versions (2019), this required no authentication, but newer versions require a secret key. In versions from 2019 this does not require any authentication.” “The evil is in the adminLoadLicense function, which executes $licenseFile as PHP.” ” continues the report. ” continues the report.

eCommerce 97

eCommerce Hacking Authentication Software 97

Security Affairs

NOVEMBER 2, 2024

is an inadequate authentication mechanisms that could allow an attacker to access sensitive information like usernames, MD5 password hashes, and configuration data. “Read the GreyNoise Labs blog for technical analysis and deeper insight into how Sift helped discover these zero-day vulnerabilities.”

Firmware 125

Firmware Manufacturing IoT Healthcare 125

Malwarebytes

MAY 2, 2025

The alternative: passkeys Passkeys are an alternative, more modern authentication method designed to replace passwords with a safer, simpler alternative. This blog post will try to explain what passkeys are, how to use them, and why they are better than passwords, helping you embrace this next step in online security. And its faster.

Passwords 87

Passwords Password Management Authentication Accountability 87

Schneier on Security

FEBRUARY 3, 2021

Details are in the Microsoft blog: We have published our in-depth analysis of the Solorigate backdoor malware (also referred to as SUNBURST by FireEye), the compromised DLL that was deployed on networks as part of SolarWinds products, that allowed attackers to gain backdoor access to affected devices.

Computers and Electronics 363

Computers and Electronics Malware Software Government 363

Malwarebytes

APRIL 28, 2025

Ive lost count of how many blogs Ive written about stalkerware -type apps that not only exposed the people they spied on but also ended up exposing the spies themselves. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password.

Passwords 95

Passwords Phishing Spyware Password Management 95

Anton on Security

OCTOBER 12, 2022

This is my completely informal, uncertified, unreviewed and otherwise completely unofficial blog inspired by my reading of our fourth Threat Horizons Report ( full version ) that we just released ( the official blog for #1 report , my unofficial blog for #2 , my unofficial blog for #3 ).

Cybersecurity 246

Cybersecurity Malware Accountability Passwords 246

Krebs on Security

MARCH 16, 2021

An expert on SIM-swapping attacks who’s been quoted quite a bit on this blog , Nixon said she also had Lucky225 test his interception tricks on her mobile phone, only to watch her incoming SMS messages show up on his burner phone. Usually, this is a mobile app like Authy or Google Authenticator that generates a one-time code.

Telecommunications 363

Telecommunications Mobile Accountability Wireless 363

Security Boulevard

MARCH 31, 2025

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication (BOLA) and broken function-level authentication (BFLA), remain almost impossible to detect.

Risk 64

Risk Authentication 64

IT Security Guru

FEBRUARY 25, 2025

A prime example is multi-factor authentication (MFA), a security process that requires users to verify their identity in two or more ways, such as a password, a code sent to their phone, or a fingerprint. Advanced authentication systems can analyse contextual factors, like location, device, and login behaviour, to detect anomalies.

Social Engineering 118

Social Engineering Authentication Risk Accountability 118

The Last Watchdog

APRIL 22, 2025

Typically, the attacker collects authentic media samples of their target, including still images, videos, and audio clips, to train the deep learning model. The more training data used, the more authentic the deepfake appears.

Authentication 100

Authentication Social Engineering Technology Media 100

Security Affairs

FEBRUARY 10, 2025

CVE-2024-57968 allows remote authenticated users to upload files to unintended folders, while CVE-2025-25181 is an SQL injection flaw enabling remote SQL execution (no patch available). The group was also observed exploiting vulnerabilities in Telerik UI such as CVE-2017-9248 and CVE-2019-18935. .

Manufacturing 113

Manufacturing Cybercrime Passwords Authentication 113

Krebs on Security

FEBRUARY 8, 2021

Perhaps the biggest selling point for U-Admin is a module that helps phishers intercept multi-factor authentication codes. Qbot) — to harvest one-time codes needed for multi-factor authentication. 2020 blog post on an ongoing Qakbot campaign that was first documented three months earlier by Check Point Research.

Phishing 339

Phishing Scams Banking Mobile 339

eSecurity Planet

DECEMBER 4, 2024

David Weston, VP of enterprise and OS security, said in a blog post , “We are committed to ensuring that Windows remains the most reliable and resilient open platform for our customers.” This includes strengthening password policies, implementing multi-factor authentication, and leveraging advanced threat detection techniques.

Encryption 107

Encryption Phishing Passwords Authentication 107

Krebs on Security

NOVEMBER 21, 2020

. “A domain hosting provider ‘GoDaddy’ that manages one of our core domain names incorrectly transferred control of the account and domain to a malicious actor,” Liquid CEO Kayamori said in a blog post. authenticate the phone call before sensitive information can be discussed.

Cryptocurrency 364

Cryptocurrency VPN Scams Social Engineering 364

Krebs on Security

SEPTEMBER 2, 2021

Bill said this criminal group averages between five and ten million email authentication attempts daily, and comes away with anywhere from 50,000 to 100,000 of working inbox credentials. “For context, our research indicates that multi-factor authentication prevents more than 99.9%

Accountability 347

Accountability Authentication Passwords Hacking 347

Krebs on Security

OCTOBER 20, 2023

Okta , a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. ET: BeyondTrust has published a blog post about their findings. Update, 2:57 p.m.

Social Engineering 361

Social Engineering Engineering Accountability Hacking 361

Duo's Security Blog

APRIL 24, 2025

Were thrilled to announce Duo Wear , a companion app for Duo Mobile that brings fast and easy multi-factor authentication (MFA) to your Wear OS smartwatch! Its quick, simple, and offers a frictionless authentication experience. What is Duo Wear? Duo Wear is an app designed specifically for Wear OS smartwatches. Why Make a Wear OS App?

Authentication 72

Authentication Mobile Technology 72

Troy Hunt

OCTOBER 28, 2020

Everything becomes clear(er) if I manually change the font in the browser dev tools to a serif version: The victim I was referring to in the opening of this blog post? Obviously, the image is resized to the width of paragraphs on this blog, give it a click if you want to check it out at 1:1 size. What's the solution here?

Phishing 363

Phishing Password Management Passwords Internet 363