SecureList

AUGUST 14, 2023

Examples include automation with phishing kits or Telegram bots. Besides tucking a phishing page inside the website they hack, scammers can steal all of the data on the server and completely disrupt the site’s operation. A lack of maintenance and security patches means they are easy to compromise using a known exploit.

Phishing 74

Phishing Hacking Banking Scams 74

Security Affairs

SEPTEMBER 5, 2022

Cybersecurity firm Armorblox discovered a new phishing campaign aimed at American Express customers. Armorblox researchers uncovered a new phishing campaign that is targeting American Express customers. The page was crafted to request the victims to enter their user ID and password. Pierluigi Paganini.

Phishing 97

Phishing Scams Social Engineering Password Management 97

Security Affairs

AUGUST 24, 2022

The threat actors behind a large-scale adversary-in-the-middle (AiTM) phishing campaign now target Google G Suite users. The threat actors behind a large-scale adversary-in-the-middle (AiTM) phishing campaign targeting enterprise users of Microsoft email services were spotted targeting Google G Suite users.

Phishing 98

Phishing Authentication Passwords Hacking 98

Security Affairs

MAY 2, 2024

Threat actors breached the Dropbox Sign production environment and accessed customer email addresses and hashed passwords Cloud storage provider DropBox revealed that threat actors have breached the production infrastructure of the DropBox Sign eSignature service and gained access to customer information and authentication data.

Hacking 99

Hacking Authentication Passwords Accountability 99

Security Affairs

AUGUST 22, 2023

While the leaked information highlights Belcan’s commitment to information security through the implementation of penetration tests and audits, attackers could exploit the lapse in leaving the tests’ results open, together with admin credentials hashed with bcrypt.

Passwords 81

Passwords Penetration Testing Engineering Manufacturing 81

Security Affairs

JUNE 11, 2023

Microsoft researchers warn of banking adversary-in-the-middle (AitM) phishing and BEC attacks targeting banking and financial organizations. Microsoft discovered multi-stage adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) attacks against banking and financial services organizations.

Phishing 89

Phishing Banking Financial Services Authentication 89

Security Boulevard

FEBRUARY 5, 2023

The attacks on password managers and their users continue as Bitwarden and 1Password users have reported seeing paid ads for phishing sites in Google search results for the official login page of the password management vendors.

Password Management 98

Password Management Passwords Accountability Phishing 98

Security Affairs

FEBRUARY 16, 2021

Researchers from threat intelligence Cyble have discovered threat actors abusing the Ngrok platform in a fresh phishing campaign. Researchers at the threat intelligence firm Cyble discovered a new wave of phishing attacks targeting multiple organizations that are abusing the ngrok platform, a secure and introspectable tunnel to the localhost.

Phishing 127

Phishing Cybercrime Mobile Internet 127

Security Affairs

AUGUST 25, 2022

The threat actors behind Twilio and Cloudflare attacks have been linked to a phishing campaign that targeted other 136 organizations. The threat actors behind the attacks on Twilio and Cloudflare have been linked to a large-scale phishing campaign that targeted 136 organizations, security firm Group-IB reported.

Phishing 90

Phishing Authentication Accountability Passwords 90

Security Affairs

APRIL 4, 2022

Threat actors gained access to internal tools of the email marketing giant MailChimp to conduct phishing attacks against crypto customers. Trezor WARNING: Elaborate Phishing attack. Trazor also took the phishing domain used by threat actors offline and launched an investigation to determine how many users have been impacted.

Phishing 116

Phishing Data breaches Cryptocurrency Social Engineering 116

Security Affairs

SEPTEMBER 15, 2022

Threat actors are exploiting the death of Queen Elizabeth II as bait in phishing attacks to steal Microsoft account credentials from victims. Researchers from Proofpoint are warning of threat actors that are using the death of Queen Elizabeth II as bait in phishing attacks. The phishing page (hxxps://auth[.]royalqueenelizabeth[.]com/?)

Phishing 85

Phishing Accountability Authentication Technology 85

Security Affairs

OCTOBER 11, 2022

Researchers warn of a new phishing-as-a-service (PhaaS) toolkit, called Caffeine, which is being used by cybercriminals. In March 2022, Mandiant researchers discovered threat actors using a shared Phishing-as-a-Service (PhaaS) platform called Caffeine. ” reads the report published by Mandiant.

Phishing 89

Phishing Cybercrime Accountability Advertising 89

Security Affairs

FEBRUARY 12, 2024

Once they’re in, they can grab your emails, usernames, passwords, and more. They might even lock you out of your own accounts by resetting your passwords. Avoid entering any data if you see a warning message about a site’s authenticity. Most browsers will alert you if a site isn’t secure.

DNS 124

DNS VPN Encryption Passwords 124

Malwarebytes

FEBRUARY 27, 2024

The German Federal Office for Information Security (BSI) has published a report on The State of IT Security in Germany in 2023 , and the number one threat for consumers is… identity theft. Change your password. You can make a stolen password useless to thieves by changing it. Watch out for fake vendors.

Identity Theft 100

Identity Theft Data breaches Artificial Intelligence Passwords 100

Security Affairs

JUNE 7, 2021

RockYou2021, the largest password compilation of all time has been leaked on a popular hacker forum, it contains 8.4 billion entries of passwords. . What seems to be the largest password collection of all time has been leaked on a popular hacker forum. The same user also claims that the compilation contains 82 billion passwords.

Passwords 114

Passwords Data breaches Accountability Password Management 114

Security Affairs

SEPTEMBER 5, 2022

Resecurity researchers discovered a new Phishing-as-a-Service (PhaaS) called EvilProxy advertised on the Dark Web. Following the recent Twilio hack leading to the leakage of 2FA (OTP) codes, cybercriminals continue to upgrade their attack arsenal to orchestrate advanced phishing campaigns targeting users worldwide.

Phishing 99

Phishing Accountability Hacking Advertising 99

Security Affairs

JANUARY 30, 2022

Microsoft has disclosed details of a large-scale phishing campaign using a novel device registration technique to target other enterprises. Microsoft has shared details of a large-scale phishing campaign that leverages stolen credentials to register devices on a target’s network to extend the attack to other enterprises.

Phishing 86

Phishing Hacking Authentication Passwords 86

Security Affairs

NOVEMBER 2, 2022

According to the advisory published by Dropbox, the company was the target of a phishing campaign that resulted in access to the GitHub repositories. The company pointed out that no one’s content, passwords, or payment information were accessed, it also remarked that the issue was quickly resolved. Pierluigi Paganini.

Phishing 122

Phishing Authentication Passwords Accountability 122

Security Affairs

NOVEMBER 15, 2023

The Cybernews research team discovered that Strendus, a Mexican-licensed online casino, had left public access to 85GB of its authentication logs, with hundreds of thousands of entries containing private gamblers’ data. Storing personal information in logs should be avoided, as it elevates their sensitivity level. User security log.

Passwords 103

Passwords Identity Theft Social Engineering Spyware 103

Identity IQ

FEBRUARY 21, 2024

IdentityIQ The traditional method of safeguarding our accounts with passwords is facing growing challenges. As technology evolves, so do the methods employed by hackers, making passwords both inconvenient and increasingly susceptible to breaches. Passkey vs. Password – What’s the Difference? What is a Passkey?

Passwords 52

Passwords Authentication Accountability Phishing 52

Security Affairs

OCTOBER 13, 2021

Threat actors are using mathematical symbols on impersonated company logos to evade detection in phishing campaigns. Researchers from anti-phishing cybersecurity firm INKY have detailed a new technique to evade detection in phishing attacks, it leverages using mathematical symbols on impersonated company logos.

Phishing 88

Phishing Telecommunications Accountability Marketing 88

Security Affairs

JUNE 7, 2021

Ukraine warned of a “massive” spear-phishing campaign carried out by Russia-linked threat actors against its government and private businesses. This is the third massive spear-phishing campaign that the Ukrainian government attributed to Russia-linked threat actors this year. Follow me on Twitter: @securityaffairs and Facebook.

Phishing 91

Phishing Government Antivirus Passwords 91

Security Affairs

MAY 30, 2021

Workers are going back to offices after months of remote working and crooks are attempting to exploit the situation by conducting spear-phishing attacks against their organizations. The messages pretend to provide information about changes to business operations the company is taking relative to the COVID-19 pandemic. .

Phishing 99

Phishing Authentication Government Accountability 99

Security Affairs

JULY 22, 2019

Last week, hackers published a list of Discord credentials (email addresses/passwords) that were allegedly phished from the users of the gaming chat platform. “Along with their message, the hackers posted a database of the allegedly phished credentials, split into multiple sections of those that work and those that don’t.

Phishing 78

Phishing Data breaches Passwords Advertising 78

Security Affairs

SEPTEMBER 25, 2022

Threat actors target GitHub users to steal credentials and two-factor authentication (2FA) codes by impersonating the CircleCI DevOps platform. GitHub is warning of an ongoing phishing campaign targeting its users to steal credentials and two-factor authentication (2FA) codes by impersonating the CircleCI DevOps platform.

Accountability 105

Accountability Phishing Authentication Passwords 105

SecureList

MARCH 12, 2024

Broken Authentication 5. Broken Authentication 5. Recommendations provided in these rankings are general in nature and based on information security best practices standards and guidelines, such as OWASP and NIST. Mitigation: implement authentication and authorization controls according to the role-based access model.

Passwords 99

Passwords Authentication Architecture Risk 99

Security Affairs

JANUARY 26, 2023

National Cyber Security Centre (NCSC) warns of a surge in the number of attacks from Russian and Iranian nation-state actors. National Cyber Security Centre (NCSC) is warning of targeted phishing attacks conducted by threat actors based in Russia and Iran. The are increasingly targeting organizations and individuals.

Phishing 75

Phishing Media Hacking Education 75

Duo's Security Blog

DECEMBER 6, 2022

When someone is told that passwords are going away in favor of a new, “password-less” authentication method, a healthy dose of skepticism is not unwarranted. While this isn’t entirely wrong, passwords are difficult to remember and rarely secure. What is WebAuthn? What is the difference between CTAP1 and CTAP2?

Architecture 93

Architecture Authentication Passwords Technology 93

Security Affairs

SEPTEMBER 2, 2023

The attacks targeted IT service desk staff to trick them into resetting all multi-factor authentication (MFA) factors enrolled by highly privileged users. The provider reported also that the threat actor removed the second factor for authentication policies. The company did not attribute the attack to a specific threat actor.

Social Engineering 133

Social Engineering Engineering Authentication Accountability 133

Security Affairs

JANUARY 19, 2022

A vulnerability in the implementation of multi-factor authentication (MFA) for Box allowed threat actors to take over accounts. A vulnerability in the implementation of multi-factor authentication (MFA) for Box allowed attackers to take over accounts without having access to the victim’s phone, Varonis researchers reported.

Accountability 115

Accountability Authentication Passwords Data breaches 115

Security Affairs

DECEMBER 21, 2023

The database included the personally identifiable information of Blink Mobility customers and administrators, including: Phone number Email address Encrypted password Registration date Device info and device token Details on subscription and rented vehicles (license plate, VIN, booking start and end location, etc.)

Mobile 105

Mobile Identity Theft Passwords Phishing 105

Security Affairs

JANUARY 2, 2020

The Poloniex cryptocurrency exchange is forcing users to reset their passwords following a data leak. . Another bad news for the community of the virtual currencies communities, the Poloniex cryptocurrency exchange has forced its users to reset their passwords following a data leak. . This is a real email! Pierluigi Paganini.

Passwords 59

Passwords Cryptocurrency Data breaches Advertising 59

Security Affairs

DECEMBER 17, 2023

” The US firm urges customers to be vigilant for social engineering and phishing attacks. The company also recommends active multi-factor authentication (MFA), and regularly rotate their MongoDB Atlas passwords. .” At this time, we are not aware of any exposure to the data that customers store in MongoDB Atlas.”

Social Engineering 118

Social Engineering Data breaches Cyber Attacks Accountability 118

Security Affairs

OCTOBER 17, 2023

With 85% of campaigns targeting victims with phishing emails containing malicious links, another form of a social engineering attack, education and cyber vigiliance remain a high priority. Why should employers educate employees about cyber security? This method was identified as vishing – a voice-based phishing attack.

Social Engineering 113

Social Engineering Ransomware Engineering Phishing 113

Security Affairs

JANUARY 18, 2021

It is not known how the account was accessed: the account had a good password, but did not have two-factor authentication enabled.” “The intruder was able to download a copy of the user list that contains email addresses, handles, and other statistical information about the users of the forum.

Hacking 131

Hacking Data breaches Passwords Accountability 131

CyberSecurity Insiders

MARCH 28, 2023

Understanding the FTC Safeguards Rule The FTC Safeguards Rule is a set of regulations that require covered financial institutions to develop, implement, and maintain an information security program designed to protect customer information. Implementation of multi-factor authentication.

Data breaches 125

Data breaches Authentication Risk Phishing 125

CyberSecurity Insiders

JULY 21, 2021

But a survey conducted by Google and Harris found that many people still refuse to adopt even the most essential credential security measures: just 37 percent use two-factor authentication, around a third change their passwords regularly, and a mere 15 percent use a password manager.

Social Engineering 145

Social Engineering Password Management Passwords Phishing 145