Phishing
Researchers say iAuthFlow V2 can register an attacker-controlled passkey, enabling persistent access even after passwords are changed and active sessions revoked.
Hi, what are you looking for?
SecurityWeek
Cybercrime
The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.
Phishing
Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks.
Data Breaches
Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.
Phishing
Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or...
Mobile & Wireless
Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations.
Phishing
The attackers call victims to direct them to phishing websites mirroring Microsoft Entra ID login pages.
Cybercrime
The decentralized prediction market said hackers targeted some of its users through a compromise of a third-party vendor.
Phishing
The platform used more than 9,000 phishing sites, stealing nearly 4 million credit cards and causing roughly $1.9 billion in losses.
Phishing
MokN's platform deploys realistic decoy access points to lure attackers into revealing compromised credentials, enabling organizations to respond before abuse occurs.
Phishing
Victims span across the aviation, critical infrastructure, energy, logistics, public administration, and technology sectors.
Phishing
The malicious emails claim to contain a conduct report and lure victims to a Microsoft phishing website that leverages AitM.
Phishing
Still under development, Bluekit provides users with automated domain registration and an AI Assistant.
Phishing
Legitimate-looking emails coming from Robinhood systems lured recipients to phishing websites.
Email Security
New analysis from Abnormal AI reveals how attackers have abandoned technical exploits to weaponize routine workflows and internal trust.
Phishing
Threat actors are reusing Tycoon 2FA tools across other phishing kits following the platform’s disruption.
Phishing
Attack volumes are back to pre-disruption levels, and the adversary tactics have remained unchanged.
Malware & Threats
Insufficient sanitization of CSS content within HTML emails leads to inline script execution when the message is opened in a browser.
Phishing
The attackers used a DKIM-signed phishing email, trusted redirect infrastructure, compromised servers, and Cloudflare-protected phishing pages, but the attack was unsuccessful.
Data Breaches
Starbucks said the incident involved phishing attacks targeting an employee portal, affecting hundreds.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.
(Nadir Izrael)
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today.
(Sravish Sridhar)
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default.
(Matt Honea)
Security teams must treat autonomous agents as highly privileged identities.
(Etay Maor)
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)