Collecting Cyber-News from over 60 sources

Tag: login

OAuth phishers make ‘check where the link points’ advice ineffective

Mar 3, 2026 2:47 PM

Tags: authentication, automation, awareness, business, cloud, control, edr, email, encryption, endpoint, exploit, governance, identity, login, malicious, microsoft, monitoring, phishing, saas, threat, tool

Context, not the URL, is the new red flag: Sakshi Grover, Senior Research Manager at IDC Asia/Pacific, said the longstanding advice to hover over a link and verify its domain was built for an era of lookalike domains and that it no longer holds in environments where authentication flows routinely pass through trusted identity providers.”Organizations…
New Starkiller Phishing Framework Uses Real Login Pages to Bypass MFA Security

Mar 3, 2026 2:47 PM

Tags: authentication, credentials, cyber, framework, infrastructure, login, mfa, phishing

A new phishing framework called Starkiller is raising the bar for “phishing-as-a-service” by serving victims the real login pages of major brands through attacker infrastructure, making pages look authentic and stay up to date. By acting as a live reverse proxy, it can capture credentials and, more importantly, steal session cookies/tokens after the victim completes multi-factor authentication (MFA), enabling…
HPE AutoPass Vulnerability Allows Remote Attackers to Bypass Authentication

Mar 3, 2026 1:47 PM

Tags: authentication, control, cve, cyber, login, vulnerability

Hewlett Packard Enterprise (HPE) has disclosed a remote authentication-bypass vulnerability in HPE AutoPass License Server (APLS) that could let unauthenticated attackers bypass login controls over the network. The issue is tracked as CVE-2026-23600 and is fixed in APLS 9.19 and later.”‹ Item Details Vendor bulletin HPESBGN05003 rev.1 (Security Bulletin), initial release 27 Feb 2026; last…
Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication

Mar 3, 2026 1:47 PM

Tags: access, authentication, cybercrime, cybersecurity, group, login, mfa, phishing, threat

Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller that proxies legitimate login pages to bypass multi-factor authentication (MFA) protections.It’s advertised as a cybercrime platform by a threat group calling itself Jinkusu, granting customers access to a dashboard that lets them select a brand to impersonate or enter a brand’s real URL.…
Neue Phishing-Methode über .arpa

Mar 3, 2026 11:46 AM

Tags: login, mail, phishing

Phishing-Kampagnen folgen häufig bekannten Mustern: gefälschte Login-Seiten, täuschend echte E-Mails und manipulierte Links. Doch aktuelle Analysen von Infoblox zeigen eine ungewöhnliche Entwicklung. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/phishing-methode-ueber-arpa
GTFire Phishing Campaign Exploits Google Services to Bypass Detection and Harvest Credentials

Mar 2, 2026 1:47 PM

Tags: credentials, cyber, detection, exploit, google, infrastructure, login, malicious, phishing, service, tool

GTFire is a large-scale phishing scheme that abuses multiple Google services to hide malicious infrastructure, evade security tools, and steal credentials from organizations worldwide. GTFire is a credential-harvesting operation that chains Google Firebase Hosting and Google Translate to deliver phishing pages that look like legitimate brand logins. Attackers host fake login portals on Firebase .web.…
Configuration and Runtime: The PBJ of Effective Security Operations

Mar 2, 2026 12:47 PM

Tags: attack, infrastructure, login, network, siem

For most of the security industry’s history, logs were the problem to solve. Attacks were easy to spot in events: Failed logins, suspicious processes, and unexpected network connections. Infrastructure was relatively static, identities were long-lived, and configuration changed slowly enough to be treated as background context. SIEMs emerged to centralize logs, correlate activity across systems,..…
Purchase order attachment isn’t a PDF. It’s phishing for your password

Mar 2, 2026 11:47 AM

Tags: login, password, phishing

A fake purchase order attachment turned out to be a phishing page designed to harvest your login details. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/purchase-order-attachment-isnt-a-pdf-its-phishing-for-your-password/
How to make LLMs a defensive advantage without creating a new attack surface

Feb 27, 2026 12:37 PM

Tags: access, ai, api, attack, authentication, best-practice, business, control, credentials, cyber, cybersecurity, data, email, exploit, framework, fraud, governance, group, identity, infrastructure, injection, intelligence, international, LLM, login, malware, mitre, nist, phishing, radius, RedTeam, risk, risk-management, scam, spear-phishing, switch, technology, threat, tool, training, unauthorized, update, vulnerability

Alert triage summaries that turn raw telemetry into a short “what happened, why it matters and what I should check next” narrativeInvestigation copilots that generate a timeline from logs, tickets and chat transcripts, then highlight gaps and recommended pivotsDetection engineering assistance for drafting Sigma, YARA or query language snippets that an engineer can review and…
Infostealers Drive Massive Brute-Force Attacks on Corporate SSO Gateways with Stolen Credentials

Feb 27, 2026 9:36 AM

Tags: attack, breach, corporate, credentials, cyber, cybercrime, cybersecurity, login

The cybersecurity community is witnessing a rise in credential”‘stuffing attacks targeting corporate Single Sign”‘On (SSO) systems, with recent campaigns focusing on F5 BIG”‘IP devices. To understand the source of the stolen logins, Defused Cyber analyzed a dataset of 70 unique email”‘password pairs used in the attack. When cross”‘referenced with Hudson Rock’s cybercrime database of Infostealer…
Malicious NuGet Packages Target ASP.NET Developers to Steal Login Credentials

Feb 24, 2026 1:02 PM

Tags: backdoor, credentials, cyber, identity, login, malicious

Malicious NuGet packages posing as legitimate developer utilities are targeting ASP.NET projects to steal identity credentials and silently backdoor applications through a localhost proxy. All four were published between August 1221, 2024, by a NuGet user named “hamzazaheer” and have collectively amassed a little over 4,500 downloads before takedown requests were submitted. The campaign’s core…
Master Your Passwordless Future: Introducing Thales Authenticator Lifecycle Manager

Feb 24, 2026 10:01 AM

Tags: access, attack, authentication, automation, breach, compliance, container, control, data, fido, Hardware, identity, login, msp, phishing, service, software, tool, zero-trust

Master Your Passwordless Future: Introducing Thales Authenticator Lifecycle Manager madhav Tue, 02/24/2026 – 07:53 The move to passwordless authentication is no longer a distant goal; it’s a present-day necessity. Organizations are rapidly adopting FIDO2 authenticators to defend against phishing and strengthen their security posture. While this shift enhances security, it introduces a new challenge: managing…
Starkiller Phishing Kit Clones Real Login Pages to Evade MFA Protections

Feb 23, 2026 1:01 PM

Tags: authentication, credentials, cyber, framework, login, mfa, phishing, theft, update

New phishing framework Starkiller is enabling more convincing, scalable credential theft by proxying real login pages and bypassing multi-factor authentication (MFA), significantly raising the bar for defenders. Traditional phishing kits typically serve static HTML clones of popular login portals, which quickly become outdated when brands update their interfaces, creating telltale visual discrepancies. Starkiller takes a…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

Feb 21, 2026 1:02 PM

Tags: authentication, login, mfa, password, phishing, service

Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and…
TDL 016 – Speed, Risk, and Responsibility in the Age of AI – Rafael Ramirez

Feb 20, 2026 9:02 PM

Tags: access, ai, antivirus, automation, awareness, business, ciso, cloud, control, country, cyber, data, defense, detection, dns, firewall, governance, government, hacker, ibm, incident response, intelligence, Internet, law, linkedin, login, mfa, microsoft, network, risk, saas, service, skills, software, startup, strategy, technology, threat, tool, training, update, vulnerability, windows, zero-trust

Summary In a recent episode of The Defenders Log, host David Redekop sat down with cyber security expert Rafael Ramirez to navigate the rapidly shifting landscape of AI security. As we move deeper into 2026, the duo explored how artificial intelligence has evolved from simple chatbots into powerful, autonomous “agentic” systems. The Double-Edged Sword of…
CharlieKirk Grabber Malware Targets Windows Systems to Steal Login Credentials

Feb 20, 2026 2:01 PM

Tags: control, credentials, cyber, data, login, malware, password, theft, windows

CharlieKirk Grabber is a Python-based Windows infostealer that focuses on rapid “smash”‘and”‘grab” credential theft and data exfiltration rather than long-term system control or destructive behavior. It targets browser”‘stored passwords, Wi”‘Fi keys, Discord tokens, and gaming sessions, then exfiltrates the collected data via third”‘party file hosting and encrypted Discord or Telegram channels. File Name CharlieKirk.exe File…
PayPal launches latest struggle to get rid of SMS for MFA

Feb 20, 2026 9:01 AM

Tags: authentication, ceo, ciso, communications, compliance, cybersecurity, email, finance, fraud, government, group, login, mfa, mobile, nfc, passkey, password, phishing, risk, service, strategy, switch, update

Muddled effort, mixed messages Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, says he’s “always found it odd” that PayPal still supports SMS as its primary secondary authentication factor.”Everyone in financial services and government has abandoned it for not being sufficiently secure and are moving to even phishing-resistant authentication, such as passkeys, Yubikeys,” he…
New phishing campaign tricks employees into bypassing Microsoft 365 MFA

Feb 20, 2026 5:01 AM

Tags: access, attack, awareness, business, credentials, defense, email, google, identity, incident response, least-privilege, login, malicious, mfa, microsoft, monitoring, office, phishing, risk, saas, social-engineering, training

microsoft.com. But the attacker has pre-registered their device to get the code for [the victim] to verify.”David Shipley, head of Canadian security awareness training provider Beauceron Security, said OAuth device code attacks have been gaining steam since 2024. “It’s the natural evolutionary response to improvements in account security, particularly MFA”, he said. The easiest defense is…
BestClass ‘Starkiller’ Phishing Kit Bypasses MFA

Feb 20, 2026 12:00 AM

Tags: attack, login, mfa, phishing, tool

A user-friendly PhaaS tool beats standard methods for detecting phishing attacks by live-proxying legitimate login sites. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa
Threat Actors Using Fake Google Forms Site to Harvest Google Logins

Feb 19, 2026 11:01 AM

Tags: cyber, cybercrime, exploit, google, jobs, login, malicious, phishing, threat

A new phishing campaign in which threat actors are using a convincing fake version of Google Forms to steal Google account credentials. Cybercriminals are once again exploiting a trusted brand Google to trick job seekers and steal their credentials. The campaign’s malicious URLs all followed a similar structure: forms.google.ss-o[.]com/forms/d/e/{unique_id}/viewform?form=opportunitysecpromo= At first glance, these links appear…
Shadow Machines: The Non-Human Identities Exposing Your Cloud AI Stack

Feb 19, 2026 10:01 AM

Tags: access, ai, api, authentication, automation, business, cloud, compliance, container, control, credentials, data, encryption, framework, governance, iam, identity, infrastructure, iot, jobs, login, mfa, password, risk, risk-management, saas, service, software, strategy, supply-chain, tool

Shadow Machines: The Non-Human Identities Exposing Your Cloud & AI Stack madhav Thu, 02/19/2026 – 06:30 The machines we don’t see are the ones running our businesses. Unfortunately, most IAM systems do not track them. In an ironic twist, the ghost in the machine has become the machine itself: invisible, autonomous, and increasingly beyond human…
Job scam uses fake Google Forms site to harvest Google logins

Feb 18, 2026 2:58 PM

Tags: google, jobs, login, phishing, scam

Phishers are using fake Google Forms pages hosted on lookalike domains to trick job seekers into handing over their Google credentials. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/job-scam-uses-fake-google-forms-site-to-harvest-google-logins/
One stolen credential is all it takes to compromise everything

Feb 18, 2026 12:58 PM

Tags: access, breach, credentials, email, login, saas

Attackers often gain access through routine workflows like email logins, browser sessions, and SaaS integrations. A single stolen credential can give them a quick path to move … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/18/identity-based-cyberattacks-compromise/
MetaMask Users Targeted by Phishing Emails with Fake Security Report to Bypass Detection

Feb 18, 2026 9:58 AM

Tags: attack, authentication, cyber, detection, email, login, mfa, phishing, social-engineering

A new phishing campaign is targeting MetaMask users with cleverly crafted emails designed to trick recipients into enabling a fake Two-Factor Authentication (2FA) setup. The lure includes a forged “security report” PDF meant to mimic a legitimate notification about unusual login activity, adding credibility and emotional urgency to the scam. The attack blends social engineering…
The new paradigm for raising up secure software engineers

Feb 18, 2026 8:58 AM

Tags: ai, application-security, awareness, ceo, ciso, compliance, control, cyber, data, governance, login, risk, skills, software, threat, tool, training, vulnerability

Threat modeling as a core competency: This system-level thinking should also elevate the need for greater developer fluency in threat modeling, says Yasar. He notes that threat modeling has historically been difficult for product security and engineering teams to operationalize at scale. One of the longstanding barriers to practical threat modeling was the knowledge required…
Polish cops nab 47-year-old man in Phobos ransomware raid

Feb 17, 2026 2:58 PM

Tags: login, password, ransomware

Police say seized kit contained logins, passwords, and server IP addresses First seen on theregister.com Jump to article: www.theregister.com/2026/02/17/poland_phobos_ransomware_arrest/
What Is a Single Sign-On (SSO) Code?

Feb 17, 2026 11:58 AM

Tags: login

Locked out? Learn what an SSO code actually is, where to find your company domain, and how to solve common login errors in Zoom, Slack, and Salesforce. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/what-is-a-single-sign-on-sso-code/
Threat Actors Target OpenClaw Configurations to Steal Login Credentials

Feb 17, 2026 6:58 AM

Tags: ai, credentials, crypto, cyber, infection, login, malware, theft, threat

A new wave of infostealer activity targeting OpenClaw, an emerging AI assistant platform. The discovery marks a major turning point in the behavior of infostealer malware moving beyond browser and cryptocurrency theft to focus on AI configuration environments that hold deep digital identities and sensitive metadata. Hudson Rock detected a live infection where an infostealer successfully…