Collecting Cyber-News from over 60 sources

Tag: login

1-Click ZITADEL Vulnerability Could Allow Full System Takeover

Mar 9, 2026 10:47 AM

Tags: access, cve, cyber, flaw, identity, login, malicious, open-source, vulnerability

A critical Cross-Site Scripting (XSS) vulnerability has been discovered in ZITADEL, a popular open-source identity and access management platform. Tracked as CVE-2026-29191 with a Critical severity rating, this flaw resides in the platform’s login V2 interface, specifically within the /saml-post endpoint. It allows unauthenticated remote attackers to execute malicious JavaScript directly within a user’s browser. With a…
Wenn der Login zur Einfallstür wird: Neue OAuth-Missbrauchskampagnen im Fokus

Mar 7, 2026 9:47 AM

Tags: bug, login

Im Mittelpunkt steht dabei ein Angriffsszenario, das auf den ersten Blick überraschend wirkt: Nicht eine klassische Sicherheitslücke wird ausgenutzt, sondern ein eigentlich legitimer Authentifizierungsprozess. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/wenn-der-login-zur-einfallstuer-wird-neue-oauth-missbrauchskampagnen-im-fokus/a43988/
ClickFix attackers using new tactic to evade detection, says Microsoft

Mar 6, 2026 11:48 PM

Tags: access, attack, awareness, blockchain, ciso, computer, control, crypto, cybersecurity, defense, detection, email, endpoint, infosec, infrastructure, injection, login, malicious, malware, microsoft, phishing, powershell, risk, tactics, tool, training, windows

AppData\Local that is then invoked through cmd.exe to write a VBScript to %Temp%. The batch script is executed via cmd.exe with the /launched command-line argument, and is then executed again through MSBuild.exe, resulting in LOLBin abuse. The script connects to Crypto Blockchain RPC endpoints, indicating etherhiding technique, and also performs QueueUserAPC()-based code injection into chrome.exe…
Bitwarden Brings Passkey Logins to Windows 11, Expanding Passwordless Sign-Ins

Mar 6, 2026 6:47 PM

Tags: login, microsoft, passkey, windows

Bitwarden now supports passkey logins on Windows 11 for Microsoft Entra ID users, extending passwordless sign-ins to device authentication. The post Bitwarden Brings Passkey Logins to Windows 11, Expanding Passwordless Sign-Ins appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-bitwarden-passkey-windows-11-sign-in/
Passwordless Authentication for WooCommerce with Adaptive MFA

Mar 5, 2026 7:47 PM

Tags: authentication, infrastructure, login, mfa

Secure WooCommerce stores with passwordless login, adaptive MFA, and scalable authentication infrastructure for modern ecommerce applications. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/passwordless-authentication-for-woocommerce-with-adaptive-mfa/
EasyIntegrate Passwordless Authentication for Shopify with Adaptive MFA and Private Instances

Mar 5, 2026 7:47 PM

Tags: authentication, guide, login, mfa, passkey

how to implement passwordless authentication for Shopify apps using OTP, magic links, and passkeys with adaptive MFA and private authentication infrastructure.Secure Shopify applications with passwordless authentication, adaptive MFA, and private instances. A developer guide for implementing secure login infrastructure. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/easy-to-integrate-passwordless-authentication-for-shopify-with-adaptive-mfa-and-private-instances/
Bitwarden adds support for passkey login on Windows 11

Mar 5, 2026 12:47 AM

Tags: login, passkey, windows

Bitwarden announced support for logging into Windows 11 devices using passkeys stored in the manager’s vault, enabling phishing-resistant authentication. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bitwarden-adds-support-for-passkey-login-on-windows-11/
Bitwarden adds support for passkey login on Windows 11

Mar 5, 2026 12:47 AM

Tags: login, passkey, windows

Bitwarden announced support for logging into Windows 11 devices using passkeys stored in the manager’s vault, enabling phishing-resistant authentication. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bitwarden-adds-support-for-passkey-login-on-windows-11/
How a Brute Force Attack Unmasked a Ransomware Infrastructure Network

Mar 4, 2026 4:46 PM

Tags: access, attack, credentials, infrastructure, login, network, ransomware, service, vpn

A routine RDP brute-force alert led to unusual credential hunting and a geo-distributed VPN-linked infrastructure. Huntress Labs explains how one compromised login unraveled a suspected ransomware-as-a-service ecosystem tied to initial access brokers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/how-a-brute-force-attack-unmasked-a-ransomware-infrastructure-network/
Attackers abuse OAuth’s built-in redirects to launch phishing and malware attacks

Mar 4, 2026 3:48 PM

Tags: attack, google, login, malware, microsoft, phishing

Researchers have found that attackers are abusing OAuth to send users from legitimate Microsoft or Google login pages to phishing sites or malware downloads. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/attackers-abuse-oauths-built-in-redirects-to-launch-phishing-and-malware-attacks/
The DocuSign Email That Wasn’t A Three-Redirect Credential Harvest

Mar 4, 2026 5:46 AM

Tags: ai, attack, authentication, credentials, dkim, dmarc, email, finance, google, identity, infrastructure, law, login, malicious, microsoft, phishing, risk, service, threat

<div cla TL;DR Attackers sent a convincing DocuSign notification with a “Review & Sign” button that chained through Google Maps redirects to an Amazon S3-hosted credential harvesting page. The redirect chain defeated URL scanners, and real law-firm footers added legitimacy. IRONSCALES Adaptive AI flagged the behavioral mismatch between sender infrastructure and brand identity before the first…
The DocuSign Email That Wasn’t A Three-Redirect Credential Harvest

Mar 4, 2026 5:46 AM

Tags: ai, attack, authentication, credentials, dkim, dmarc, email, finance, google, identity, infrastructure, law, login, malicious, microsoft, phishing, risk, service, threat

<div cla TL;DR Attackers sent a convincing DocuSign notification with a “Review & Sign” button that chained through Google Maps redirects to an Amazon S3-hosted credential harvesting page. The redirect chain defeated URL scanners, and real law-firm footers added legitimacy. IRONSCALES Adaptive AI flagged the behavioral mismatch between sender infrastructure and brand identity before the first…
Cloudflare Threat Report 2026: Ransomware beginnt mit dem Login

Mar 3, 2026 7:47 PM

Tags: authentication, login, mfa, ransomware, threat

Ein zentrales Motiv des Reports ist die Verschiebung vom klassischen Netzwerkangriff hin zum Identitätsmissbrauch. Infostealer wie LummaC2 stehlen aktive Session-Tokens und umgehen damit selbst Multi-Faktor-Authentifizierung First seen on infopoint-security.de Jump to article: www.infopoint-security.de/cloudflare-threat-report-2026-ransomware-beginnt-mit-dem-login/a43931/
OAuth phishers make ‘check where the link points’ advice ineffective

Mar 3, 2026 2:47 PM

Tags: authentication, automation, awareness, business, cloud, control, edr, email, encryption, endpoint, exploit, governance, identity, login, malicious, microsoft, monitoring, phishing, saas, threat, tool

Context, not the URL, is the new red flag: Sakshi Grover, Senior Research Manager at IDC Asia/Pacific, said the longstanding advice to hover over a link and verify its domain was built for an era of lookalike domains and that it no longer holds in environments where authentication flows routinely pass through trusted identity providers.”Organizations…
New Starkiller Phishing Framework Uses Real Login Pages to Bypass MFA Security

Mar 3, 2026 2:47 PM

Tags: authentication, credentials, cyber, framework, infrastructure, login, mfa, phishing

A new phishing framework called Starkiller is raising the bar for “phishing-as-a-service” by serving victims the real login pages of major brands through attacker infrastructure, making pages look authentic and stay up to date. By acting as a live reverse proxy, it can capture credentials and, more importantly, steal session cookies/tokens after the victim completes multi-factor authentication (MFA), enabling…
HPE AutoPass Vulnerability Allows Remote Attackers to Bypass Authentication

Mar 3, 2026 1:47 PM

Tags: authentication, control, cve, cyber, login, vulnerability

Hewlett Packard Enterprise (HPE) has disclosed a remote authentication-bypass vulnerability in HPE AutoPass License Server (APLS) that could let unauthenticated attackers bypass login controls over the network. The issue is tracked as CVE-2026-23600 and is fixed in APLS 9.19 and later.”‹ Item Details Vendor bulletin HPESBGN05003 rev.1 (Security Bulletin), initial release 27 Feb 2026; last…
Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication

Mar 3, 2026 1:47 PM

Tags: access, authentication, cybercrime, cybersecurity, group, login, mfa, phishing, threat

Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller that proxies legitimate login pages to bypass multi-factor authentication (MFA) protections.It’s advertised as a cybercrime platform by a threat group calling itself Jinkusu, granting customers access to a dashboard that lets them select a brand to impersonate or enter a brand’s real URL.…
Neue Phishing-Methode über .arpa

Mar 3, 2026 11:46 AM

Tags: login, mail, phishing

Phishing-Kampagnen folgen häufig bekannten Mustern: gefälschte Login-Seiten, täuschend echte E-Mails und manipulierte Links. Doch aktuelle Analysen von Infoblox zeigen eine ungewöhnliche Entwicklung. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/phishing-methode-ueber-arpa
GTFire Phishing Campaign Exploits Google Services to Bypass Detection and Harvest Credentials

Mar 2, 2026 1:47 PM

Tags: credentials, cyber, detection, exploit, google, infrastructure, login, malicious, phishing, service, tool

GTFire is a large-scale phishing scheme that abuses multiple Google services to hide malicious infrastructure, evade security tools, and steal credentials from organizations worldwide. GTFire is a credential-harvesting operation that chains Google Firebase Hosting and Google Translate to deliver phishing pages that look like legitimate brand logins. Attackers host fake login portals on Firebase .web.…
Configuration and Runtime: The PBJ of Effective Security Operations

Mar 2, 2026 12:47 PM

Tags: attack, infrastructure, login, network, siem

For most of the security industry’s history, logs were the problem to solve. Attacks were easy to spot in events: Failed logins, suspicious processes, and unexpected network connections. Infrastructure was relatively static, identities were long-lived, and configuration changed slowly enough to be treated as background context. SIEMs emerged to centralize logs, correlate activity across systems,..…
Purchase order attachment isn’t a PDF. It’s phishing for your password

Mar 2, 2026 11:47 AM

Tags: login, password, phishing

A fake purchase order attachment turned out to be a phishing page designed to harvest your login details. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/purchase-order-attachment-isnt-a-pdf-its-phishing-for-your-password/
How to make LLMs a defensive advantage without creating a new attack surface

Feb 27, 2026 12:37 PM

Tags: access, ai, api, attack, authentication, best-practice, business, control, credentials, cyber, cybersecurity, data, email, exploit, framework, fraud, governance, group, identity, infrastructure, injection, intelligence, international, LLM, login, malware, mitre, nist, phishing, radius, RedTeam, risk, risk-management, scam, spear-phishing, switch, technology, threat, tool, training, unauthorized, update, vulnerability

Alert triage summaries that turn raw telemetry into a short “what happened, why it matters and what I should check next” narrativeInvestigation copilots that generate a timeline from logs, tickets and chat transcripts, then highlight gaps and recommended pivotsDetection engineering assistance for drafting Sigma, YARA or query language snippets that an engineer can review and…
Infostealers Drive Massive Brute-Force Attacks on Corporate SSO Gateways with Stolen Credentials

Feb 27, 2026 9:36 AM

Tags: attack, breach, corporate, credentials, cyber, cybercrime, cybersecurity, login

The cybersecurity community is witnessing a rise in credential”‘stuffing attacks targeting corporate Single Sign”‘On (SSO) systems, with recent campaigns focusing on F5 BIG”‘IP devices. To understand the source of the stolen logins, Defused Cyber analyzed a dataset of 70 unique email”‘password pairs used in the attack. When cross”‘referenced with Hudson Rock’s cybercrime database of Infostealer…
Malicious NuGet Packages Target ASP.NET Developers to Steal Login Credentials

Feb 24, 2026 1:02 PM

Tags: backdoor, credentials, cyber, identity, login, malicious

Malicious NuGet packages posing as legitimate developer utilities are targeting ASP.NET projects to steal identity credentials and silently backdoor applications through a localhost proxy. All four were published between August 1221, 2024, by a NuGet user named “hamzazaheer” and have collectively amassed a little over 4,500 downloads before takedown requests were submitted. The campaign’s core…
Master Your Passwordless Future: Introducing Thales Authenticator Lifecycle Manager

Feb 24, 2026 10:01 AM

Tags: access, attack, authentication, automation, breach, compliance, container, control, data, fido, Hardware, identity, login, msp, phishing, service, software, tool, zero-trust

Master Your Passwordless Future: Introducing Thales Authenticator Lifecycle Manager madhav Tue, 02/24/2026 – 07:53 The move to passwordless authentication is no longer a distant goal; it’s a present-day necessity. Organizations are rapidly adopting FIDO2 authenticators to defend against phishing and strengthen their security posture. While this shift enhances security, it introduces a new challenge: managing…
Starkiller Phishing Kit Clones Real Login Pages to Evade MFA Protections

Feb 23, 2026 1:01 PM

Tags: authentication, credentials, cyber, framework, login, mfa, phishing, theft, update

New phishing framework Starkiller is enabling more convincing, scalable credential theft by proxying real login pages and bypassing multi-factor authentication (MFA), significantly raising the bar for defenders. Traditional phishing kits typically serve static HTML clones of popular login portals, which quickly become outdated when brands update their interfaces, creating telltale visual discrepancies. Starkiller takes a…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
‘Starkiller’ Phishing Service Proxies Real Login Pages, MFA

Feb 21, 2026 1:02 PM

Tags: authentication, login, mfa, password, phishing, service

Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and…
TDL 016 – Speed, Risk, and Responsibility in the Age of AI – Rafael Ramirez

Feb 20, 2026 9:02 PM

Tags: access, ai, antivirus, automation, awareness, business, ciso, cloud, control, country, cyber, data, defense, detection, dns, firewall, governance, government, hacker, ibm, incident response, intelligence, Internet, law, linkedin, login, mfa, microsoft, network, risk, saas, service, skills, software, startup, strategy, technology, threat, tool, training, update, vulnerability, windows, zero-trust

Summary In a recent episode of The Defenders Log, host David Redekop sat down with cyber security expert Rafael Ramirez to navigate the rapidly shifting landscape of AI security. As we move deeper into 2026, the duo explored how artificial intelligence has evolved from simple chatbots into powerful, autonomous “agentic” systems. The Double-Edged Sword of…