Tag: mfa
-
Payroll Pirate Campaign Uses AiTM Session Hijacking to Bypass MFA and Redirect Salaries
A financially motivated campaign dubbed >>Payroll Pirate<< has emerged using advanced phishing and adversary-in-the-middle (AiTM) session hijacking to bypass multifactor authentication (MFA) and reroute payroll disbursements. This operation targets payroll and HR portals at mid-market and enterprise organizations, chaining credential theft, real-time session interception, and subtle profile changes to siphon funds without triggering conventional alarms.…
-
Experts say we should use passkeys, but can a smartphone PIN really be safer than a password?
The long-running series in which readers answer other readers’ questions explores a topical issue of personal cybersecurity<ul><li>Readers reply: <a href=”https://www.theguardian.com/lifeandstyle/2026/jun/07/readers-reply-alien-music-playlist-first-contact”>If an alien asked you: ‘What is music?’ what would you play for them?</li></ul>I’ve been struggling to get my head around the idea that a passkey, which can be a PIN on your phone, or facial…
-
New Pink Extortion Group Targets Microsoft 365 Cloud Data Via Vishing Scams
Cybersecurity researchers are warning businesses about Pink Extortion Group, a threat actor that uses voice phishing to bypass multi-factor authentication and steal files from cloud environments. First seen on hackread.com Jump to article: hackread.com/pink-extortion-microsoft-365-cloud-data-vishing-scams/
-
FBI warnt vor Phishing-Plattform Kali365 – Kali365 missbraucht legitimen Microsoft-Flow um MFA zu umgehen
First seen on security-insider.de Jump to article: www.security-insider.de/kali365-phishing-microsoft-365-mfa-oauth-device-code-flow-a-4571206ba2a0d237ebb8bb01d289ff61/
-
Password manager Dashlane says hackers stole some customers’ password vaults
The password manager giant said hackers were able to ‘brute-force’ its two-factor system, allowing them to access customer accounts and download their password vaults. First seen on techcrunch.com Jump to article: techcrunch.com/2026/06/02/password-manager-dashlane-says-hackers-stole-some-customers-password-vaults/
-
Kali365 imitiert vermehrt Unternehmen wie Microsoft und Okta
Steven Campbell, Staff Threat Intelligence Researcher bei Arctic Wolf, ordnete kürzlich die FBI-Warnung vor ‘Kali365″, eine Kampagne, die sich mittlerweile vom Phishing-Kit zu einer umfassenderen Phishing-as-a-Service-Plattform entwickelt hat, und aktuelle Entwicklungen rund um moderne Phishing-Angriffe ein. Kali365 war zunächst dadurch aufgefallen, dass sie den OAuth-Device-Authorization-Flow von Microsoft ausnutzte, um Authentifizierungs-Tokens zu stehlen und Multi-Faktor-Authentifizierung zu…
-
Meta’s AI Bot Misused by Hackers to Take Over Instagram Accounts
Attackers have exploited a critical vulnerability in Meta’s AI-powered Instagram support chatbot to hijack user accounts without needing passwords, phishing, or malware. Instead of bypassing security through technical exploits, hackers simply manipulated the chatbot via natural-language requests. Meta’s AI Bot Misused by Hackers The flaw allowed attackers to bypass two-factor authentication (2FA) effectively. By interacting…
-
Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded
Password manager Dashlane has disclosed that “fewer than” 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party.On May 31, 2026, the company said an “external” threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication…
-
Microsoft fixes outage affecting MFA setup, MySignIn service
Microsoft is working to address an ongoing incident preventing customers from setting up multi-factor authentication (MFA) or accessing the My Sign-Ins platform. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-fixes-outage-affecting-mfa-setup-mysignin-service/
-
Microsoft confirms outage affecting MFA, My Sign-Ins platform
Microsoft is working to address an ongoing incident preventing customers from setting up multi-factor authentication (MFA) or accessing the My Sign-Ins platform. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-confirms-outage-affecting-mfa-my-sign-ins-platform/
-
FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts no password required
So, you’ve enabled multi-factor authentication. You’ve taught your staff never to type their passwords into dodgy-looking login pages. Surely your Microsoft 365 accounts are safe now? First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/fbi-kali365-phishing-kit-breaks-microsoft-365-accounts-no-password-required
-
MFA Prompt Bombing: Why Your Second Factor Isn’t Saving You
Multi-factor authentication (MFA) was supposed to close a critical gap in identity security. It meant that, even if an attacker possessed the account credentials, they couldn’t log in without the second factor. While that logic was sound, attackers have now figured out that they don’t need to steal the second factor: they just need the…
-
MFA Prompt Bombing: Why Your Second Factor Isn’t Saving You
Multi-factor authentication (MFA) was supposed to close a critical gap in identity security. It meant that, even if an attacker possessed the account credentials, they couldn’t log in without the second factor. While that logic was sound, attackers have now figured out that they don’t need to steal the second factor: they just need the…
-
FBI warns of Kali365 phishing service targeting Microsoft 365 accounts
The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multi-factor authentication (MFA). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/
-
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation.Called staged publishing, the feature is now generally available on npm. It mandates that a human maintainer pass a two-factor authentication…
-
Attackers exploit SonicWall VPN vulnerability to bypass MFA
First seen on scworld.com Jump to article: www.scworld.com/brief/attackers-exploit-sonicwall-vpn-vulnerability-to-bypass-mfa
-
FBI Warns of Kali365 Phishing Service Targeting Microsoft 365 Account
FBI warns of Kali365, a PaaS scam kit that lets cybercriminals bypass MFA and hijack Microsoft 365 accounts without passwords. First seen on hackread.com Jump to article: hackread.com/fbi-kali365-phishing-service-microsoft-365-account/
-
Microsoft 365 users targeted by new phishing threat that bypasses MFA
Microsoft 365 access tokens are being targeted by an emerging Phishing-as-a-Service (PhaaS) platform called Kali365, the FBI is warning. First observed in April 2026, Kali365 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/22/kali365-microsoft-365-phishing-fbi-warning/
-
FBI Warns Kali365 PhaaS Platform Targets Microsoft 365 Users to Steal Logins
The U.S. Federal Bureau of Investigation (FBI) has issued a Public Service Announcement (Alert I-052126-PSA) warning about a newly identified Phishing-as-a-Service (PhaaS) platform named Kali365, which is actively targeting Microsoft 365 users. First observed in April 2026, the platform enables attackers to bypass multi-factor authentication (MFA) by exploiting OAuth-based authentication flows. Kali365 PhaaS Platform Targets Microsoft…
-
Mini Shai-Hulud Attack Prompts npm to Revoke 2FA-Bypass Tokens
npm has forced a platform-wide reset of granular access tokens that bypass two-factor authentication (2FA) after a wave of supply chain attacks linked to the “Mini Shai-Hulud” campaign compromised hundreds of JavaScript packages. The emergency action, rolled out on May 19, invalidated all npm tokens with write permissions that allowed publishing without 2FA. The move…
-
Attackers are bypassing MFA on SonicWall VPNs because something was wrong with previous fix
Attackers bypassed MFA on patched SonicWall Gen6 VPNs because admins missed extra manual steps required to fully fix the flaw. There is a particular kind of security failure that is harder to catch than an unpatched system: a patched system where the patch did not actually work because nobody followed all the steps. That is…
-
Hackers bypass SonicWall VPN MFA due to incomplete patching
Threat actors brute-forced VPN credentials and bypassed multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-bypass-sonicwall-vpn-mfa-due-to-incomplete-patching/
-
6 Milliarden gestohlene Passwörter Warum Unternehmen 2026 noch immer dieselben Fehler machen
Trotz jahrelanger Security-Awareness-Kampagnen, komplexer Passwortregeln und wachsender MFA-Verbreitung bleibt eine der ältesten Schwachstellen der IT erschreckend aktuell: schwache und wiederverwendete Passwörter. Der aktuelle ‘2026 Breached Password Report” von Specops Software analysiert mehr als sechs Milliarden durch Malware gestohlene Zugangsdaten und zeichnet ein alarmierendes Bild moderner Identitätssicherheit. Die zentrale Erkenntnis: Nicht Brute-Force-Angriffe sind heute das […]…
-
Neue Phishing-Methode umgeht MFA über echte Microsoft-Seiten
Sicherheitsforscher von Proofpoint schlagen Alarm: Eine Angriffstechnik namens ‘Device Code Phishing” entwickelt sich derzeit zu einer der am schnellsten wachsenden Bedrohungen im Bereich Identitätsschutz. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/phishing-methode-mfa-microsoft
-
The New Phishing Click: How OAuth Consent Bypasses MFA
In February 2026, a phishing-as-a-service (PhaaS) platform called EvilTokens went live. Within five weeks, it had compromised more than 340 Microsoft 365 organizations across five countries. The targets of the platform received a message asking them to enter a short code at microsoft.com/devicelogin and complete their normal MFA challenge, then walked away believing they had…
-
Erster KI-generierte Zero-Day-Exploit sollte Weckruf für jede Organisation sein, die noch auf MFA setzt
Googles Entdeckung des ersten von KI generierten Zero-Day-Exploits markiert einen bedeutenden Zeitpunkt. Die Bedeutung dieses Fundes liegt nicht darin, dass die zugrundeliegende Technik eine völlig neue Idee ist. Vielmehr bestätigt er, dass KI von einem theoretischen Beschleuniger für Angriffe zu einem operativen Werkzeug geworden ist. Besonders alarmierend ist, dass der Exploit auf die Umgehung von…
-
CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions
Hackers are exploiting Outlook calendar invites and device code phishing to steal M365 session tokens, bypass MFA and breach enterprise accounts. First seen on hackread.com Jump to article: hackread.com/calphishing-eviltokens-kit-outlook-invites-m365/
-
Tycoon 2FA Operators Use OAuth Device Code Phishing to Bypass MFA
A new phishing campaign uncovered in late April 2026 shows how threat actors behind the Tycoon 2FA Phishing-as-a-Service (PhaaS) kit are evolving beyond traditional credential theft. This development comes just weeks after a global takedown effort led by Microsoft and Europol disrupted Tycoon 2FA infrastructure. Despite that operation, the actors have quickly adapted, reusing their…
-
Meet Fragnesia, the third Linux kernel vulnerability in a month
Tags: access, control, exploit, framework, least-privilege, linux, mfa, mitigation, monitoring, password, service, switch, update, vulnerabilityCSO. “It is bypassing traditional filesystem permissions that are present and enforced (for example, ‘file is owned by root’, or ‘file is read-only’) to allow manipulation without touching the disk.”Similar to Dirty Frag, Fragnesia (CVE-2026-46300) is a local privilege escalation hole that exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory write…