Krebs on Security

MARCH 15, 2023

The Outlook vulnerability ( CVE-2023-23397 ) affects all versions of Microsoft Outlook from 2013 to the newest. While CVE-2023-23397 is labeled as an “Elevation of Privilege” vulnerability, that label doesn’t accurately reflect its severity, said Kevin Breen , director of cyber threat research at Immersive Labs.

Passwords 278

Passwords Cyber threats Authentication Internet 278

Krebs on Security

DECEMBER 19, 2024

Rumors of a cracked version of Acunetix being used by attackers surfaced in June 2023 on Twitter/X , when researchers first posited a connection between observed scanning activity and Araneida. According to an August 2023 report (PDF) from the U.S. co — first came online in February 2023. 2023 on the forum Cracked.

Hacking 229

Hacking Cybercrime Advertising Data breaches 229

Krebs on Security

AUGUST 8, 2023

They were assigned a single placeholder designation of CVE-2023-36884. Satnam Narang , senior staff research engineer at Tenable, said the August patch batch addresses CVE-2023-36884 , which involves bypassing the Windows Search Security feature. out of a possible 10, even though Microsoft rates it as an important flaw, not critical.

Engineering 226

Engineering Accountability Passwords Software 226

Schneier on Security

JANUARY 29, 2024

The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. Microsoft is reporting that a Russian intelligence agency—the same one responsible for SolarWinds—accessed the email system of the company’s executives.

Hacking 334

Hacking Accountability Passwords Cybersecurity 334

Malwarebytes

FEBRUARY 14, 2025

In 2023, data allegedly belonging to Zacks containing 8,615,098 records was leaked online. The data contains names, email addresses, usernames, passwords, phone numbers, addresses, company names, and additional personal information. Change your password. You can make a stolen password useless to thieves by changing it.

Accountability 83

Accountability Data breaches Passwords Phishing 83

Krebs on Security

JANUARY 16, 2025

Those who fall for the scam are asked to provide payment card data, and eventually will be asked to supply a one-time password sent via SMS or a mobile authentication app. In October 2023, KrebsOnSecurity wrote about a massive uptick in SMS phishing scams targeting U.S. Postal Service customers.

Phishing 299

Phishing Scams Mobile Passwords 299

Krebs on Security

SEPTEMBER 13, 2023

11, 2023, USDoD resurfaced after a lengthy absence to leak sensitive employee data stolen from the aerospace giant Airbus , while promising to visit the same treatment on top U.S. USDoD claimed they grabbed the data by using passwords stolen from a Turkish airline employee who had third-party access to Airbus’ systems.

Cybercrime 338

Cybercrime Passwords Authentication Malware 338

Krebs on Security

FEBRUARY 26, 2025

At the end of 2023, malicious hackers learned that many companies had uploaded sensitive customer records to accounts at the cloud data storage service Snowflake that were protected with little more than a username and password (no multi-factor authentication needed).

Hacking 238

Hacking Government Identity Theft Accountability 238

Malwarebytes

JANUARY 6, 2025

Westend Dental agreed to settle several violations of the Health Insurance Portability and Accountability Act (HIPAA) in a penalty of $350,000. In January 2023 a witness confirmed there had been a data breach, which prompted the Indiana OIG to initiate a wider investigation to assess compliance with the HIPAA rules and state laws.

Data breaches 145

Data breaches Ransomware Passwords Insurance 145

Krebs on Security

JUNE 15, 2024

. “He stands accused of hacking into corporate accounts and stealing critical information, which allegedly enabled the group to access multi-million-dollar funds,” Murcia Today wrote. ” The cybercrime-focused Twitter/X account vx-underground said the U.K. In January 2024, U.S.

Hacking 333

Hacking Cybercrime Phishing Passwords 333

Krebs on Security

SEPTEMBER 5, 2023

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. “If you have my seed phrase, you can copy and paste that into your wallet, and then you can see all my accounts. . Then on Aug.

Cryptocurrency 361

Cryptocurrency Passwords Encryption Accountability 361

Krebs on Security

JULY 15, 2024

Squarespace bought all assets of Google Domains a year ago, but many customers still haven’t set up their new accounts. Experts say malicious hackers learned they could commandeer any migrated Squarespace accounts that hadn’t yet been registered, merely by supplying an email address tied to an existing domain.

Accountability 327

Accountability Cryptocurrency Passwords DNS 327

Krebs on Security

NOVEMBER 5, 2024

At the end of 2023, malicious hackers learned that many large companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with little more than a username and password (no multi-factor authentication required). “The rest is just ransom.” CRACKDOWN ON HARM GROUPS?

Cybercrime 274

Cybercrime Mobile Media Hacking 274

The Last Watchdog

MARCH 19, 2025

Holistic Identity: The New Cyber Battleground Organizations have traditionally focused on securing individual account credentials, but SpyClouds research indicates that cybercriminals have expanded their tactics beyond conventional account takeover. ” Additional Report Findings: 17.3 ” Additional Report Findings: 17.3

Cyber Risk 113

Cyber Risk Risk Phishing Cybercrime 113

Security Affairs

JANUARY 24, 2024

Thousands of GitLab servers are vulnerable to zero-click account takeover attacks exploiting the flaw CVE-2023-7028. The most critical vulnerability, tracked as CVE-2023-7028 (CVSS score 10), is an account takeover via Password Reset. The flaw can be exploited to hijack an account without any interaction.

Accountability 143

Accountability Passwords Internet Internet 143

The Hacker News

MAY 1, 2024

Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email

Passwords 142

Passwords Accountability Cybersecurity 142

Krebs on Security

JULY 12, 2024

AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed). Earlier this year, AT&T reset passwords for millions of customers after the company finally acknowledged a data breach from 2018 involving approximately 7.6

Data breaches 347

Data breaches Passwords Authentication Accountability 347

Security Affairs

APRIL 27, 2024

Threat actors accessed more than 19,000 online accounts on a California state platform for welfare programs. Threat actors breached over 19,000 online accounts on a California state platform dedicated to welfare programs. Threat actors exploited reused passwords obtained from third-party websites.

Accountability 139

Accountability Passwords Data breaches Hacking 139

Malwarebytes

OCTOBER 25, 2024

The Office for Civil Rights (OCR) at the HHS confirmed that it prioritized and opened investigations of Change Healthcare and UnitedHealth Group, focused on whether a breach of protected health information (PHI) occurred and on the entities’ compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules.

Healthcare 118

Healthcare Data breaches Passwords Identity Theft 118

Krebs on Security

NOVEMBER 29, 2023

20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. For this reason, they can’t be locked down with multifactor authentication the way user accounts can.

Authentication 293

Authentication Accountability Passwords Antivirus 293

Security Affairs

JANUARY 13, 2024

GitLab addressed two critical flaws impacting both the Community and Enterprise Edition, including a critical zero-click account hijacking vulnerability GitLab has released security updates to address two critical vulnerabilities impacting both the Community and Enterprise Edition. CVE-2023-4812 : Bypass CODEOWNERS approval removal.

Accountability 136

Accountability Passwords Hacking Information Security 136

Security Affairs

SEPTEMBER 16, 2023

Iran-linked Peach Sandstorm APT is behind password spray attacks against thousands of organizations globally between February and July 2023. The campaign targeted thousands of organizations worldwide between February and July 2023. ” Microsoft concludes.

Passwords 137

Passwords Accountability Authentication Hacking 137

Malwarebytes

NOVEMBER 12, 2024

All the company’s social media accounts haven’t been updated since 2023 at the latest. In 2018, MyHeritage suffered a security incident which exposed the email addresses and hashed passwords of 92 million users. The atlasbiomed.com domain appears to be inactive.

Insurance 145

Insurance Accountability Risk Data breaches 145

Krebs on Security

NOVEMBER 14, 2024

In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator , the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Mr. Shefel did not respond to requests for comment in advance of that December 2023 profile.

Retail 254

Retail Advertising Cryptocurrency Marketing 254

Security Affairs

OCTOBER 18, 2023

A vulnerability in Synology DiskStation Manager ( DSM ) could be exploited to decipher an administrator’s password. Researchers from Claroty’s Team82 discovered a vulnerability, tracked as CVE-2023-2729 (CVSS score 5.9), in Synology DiskStation Manager (DSM). ” reads the advisory published by the company.

Accountability 133

Accountability Passwords Hacking Internet 133

Krebs on Security

APRIL 18, 2023

In January 2023, the Faceless service website said it was willing to pay for information about previously undocumented security vulnerabilities in IoT devices. MrMurza also told the admin that his account number at the now-defunct virtual currency Liberty Reserve was U1018928. The password chosen by this user was “ 1232.”

Malware 292

Malware Passwords Accountability Advertising 292

SecureList

MAY 6, 2024

With trillions of dollars of digital payments made every year, it is no wonder that attackers target electronic wallets, online shopping accounts and other financial assets, inventing new techniques and reusing good old ones. Online shopping brands were the most popular lure, accounting for 41.65% of financial phishing attempts.

Phishing 134

Phishing Banking Mobile Scams 134

SecureList

MARCH 12, 2024

Profile of participants and applications We collected the data from a sample of the application security assessment projects our team completed in 2021–2023. Mitigation: do not store files containing sensitive data, such as passwords or backups, in web application publish directories.

Passwords 140

Passwords Authentication Architecture Risk 140

Malwarebytes

NOVEMBER 13, 2024

One particular campaign that we tracked peaked in April 2023, but then really slowed down during the summer months. In terms of the actual advertiser accounts that are used in malvertising campaigns, most are based in the US and are set up using a combination of fake identities or hijacked accounts. Protect your online accounts.

Scams 131

Scams Accountability Retail Advertising 131

Malwarebytes

NOVEMBER 7, 2023

After 1Password, BeyondTrust, and Cloudflare detected unauthorized log-in attempts to their in-house Okta administrator accounts, they reported the incidents to Okta who started an investigation. To gain access to that service account, the attacker compromised an Okta employee. Change your password. Watch out for fake vendors.

Accountability 137

Accountability Passwords Data breaches Phishing 137

Malwarebytes

SEPTEMBER 13, 2023

Although the " unauthorized party" that compromised LastPass users' data was able to steal password vaults, it's likely that they are having a hard time cracking them open. Brute force guessing techniques may be successful for some weak passwords, but it's an approach that quickly runs out of steam. For us, data security is paramount.

Phishing 144

Phishing Accountability Passwords Password Management 144

Security Affairs

MAY 24, 2024

GitLab addressed a high-severity cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to take over user accounts. GitLab fixed a high-severity XSS vulnerability, tracked as CVE-2024-4835 , that allows attackers to take over user accounts. The flaw can be exploited to hijack an account without any interaction.

Accountability 139

Accountability Passwords Hacking Cybersecurity 139

Security Affairs

JANUARY 1, 2024

These are the Top 2023 Security Affairs cybersecurity stories … enjoy it. RESEARCHER DISCOVERED A NEW LOCK SCREEN BYPASS BUG FOR ANDROID 14 AND 13 Researchers discovered a lock screen bypass bug in Android 14 and 13 that could expose sensitive data in users’ Google accounts. TWO SPYWARE SENDING DATA OF MORE THAN 1.5M

Cybersecurity 133

Cybersecurity Spyware Data breaches Passwords 133

Malwarebytes

JANUARY 16, 2024

The vulnerability allows a successful attacker to easily take over users’ accounts without any interaction. As we can see from the description in the database, the root of the problem is that it’s possible to direct password reset emails to unverified email addresses. Do not skip upgrade stops as this could create instability.

Accountability 130

Accountability Passwords Authentication Password Management 130

Security Affairs

NOVEMBER 21, 2024

Between September 2021 and April 2023, the hackers carried out phishing attacks to steal login credentials from employees of 12 companies and individuals. Victims included gaming, telecom, and cryptocurrency firms, with losses reaching millions in stolen cryptocurrency and data from hundreds of thousands of accounts.

Cybercrime 109

Cybercrime Identity Theft Cryptocurrency Phishing 109

Google Security

MAY 5, 2023

Silvia Convento, Senior UX Researcher and Court Jacinic, Senior UX Content Designer In recognition of World Password Day 2023, Google announced its next step toward a passwordless future: passkeys. Passkeys are not just easier to use, but also significantly faster than passwords. seconds, as seen in Figure 2 below).

Authentication 122

Authentication Passwords Technology Password Management 122

Malwarebytes

FEBRUARY 19, 2025

The latest, major threats to Mac computers can steal passwords and credit card details with delicate precision, targeting victims across the internet based on their device, location, and operating system. Some info stealers dont even require an additional stepthey can take cryptocurrency directly from a victims online accounts.

Malware 128

Malware Software Passwords Cryptocurrency 128