Duo's Security Blog

DECEMBER 14, 2023

A few days later, John finds himself locked out of his account, and quickly learns that the password reset link he clicked earlier did not come from his company. He took the steps needed to keep his account safe by following the directions from his IT team. What is social engineering? John is a diligent employee.

Social Engineering 129

Social Engineering Engineering Phishing Passwords 129

NetSpi Executives

OCTOBER 25, 2024

In this article, we will dive deep into the sea of phishing and vishing, sharing real-world stories and insights we’ve encountered during social engineering tests to highlight the importance of awareness. Unfortunately for me, they had MFA enabled on all of their accounts. The customer didn’t provide any other information.

Social Engineering 98

Social Engineering Engineering Phishing Penetration Testing 98

Krebs on Security

NOVEMBER 21, 2020

And in May of this year, GoDaddy disclosed that 28,000 of its customers’ web hosting accounts were compromised following a security incident in Oct. “This gave the actor the ability to change DNS records and in turn, take control of a number of internal email accounts. . 2019 that wasn’t discovered until April 2020.

Cryptocurrency 363

Cryptocurrency VPN Scams Social Engineering 363

Krebs on Security

JANUARY 7, 2025

Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. The phishers also abused legitimate Google services to send Tony an email from google.com, and to send a Google account recovery prompt to all of his signed-in devices.

Phishing 332

Phishing Cryptocurrency Accountability Social Engineering 332

Security Through Education

MARCH 3, 2025

When I first heard of social engineering, about 6 years ago, I couldnt define it clearly and concisely if you had offered me millions of dollars. ’ Lets re-visit what social engineering really means, how people use it, and how you can start protecting yourself from it. Either way, lets refresh and learn together!

Social Engineering 59

Social Engineering Engineering Scams Banking 59

Krebs on Security

NOVEMBER 9, 2024

The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based based technology companies.

Hacking 266

Hacking Accountability Government Social Engineering 266

Krebs on Security

FEBRUARY 26, 2023

GoDaddy described the incident at the time in general terms as a social engineering attack, but one of its customers affected by that March 2020 breach actually spoke to one of the hackers involved. But we do know the March 2020 attack was precipitated by a spear-phishing attack against a GoDaddy employee.

Hacking 315

Hacking Social Engineering Phishing Scams 315

Krebs on Security

AUGUST 19, 2020

According to interviews with several sources, this hybrid phishing gang has a remarkably high success rate, and operates primarily through paid requests or “bounties,” where customers seeking access to specific companies or accounts can hire them to target employees working remotely at home. A phishing page (helpdesk-att[.]com)

Phishing 363

Phishing VPN Social Engineering Media 363

Krebs on Security

AUGUST 21, 2020

” The perpetrators focus on social engineering new hires at the targeted company, and impersonate staff at the target company’s IT helpdesk. The actor logged the information provided by the employee and used it in real-time to gain access to corporate tools using the employee’s account.”

VPN 363

VPN Social Engineering Authentication Engineering 363

Krebs on Security

MARCH 23, 2022

Our investigation has found a single account had been compromised, granting limited access. Microsoft says LAPSUS$ — which it boringly calls “ DEV-0537 ” — mostly gains illicit access to targets via “social engineering.” “No customer code or data was involved in the observed activities.

Social Engineering 324

Social Engineering Accountability Mobile Passwords 324

Krebs on Security

MARCH 31, 2020

Barrie said the hacker was able to read messages and notes left on escrow.com’s account at GoDaddy that only GoDaddy employees should have been able to see. “This guy had access to the notes, and knew the number to call,” to make changes to the account, Barrie said.

Phishing 317

Phishing DNS Social Engineering Accountability 317

Krebs on Security

JANUARY 24, 2020

In the case of e-hawk.net, however, the scammers managed to trick an OpenProvider customer service rep into transferring the domain to another registrar with a fairly lame social engineering ruse — and without triggering any verification to the real owners of the domain. ” REGISTRY LOCK.

DNS 303

DNS Social Engineering Engineering Accountability 303

Krebs on Security

APRIL 6, 2022

The smash-and-grab attacks by LAPSUS$ obscure some of the group’s less public activities, which according to Microsoft include targeting individual user accounts at cryptocurrency exchanges to drain crypto holdings. The group of teenagers who hacked Twitter hailed from a community that traded in hacked social media accounts.

Social Engineering 281

Social Engineering Phishing Engineering Accountability 281

Security Affairs

SEPTEMBER 18, 2023

Software development company Retool was the victim of a smishing attack that resulted in the compromise of 27 accounts of its cloud customers. Software development company Retool revealed that 27 accounts of its cloud customers were compromised as a result of an SMS-based social engineering attack.

Accountability 137

Accountability Social Engineering Authentication VPN 137

Adam Levin

JULY 10, 2020

billion records have already been exposed, and that’s only accounting for the first quarter of 2020. Phishing scams skyrocketed as citizens self-isolated during the lockdown, and social-engineering schemes defrauded Internet users of millions.”. For comparison, that’s a 273% increase over the first two quarters of 2019 combined.

Data breaches 252

Data breaches Social Engineering Antivirus Scams 252

Troy Hunt

JULY 17, 2020

The Twitter "breach" is really interesting stuff (I don't think breach is the right word here, "account takeover via social engineering" seems more apt) Sponsored by: SecurityFWD. and isn't in Melbourne!) A brand new YouTube show from Varonis. Watch Episode 1: How Far can Wi-Fi Travel?

Social Engineering 224

Social Engineering Engineering Accountability 224

Krebs on Security

AUGUST 12, 2020

Several stories here have highlighted the importance of creating accounts online tied to your various identity, financial and communications services before identity thieves do it for you. ” In short, although you may not be required to create online accounts to manage your affairs at your ISP, the U.S. .”

Accountability 355

Accountability Mobile Banking Passwords 355

The Last Watchdog

APRIL 2, 2024

It’s a digital swindle as old as the internet itself, and yet, as the data tells us, the vast majority of security incidents are still rooted in the low-tech art of social engineering. Some 74 percent of cyber breaches are caused by human factors, including errors, stolen credentials, misuse of access privileges, or social engineering.

Social Engineering 211

Social Engineering Technology Engineering Accountability 211

The Hacker News

MAY 16, 2024

The North Korea-linked Kimsuky hacking group has been attributed to a new social engineering attack that employs fictitious Facebook accounts to targets via Messenger and ultimately delivers malware.

Social Engineering 143

Social Engineering Malware Engineering Accountability 143

Krebs on Security

DECEMBER 29, 2020

With the ongoing disruption to life and livelihood wrought by the Covid-19 pandemic, 2020 has been a fairly horrid year by most accounts. In almost every category — from epic breaches and ransomware to cybercrime justice and increasingly aggressive phishing and social engineering scams — 2020 was a year that truly went to eleven.

Scams 300

Scams Social Engineering Cybercrime Advertising 300

Krebs on Security

JULY 22, 2020

As first reported here on July 16, prior to bitcoin scam messages being blasted out from such high-profile Twitter accounts @barackobama, @joebiden, @elonmusk and @billgates, several highly desirable short-character Twitter account names changed hands, including @L, @6 and @W. They would take a cut from each transaction.”

Hacking 321

Hacking Accountability Scams Media 321

Krebs on Security

JANUARY 29, 2020

A review of the exposed support forum by this author suggests that while none of the posts exposed customer information such as payment card data, a number of them did include customer account information, such customer names, device identifiers and in some cases location information.

Social Engineering 294

Social Engineering Telecommunications Data privacy Engineering 294

Schneier on Security

MAY 1, 2019

Security keys usually have fallback mechanisms -- some way to attach a new key to your account for when you lose or destroy your old key. Cory Doctorow makes a critical point , that the system is only as good as its backup system: I agree, but there's an important caveat.

Social Engineering 262

Social Engineering Backups Passwords Authentication 262

Bleeping Computer

SEPTEMBER 15, 2023

Software company Retool says the accounts of 27 cloud customers were compromised following a targeted and multi-stage social engineering attack. [.]

Social Engineering 141

Social Engineering Authentication Engineering Accountability 141

Krebs on Security

AUGUST 5, 2019

If you bank online and choose weak or re-used passwords, there’s a decent chance your account could be pilfered by cyberthieves — even if your bank offers multi-factor authentication as part of its login process. Crooks are constantly probing bank Web sites for customer accounts protected by weak or recycled passwords.

Banking 271

Banking Passwords Risk Accountability 271

Security Affairs

APRIL 8, 2024

The Health Sector Cybersecurity Coordination Center (HC3) recently observed threat actors using sophisticated social engineering tactics to target IT help desks in the health sector. Then they used compromised employee email accounts to hijack payments. bank accounts.” bank accounts.”

Social Engineering 138

Social Engineering Healthcare Engineering Accountability 138

Security Boulevard

SEPTEMBER 9, 2024

The rise in sophisticated phishing threats like polymorphic attacks, social engineering tactics, and the use of compromised accounts have undoubtedly highlighted the significant gaps in perimeter technology, leading to a notable increase in bypassed attacks.

Phishing 121

Phishing Social Engineering Engineering Accountability 121

Security Boulevard

MARCH 28, 2024

The post Apple OTP FAIL: ‘MFA Bomb’ Warning — Locks Accounts, Wipes iPhones appeared first on Security Boulevard. Rethink different: First, fatigue frightened users with multiple modal nighttime notifications. Next, call and pretend to be Apple support.

Accountability 132

Accountability Social Engineering Authentication Data privacy 132

The Hacker News

SEPTEMBER 18, 2023

Software development company Retool has disclosed that the accounts of 27 of its cloud customers were compromised following a targeted and SMS-based social engineering attack. The fact that Google Authenticator syncs to

Social Engineering 137

Social Engineering Phishing Engineering Accountability 137

Adam Levin

AUGUST 13, 2020

The successful breach of an industry leader demonstrates the threat posed by social engineering, which focuses on gaining access to a network by deceiving employees rather than deploying more sophisticated means. The recent hack of several high-profile Twitter accounts used a similar approach. .

Phishing 196

Phishing Cybersecurity Social Engineering Data breaches 196

Krebs on Security

AUGUST 26, 2020

For several years beginning around 2010, a lone teenager in Vietnam named Hieu Minh Ngo ran one of the Internet’s most profitable and popular services for selling “ fullz ,” stolen identity records that included a consumer’s name, date of birth, Social Security number and email and physical address. ” MICROBILT.

Identity Theft 353

Identity Theft Computers and Electronics Hacking Accountability 353

Krebs on Security

JANUARY 30, 2024

In each attack, the victims saw their email and financial accounts compromised after suffering an unauthorized SIM-swap, wherein attackers transferred each victim’s mobile phone number to a new device that they controlled. Prosecutors say Noah Michael Urban of Palm Coast, Fla., Twilio disclosed in Aug. On July 28 and again on Aug.

Social Engineering 351

Social Engineering Mobile Passwords Cybercrime 351

The Last Watchdog

APRIL 14, 2022

The CFO commonly carries out such tasks and arranges a wire transfer using the account information provided on the invoice. In actuality, the request is coming from a BEC fraud ring, and the payment details direct the funds to an account controlled by the attackers. Scenario 2. Scenario 3. Planned attacks.

Phishing 247

Phishing Accountability Scams Social Engineering 247

Krebs on Security

JUNE 15, 2024

. “He stands accused of hacking into corporate accounts and stealing critical information, which allegedly enabled the group to access multi-million-dollar funds,” Murcia Today wrote. ” The cybercrime-focused Twitter/X account vx-underground said the U.K.

Hacking 323

Hacking Phishing Cybercrime Passwords 323

Digital Shadows

OCTOBER 23, 2024

The attacker gained initial access to two employee accounts by carrying out social engineering attacks on the organization’s help desk twice. Scattered Spider previously targeted telecommunications firms, likely to support its SIM-swapping activities that facilitate account takeovers.

Social Engineering 122

Social Engineering Engineering Accountability Backups 122

Krebs on Security

NOVEMBER 21, 2024

That Joeleoli moniker registered on the cybercrime forum OGusers in 2018 with the email address joelebruh@gmail.com , which also was used to register accounts at several websites for a Joel Evans from North Carolina. Click to enlarge.

Identity Theft 240

Identity Theft Phishing Cryptocurrency Accountability 240

Security Affairs

APRIL 15, 2024

Then they used the access to download a set of MFA SMS message logs belonging to customers’ Duo accounts. “More specifically, the threat actor downloaded message logs for SMS messages that were sent to certain users under your Duo account between March 1, 2024 and March 31, 2024. ” continues the notification.

Data breaches 140

Data breaches Social Engineering Engineering Authentication 140