Krebs on Security

JULY 23, 2018

Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. A YubiKey Security Key made by Yubico. a mobile device). a mobile device).

Phishing 240

Phishing Authentication Mobile Passwords 240

Thales Cloud Protection & Licensing

JANUARY 31, 2025

Level Up Your Security: Embrace Passkeys and Phishing-Resistant 2FA andrew.gertz@t Fri, 01/31/2025 - 15:17 Celebrate Change Your Password Day and 2FA Day by embracing passkeys and phishing-resistant 2FA. Learn why these modern security practices are essential for safer, stronger authentication. So, whats the alternative?

Phishing 62

Phishing Passwords Password Management Authentication 62

Security Affairs

NOVEMBER 15, 2024

The malware could harvest a huge trove of data from infected systems, including cookies, autofill, cryptocurrency wallets, 2FA authenticators, password managers, and email client information. Gen Digital observed phishing campaigns distributing the Glove Stealer.

Encryption 116

Encryption Password Management Cryptocurrency Social Engineering 116

Cisco Security

NOVEMBER 2, 2022

Going beyond the hype, passwordless authentication is now a reality. Cisco Duo’s passwordless authentication is now generally available across all Duo Editions. “ Cisco Duo simplifies the passwordless journey for organizations that want to implement phishing-resistant authentication and adopt a zero trust security strategy.

Authentication 145

Authentication Passwords Phishing Mobile 145

Malwarebytes

FEBRUARY 25, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Passwords 145

Passwords Password Management Phishing Authentication 145

Malwarebytes

JANUARY 27, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Data breaches 129

Data breaches Healthcare Passwords Insurance 129

Krebs on Security

JULY 29, 2021

Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another. TARGETED PHISHING. So hopefully by this point it should be clear why re-using passwords is generally a bad idea. The targeted phishing message that went out to classicfootballshirts.co.uk

Passwords 363

Passwords Password Management Phishing Scams 363

Krebs on Security

JUNE 15, 2024

.” In a SIM-swapping attack, crooks transfer the target’s phone number to a device they control and intercept any text messages or phone calls sent to the victim — including one-time passcodes for authentication, or password reset links sent via SMS. A Scattered Spider phishing lure sent to Twilio employees.

Hacking 333

Hacking Cybercrime Phishing Passwords 333

Malwarebytes

OCTOBER 25, 2024

Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.

Healthcare 122

Healthcare Data breaches Passwords Identity Theft 122

Malwarebytes

NOVEMBER 4, 2024

Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.

Data breaches 119

Data breaches Passwords Ransomware Phishing 119

CSO Magazine

JANUARY 4, 2023

Every business needs a secure way to collect, manage, and authenticate passwords. Storing passwords in the browser and sending one-time access codes by SMS or authenticator apps can be bypassed by phishing. Unfortunately, no method is foolproof.

Authentication 129

Authentication Password Management Backups Passwords 129

Malwarebytes

APRIL 15, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Data breaches 97

Data breaches Ransomware Passwords B2B 97

Malwarebytes

FEBRUARY 25, 2025

Given the field that DISA is active in, that information could interest cybercriminals for use as background information for targeted phishing attempts or extortion. Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA).

Data breaches 102

Data breaches Passwords Phishing Password Management 102

eSecurity Planet

AUGUST 19, 2022

One new tactic hackers have been using is to steal cookies from current or recent web sessions to bypass multi-factor authentication (MFA). Even cloud infrastructures rely on cookies to authenticate their users. Browsers allow users to maintain authentication, remember passwords and autofill forms.

Authentication 142

Authentication Password Management Passwords Malware 142

Malwarebytes

JANUARY 10, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Ransomware 101

Ransomware Data breaches Passwords Phishing 101

Krebs on Security

AUGUST 5, 2019

If you bank online and choose weak or re-used passwords, there’s a decent chance your account could be pilfered by cyberthieves — even if your bank offers multi-factor authentication as part of its login process. “This is just more empirical data around the fact that passwords just need to go away,” Knight said.

Banking 276

Banking Passwords Risk Accountability 276

Malwarebytes

MARCH 14, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Passwords 92

Passwords Data breaches Phishing Password Management 92

Daniel Miessler

MAY 14, 2020

Use unique, strong passwords, and store them in a password manager. Many people get hacked from having guessable or previously compromised passwords. Good passwords are long, random, and unique to each account, which means it’s impossible for a human to manage them on their own. Everything.

Risk 345

Risk Passwords Password Management Accountability 345

Security Affairs

MAY 13, 2024

Experts reported that since April, the Phorpiex botnet sent millions of phishing emails to spread LockBit Black ransomware. Password Management : Use strong, unique passwords and implement multi-factor authentication (MFA) whenever possible, prioritizing authentication apps or hardware tokens over SMS text-based codes.

Phishing 132

Phishing Ransomware Security Awareness Authentication 132

Security Boulevard

FEBRUARY 5, 2023

The attacks on password managers and their users continue as Bitwarden and 1Password users have reported seeing paid ads for phishing sites in Google search results for the official login page of the password management vendors.

Password Management 98

Password Management Passwords Accountability Phishing 98

Troy Hunt

OCTOBER 28, 2020

But let's also keep some perspective here; look at how many pixels are different between an "i" and an "l": Are we really saying we're going to combat phishing by relying on untrained eyes to spot 6 pixels being off in a screen of more than 2 million of them?! Poor Googie! More on that soon. Is it a button? A notification somewhere?

Phishing 363

Phishing Password Management Passwords Internet 363

Malwarebytes

MARCH 25, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Passwords 116

Passwords Accountability Data breaches Phishing 116

Malwarebytes

MARCH 19, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Banking 98

Banking Data breaches Computers and Electronics Passwords 98

Malwarebytes

AUGUST 18, 2021

Phishing scammers love well known brand names, because people trust them, and their email designs are easy to rip off. Earlier this year, DocuSign specifically warned about phishing campaigns using its brand. We’ve included some examples of DocuSign phishing campaigns below. Real DocuSign emails used for phishing.

Phishing 145

Phishing Password Management Passwords Accountability 145

Thales Cloud Protection & Licensing

FEBRUARY 1, 2024

Passkeys and The Beginning of Stronger Authentication madhav Fri, 02/02/2024 - 05:23 How passkeys are rewriting the current threat landscape Lillian, an experienced CISO, surveyed the threat landscape. Despite solid cybersecurity defenses within her enterprise, the reliance on age-old passwords left it vulnerable.

Authentication 138

Authentication Passwords CISO Password Management 138

Malwarebytes

JULY 23, 2021

The Dutch police announced that they arrested two Dutch citizens, aged 24 and 15, for developing and selling phishing panels. For cybercriminals that lacked the technical knowledge or means, the Fraud Family also offered to host the phishing sites and backend panels. 2FA bypass.

Phishing 132

Phishing Banking Password Management Scams 132

The Last Watchdog

APRIL 7, 2021

Passwordless authentication as a default parameter can’t arrive too soon. That’s the upshot of a new report, The State of Passwordless Security 2021 , put out by HYPR , a New York City-based supplier of advanced authentication systems. Related: Top execs call for facial recognition to be regulated. 1 use case is remote access.”.

Authentication 147

Authentication Digital transformation Passwords Password Management 147

Malwarebytes

SEPTEMBER 13, 2023

The consequences of last year's LastPass breach continue to be felt, with the latest insult to users coming in the form of a highly convincing phishing email. Although the " unauthorized party" that compromised LastPass users' data was able to steal password vaults, it's likely that they are having a hard time cracking them open.

Phishing 144

Phishing Accountability Passwords Password Management 144

SecureWorld News

FEBRUARY 20, 2025

He urges enterprises to implement Privileged Access Management (PAM) solutions and multi-factor authentication (MFA) and to enforce robust password policies to reduce the risk of account compromise. Strengthening identity security Enforce phishing-resistant MFA for all privileged accounts.

Ransomware 113

Ransomware IoT Encryption Social Engineering 113

The Last Watchdog

OCTOBER 15, 2019

Compromised logins continue to facilitate cyber attacks at all levels, from phishing ruses to credential stuffing to enabling hackers to probe deep inside of a breached network. So what’s stopping us from getting rid of passwords altogether? Push’ authentication So how do companies even begin to think about getting rid of passwords?

Passwords 164

Passwords Authentication Data breaches Internet 164

Google Security

MAY 5, 2023

Passkeys are a new, passwordless authentication method that offer a convenient authentication experience for sites and apps, using just a fingerprint, face scan or other screen lock. Passkeys are not just easier to use, but also significantly faster than passwords. Figure 1: authentication success rate with passkey vs password.

Authentication 122

Authentication Passwords Technology Password Management 122

eSecurity Planet

MAY 9, 2023

Passkeys are a lot easier to manage and are resistant to phishing , harvesting and other credential attacks, which is why it’s making its way into the mainstream as a more secure and convenient authentication method. Just last week, Google announced that it will support passkeys for Google accounts.

Authentication 109

Authentication Passwords Accountability Password Management 109

Malwarebytes

FEBRUARY 20, 2023

From March 19, users of Twitter won’t be able to use SMS-based two-factor authentication (2FA) unless they have a subscription to the paid Twitter Blue service. You can still use the authentication app and security key methods. To avoid losing access to Twitter, remove text message two-factor authentication by Mar 19, 2023.

Authentication 98

Authentication Phishing Mobile Accountability 98

eSecurity Planet

JUNE 14, 2023

Passkeys can use a range of passwordless authentication methods, from fingerprint, face and iris recognition to screen lock pins, smart cards, USB devices and more. They can be implemented as part of an account, application, cloud service, access management system, or password manager. 600/year minimum Premium: $4.

Authentication 98

Authentication Passwords Password Management Phishing 98

Krebs on Security

JANUARY 30, 2024

.” Group-IB dubbed the gang by a different name — 0ktapus — which was a nod to how the criminal group phished employees for credentials. The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. On July 28 and again on Aug.

Social Engineering 356

Social Engineering Mobile Passwords Cybercrime 356

Security Affairs

SEPTEMBER 5, 2022

Cybersecurity firm Armorblox discovered a new phishing campaign aimed at American Express customers. Armorblox researchers uncovered a new phishing campaign that is targeting American Express customers. The page was crafted to request the victims to enter their user ID and password. Pierluigi Paganini.

Phishing 100

Phishing Scams Social Engineering Password Management 100

Malwarebytes

FEBRUARY 14, 2025

Choose a strong password that you dont use for anything else. Better yet, let a password manager choose one for you. Enable two-factor authentication (2FA). Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished.

Accountability 87

Accountability Data breaches Passwords Phishing 87