account hijacking - Security Ticks

Attackers phish OAuth codes, take over Microsoft 365 accounts

account hijacking, APT, Don't miss, government-backed attacks, Hot stuff, Microsoft 365, News, OAuth, phishing, Volexity / SecurityTicks

Attackers phish OAuth codes, take over Microsoft 365 accounts 2025-04-23 at 13:36 By Zeljka Zorz Suspected Russian threat actors are using OAuth-based phishing attacks to get targets to grant them access to their Microsoft 365 (M365) accounts. “The primary tactics observed involve the attacker requesting victim’s supply Microsoft Authorization codes, which grant the attacker with […]

React to this headline:

Attackers phish OAuth codes, take over Microsoft 365 accounts Read More »

If you think you’re immune to phishing attempts, you’re wrong!

2FA, account hijacking, account protection, data breach, Don't miss, HIBP, Hot stuff, Mailchimp, News, phishing, social engineering / SecurityTicks

If you think you’re immune to phishing attempts, you’re wrong! 2025-03-26 at 16:17 By Zeljka Zorz Security consultant Troy Hunt, the creator of the Have I Been Pwned (HIBP) service, has revealed that he got tricked by a clever phishing email, and that the attacker gained access to his Mailchimp account and stole a list

React to this headline:

If you think you’re immune to phishing attempts, you’re wrong! Read More »

GitHub project maintainers targeted with fake security alert

account hijacking, Don't miss, GitHub, Hot stuff, News, OAuth, phishing / SecurityTicks

GitHub project maintainers targeted with fake security alert 2025-03-17 at 12:52 By Zeljka Zorz A phishing campaign targeting GitHub account owners has been trying to scare them with a fake security alert into allowing a malicious OAuth app access to their account and repositories. The fake security alert from GitHub GitHub users have taken to

React to this headline:

GitHub project maintainers targeted with fake security alert Read More »

Account takeover detection: There’s no single tell

account hijacking, account protection, Don't miss, enterprise, Hot stuff, MFA, News, Proofpoint / SecurityTicks

Account takeover detection: There’s no single tell 2025-02-24 at 14:48 By Zeljka Zorz Account takeover (ATO) is one of the most prevalent attack types; Proofpoint says that in 2024, 99% of the customer tenants the company monitors were hit with at least one account takeover attempt, and 62% of the customers experienced at least one

React to this headline:

Account takeover detection: There’s no single tell Read More »

Threat actors are using legitimate Microsoft feature to compromise M365 accounts

account hijacking, cyber espionage, Don't miss, Government, government-backed attacks, Hot stuff, Microsoft, Microsoft 365, News, social engineering, spear-phishing, Volexity / SecurityTicks

Threat actors are using legitimate Microsoft feature to compromise M365 accounts 2025-02-14 at 16:23 By Zeljka Zorz Suspected Russian threat actors have been taking advantage of Microsoft Device Code Authentication to trick targets into granting them access to their Microsoft 365 (M365) accounts. “While Device Code Authentication attacks are not new, they appear to have

React to this headline:

Threat actors are using legitimate Microsoft feature to compromise M365 accounts Read More »

How Russian hackers went after NGOs’ WhatsApp accounts

account hijacking, APT, Don't miss, Hot stuff, Microsoft, News, Russian Federation, spear-phishing, WhatsApp / SecurityTicks

How Russian hackers went after NGOs’ WhatsApp accounts 2025-01-17 at 17:34 By Zeljka Zorz Star Blizzard, a threat actor tied to the Russian Federal Security Service (FSB), was spotted attempting to compromise targets’ WhatsApp accounts through a clever phishing campaign. The campaign The campaign started with a spear-phishing email that was made to look like

React to this headline:

How Russian hackers went after NGOs’ WhatsApp accounts Read More »

European companies hit with effective DocuSign-themed phishing emails

account hijacking, Don't miss, Europe, Germany, Hot stuff, Microsoft 365, Microsoft Azure, News, phishing, UK / SecurityTicks

European companies hit with effective DocuSign-themed phishing emails 2024-12-18 at 14:07 By Zeljka Zorz A threat actor looking to take over the Microsoft Azure cloud infrastructure of European companies has successfully compromised accounts of multiple victims in different firms, according to Palo Alto Networks’ Unit 42 researchers. The phishing campaign The attack started earlier this

React to this headline:

European companies hit with effective DocuSign-themed phishing emails Read More »

Solana’s popular web3.js library backdoored in supply chain compromise

account hijacking, Cryptocurrency, cybercrime, Don't miss, Hot stuff, JavaScript, News, supply chain compromise, wall / SecurityTicks

Solana’s popular web3.js library backdoored in supply chain compromise 2024-12-04 at 18:03 By Zeljka Zorz A software supply chain attack has lead to the publication of malicious versions of Solana’s web3.js library on the npm registry. Just like the recent Lottie Player supply chain compromise, this attack was reportedly made possible due to compromised (phished)

React to this headline:

Arrested: USDoD, Anonymous Sudan, SEC X account hacker

account hijacking, arrest, cybercriminals, data breach, DDoS, Hot stuff, News, USA / SecurityTicks

Arrested: USDoD, Anonymous Sudan, SEC X account hacker 2024-10-18 at 12:22 By Zeljka Zorz Law enforcement agencies have arrested suspects involved in cyber attacks claimed by USDoD and Anonymous Sudan, as well as a person involved in the hacking of SEC’s X (Twitter) account. USDoD On Wednesday, the Brazilian federal police (Policia Federal) arrested a

React to this headline:

Arrested: USDoD, Anonymous Sudan, SEC X account hacker Read More »

Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts

account hijacking, Cloud, credentials, Don't miss, Hot stuff, Microsoft, Microsoft Entra ID, News, privileged accounts, Ransomware / SecurityTicks

Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts 2024-09-30 at 17:01 By Zeljka Zorz Storm-0501, an affiliate of several high-profile ransomware-as-a-service outfits, has been spotted compromising targets’ cloud environments and on-premises systems. “Storm-0501 is the latest threat actor observed to exploit weak credentials and over-privileged accounts to move from organizations’

React to this headline:

Ransomware attackers hop from on-premises systems to cloud to compromise Microsoft 365 accounts Read More »

SYS01 info-stealer pushed via Facebook ads, LinkedIn and YouTube posts

account hijacking, Don't miss, Facebook, Hot stuff, LinkedIn, malvertising, Malware, News, Trustwave / SecurityTicks

SYS01 info-stealer pushed via Facebook ads, LinkedIn and YouTube posts 2024-07-16 at 13:16 By Zeljka Zorz Malicious Google ads are a well known threat, but malvertising can also be found on other popular online destinations such as Facebook, LinkedIn, and YouTube. Case in point: an enduring campaign that aims to infect Facebook users with the

React to this headline:

SYS01 info-stealer pushed via Facebook ads, LinkedIn and YouTube posts Read More »

Open-source Rafel RAT steals info, locks Android devices, asks for ransom

account hijacking, Android, Check Point, cyber espionage, Don't miss, Hot stuff, Malware, News, open source, Ransomware / SecurityTicks

Open-source Rafel RAT steals info, locks Android devices, asks for ransom 2024-06-24 at 14:46 By Zeljka Zorz The open-source Rafel RAT is being leveraged by multiple threat actors to compromise Android devices and, in some cases, to lock them, encrypt their contents, and demand money to restore the device to its original state. Check Point

React to this headline:

Open-source Rafel RAT steals info, locks Android devices, asks for ransom Read More »

361 million account credentials leaked on Telegram: Are yours among them?

account hijacking, consumer, credentials, Data leak, data theft, Don't miss, enterprise, HIBP, Hot stuff, Malware, News, passwords, Telegram, tips / SecurityTicks

361 million account credentials leaked on Telegram: Are yours among them? 2024-06-04 at 15:03 By Zeljka Zorz A new trove of 361 million email addresses has been added to Have I Been Pwned? (HIBP), the free online service through which users can check whether their account credentials and other data has been compromised in one

React to this headline:

361 million account credentials leaked on Telegram: Are yours among them? Read More »

How fraudsters stole $37 million from Coinbase Pro users

account hijacking, Coinbase, Don't miss, fraud, Hot stuff, News, phishing, remote access, social engineering, USA / SecurityTicks

How fraudsters stole $37 million from Coinbase Pro users 2024-05-29 at 13:46 By Zeljka Zorz A convincing phishing page and some over-the-phone social engineering allowed a group of crooks to steal over $37 million from unlucky Coinbase Pro users. One of them – Chirag Tomar, a 30-year-old citizen of the Republic of India – has

React to this headline:

How fraudsters stole $37 million from Coinbase Pro users Read More »

Okta warns customers about credential stuffing onslaught

account hijacking, account protection, attacks, credentials, Don't miss, Hot stuff, News, Okta / SecurityTicks

Okta warns customers about credential stuffing onslaught 2024-04-29 at 14:01 By Zeljka Zorz Credential stuffing attacks have exploded this April, Okta warns, and advises its customers to use available tools to block access requests originating from residential proxies before authentication takes place. Abuse of proxy networks “In credential stuffing attacks, adversaries attempt to sign-in to

React to this headline:

Okta warns customers about credential stuffing onslaught Read More »

Microsoft: Russian hackers accessed internal systems, code repositories

account hijacking, APT, brute-force, Don't miss, government-backed attacks, Hot stuff, IBM X-Force, Microsoft, News / SecurityTicks

Microsoft: Russian hackers accessed internal systems, code repositories 2024-03-11 at 14:14 By Zeljka Zorz Midnight Blizzard (aka APT29), a group of Russian hackers tied to the country’s Foreign Intelligence Service (SVR), has leveraged information stolen from Microsoft corporate email systems to burrow into the company’s source code repositories and internal systems. “It is apparent that

React to this headline:

Microsoft: Russian hackers accessed internal systems, code repositories Read More »

Spoutible API exposed encrypted password reset tokens, 2FA secrets of users

account hijacking, API security, data breach, Don't miss, Hot stuff, News, social media, Spoutible, vulnerability / SecurityTicks

Spoutible API exposed encrypted password reset tokens, 2FA secrets of users 2024-02-06 at 16:33 By Helga Labus A publicly exposed API of social media platform Spoutible may have allowed threat actors to scrape information that can be used to hijack user accounts. The problem with the Spoutible API Security consultant Troy Hunt has been tipped

React to this headline:

Spoutible API exposed encrypted password reset tokens, 2FA secrets of users Read More »

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832)

account hijacking, Cure53, Don't miss, Hot stuff, Mastodon, News, security update, social media, vulnerability / SecurityTicks

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832) 2024-02-06 at 12:02 By Zeljka Zorz Five days after Mastodon developers pushed out fixes for a remotely exploitable account takeover vulnerability (CVE-2024-23832), over 66% of Mastodon servers out there have been upgraded to close the hole. About Mastodon Mastodon is open-source (server) software for

React to this headline:

Lagging Mastodon admins urged to patch critical account takeover flaw (CVE-2024-23832) Read More »

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)

account hijacking, Don't miss, GitLab, Hot stuff, News, security update, vulnerability / SecurityTicks

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028) 2024-01-12 at 13:16 By Zeljka Zorz A critical vulnerability in GitLab CE/EE (CVE-2023-7028) can be easily exploited by attackers to reset GitLab user account passwords. While also vulnerable, users who have two-factor authentication enabled on their account are safe from account takeover. “We

React to this headline:

Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028) Read More »

SEC’s X account hacked to post fake news of Bitcoin ETF approval

account hijacking, account protection, Don't miss, Fake News, MFA, News, scams, Twitter / SecurityTicks

SEC’s X account hacked to post fake news of Bitcoin ETF approval 2024-01-10 at 15:47 By Zeljka Zorz Someone has hijacked the X (formerly Twitter) account of the US Securities and Exchange Commission (SEC), and posted an announcement saying the agency has decided to allow the listing of Bitcoin ETFs (exchange-traded funds) on registered national

React to this headline:

SEC’s X account hacked to post fake news of Bitcoin ETF approval Read More »