account hijacking - Security Ticks

French government messaging platform breached through account hijacking

account hijacking, breach, EU, France, Government, News / SecurityTicks

French government messaging platform breached through account hijacking 2026-06-09 at 18:19 By Sinisa Markovic French authorities are investigating a compromise of Tchap, the government’s secure messaging platform, after hackers hijacked a user account and gained access to public chat rooms. Tchap is the French government’s messaging platform for civil servants, ministries, and public agencies. Built […]

French government messaging platform breached through account hijacking Read More »

Hackers used Meta’s AI support system to hijack over 20,000 Instagram accounts

account hijacking, AI, Instagram, Meta, News / SecurityTicks

Hackers used Meta’s AI support system to hijack over 20,000 Instagram accounts 2026-06-08 at 17:58 By Sinisa Markovic Meta has revealed that attackers hijacked 20,225 Instagram accounts by exploiting a flaw in the company’s AI-assisted account recovery system. According to the company, a vulnerability in High Touch Support (HTS) allowed unauthorized parties to perform password

Hackers used Meta’s AI support system to hijack over 20,000 Instagram accounts Read More »

Poisoned “Office 365” search results lead to stolen paychecks

account hijacking, Canada, Don't miss, enterprise, Hot stuff, MFA, News, Office 365, phishing, SMBs / SecurityTicks

Poisoned “Office 365” search results lead to stolen paychecks 2026-04-10 at 14:45 By Zeljka Zorz A financially motivated hacking group is targeting Canadian employees with a sophisticated campaign designed to covertly redirect their salary payments into attacker-controlled bank accounts, Microsoft researchers discovered. SEO poisoning and malvertising + phishing + AiTM The group, which Microsoft tracks

Poisoned “Office 365” search results lead to stolen paychecks Read More »

EvilTokens ramps up device code phishing targeting Microsoft 365 users

account hijacking, BEC scams, Don't miss, financial industry, Hot stuff, Human Resources, Microsoft 365, Mnemonic, News, phishing, Sekoia.io, social engineering, transportation / SecurityTicks

EvilTokens ramps up device code phishing targeting Microsoft 365 users 2026-03-31 at 17:56 By Zeljka Zorz Security researchers report a notable increase in device code phishing activity aimed at Microsoft 365 users, and have attributed this rise to the availability of EvilTokens, a new, specialized phishing toolkit that’s being offered as-a-service via Telegram. What is

EvilTokens ramps up device code phishing targeting Microsoft 365 users Read More »

Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts

account hijacking, AWS, Datadog, Don't miss, Hot stuff, News, phishing / SecurityTicks

Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts 2026-03-10 at 15:22 By Zeljka Zorz Phishers are targeting AWS accounts holders with fake email security alerts and redirecting them to a high-fidelity clone of the AWS Management Console sign-in page, Datadog researchers have warned. The cloned AWS phishing page (Source: Datadog Security Labs)

Attackers use AiTM phishing kit, typosquatted domains to hijack AWS accounts Read More »

Massive gambling network doubles as hidden C2 and anonymity infrastructure, researchers say

account hijacking, APT, Asia, cybercrime, Don't miss, Hot stuff, Malanta, News / SecurityTicks

Massive gambling network doubles as hidden C2 and anonymity infrastructure, researchers say 2025-12-03 at 15:24 By Zeljka Zorz A sprawling network that’s seemingly maintained to serve (illegal) online gambling opportunities and deliver malware to Indonesian citizens is likely also being used to provide threat actors command and control (C2) and anonymity services. “The infrastructure has

Massive gambling network doubles as hidden C2 and anonymity infrastructure, researchers say Read More »

Cybercriminals exploit RMM tools to steal real-world cargo

account hijacking, Don't miss, Hot stuff, News, Proofpoint, remote management, social engineering, transportation / SecurityTicks

Cybercriminals exploit RMM tools to steal real-world cargo 2025-11-04 at 17:18 By Zeljka Zorz Cybercriminals are compromising logistics and trucking companies by tricking them into installing remote monitoring and management (RMM) tools, Proofpoint researchers warned. The attackers’ end goal is to hijack freight shipments and sell the stolen goods. How the attack unfolds Since at

Cybercriminals exploit RMM tools to steal real-world cargo Read More »

Fake npm 2FA reset email led to compromise of popular code packages

account hijacking, Acumen Cyber, Aikido Security, Don't miss, GitHub, Hot stuff, JavaScript, News, Node.js, phishing, ReversingLabs, Sonatype, supply chain compromise / SecurityTicks

Fake npm 2FA reset email led to compromise of popular code packages 2025-09-09 at 16:51 By Zeljka Zorz Malicious versions of at least 18 widely used npm packages were uploaded to the npm Registry on Monday, following the compromise of their maintainer’s account. “The packages were updated to contain a piece of code that would

Fake npm 2FA reset email led to compromise of popular code packages Read More »

Researchers warn of ongoing Entra ID account takeover campaign

account hijacking, account protection, brute-force, Don't miss, Hot stuff, Microsoft Entra ID, News, penetration testing, Proofpoint / SecurityTicks

Researchers warn of ongoing Entra ID account takeover campaign 2025-06-12 at 19:50 By Zeljka Zorz Attackers are using the TeamFiltration pentesting framework to brute-force their way into Microsoft Entra ID (formerly Azure AD) accounts, Proofpoint researchers have discovered. “Proofpoint’s research indicates that while simulated intrusions using TeamFiltration date back nearly to the tool’s initial release

Researchers warn of ongoing Entra ID account takeover campaign Read More »

Microsoft, Dutch security agencies lift veil on Laundry Bear cyber espionage group

account hijacking, cyber espionage, Don't miss, EU, Government, government-backed attacks, Hot stuff, Microsoft, NATO, News, phishing / SecurityTicks

Microsoft, Dutch security agencies lift veil on Laundry Bear cyber espionage group 2025-05-27 at 17:02 By Zeljka Zorz The Dutch intelligence and security services have identified a new Russia-affiliated threat group that has been breaching government organizations and commercial entities in Europe and North America, and they dubbed it Laundry Bear. “Compared to some other

Microsoft, Dutch security agencies lift veil on Laundry Bear cyber espionage group Read More »

Flawed WordPress theme may allow admin account takeover on 22,000+ sites (CVE-2025-4322)

account hijacking, Don't miss, Hot stuff, News, vulnerability, Wordfence, WordPress / SecurityTicks

Flawed WordPress theme may allow admin account takeover on 22,000+ sites (CVE-2025-4322) 2025-05-21 at 13:32 By Zeljka Zorz A critical vulnerability (CVE-2025-4322) in Motors, a WordPress theme popular with car/motor dealerships and rental services, can be easily exploited by unauthenticated attackers to take over admin accounts and gain full control over target WP-based sites. The

Flawed WordPress theme may allow admin account takeover on 22,000+ sites (CVE-2025-4322) Read More »

Attackers phish OAuth codes, take over Microsoft 365 accounts

account hijacking, APT, Don't miss, government-backed attacks, Hot stuff, Microsoft 365, News, OAuth, phishing, Volexity / SecurityTicks

Attackers phish OAuth codes, take over Microsoft 365 accounts 2025-04-23 at 13:36 By Zeljka Zorz Suspected Russian threat actors are using OAuth-based phishing attacks to get targets to grant them access to their Microsoft 365 (M365) accounts. “The primary tactics observed involve the attacker requesting victim’s supply Microsoft Authorization codes, which grant the attacker with

Attackers phish OAuth codes, take over Microsoft 365 accounts Read More »

If you think you’re immune to phishing attempts, you’re wrong!

2FA, account hijacking, account protection, data breach, Don't miss, HIBP, Hot stuff, Mailchimp, News, phishing, social engineering / SecurityTicks

If you think you’re immune to phishing attempts, you’re wrong! 2025-03-26 at 16:17 By Zeljka Zorz Security consultant Troy Hunt, the creator of the Have I Been Pwned (HIBP) service, has revealed that he got tricked by a clever phishing email, and that the attacker gained access to his Mailchimp account and stole a list

If you think you’re immune to phishing attempts, you’re wrong! Read More »

GitHub project maintainers targeted with fake security alert

account hijacking, Don't miss, GitHub, Hot stuff, News, OAuth, phishing / SecurityTicks

GitHub project maintainers targeted with fake security alert 2025-03-17 at 12:52 By Zeljka Zorz A phishing campaign targeting GitHub account owners has been trying to scare them with a fake security alert into allowing a malicious OAuth app access to their account and repositories. The fake security alert from GitHub GitHub users have taken to

GitHub project maintainers targeted with fake security alert Read More »

Account takeover detection: There’s no single tell

account hijacking, account protection, Don't miss, enterprise, Hot stuff, MFA, News, Proofpoint / SecurityTicks

Account takeover detection: There’s no single tell 2025-02-24 at 14:48 By Zeljka Zorz Account takeover (ATO) is one of the most prevalent attack types; Proofpoint says that in 2024, 99% of the customer tenants the company monitors were hit with at least one account takeover attempt, and 62% of the customers experienced at least one

Account takeover detection: There’s no single tell Read More »

Threat actors are using legitimate Microsoft feature to compromise M365 accounts

account hijacking, cyber espionage, Don't miss, Government, government-backed attacks, Hot stuff, Microsoft, Microsoft 365, News, social engineering, spear-phishing, Volexity / SecurityTicks

Threat actors are using legitimate Microsoft feature to compromise M365 accounts 2025-02-14 at 16:23 By Zeljka Zorz Suspected Russian threat actors have been taking advantage of Microsoft Device Code Authentication to trick targets into granting them access to their Microsoft 365 (M365) accounts. “While Device Code Authentication attacks are not new, they appear to have

Threat actors are using legitimate Microsoft feature to compromise M365 accounts Read More »

How Russian hackers went after NGOs’ WhatsApp accounts

account hijacking, APT, Don't miss, Hot stuff, Microsoft, News, Russian Federation, spear-phishing, WhatsApp / SecurityTicks

How Russian hackers went after NGOs’ WhatsApp accounts 2025-01-17 at 17:34 By Zeljka Zorz Star Blizzard, a threat actor tied to the Russian Federal Security Service (FSB), was spotted attempting to compromise targets’ WhatsApp accounts through a clever phishing campaign. The campaign The campaign started with a spear-phishing email that was made to look like

How Russian hackers went after NGOs’ WhatsApp accounts Read More »

European companies hit with effective DocuSign-themed phishing emails

account hijacking, Don't miss, Europe, Germany, Hot stuff, Microsoft 365, Microsoft Azure, News, phishing, UK / SecurityTicks

European companies hit with effective DocuSign-themed phishing emails 2024-12-18 at 14:07 By Zeljka Zorz A threat actor looking to take over the Microsoft Azure cloud infrastructure of European companies has successfully compromised accounts of multiple victims in different firms, according to Palo Alto Networks’ Unit 42 researchers. The phishing campaign The attack started earlier this

European companies hit with effective DocuSign-themed phishing emails Read More »

Solana’s popular web3.js library backdoored in supply chain compromise

account hijacking, Cryptocurrency, cybercrime, Don't miss, Hot stuff, JavaScript, News, supply chain compromise, wall / SecurityTicks

Solana’s popular web3.js library backdoored in supply chain compromise 2024-12-04 at 18:03 By Zeljka Zorz A software supply chain attack has lead to the publication of malicious versions of Solana’s web3.js library on the npm registry. Just like the recent Lottie Player supply chain compromise, this attack was reportedly made possible due to compromised (phished)

Arrested: USDoD, Anonymous Sudan, SEC X account hacker

account hijacking, arrest, cybercriminals, data breach, DDoS, Hot stuff, News, USA / SecurityTicks

Arrested: USDoD, Anonymous Sudan, SEC X account hacker 2024-10-18 at 12:22 By Zeljka Zorz Law enforcement agencies have arrested suspects involved in cyber attacks claimed by USDoD and Anonymous Sudan, as well as a person involved in the hacking of SEC’s X (Twitter) account. USDoD On Wednesday, the Brazilian federal police (Policia Federal) arrested a

Arrested: USDoD, Anonymous Sudan, SEC X account hacker Read More »