Microsoft Entra ID is removing an extra MFA hurdle for Windows Hello and macOS PSSO users 2026-08-10 at 16:19 By Sinisa Markovic Microsoft is changing how Entra ID handles MFA for people who sign in with Windows Hello for Business (WHfB) or macOS Platform Single Sign-On (PSSO). The rollout reaches worldwide and GCC tenants starting […]
Exposed credentials are giving attackers a head start many organizations don’t see 2026-07-30 at 07:00 By Anamarija Pogorelec Compromised credentials can remain active long after passwords are created, leaving organizations trying to identify exposed accounts before attackers can use them. The 2026 Credential Risk Report from Enzoic shows growing awareness of the problem, but monitoring
Exposed credentials are giving attackers a head start many organizations don’t see Read More »
Microsoft Entra ID authentication overhaul to start in September 2026 2026-07-14 at 11:49 By Anamarija Pogorelec Microsoft will begin rolling out passkeys as the default authentication experience for Microsoft Entra ID in the public cloud on September 1, 2026. Organizations with SMS or voice authentication enabled will automatically be enabled for passkeys. The next time
Microsoft Entra ID authentication overhaul to start in September 2026 Read More »
Only 28% of financial workforce MFA is phishing-resistant 2026-07-10 at 08:41 By Anamarija Pogorelec Passwords remain part of many workforce authentication flows in financial organizations, making phishing and credential theft major identity security risks, according to a new Secret Double Octopus report. Key challenges preventing universal implementation of phishing-resistant MFA (Source: Secret Double Octopus) Workforce
Only 28% of financial workforce MFA is phishing-resistant Read More »
Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials 2026-06-26 at 12:26 By Sinisa Markovic Mirage2FA, a phishing kit that combines short-lived HTML smuggling with obfuscated JavaScript loaders to deliver fake Microsoft 365 login pages and steal credentials during MFA prompts, has been identified by researchers at Fortra. Fortra based its analysis on
Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials Read More »
Webinar Today: How Modern Breaches Bypass MFA and Evade Detection 2026-06-17 at 17:07 By SecurityWeek News Attendees will learn how attackers evade conventional detection methods, why legacy MFA alone is no longer sufficient, and how organizations can strengthen their defenses. The post Webinar Today: How Modern Breaches Bypass MFA and Evade Detection appeared first on
Webinar Today: How Modern Breaches Bypass MFA and Evade Detection Read More »
Poisoned “Office 365” search results lead to stolen paychecks 2026-04-10 at 14:45 By Zeljka Zorz A financially motivated hacking group is targeting Canadian employees with a sophisticated campaign designed to covertly redirect their salary payments into attacker-controlled bank accounts, Microsoft researchers discovered. SEO poisoning and malvertising + phishing + AiTM The group, which Microsoft tracks
Poisoned “Office 365” search results lead to stolen paychecks Read More »
Microsoft hands Entra ID users new option for MFA 2026-03-25 at 12:46 By Anamarija Pogorelec Organizations rely on MFA to enforce identity checks before granting access to systems and services. Microsoft has made external MFA generally available in Microsoft Entra ID, expanding support for third-party identity providers. Configure external MFA in Microsoft Entra ID (Source:
Microsoft hands Entra ID users new option for MFA Read More »
Vulnerabilities from years ago still opening doors for attackers 2026-03-24 at 14:02 By Sinisa Markovic Exploitation timelines continued to compress in enterprise environments, with newly disclosed flaws reaching active use almost immediately and older weaknesses remaining active years after disclosure. (Source: Cisco Talos) Findings from Cisco Talos’ 2025 Year in Review show how attackers combined
Vulnerabilities from years ago still opening doors for attackers Read More »
Passwords, MFA, and why neither is enough 2026-03-13 at 07:37 By Help Net Security Passwords weren’t enough, so we added MFA. Now MFA isn’t enough either. In this Help Net Security video, Karlo Zatylny, CTO/CISO at Portnox, walks through why each layer of identity security has failed and what comes next. SMS codes can be
Passwords, MFA, and why neither is enough Read More »
Cybercriminals are scaling phishing attacks with ready-made kits 2026-01-08 at 09:10 By Anamarija Pogorelec Phishing-as-a-Service (PhaaS) kits lower the barrier to entry, enabling less-skilled attackers to run large-scale, targeted phishing campaigns that impersonate legitimate services and institutions, according to Barracuda Networks. Phishing kits grow more sophisticated and scalable Barracuda threat analysts found that in 2025
Cybercriminals are scaling phishing attacks with ready-made kits Read More »
Session tokens give attackers a shortcut around MFA 2025-12-22 at 07:45 By Help Net Security In this Help Net Security video, Simon Wijckmans, CEO at cside, discusses why session token theft is rising and why security teams miss it. He walks through how web applications rely on browsers to store session tokens after login often
Session tokens give attackers a shortcut around MFA Read More »
Passwordless is finally happening, and users barely notice 2025-12-16 at 07:32 By Anamarija Pogorelec Security teams know the strain that comes from tightening authentication controls while keeping users productive. A new report from Okta suggests this strain is easing. Stronger authentication methods are gaining traction, and many of them let users move through sign in
Passwordless is finally happening, and users barely notice Read More »
The identity mess your customers feel before you do 2025-11-27 at 07:55 By Anamarija Pogorelec Customer identity has become one of the most brittle parts of the enterprise security stack. Teams know authentication matters, but organizations keep using methods that frustrate users and increase risk. New research from Descope shows how companies manage customer identity
The identity mess your customers feel before you do Read More »
Old authentication habits die hard 2025-10-06 at 07:48 By Anamarija Pogorelec Many organizations still rely on weak authentication methods while workers’ personal habits create additional risks, according to Yubico. Training and policy gaps 40% of employees said they have never received cybersecurity training. Even among those who have, the guidance is often outdated because many
Old authentication habits die hard Read More »
Akira ransomware: From SonicWall VPN login to encryption in under four hours 2025-09-29 at 18:47 By Zeljka Zorz Four hours or less: that’s how long it takes for Akira affiliates to break into organizations and deploy the ransomware on their systems, Arctic Wolf researchers have warned. Armed with SonicWall SSL VPN credentials stolen in earlier
Akira ransomware: From SonicWall VPN login to encryption in under four hours Read More »
ScreenConnect admins targeted with spoofed login alerts 2025-08-25 at 17:56 By Zeljka Zorz ScreenConnect cloud administrators across all region and industries are being targeted with fake email alerts warning about a potentially suspicious login event. The goal of the attackers is to grab the login credentials and MFA tokens of Super Admins: users who have
ScreenConnect admins targeted with spoofed login alerts Read More »
From legacy to SaaS: Why complexity is the enemy of enterprise security 2025-08-11 at 08:32 By Mirko Zorz In this Help Net Security interview, Robert Buljevic, Technology Consultant at Bridge IT, discusses how the coexistence of legacy systems and SaaS applications is changing the way organizations approach security. He explains why finding the right balance
From legacy to SaaS: Why complexity is the enemy of enterprise security Read More »
AWS launches new cloud security features 2025-06-18 at 17:59 By Zeljka Zorz Amazon Web Services has announced new and improved security features at its annual AWS re:Inforce cloud security conference. The company has also introduced features aimed at speeding up backup recovery, and has announced the completion of its push to protect all AWS root
AWS launches new cloud security features Read More »
Corsha Raises $18 Million to Enhance and Extend Machine-to-Machine Security 2025-04-08 at 15:02 By Kevin Townsend The new funds will be used to extend Corsha’s reach into critical infrastructure and further improve its own use of AI. The post Corsha Raises $18 Million to Enhance and Extend Machine-to-Machine Security appeared first on SecurityWeek. This article
Corsha Raises $18 Million to Enhance and Extend Machine-to-Machine Security Read More »