The attack dominating financial services doesn't steal passwords. It resets MFA and steals the token.

The attacker who hit the most financial services organizations over the past 12 months never phished a password. They called an IT support line, convinced an employee to reset their MFA, and registere [...]

Meta's AI support agent bound recovery emails for anyone who asked. Your SOC never saw an alert.

Meta's AI support agent bound recovery emails to accounts for whoever asked, and SOCs never saw an alert. An authorized agent writes a log of legitimate transactions, so nothing in the detection [...]

MFA verifies who logged in. It has no idea what they do next.

Every MFA check passed. Every login was legitimate. The compliance dashboard was green across every identity control. And the attacker was already inside, moving laterally through Active Directory wit [...]

Hackers can bypass FIDO MFA keys, putting your accounts at risk - here's what we know

Fallback mechanism found in FIDO keys is being abused in adversary-in-the-middle attacks. [...]

The Playdate Catalog's 3-year anniversary sale is here

If your Playdate wishlist is anything like mine (endless), here's a good excuse to actually go ahead and free some of those games from limbo: Panic is running a two-week-long sale on the Playdate [...]

Hackers slipped a trojan into the code library behind most of the internet. Your team is probably affected

Attackers stole a long-lived npm access token belonging to the lead maintainer of axios, the most popular HTTP client library in JavaScript, and used it to publish two poisoned versions that install a [...]

Don't just lock your door: MFA alone is not enough in today's cybersecurity climate

For years, MFA has been heralded as a cornerstone of modern security. However, it has become clear that MFA alone is no longer sufficient. [...]

How to cancel or downgrade your Xbox Game Pass subscription

If raising console prices wasn't enough to scare you away, Microsoft has also increased the price of Xbox Game Pass Ultimate by 50 percent. That makes the subscription cost $30 per month when it [...]

Why stolen credentials continue to work even where MFA is in place

How stolen credentials and cookies can bypass MFA protections. [...]