The attack dominating financial services doesn't steal passwords. It resets MFA and steals the token.

The attacker who hit the most financial services organizations over the past 12 months never phished a password. They called an IT support line, convinced an employee to reset their MFA, and registere [...]

Meta's AI support agent bound recovery emails for anyone who asked. Your SOC never saw an alert.

Meta's AI support agent bound recovery emails to accounts for whoever asked, and SOCs never saw an alert. An authorized agent writes a log of legitimate transactions, so nothing in the detection [...]

The best ergonomic keyboards for 2025

I probably look at my computer screen more than I look at my family members. And copious hours sitting at a desk have not done favors for my already wonky neck and shoulders. If you also feel some dis [...]

MFA verifies who logged in. It has no idea what they do next.

Every MFA check passed. Every login was legitimate. The compliance dashboard was green across every identity control. And the attacker was already inside, moving laterally through Active Directory wit [...]

Engadget Podcast: iPhone 16e review and Amazon's AI-powered Alexa+

The keyword for the iPhone 16e seems to be "compromise." In this episode, Devindra chats with Cherlynn about her iPhone 16e review and try to figure out who this phone is actually for. Also, [...]

The 5 best mechanical keyboards for 2025

Your keyboard is one of the few pieces of technology you’ll use for hours at a time, so why not make it something that brings you joy? Sure, the people who gush over mechanical keyboards can be a bi [...]

Hackers slipped a trojan into the code library behind most of the internet. Your team is probably affected

Attackers stole a long-lived npm access token belonging to the lead maintainer of axios, the most popular HTTP client library in JavaScript, and used it to publish two poisoned versions that install a [...]

Phishers have found a way to downgrade—not bypass—FIDO MFA

Contrary to recent reports, phishing sleight-of-hand doesn't defeat FIDO. [...]

Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke

Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards.The accounts Anthropic flagged were card-billed, self-serve [...]