authentication

How Device Code Phishing Gives Scammers Access to Your Account

,

Device code phishing exploits the OAuth 2.0 Device Authorization Grant by tricking victims into entering a legitimate short code on a real sign-in page, unknowingly approving a scammer's sign-in request and granting them access to the victim’s account. This attack bypasses typical security measures such as multifactor authentication because the victim themselves authorizes the sign-in, allowing attackers to obtain authentication tokens to access emails, files, or other services depending on granted permissions. Users should be wary of unexpected requests to enter sign-in codes purportedly for meetings or documents and verify legitimate device sign-ins, while monitoring account activity if a scam is suspected.

https://www.malwarebytes.com/blog/how-to/2026/09/how-device-code-phishing-gives-scammers-access-to-your-account

N0va Phishkit Targets US and EU Businesses: a New Challenge for Identity Security

, , ,

The N0va phishkit is conducting sophisticated phishing campaigns targeting organizations across North America and Europe, leveraging trusted business platforms and legitimate authentication flows to steal access tokens and gain single sign-on entry to corporate resources. This identity compromise risks financial loss, sensitive data exposure, operational disruption, and reputational damage, especially in high-risk sectors such as government, healthcare, and technology. Security teams are advised to use advanced threat intelligence tools and behavioral analysis to detect, contextualize, and respond swiftly to N0va-related attacks to minimize impact and contain breaches effectively.

https://thehackernews.com/2026/09/n0va-phishkit-targets-us-and-eu.html

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

, ,

Researcher Dirk-jan Mollema demonstrated that malware running in a logged-in Windows session can abuse Windows Hello for Business keys to authenticate silently to Microsoft Entra ID, enabling persistent cloud access without requiring admin privileges or extracting private keys. This technique leverages Windows ticketing and WebAuthn to request authentication on a compromised device, allowing attackers to register new devices, obtain refresh tokens, and bypass some conditional access controls, exposing limits in phishing-resistant authentication methods. Mollema has released proof-of-concept scripts and recommends monitoring for unexpected device registrations to detect such abuse.

https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

,

Three recent research efforts revealed attacks bypassing passkey security without breaking underlying cryptography by exploiting implementation flaws in Windows and Google Chrome. These include Windows exposing signed authentication assertions allowing privileged user impersonation (CVE-2026-34348), malware recovering private keys from Google's synced passkeys in Chrome via leaked master secrets, and malware abusing Windows Hello for Business keys without user verification to satisfy phishing-resistant MFA. Microsoft and Google have issued mitigations and updates, but attackers with endpoint access can still leverage these weaknesses, emphasizing the need for endpoint protections and strict enforcement of authentication policies.

https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

, , ,

Russian cyber espionage group TA488 has exploited a cross-site scripting vulnerability (CVE-2026-42897) in Microsoft Outlook Web Access (OWA) to maintain persistent mailbox access even after credential changes. The implanted JavaScript malware, dubbed OWAReaper, operates stealthily within the OWA browser context, harvesting credentials, stealing OAuth tokens, and surviving device re-imaging by leveraging server-side persistence on Exchange servers and hidden offline cache elements. This advanced half-click exploit campaign targets various sectors including government and finance, enabling the actor to maintain long-term access that cannot be removed by credential rotation alone.

https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html

Attackers Are Turning Microsoft’s Trusted Login System Into Their Latest Phishing Weapon

, , ,

Attackers are exploiting Microsoft’s legitimate login system by directing victims to real Microsoft sign-in pages to grant permissions to malicious apps, enabling phishing campaigns to bypass traditional detection. This method, observed in over 200 phishing emails targeting around 120 organizations worldwide, allows attackers to access email, files, Teams, SharePoint, OneDrive, and calendars within the victim’s Microsoft 365 environment. The campaign emphasizes the growing threat of abuse of trusted authentication flows and highlights the need for vigilance despite appearances of legitimate Microsoft login prompts.

https://blog.checkpoint.com/email-security/attackers-are-turning-microsofts-trusted-login-system-into-their-latest-phishing-weapon/

New Certighost PoC Exploit Lets Attackers Hijack Windows Domains

, ,

A proof-of-concept exploit for the Certighost vulnerability (CVE-2026-54121) in Windows Active Directory Certificate Services allows authenticated attackers to impersonate domain controllers and gain domain-level privileges. The flaw exploited a fallback mechanism in certificate enrollment requests, permitting attackers to obtain unauthorized certificates and perform privileged Active Directory operations, including DCSync attacks. Microsoft addressed the issue in the July 2026 Patch Tuesday updates by validating domain controller identities during certificate requests, and administrators are urged to apply these patches promptly.

https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/

Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts

, , , , ,

Hackers have compromised hotel Wi-Fi gateways to redirect employees connecting to the network to fake Microsoft 365 login pages, enabling them to steal credentials and authorization tokens without phishing emails or malware. The attack, identified by ReliaQuest since June 2026 across multiple countries, involves DNS manipulation and may exploit weak administrator passwords on gateway devices. Using an always-on VPN that routes traffic through a company network can prevent these redirects, while employees should reject unexpected Microsoft login prompts on public Wi-Fi.

https://hackread.com/hackers-hotel-wi-fi-gateways-hijack-microsoft-365-accounts/

Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials

, , , , ,

A threat actor has been compromising public Wi-Fi gateway appliances at venues like hotels and conference centers across the US, India, and Saudi Arabia to hijack DNS settings and redirect users to attacker-controlled sites, harvesting Microsoft 365 credentials of traveling corporate employees. This ongoing campaign since June 2026 resembles tactics used by the Russian-linked APT28 group but shows differences in infrastructure and targeting, suggesting a possible reuse of known tradecraft by a different actor. Organizations providing captive portal Wi-Fi services face heightened risks as attackers employ adversary-in-the-middle techniques to intercept sensitive information from multiple industries.

https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/

ConsentFix: a New ClickFix Variation for Compromising Microsoft 365 Accounts

, , ,

Researchers have identified ConsentFix, a new variation of the ClickFix social engineering attack that enables cybercriminals to hijack Microsoft 365 accounts via OAuth tokens without stealing passwords. By tricking users into dragging a session token URL into an attacker-controlled page during a fake authentication process, attackers gain access to corporate email, documents, Teams, and other cloud services, facilitating data exfiltration and lateral movement within organizations. The widespread availability of ConsentFix attack blueprints increases the risk of such intrusions, highlighting the need for robust email security solutions and employee awareness training.

https://www.kaspersky.com/blog/consentfix-microsoft-365-account-hijacking/56155/

Mirage2FA Phishing Kit Uses HTML Smuggling to Steal Microsoft 365 Credentials

, ,

Researchers at Fortra uncovered Mirage2FA, a phishing kit that uses HTML smuggling and obfuscated JavaScript to deploy fake Microsoft 365 login pages, tricking users into submitting credentials and multi-factor authentication details. The campaign employs business-themed lures and short-lived domains to carry out Microsoft 365 account takeovers, potentially exposing email, files, Teams messages, and other cloud resources. Users affected are advised to reset passwords, revoke sessions, review MFA methods, and check for unauthorized mailbox access.

https://www.helpnetsecurity.com/2026/06/26/mirage2fa-phishing-kit-microsoft-365-html-smuggling/

China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade

, ,

A China-linked threat group known as Velvet Ant backdoored critical Linux login software components PAM and OpenSSH to maintain covert access inside isolated networks for nearly a decade, starting from 2016. By altering trusted login programs themselves, the attackers bypassed traditional defenses, capturing credentials and commands without exploiting new malware, making the intrusion difficult to detect and remediate. Security experts recommend monitoring these login files for changes and verifying software integrity to detect and remove such stealthy backdoors effectively.

https://thehackernews.com/2026/06/china-linked-hackers-backdoored-linux.html

These Convincing Copyright Notices Are Designed to Steal Google Logins

, , , ,

A new phishing scam targets Chrome extension developers with fake copyright removal notices designed to steal Google login credentials. The scam uses publicly available extension information to create convincing personalized warnings and a fake Google sign-in window, pressuring victims to enter their credentials before a fabricated deadline. Developers are advised to verify warnings only through their Chrome Web Store dashboard and to safeguard accounts with strong authentication and security software.

https://www.malwarebytes.com/blog/threat-intel/2026/06/these-convincing-copyright-notices-are-designed-to-steal-google-logins

Microsoft 365 Android Apps Account Takeover Vulnerability Impacted Billions of Android Users

, , ,

A critical vulnerability called FlagLeft was discovered in six major Microsoft 365 Android apps, where a debug flag left enabled in production allowed any app on the device to silently obtain valid Microsoft account tokens without user consent. This flaw exposed billions of users to account takeover risks, enabling attackers to access emails, files, and calendar data under the victim's identity; Microsoft has since patched the issue and urged users to update affected apps immediately.

https://cybersecuritynews.com/microsoft-365-android-apps-account-takeover-vulnerability/

Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation

, ,

Google disclosed that hackers have used artificial intelligence to develop the first known zero-day exploit capable of bypassing two-factor authentication (2FA) for mass exploitation. The zero-day vulnerability, implemented in a Python script with characteristics of AI-generated code, targets a popular open-source web-based administration tool and demonstrates how AI models are accelerating the discovery and weaponization of software vulnerabilities.

https://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.html

Scroll to Top