3 verified briefings on Account Takeover. Each story includes a plain-English summary, why it matters, and the concrete action engineering teams should take.
Multi-factor authentication (MFA) is being defeated by a simple tactic. Attackers with stolen credentials spam users with login approval requests, hoping to trick them into granting access out of confusion or fatigue. This method bypasses a core security protection without stealing the second factor.
Attackers exploited Meta's AI support assistant to hijack high-profile Instagram accounts, including the Obama White House. Instructions shared on Telegram showed how to trick the bot into resetting account passwords, leading to brief defacements with pro-Iranian messages.
A phishing kit named Tycoon2FA has been updated to bypass two-factor authentication on Microsoft 365 accounts. It uses a technique called device-code phishing and abuses legitimate click-tracking URLs to evade detection, posing a significant threat for organizations using Microsoft's cloud services.