Info Security Magazine
4 years ago
Financial Firms Failing to Fix Authentication Breaches
Four in five breaches down to compromised credentials, research finds
Security news aggregator
Latest coverage for Credentials
Stolen credentials can enable account takeover and lateral movement; phishing-resistant MFA, password managers, and rapid revocation reduce the risk.
7
headlines in this view
Refine the feed
Search across headline titles and summaries.
Tag briefing
Background for this topic.
Credentials are the data used to verify a user's identity to a system, commonly including usernames, passwords, security tokens, or biometric identifiers. They serve as gatekeepers for access to accounts, applications, and sensitive information. Attackers target credentials to impersonate users, escalate privileges, or gain unauthorized system access.
Compromise of credentials can occur through phishing, credential stuffing, or theft from insecure storage. Effective defenses include enforcing strong, unique passwords, implementing multi-factor authentication (MFA), and securely storing credentials using hashing or encryption. Monitoring for unusual login patterns and promptly revoking compromised credentials are also critical to limit attacker impact.
Showing 7 most recent headlines
Filtered view
The Register
4 years ago
Digital burglary at recruitment agency Morgan Hunt confirmed
Third-party software developer blamed for 'improperly storing credentials to our database' The bad news keeps on rolling for British recruitment agency Morgan Hunt amid confirmation it suffered a digital burglary, with intruders making off with the personal data for some of the freelancers on its books.…
Threat Post
4 years ago
Journalists Emerge as Favored Attack Target for APTs
Since 2021, various state-aligned threat groups have turned up their targeting of journalists to siphon data and credentials and also track them.
The Register
4 years ago
This big phish can swim around MFA, says Microsoft Security
Slippery AiTM attacks targeted more than 10,000 orgs over the past nine months A widespread phishing campaign that has hit more than 10,000 organizations since September 2021 uses adversary-in-the-middle (AiTM) proxy sites to get around multifactor authentication (MFA) features and steal credentials that are then used to compromise business email accounts.…
Dark Reading
4 years ago
Microsoft: 10,000 Orgs Targeted in Phishing Attack That Bypasses Multifactor Authentication
The massive phishing campaign does not exploit a vulnerability in MFA. Instead, it spoofs an Office 365 authentication page to steal credentials.
The Hacker News
4 years ago
Microsoft Warns of Large-Scale AiTM Phishing Attacks Against Over 10,000 Organizations
Microsoft on Tuesday disclosed that a large-scale phishing campaign targeted over 10,000 organizations since September 2021 by hijacking Office 365's authentication process even on accounts secured with multi-factor authentication (MFA)
Dark Reading
4 years ago
New Phishing Attacks Shame, Scare Victims into Surrendering Twitter, Discord Credentials
Scams pressure victims to "resolve an issue that could impact their status, business."