Identity & Access — Page 2
Machine Accounts Are Now the Likeliest Way Into Your Company, and Almost Nobody Is Watching Them
A new SpyCloud survey of 750 security leaders finds that automated accounts and AI agents have become the single most common entry point for attackers, yet fewer than four in ten organisations are actively monitoring them.
When Password Resets Become the Front Door: The Rise of Help Desk Attacks
Multi-factor authentication has pushed criminals to a softer target: the humans who reset it.
2.47 Million Simulated Attacks Suggest We're Measuring the Wrong Things in Phishing Training
New research points out a gap between what most companies track (who clicked a fake link) and what actually matters (whether stolen passwords are being spotted and staff are reporting suspicious emails).
Why knowing about a threat isn't the same as stopping it
Attackers are turning fresh leaks and new bug disclosures into working break-ins faster than most defenders can read the alert.
N0va phishing kit hunts logins across US and EU businesses
A phishing toolkit called N0va is tricking staff into handing over working accounts, then quietly walking through the front door.
New US Government Token Security Guide Leaves AI Agents in a Grey Zone
NIST and CISA have published fresh guidance on protecting the digital passes that systems use to grant access. It is solid work, but it sidesteps the hardest problem: nobody yet agrees how much to trust an AI agent holding a perfectly valid pass.
A Windows 11 update is locking staff out of their own work computers
Microsoft's September patch, KB5124008, is breaking the trust link between Windows 11 machines and company networks, leaving valid passwords rejected at the login screen.
The QR Code Hiding in Plain Text: This Week's Sneakiest Phishing Trick
Attackers built scannable QR codes out of typed characters to slip past image-blocking filters, while a trusted developer tool shipped credential-stealing code.
Phishing kit 'BigBear' walked past Microsoft 365 logins at 258 companies
Researchers at CloudSEK found the rented service scooped up more than 5,000 Microsoft 365 credentials and 4,148 session cookies from victims in 40 countries.
Sadiq Khan's Car Tax Conviction Withdrawn After 'Scam' Targeting London Mayor
A conviction handed down by magistrates in Hereford has been dropped after it emerged that Khan was fined for failing to tax a car he does not own, raising questions about a court system that processes hundreds of cases a day.
Passkeys Aren't Magic: Researchers Map 39 Ways to Sidestep Them
A new catalogue from Token shows attackers don't need to break the cryptography behind passkeys to steal accounts. They just walk around it.
When an Employee's Password Shows Up in a Stealer Log, the Session Cookie Is the Real Problem
Infostealer malware grabs more than passwords. It grabs live logins, and that's what lets attackers walk past multi-factor prompts.
Shai-Hulud Worm Now Hunts 469 Places for Developer Secrets
A self-spreading credential thief has more than doubled the hiding spots it checks on developer machines, from 189 to 469.
Criminals Pose as IT Support Inside Microsoft Teams to Take Over Company Networks
A hacking campaign called Spring Ring tricked more than 150 employees at ten-plus companies into handing over remote control of their computers, all through a fake Teams call from a fake help desk.
Ransomware Gangs Are Now Paying Insiders to Unlock the Front Door
Criminal groups are bribing employees to hand over company access rather than hacking their way in. It is cheaper, faster, and harder to detect, and the insider threat problem is getting worse.