Identity & Access — Page 3
Dropbox accounts hijacked after attacker abused a Lenovo signup flaw
A weakness in how Lenovo verified email addresses let an attacker create fake Lenovo IDs and walk straight into around 5,000 Dropbox accounts, no password needed.
Why Edge Security Alone Misses the Riskiest Logins
Attackers now hide behind home internet connections and privacy tools that make their sessions look ordinary. Session enrichment aims to fix that blind spot.
Microsoft Makes Passkeys the Default Login for Business Accounts. Passwords Aren't Dead Yet.
From September 2026, Microsoft's business identity system defaults to passkeys instead of passwords. But the shift will take years, and most companies will run both systems side by side for a long time.
Five habits that keep file server access from spiralling out of control
A practical guide to least-privilege permissions, drawn from vendor guidance aimed at overworked IT teams.
Bank Impersonation Scams: How One Target Wasted the Fraudsters' Time for Hours
A reader who received a fake Barclays automated call decided not to hang up. What followed is a useful case study in how these scams work and what you can do when one lands in your lap.
Phone thief raided victim's Sharesies investment account and moved $50,000 in three transfers
A Hamilton man is behind bars after a stolen cellphone gave criminals a direct route into an investment app, netting tens of thousands of dollars. The case also exposed a separate scheme to help scammers cheat an elderly victim out of $24,000.
Anthropic warns Claude accounts are being hijacked by password-stealing malware
The AI company says common infostealer malware on customer PCs has been lifting active Claude login sessions, letting criminals sign in without a password and burn through usage limits.
Brave Rolls Out Email Aliases to Cut Off a Common Path to Phishing
Version 1.94 of the Brave browser lets users mask their real inbox behind disposable addresses, aiming to blunt data-broker resale and post-breach phishing.
Why 'Identity Fabric' Is the Phrase Every Security Team Will Hear in 2026
As passwords fade and machine accounts outnumber humans, a new architecture promises to watch every login, token and API call in one place. What it actually means.
Dark-web card data, 98 Bunnings items, and one PowerPass account: how a South Australian man was caught
Aijaypal Tim Sanghera used stolen credit card numbers, almost certainly bought on the dark web, to order $15,899 worth of goods from Bunnings stores across South Australia. A loyalty account tied every transaction to his name.
Android 17 hides which websites you visit from your Wi-Fi and mobile provider
Google's next Android release turns on Encrypted Client Hello by default, blocks silent local network scans, and lets carriers switch off the ageing 2G network that fraudsters abuse.
When Google Workspace gets breached, the door is usually already open
Most Workspace break-ins start with a tricked employee or a forgotten app connection, not a clever hack. Here is what actually happens in the first hours, and what stops the damage.
Okta Beats Earnings Forecasts as Companies Rush to Secure AI Agents
The identity security firm raised its annual outlook after a stronger-than-expected quarter, with demand rising from businesses trying to control who, and what, can access their systems.
Six Phone Settings That Actually Protect Your Privacy
Most of us carry a small tracking device in our pockets and never adjust a single default. Here is what to switch on, what to switch off, and why it matters.
NovaCookies Phishing Kit Rents Microsoft 365 Session Theft for $320 a Month
A new subscription phishing service abuses genuine Docusign emails to slip past multi-factor authentication and steal live Microsoft 365 logins.