Identity & Access — Page 4
Snowflake kills passwords for service accounts. The cleanup starts now.
The cloud data giant is retiring password logins for machine accounts. Working out what those accounts actually do is the real headache.
Passing the Login Test Does Not Mean You Let In the Right Person
Multi-factor authentication is a genuine security win, but organisations that mistake 'logged in successfully' for 'identity confirmed' are handing attackers a very comfortable seat at the table.
Attackers Are Skipping the Login and Going After the Hiring Desk
Criminals have figured out that faking a new hire or a password reset is easier than cracking a password. Identity verification is now the soft spot.
WhatsApp Rolls Out Alphanumeric Passwords and Multi-Device Passkeys
The messaging app is closing off the easy ways scammers hijack accounts, from '123456' PINs to unknown callers pushing you into a snap decision.
Mirage2FA Phishing Kit Slipped Past Microsoft 365 Logins at 4,500 Firms
A rented phishing service quietly harvested Microsoft 365 credentials and two-factor codes across US and European companies for nearly two years.
ShinyHunters phoned a ReliaQuest employee, and one of them fell for it
The security firm says a vishing call led to a view-only peek at its Okta dashboard, but device-trust rules stopped anything worse.
Microsoft Teams gets a new switch that kicks uninvited bots out of meetings
Admins can now auto-block external bots from joining Teams calls, closing a quiet side door that attackers have been probing.
Critical Keycloak Bug Lets Anyone Reset Your Password and Log In as You
A 9.1-severity flaw in the popular open-source login server hands attackers full account takeover with no credentials required.
Apollo Global Hit by Social Engineering Attack That Exposed Names and Social Security Numbers
A phone-based scam tricked Apollo Global Management's IT support staff into handing over access. Names, contact details, and Social Security numbers may have been stolen.
New Phishing Toolkit Registers Attacker Passkeys to Survive Password Resets
A tool called iAuthFlow V2 lets criminals plant a login credential they control inside your account, so changing your password does nothing to lock them out.
Can you actually stay private online? The case for separate digital identities
Reusing the same email, phone number and card everywhere hands data brokers and criminals a ready-made profile. Compartmentalising your identity blunts that.
Microsoft Confirms Critical Entra ID Flaw Was Exploited, Says No Customer Action Needed
Redmond patched a perfect-10 remote code execution bug in its cloud identity service and says the fix was applied on its side.
AI-powered phishing is slipping past email filters. Here's how to catch it after the click.
Email gateways can't spot every AI-written lure. The catch now happens at the identity and endpoint layer.
UK Prime Minister Andy Burnham Tricked Into Texting a Fake Trump Aide
Someone impersonating Susie Wiles, Donald Trump's chief of staff, exchanged messages with the British Prime Minister. It's the latest in a string of attacks targeting senior politicians through simple social deception.
Password Spraying Attacks Jump 155-Fold as Attackers Hunt for MFA Blind Spots
Huntress logged more than 81 million login attempts in a single two-week campaign, with attackers targeting old sign-in methods that skip multi-factor checks.