Identity & Access — Page 6
Kali365 Phishing Kit Turns Microsoft's Own Login Page Against US Firms
A criminal toolkit tricks staff into approving attacker device codes on genuine Microsoft screens, handing over long-lived access to email and cloud files.
Leaked n8n Tokens Left 321 Live Automation Servers Open to Anyone With a GitHub Search
GitGuardian found thousands of API keys for the popular workflow tool spilled into public code repositories, handing attackers a straight path to connected apps and stored secrets.
Greatness Phishing Kit Adds a New Trick to Steal Logins Without Passwords
The rented phishing toolkit now abuses Microsoft's own login flow to walk around multi-factor authentication.
Russian hackers turn hotel Wi-Fi into a trap for Microsoft 365 logins
Microsoft has attributed the CaptiveCrunch campaign to Storm-2945, a sub-group of APT29, which has been poisoning hotel and conference Wi-Fi networks since at least May 2025 to steal corporate accounts using two newly identified malware families.
Malware Can Silently Hijack Chrome Passkeys, Researchers Show
Palo Alto's Unit 42 details three attack paths against Google Password Manager that let ordinary user-level malware sign in without a fingerprint, PIN, or on-screen prompt.
Visa Is Buying Fraud-Detection Firm BioCatch for $2.4 Billion
The payments giant wants BioCatch's technology, which watches how you move through a banking app, to help banks catch scammers before money leaves an account.
USA Fencing's Identity Problem: How a Sports Body Stopped Checking Kids' Ages by Hand
With more than 50,000 members ranging from age eight to eighty, USA Fencing was drowning in paper birth certificates. Here's how it automated the problem away, and why the data questions around children are still worth watching.
Device Code Phishing: The Login Trick That Blew Up in 2026
A login flow built for smart TVs is now one of the fastest-growing routes into corporate accounts, and identity teams are struggling to keep up.
South Korea hits KT with $39 million fine after hackers ran a fake mobile tower for 11 months
A lost cellular base station gave attackers a valid certificate, letting them pose as KT's network and drain money from customer phones.
Okta Is Buying Security Firm Permiso to Catch Identity-Based Attacks
The deal would push Okta beyond managing who can log in and into spotting when a legitimate login is being used to do something it shouldn't.
ShinyHunters Are Phoning Hospital Help Desks: Health-ISAC Sounds the Alarm
A wave of voice-phishing calls is tricking healthcare staff into handing over single sign-on access, and the data theft is following fast.
AI agents with too many keys: why permissions are the new identity problem
As companies rush to deploy AI assistants that act on their behalf, security researchers warn the real danger is not the AI itself but the sweeping access rights it inherits.
The Four Ways Criminals Beat Multi-Factor Authentication (And What You Can Do About It)
Multi-factor authentication was supposed to be the lock that hackers couldn't pick. It turns out there are at least four reliable routes through it, and most organisations are leaving at least one wide open.
Fake Spotify Payment Emails Are Stealing Card Details From Real Subscribers
Criminals are sending convincing payment-failure notices that lead Spotify users to copycat websites designed to harvest login credentials and credit card numbers.
The 'Ghost Credentials' Problem: How Forgotten Digital Keys Are Leaving Cloud Systems Wide Open
A sleeping AI agent that woke up and started making requests at odd hours led a security researcher to a sprawling mess of forgotten digital keys, and a free tool to help organisations find them before attackers do.