Authentication

Users searching for Bitwarden and 1Password's Web vaults on Google have recently reported seeing paid ads with links to cleverly spoofed sites for stealing credentials to their password vaults.

Two common attacks against on-premises Kerberos authentication servers — known as Pass the Ticket and Silver Ticket — can be used against Microsoft's Azure AD Kerberos, a security firms says.

Encrypted backups for several GoTo remote work tools were exfiltrated from LastPass, along with encryption keys.

Zendesk has alerted customers to a successful SMS phishing campaign that has exposed "service data," but details remain scarce.

A rapid increase in the number of operators in the space — the "locksmiths" of the cyber underground — has made it substantially cheaper for cybercriminals to buy access to target networks.

Password manager accounts may have, ironically, been compromised via simple credential stuffing, thanks to password reuse.

Unpatched Cisco bugs, tracked as CVE-2023-20025 and CVE-2023-20026, allow lateral movement, data theft, and malware infestations.

Hacking to kill: Dark Reading's Fahmida Y. Rashid reflects on the monumental Black Hat 2011 moment when Jay Radcliffe showed how to hack his insulin pump.

Business users receive a message from Facebook warning their accounts will be permanently suspended for using photos illegally if they don't appeal within 24 hours, leading victims to a credential-harvesting page instead.

Job applicants could face a raft of follow-on attacks after cyber intruders accessed their data in an opportunistic attack.

The follow-on attack from August's source-code breach could fuel future campaigns against LastPass customers.

The malware has resurfaced, using an icon and name similar to the legitimate Google Play app MYT Music, a popular app with more than 10 million downloads.

With 10 layers of obfuscation and fake payloads, the Raspberry Robin worm is nesting its way deep into organizations.

Startups are coalescing around effective data loss prevention, reducing data attack surfaces, and viable AI automation.

The proliferation of automated cyberattacks against npm, NuGet, and PyPI underscores the growing sophistication of threat actors and the threats to open source software supply chains.