Collecting Cyber-News from over 60 sources

Tag: mfa

New Phishing Kit Bypasses Two-Factor Protections

Feb 14, 2025 5:48 AM

by

Andy Stern

in SecurityNews

Tags: authentication, credentials, login, mfa, microsoft, phishing, service

Astaroth Kit Offered for $2,000 on Telegram, Intercepts Authentication in Real Time. A new phishing kit called Astaroth bypasses two-factor authentication through session hijacking and real-time credential interception from services like Gmail, Yahoo, AOL and Microsoft 365. Acting as a man-in-the-middle, it captures login credentials, tokens and session cookies in real time. First seen on…
Phishing trotz Zwei-Faktor-Authentifizierung – Erfolgreiche Hacks trotz 2FA das können Unternehmen tun

Feb 13, 2025 1:48 PM

by

Andy Stern

in SecurityNews

Tags: 2fa, authentication, mfa, phishing

First seen on security-insider.de Jump to article: www.security-insider.de/-phishing-methoden-zwei-faktor-authentifizierung-herausforderungen-unternehmen-a-f271964311ee60db02f7fc9e62ce5550/
4 Ways to Keep MFA From Becoming too Much of a Good Thing

Feb 11, 2025 3:55 PM

by

Andy Stern

in SecurityNews

Tags: authentication, business, mfa

Multi-factor authentication (MFA) has quickly become the standard for securing business accounts. Once a niche security measure, adoption is on the rise across industries. But while it’s undeniably effective at keeping bad actors out, the implementation of MFA solutions can be a tangled mess of competing designs and ideas. For businesses and employees, the reality…
WTF? Why the cybersecurity sector is overrun with acronyms

Feb 11, 2025 7:55 AM

by

Andy Stern

in SecurityNews

Tags: ceo, communications, cyber, cybersecurity, email, guide, identity, jobs, mfa, risk, service, threat, tool, training, update, vpn, wifi

, a global online news organization. Let’s put it this way: Many academics, regardless of their area of expertise, have never met an acronym they didn’t prefer to typing out the entire phrase. That means our copyediting efforts too often involve spelling out or removing acronyms throughout, much to the chagrin of some of our…
Phishing Season 2025: The Latest Predictions Unveiled

Feb 10, 2025 7:55 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, attack, authentication, automation, cloud, communications, control, credentials, cyber, cyberattack, cybercrime, cybersecurity, data, defense, detection, election, email, exploit, finance, google, government, group, infrastructure, intelligence, login, malware, mfa, mobile, network, passkey, phishing, ransomware, risk, service, social-engineering, strategy, tactics, technology, threat, tool, update, voip, vulnerability, zero-trust

Every year, cybercriminals sharpen their tools and refine their tactics to exploit network and security vulnerabilities. Gone are the days of clumsy emails with glaring typos and suspicious attachments. Instead, we face an era of new sophistication. No longer just stealing credentials, attackers are creating intricate digital narratives that make it difficult to distinguish friend…
Why cyber hygiene remains critical in the era of AI-driven threats

Feb 10, 2025 1:37 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, attack, authentication, breach, business, cyber, cyberattack, cybersecurity, data, email, exploit, Internet, login, malicious, mfa, network, phishing, resilience, risk, software, strategy, technology, threat, update, vulnerability, zero-trust

Cyber-attacks are an assumed inevitable for businesses today. As companies increasingly handle large amounts of valuable data, safeguarding operations has never been more important. Now, half (50%) of IT decision-makers report information security as their most time-consuming task[1].While AI offers a promising solution, security leaders must get the basics right first. Only by practicing good…
Fortifying cyber security: What does secure look like in 2025?

Feb 10, 2025 1:37 PM

by

Andy Stern

in SecurityNews

Tags: access, ai, attack, authentication, business, compliance, cyber, cybercrime, cybersecurity, deep-fake, exploit, finance, Hardware, intelligence, least-privilege, malware, mfa, nis-2, phishing, regulation, resilience, risk, risk-management, scam, software, threat, training, update, vulnerability, zero-trust

The evolving cybersecurity landscape has increased security pressures for IT leaders. With the World Economic Forum estimating, the global cost of cybercrime is projected to reach $10.5trillion annually in 2025, the situation is only escalating[1]. The rise of new technologies, such as Artificial Intelligence (AI), and the complexities introduced by flexible working have made IT…
BSI-Analyse von Nextcloud: Zwei-Faktor-Authentifizierung war angreifbar

Feb 7, 2025 3:06 PM

by

Andy Stern

in SecurityNews

Tags: authentication, bsi, mfa, vulnerability

Eine Codeanalyse des BSI förderte Schwachstellen in Nextcloud Server zutage. Unter anderem ließ sich die Zwei-Faktor-Authentifizierung umgehen. First seen on heise.de Jump to article: www.heise.de/news/BSI-Analyse-von-Nextcloud-Zwei-Faktor-Authentifizierung-war-angreifbar-10273106.html
Bitwarden erhöht Zugangssicherheit von Nutzerkonten

Feb 7, 2025 7:06 AM

by

Andy Stern

in SecurityNews

Tags: authentication, mfa

Bitwarden erhöht die Sicherheit von Zugängen: Wer keine Zwei-Faktor-Authentifizierung aktiviert hat, bekommt Bestätigungscodes per E-Mail. First seen on heise.de Jump to article: www.heise.de/news/Bitwarden-erhoeht-Zugangssicherheit-von-Nutzerkonten-10273590.html
BSI-Analyse zeigt: Nextcloud Server speicherte Passwörter im Klartext

Feb 6, 2025 10:06 PM

by

Andy Stern

in SecurityNews

Tags: authentication, bsi, mfa, password

In Nextcloud Server ließ sich die Zwei-Faktor-Authentifizierung umgehen, zeigt eine Codeanalyse des BSI. Es wurden auch Passwörter im Klartext gespeichert. First seen on heise.de Jump to article: www.heise.de/news/BSI-Analyse-zeigt-Nextcloud-Server-speicherte-Passwoerter-im-Klartext-10273106.html
Hackers Using Fake Microsoft ADFS Login Pages to Steal Credentials

Feb 5, 2025 12:12 PM

by

Andy Stern

in SecurityNews

Tags: authentication, credentials, exploit, hacker, login, mfa, microsoft, phishing

A global phishing campaign is actively exploiting a legacy Microsoft authentication system to steal user credentials and bypass multi-factor authentication (MFA), targeting over 150 organizations. First seen on hackread.com Jump to article: hackread.com/hackers-fake-microsoft-adfs-login-pages-steal-credentials/
Hackers Exploit ADFS to Bypass MFA and Access Critical Systems

Feb 5, 2025 9:12 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, credentials, cyber, data, exploit, hacker, login, mfa, microsoft, phishing, service, threat, unauthorized, vulnerability

Hackers are targeting organizations using Microsoft’s Active Directory Federation Services (ADFS) to bypass multi-factor authentication (MFA) and infiltrate critical systems. Leveraging phishing techniques, these attackers deceive users with spoofed login pages, harvest credentials, and manipulate ADFS integrations to gain unauthorized access to sensitive data, posing a significant threat to organizational security. The ADFS Vulnerability Microsoft…
Use payment tech and still not ready for PCI DSS 4.0? You could face stiff penalties

Feb 5, 2025 8:12 AM

by

Andy Stern

in SecurityNews

Tags: access, attack, authentication, awareness, best-practice, business, cloud, compliance, control, corporate, credentials, cybersecurity, data, defense, encryption, finance, firewall, flaw, framework, guide, mail, malicious, malware, mfa, password, PCI, phishing, phone, risk, risk-assessment, theft, threat, tool, training, unauthorized, update, vulnerability, waf

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements introduced by the Payment Card Industry Security Standards Council (PCI SSC) to protect card information from theft or fraud. Since its 2004 inception, PCI DSS has undergone multiple revisions due to the many challenges posed by the evolving sophistication of…
Sophisticated Phishing Attack Bypasses Microsoft ADFS MFA

Feb 4, 2025 4:12 PM

by

Andy Stern

in SecurityNews

Tags: attack, mfa, microsoft, phishing

A sophisticated phishing campaign targeting Microsoft ADFS has been observed, affecting more than 150 organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phishing-attack-bypasses-microsoft/
How to Prevent Phishing Attacks with Multi-Factor Authentication

Feb 4, 2025 3:12 PM

by

Andy Stern

in SecurityNews

Tags: attack, authentication, mfa, phishing

Learn how to protect yourself and your sensitive information from phishing attacks by implementing multi-factor authentication. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/how-to-prevent-phishing-attacks-mfa/
What 2025 HIPAA Changes Mean to You

Feb 4, 2025 10:12 AM

by

Andy Stern

in SecurityNews

Tags: access, application-security, authentication, breach, business, cloud, compliance, control, cybersecurity, data, encryption, healthcare, HIPAA, identity, incident response, insurance, law, mfa, monitoring, nist, office, penetration-testing, privacy, risk, risk-analysis, service, strategy, threat, tool, vulnerability

What 2025 HIPAA Changes Mean to You madhav Tue, 02/04/2025 – 04:49 Thales comprehensive Data Security Platform helps you be compliant with 2025 HIPAA changes. You are going about your normal day, following routine process at your healthcare organization, following the same business process you’ve followed for the last twelve years. You expect Personal Health…
Change your Password Day 2025 mahnt: Höchste Zeit für Passkeys und Multi-Faktor-Authentifizierung

Feb 4, 2025 1:12 AM

by

Andy Stern

in SecurityNews

Tags: authentication, mfa, passkey, password

First seen on datensicherheit.de Jump to article: www.datensicherheit.de/change-your-password-day-2025-mahnung-zeit-einfuehrung-passkeys-multi-faktor-authentifizierung
Keir Starmer scrapped email account in 2022 after Russian hacking, says report

Feb 3, 2025 2:12 PM

by

Andy Stern

in SecurityNews

Tags: authentication, breach, email, group, hacking, mfa, russia, ukraine

Then opposition leader’s address was ‘dangerously obvious’ and lacked two-factor authentication, book reportedly saysKeir Starmer stopped using a personal email account when he was opposition leader after being warned about a suspected hack by a Russian group, it has been reported.The suspected breach happened in 2022, shortly after the Russian invasion of Ukraine, according to…
How to Find Old Accounts for Deletion

Jan 29, 2025 7:36 PM

by

Andy Stern

in SecurityNews

Tags: access, android, apple, attack, breach, browser, chrome, cloud, credentials, cybersecurity, data, data-breach, email, google, Internet, leak, login, macOS, mfa, open-source, password, phone, privacy, service, threat, unauthorized

Old accounts are often unmaintained and forgotten – which can be problematic when you want to “clean up” some of your digital footprint by deleting them or go back to secure them with stronger passwords/MFA. How do you find these old accounts when your recollection isn’t enough? Fortunately, we all have some tricks up our…
Is Online Fax Secure? Everything You Need to Know

Jan 28, 2025 11:36 PM

by

Andy Stern

in SecurityNews

Tags: authentication, encryption, mfa, service, technology

Online faxing uses the latest security technology, including end-to-end encryption, secure transmission and multi-factor authentication, to keep your information safe. How Does Online Fax Work? Online faxing is a cutting-edge technology that is much more convenient and secure than traditional faxing. Online fax services use the latest encryption, secure transmission and multi-factor authentication to keep…
US takes aim at healthcare cybersecurity with proposed HIPAA changes

Jan 28, 2025 10:03 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, best-practice, breach, compliance, control, csf, cyber, cyberattack, cybersecurity, data, defense, detection, dora, encryption, finance, framework, government, group, healthcare, HIPAA, incident response, infrastructure, insurance, intelligence, jobs, law, malware, mfa, network, nist, penetration-testing, phishing, privacy, ransom, ransomware, regulation, resilience, risk, security-incident, service, skills, technology, threat, tool, update, usa, vulnerability, vulnerability-management

The US Department of Health and Human Services (HHS) has launched a consultation on stricter rules for the safeguarding of electronic health records.The proposed revamp of security rules covered by the Health Insurance Portability and Accountability Act (HIPAA) is designed to address the increased risk from cyberattacks such as ransomware against healthcare environments.The revamped rules…
Bitwarden makes it harder to hack password vaults without MFA

Jan 27, 2025 11:03 PM

by

Andy Stern

in SecurityNews

Tags: access, authentication, email, mfa, open-source, password

Open-source password manager Bitwarden is adding an extra layer of security for accounts that are not protected by two-factor authentication, requiring email verification before allowing access to accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bitwarden-makes-it-harder-to-hack-password-vaults-without-mfa/
Three sentenced over OTP.Agency MFA fraud service

Jan 27, 2025 9:03 PM

by

Andy Stern

in SecurityNews

Tags: access, cyber, fraud, mfa, service

Three men have been sentenced over their role in a cyber criminal subscription service that offered access to online accounts using illicitly obtained one-time passcodes First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366618400/Three-sentenced-over-OTPAgency-MFA-fraud-service
HHS Office for Civil Rights Proposes Measures to Strengthen Cybersecurity in Health Care Under HIPAA

Jan 23, 2025 11:22 AM

by

Andy Stern

in SecurityNews

Tags: access, authentication, breach, business, cloud, compliance, control, cyber, cyberattack, cybersecurity, data, data-breach, defense, encryption, endpoint, hacker, healthcare, HIPAA, insurance, mfa, network, nist, office, privacy, regulation, risk, risk-assessment, service, software, strategy, threat, unauthorized, update, vulnerability

HHS Office for Civil Rights Proposes Measures to Strengthen Cybersecurity in Health Care Under HIPAA madhav Thu, 01/23/2025 – 06:25 Data Breaches in Healthcare: Why Stronger Regulations Matter A data breach involving personal health information isn’t just about stolen files”, it’s a gut punch to trust and a serious shake-up to people’s lives. Think about…
Google Cloud Security Threat Horizons Report #11 Is Out!

Jan 22, 2025 11:22 PM

by

Andy Stern

in SecurityNews

Tags: access, api, apt, attack, authentication, breach, business, cloud, corporate, credentials, cybersecurity, data, detection, exploit, extortion, google, identity, intelligence, leak, mfa, password, phishing, ransomware, service, tactics, theft, threat, tool, vulnerability

This is my completely informal, uncertified, unreviewed and otherwise completely unofficial blog inspired by my reading of our next Threat Horizons Report, #11 (full version) that we just released (the official blog for #1 report, my unofficial blogs for #2, #3, #4, #5, #6, #7, #8, #9 and #10). My favorite quotes from the report follow below:…
The Quiet Rise of the ‘API Tsunami’

Jan 22, 2025 8:22 PM

by

Andy Stern

in SecurityNews

Tags: access, api, attack, authentication, breach, business, cloud, compliance, control, data, data-breach, encryption, endpoint, finance, GDPR, healthcare, HIPAA, infrastructure, law, leak, mail, malicious, mfa, mobile, monitoring, network, privacy, programming, regulation, risk, security-incident, service, threat, tool, unauthorized, update, vulnerability

As enterprises increasingly adopt cloud-native architectures, microservices, and third-party integrations, the number of Application Programming Interfaces (APIs) has surged, creating an “API tsunami” in an organization’s infrastructure that threatens to overwhelm traditional management practices. As digital services proliferate, so does the development of APIs, which allow various applications to communicate or integrate with each other…
Tycoon 2FA Phishing Kit Upgraded to Bypass Security Measures

Jan 22, 2025 6:22 PM

by

Andy Stern

in SecurityNews

Tags: 2fa, mfa, phishing, threat

Threat researchers analyzed the updated Tycoon 2FA phishing kit, which bypasses MFA First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/tycoon-2fa-phishing-kit-upgraded/
Mandatory MFA, Biometrics Make Headway in Middle East, Africa

Jan 22, 2025 4:22 PM

by

Andy Stern

in SecurityNews

Tags: identity, mfa, middle-east, technology

Despite lagging in technology adoption, African and Middle Eastern organizations are catching up, driven by smartphone acceptance and national identity systems. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/mfa-biometrics-make-headway-middle-east-africa
‘Sneaky Log’ Microsoft Spoofing Scheme Sidesteps Two-Factor Security

Jan 21, 2025 11:22 PM

by

Andy Stern

in SecurityNews

Tags: authentication, mfa, microsoft, phishing, service

The phishing-as-a-service kit from Sneaky Log creates fake authentication pages to farm account information, including two-factor security codes. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/sneaky-log-microsoft-phishing-2fa/
Yubico Warns of 2FA Security Flaw in pam-u2f for Linux and macOS Users

Jan 20, 2025 1:22 PM

by

Andy Stern

in SecurityNews

Tags: 2fa, advisory, authentication, cve, fido, flaw, linux, macOS, mfa, open-source, risk, software, threat, vulnerability

Yubico has released a security advisory, YSA-2025-01, which highlighted a vulnerability within the software module that supports two-factor authentication (2FA) for Linux and macOS platforms. This issue, tracked as CVE-2025-23013, allows for a partial 2FA bypass protections when using YubiKeys or other FIDO-compatible authenticators. The vulnerability poses a high-risk security threat and could potentially compromise…