Tag: Account Takeover
Clippy-themed crypto grift briefly took over Microsoft’s X feed
The company's 13-million-follower account was hijacked and used to boost a token tied to an old Office mascot.
GhostCode phish turns a device code into a Microsoft 365 takeover
GhostCode abuses Microsoft's device authorization flow to obtain tokens and register attacker hardware inside a victim tenant.
Telus tells customers their accounts were raided with stolen passwords
Canada's Telus says attackers used stolen credentials to reach customer records over more than a year.
FBI flags OAuth consent phishing that survives password resets
The FBI warns OAuth consent phishing has been seizing prominent people's accounts since late 2025, and password resets do not…
Password reset bypass in Keycloak opens every account to takeover
Red Hat patches a critical Keycloak flaw that lets unauthenticated attackers seize any account, including admins.
iAuthFlow V2 kit keeps access alive with attacker passkeys
A new phishing kit enrolls attacker passkeys to keep access after password resets.
Session swap bug in Adobe Commerce draws attacks right after patch
Sansec blocked the first exploits of CVE-2026-71362, an unauthenticated account takeover in Adobe Commerce rated 9.1.
Chick-fil-A loyalty accounts drained in credential stuffing spree
Chick-fil-A disclosed a credential stuffing attack that compromised customer accounts in the Chick-fil-A One loyalty program.