Dropbox Trusted the Wrong Email. About 5,000 Accounts Were Opened.
A Lenovo email-verification flaw opened about 5,000 Dropbox accounts through passwordless sign-in. The incident exposes the risk of weak identity binding.
Account Takeover
Your Password Was Fine. The Stolen Claude Session Still Drained the Account
Infostealers are stealing active Claude sessions, bypassing the need to defeat passwords or multi-factor authentication.
The Login Was Legitimate. Russia-Linked Operators Turned OAuth and WhatsApp Linking Into Initial Access.
The login pages were real. The QR codes were real. The device-linking requests were real. That did not make them safe. Google Threat Intelligence Group has documented three suspected Russian cyber-espionage clusters that repeatedly turn legitimate authentication features into initial-access…
The Password-Reset Link Was Never Opened. The Account Was Still Taken Over.
A password-reset email is meant to be the point where an identity system proves that the person changing a credential controls the account. A critical Keycloak flaw allowed an unauthenticated attacker to bypass that step and set a new password…
Passkeys Stopped the Phish. Malware Could Still Steal the Trust Behind Them.
Passkeys remove the shared secret that makes password phishing possible, but they do not make a compromised endpoint trustworthy. Palo Alto Networks Unit 42 has demonstrated three attacks against Google Password Manager’s synchronised passkeys in Chrome on TPM-equipped Windows systems.…
Tchap’s Encryption Held. One Stolen Account Still Exposed Public Rooms Used by 73,467 Officials.
France says one hijacked Tchap account exposed public-room content associated with 73,467 officials. Private encrypted histories were not reported compromised.