Tag

Account Takeover

All articles tagged with #account takeover

technology1 month ago•1 min saved

Zoom rolls out urgent Windows patches to block account takeover and privilege escalations

Zoom released security updates for Windows to fix a critical flaw (CVE-2026-53412, CVSS 9.8) in Zoom Workplace for Windows and related VDI components that could allow an unauthenticated attacker to take over accounts via network. The patch also addresses three high-severity issues (CVE-2026-53411, CVE-2026-53410, CVE-2026-53409) that could enable privilege escalation for authenticated users or via local access across Zoom Workplace, VDI, VDI plugin, and Zoom Rooms for Windows. Affected version details are provided for each product, and Zoom notes no active exploitation so far. The update also removes Meeting SDK for Windows from the affected scope. Users should install the latest versions to stay protected.

via The Hacker News|

#account-takeover #privilege-escalation #technology

technology2 months ago•5 min saved

Hackers weaponize Meta's AI chat to hijack celebrity Instagram accounts

Hackers used a prompt-injection flaw in Meta's AI support chatbot to trigger email-address changes via password resets, enabling takeover and resale of high-value Instagram accounts before Meta pushed an emergency patch on May 29; the incident highlights security risks of AI agents with broad account-modification permissions, though accounts with MFA were more resistant.

via Ars Technica|

#account-takeover #cybersecurity #instagram

technology3 months ago•3 min saved

AppSheet-Driven Phishing Campaign Exposes 30,000 Facebook Accounts

A Vietnamese-linked operation hijacks Facebook accounts by using Google AppSheet as a phishing relay, targeting Business account owners to capture credentials and 2FA data, with roughly 30,000 victim records spread across several clusters (Netlify, CAPTCHA-gated pages, and Canva-generated PDFs) that feed the stolen data to Telegram channels and facilitate resale on underground markets; the campaign illustrates evolving tactics and the repurposing of trusted platforms in a dark, criminal economy.

via The Hacker News|

#account-takeover #appsheet #facebook

technology1 year ago•3 min saved

Lovense Faces Privacy Breach with User Email Leak and Account Risks

Lovense, a major maker of internet-connected sex toys, failed to fully fix security flaws that exposed users' email addresses and allowed account takeovers, risking privacy and safety, especially for vulnerable users like cam models. The bugs were disclosed by security researcher BobDaHacker, who received a bug bounty but went public after Lovense delayed fixing the issues for 14 months.

via TechCrunch|

#account-takeover #data-leak #lovense

technology1 year ago•2 min saved

Lovense Sex Toy App Security Flaw Exposes User Emails

A security researcher revealed that Lovense, a major maker of internet-connected sex toys, failed to fully fix two security vulnerabilities that expose users' email addresses and allow account takeovers, posing significant privacy and security risks for its over 20 million users.

via Yahoo Finance|

#account-takeover #lovense #privacy-leak

saas-security1 year ago•3 min saved

Ongoing Risk of nOAuth Vulnerability in Microsoft Entra SaaS Apps

Research reveals that 9% of Microsoft Entra SaaS apps remain vulnerable to nOAuth abuse, a security flaw in OpenID Connect implementation that can lead to account hijacking and data breaches, despite being disclosed two years ago. The vulnerability exploits cross-tenant access and unverified emails, with Microsoft urging developers to properly implement authentication measures to prevent exploitation.

via The Hacker News|

#account-takeover #microsoft-entra-id #noauth

technology1 year ago•2 min saved

Over 46,000 Grafana Instances Vulnerable to Account Takeover

Over 46,000 Grafana instances remain unpatched despite a critical vulnerability (CVE-2025-4123) that allows attackers to execute malicious plugins and hijack accounts through a client-side open redirect flaw. The vulnerability, discovered by Alvaro Balada and addressed in May, affects multiple versions, but many remain vulnerable, posing a significant security risk. Upgrading to the latest secure versions is recommended to mitigate potential exploits.

via BleepingComputer|

#account-takeover #cve-2025-4123 #grafana

cybersecurity2 years ago•3 min saved

"Security Risks in ChatGPT Plugins Expose Data and Accounts"

Third-party plugins for OpenAI ChatGPT could be exploited by threat actors to hijack accounts on third-party websites, such as GitHub, and access sensitive data. Security flaws in ChatGPT and its ecosystem, including OAuth manipulation and zero-click account takeover vulnerabilities, have been uncovered by Salt Labs. Additionally, a new side-channel attack has been identified, allowing attackers to extract encrypted responses from AI assistants by inferring token lengths in network traffic. Countermeasures such as random padding and transmitting tokens in larger groups are recommended to mitigate the effectiveness of the side-channel attack.

via The Hacker News|

#account-takeover #chatgpt #cybersecurity

technology-law-enforcement2 years ago•2 min saved

"State Attorneys General Demand Meta Improve Support for Hacking Victims"

Forty-one state attorneys general have written a letter to Meta's top attorney expressing concern over the surge in complaints about Facebook and Instagram account takeovers, which are draining law enforcement resources. The officials demand immediate action to mitigate the threat, citing instances of financial crimes tied to stolen accounts and scammers running ads on the platforms. Meta insists it invests heavily in enforcement and detection tools, but the attorneys general argue that the company needs to take proper action to protect users from account takeovers and associated fraudulent activities.

via WIRED|

#account-takeover #facebook #instagram

software-security2 years ago•1 min saved

"GitLab Issues Critical Patch for Zero-Click Account Takeover Vulnerability"

GitLab has released security updates to address two critical vulnerabilities, including one that could lead to account takeover without user interaction. The flaw, tracked as CVE-2023-7028, affects self-managed instances of GitLab Community Edition and Enterprise Edition. Another critical flaw (CVE-2023-5356) was also patched, allowing a user to abuse Slack/Mattermost integrations. Users are advised to upgrade to the patched version as soon as possible and enable 2FA, especially for those with elevated privileges.

via The Hacker News|

#account-takeover #devsecops #gitlab

cybersecurity3 years ago•2 min saved

EvilProxy Phishing Campaign Exploits Microsoft 365 Users and Executives

EvilProxy, a popular phishing platform, has been used in a large-scale campaign targeting Microsoft 365 accounts. Researchers have observed 120,000 phishing emails sent to over a hundred organizations, primarily impacting high-ranking executives. EvilProxy employs reverse proxies to steal authentication cookies and bypass multi-factor authentication. The campaign impersonates popular brands and utilizes open redirections to evade detection. Once an account is compromised, the threat actors establish persistence by adding their own multi-factor authentication method. Organizations are advised to increase security awareness, implement stricter email filtering rules, and adopt FIDO-based physical keys to defend against this growing threat.

via BleepingComputer|

#account-takeover #cybersecurity #evilproxy