All articles tagged with #password reset
Hackers used a prompt-injection flaw in Meta's AI support chatbot to trigger email-address changes via password resets, enabling takeover and resale of high-value Instagram accounts before Meta pushed an emergency patch on May 29; the incident highlights security risks of AI agents with broad account-modification permissions, though accounts with MFA were more resistant.
Researchers detail WT-2026-0001 in SmarterMail, a pre-authentication admin password-reset bypass that can be triggered by calling a force-reset-password API with IsSysAdmin set to true, enabling admin access without verifying OldPassword and potentially yielding remote code execution via the Volume Mount feature. A PoC shows a JSON payload including IsSysAdmin, Username, and NewPassword. SmarterTools released patch 9511 on Jan 15, 2026 to fix the flaw, but exploitation was observed shortly after the patch, highlighting urgent need to upgrade. The patched flow enforces admin verification and old-password checks, mitigating this bypass; the report also notes the ongoing risk and how attackers monitor patches to exploit high-value targets.
Instagram has denied a data breach after many users received password-reset emails; it says an external party could trigger legitimate reset requests without compromising its systems, while Malwarebytes claims a 17.5 million-account hack (a claim some researchers view as possibly old leaked data). Users are advised to change passwords via the official app and enable extra protections.
SonicWall has urged customers to reset passwords after a security breach exposed encrypted firewall configuration backup files for less than 5% of its customers, potentially aiding attackers in exploiting firewalls. The breach involved brute-force attacks on cloud backups, with no evidence of files being leaked online. SonicWall recommends verifying backup status, resetting passwords and TOTP, and importing new preferences. The incident coincides with ongoing attacks by the Akira ransomware group exploiting SonicWall vulnerabilities to gain network access and disable security defenses.
Plex experienced a security breach exposing some user data, prompting the company to advise users to reset their passwords, enable two-factor authentication, and sign out of connected devices to enhance account security.
Plex, a media streaming platform, experienced a security breach exposing user emails, usernames, and hashed passwords. The company has contained the breach, urged users to reset their passwords, enable two-factor authentication, and sign out of all devices to enhance security. Plex is reviewing its security measures to prevent future incidents and emphasizes vigilance against phishing.
Google has clarified that it did not issue a warning to 2.5 billion Gmail users to reset their passwords, contradicting recent false reports. The company emphasized the strength of Gmail's security measures and advised users to adopt passkeys for better protection, dismissing claims of a major security breach as inaccurate. This incident is part of a pattern of unverified security scare stories in the media.
The FBI warns organizations not to reset passwords in response to attacks by the threat group Scattered Spider, which uses social engineering and spearphishing to manipulate support staff into resetting passwords and transferring MFA tokens. Recent ransomware attacks attributed to Scattered Spider may actually be linked to the group ShinyHunters, highlighting collaboration among cybercriminals. Additionally, the FBI warns against scanning QR codes in suspicious packages, as they can facilitate financial fraud and malware installation.
The FBI has issued a warning against resetting passwords in response to the Scattered Spider cyber threat, which uses social engineering to manipulate support staff into resetting passwords and transferring MFA tokens. Organizations are advised to use phishing-resistant multifactor authentication and review helpdesk procedures to prevent these targeted attacks. Additionally, the FBI warns against scanning QR codes in unsolicited packages, which can lead to financial fraud and data theft.
The FBI and CISA have issued a warning against resetting passwords in response to attacks by the threat group Scattered Spider, which uses sophisticated social engineering tactics to manipulate helpdesk staff into resetting passwords and transferring MFA tokens. Organizations are advised to use phishing-resistant multi-factor authentication and review helpdesk procedures to prevent these targeted attacks.
Receiving an unexpected password reset email can indicate hacking attempts, phishing, or account compromise. It's crucial to avoid clicking links, check recent account activity, change passwords, scan devices for malware, and report suspicious activity to protect personal information. Regularly reviewing account settings and enabling two-factor authentication enhances security.
Malicious parties are exploiting the Apple ID password reset system to bombard iPhone users with prompts to take over their accounts, a tactic known as "MFA bombing." To protect against this attack, users should consistently decline the reset prompts, avoid answering calls even if they appear to be from "Apple Support," and consider temporarily changing their phone number associated with their Apple ID. There are concerns about a rate limit problem with the Apple ID password reset system, and while Apple is urged to address this issue, users are advised to be cautious and seek alternative methods to safeguard their accounts.
Apple users are being targeted by a sophisticated phishing scam that bombards them with fake password reset requests, with scammers even calling and posing as Apple Support. The scam exploits a bug in Apple's password reset feature, and users are urged to be cautious and not provide any personal information or one-time passcodes to unknown callers. Apple declined to comment on the phishing attacks but directed users to its support article on recognizing phishing attempts.
A new phishing attack targeting Apple users floods their devices with password reset requests and follows up with fake Apple Support calls, attempting to trick victims into sharing the reset code. The attackers use personal data obtained from People Data Labs to gain the victims' trust. Apple has not yet commented on the matter, and users are advised not to share the reset code with anyone to prevent unauthorized access to their Apple ID.
Apple users are being targeted by a new phishing attack called "MFA Bombing," which bombards victims with multiple password reset notifications in hopes of tricking them into granting access to their accounts. Attackers may also pose as Apple Support to obtain verification codes and reset passwords. While Apple has not responded to the issue, users can protect themselves by consistently selecting "Don't Allow" for reset notifications, verifying calls from Apple Support, and enabling the Apple Recovery Key for added security.