#login-authentication

[ follow ]
Information security
fromSecurityWeek
14 hours ago

Mobile Attack Surface Expands as Enterprises Lose Control

Mobile device security is inadequate, with many organizations using critically outdated operating systems and exposing sensitive data to potential attacks.
#data-breach
Privacy professionals
fromSilicon Canals
13 hours ago

A fintech app asked users for their passports - then left 360,000 files unprotected for five years - Silicon Canals

A money transfer app exposed over 360,000 sensitive files on a public server for nearly five years, including unencrypted personal documents.
Healthcare
fromTechCrunch
3 days ago

Health data giant CareCloud says hackers accessed patients' medical records | TechCrunch

CareCloud experienced a data breach where hackers accessed patient electronic health records for over eight hours, but data exfiltration status remains unclear.
Privacy technologies
fromTechCrunch
1 day ago

Exclusive: Money transfer app Duc exposed thousands of driver's licenses and passports to the open web

A publicly accessible Amazon storage server exposed personal data of hundreds of thousands, including driver's licenses and passports, without encryption.
Privacy professionals
fromSilicon Canals
1 day ago

Fintech apps demand your passport for verification - then leave it on an unprotected server - Silicon Canals

Duc's exposed server revealed unprotected sensitive personal data, highlighting significant gaps in fintech data protection practices.
Privacy professionals
fromTechCrunch
1 day ago

Telehealth giant Hims & Hers says its customer support system was hacked | TechCrunch

Hims & Hers confirmed a data breach affecting customer support data, including names and contact information, but not medical records.
Information security
fromTheregister
1 day ago

The company's biggest security hole lived in the breakroom

An internet-connected coffee machine caused a major data breach by exploiting security vulnerabilities in a corporate network.
Privacy professionals
fromSilicon Canals
13 hours ago

A fintech app asked users for their passports - then left 360,000 files unprotected for five years - Silicon Canals

A money transfer app exposed over 360,000 sensitive files on a public server for nearly five years, including unencrypted personal documents.
Healthcare
fromTechCrunch
3 days ago

Health data giant CareCloud says hackers accessed patients' medical records | TechCrunch

CareCloud experienced a data breach where hackers accessed patient electronic health records for over eight hours, but data exfiltration status remains unclear.
Privacy technologies
fromTechCrunch
1 day ago

Exclusive: Money transfer app Duc exposed thousands of driver's licenses and passports to the open web

A publicly accessible Amazon storage server exposed personal data of hundreds of thousands, including driver's licenses and passports, without encryption.
Privacy professionals
fromSilicon Canals
1 day ago

Fintech apps demand your passport for verification - then leave it on an unprotected server - Silicon Canals

Duc's exposed server revealed unprotected sensitive personal data, highlighting significant gaps in fintech data protection practices.
Privacy professionals
fromTechCrunch
1 day ago

Telehealth giant Hims & Hers says its customer support system was hacked | TechCrunch

Hims & Hers confirmed a data breach affecting customer support data, including names and contact information, but not medical records.
Information security
fromTheregister
1 day ago

The company's biggest security hole lived in the breakroom

An internet-connected coffee machine caused a major data breach by exploiting security vulnerabilities in a corporate network.
#ai-governance
#ai
Privacy technologies
fromComputerWeekly.com
1 day ago

Identity and AI: Questions of data security, trust and control | Computer Weekly

AI-driven identity solutions improve access control but raise compliance, privacy, and ethical concerns that organizations must address.
fromSecurityWeek
4 days ago
Artificial intelligence

Silent Drift: How LLMs Are Quietly Breaking Organizational Access Control

AI assistance in policy as code can introduce serious flaws, leading to incorrect access permissions despite syntactically valid policies.
Privacy technologies
fromComputerWeekly.com
1 day ago

Identity and AI: Questions of data security, trust and control | Computer Weekly

AI-driven identity solutions improve access control but raise compliance, privacy, and ethical concerns that organizations must address.
Artificial intelligence
fromSecurityWeek
4 days ago

Silent Drift: How LLMs Are Quietly Breaking Organizational Access Control

AI assistance in policy as code can introduce serious flaws, leading to incorrect access permissions despite syntactically valid policies.
#openclaw
DevOps
fromInfoWorld
15 hours ago

Understanding the risks of OpenClaw

OpenClaw is an orchestration layer that requires external services to function effectively, rather than being a standalone cloud platform.
Information security
fromArs Technica
4 hours ago

OpenClaw gives users yet another reason to be freaked out about security

OpenClaw's vulnerabilities pose severe security risks, allowing attackers to gain administrative access with minimal permissions.
DevOps
fromInfoWorld
15 hours ago

Understanding the risks of OpenClaw

OpenClaw is an orchestration layer that requires external services to function effectively, rather than being a standalone cloud platform.
Information security
fromArs Technica
4 hours ago

OpenClaw gives users yet another reason to be freaked out about security

OpenClaw's vulnerabilities pose severe security risks, allowing attackers to gain administrative access with minimal permissions.
#generative-ai
Privacy technologies
fromNextgov.com
2 weeks ago

New methods for assuring digital identity and authenticity

Generative AI is transforming content creation, increasing the need for reliable identity verification and authenticity in digital media.
Digital life
fromBig Think
3 days ago

3 ways to prove you're human online

Generative AI is rapidly increasing information production, leading to a potential scarcity of human-generated content and a need for new human verification methods.
Privacy technologies
fromNextgov.com
2 weeks ago

New methods for assuring digital identity and authenticity

Generative AI is transforming content creation, increasing the need for reliable identity verification and authenticity in digital media.
Privacy professionals
fromSilicon Canals
16 hours ago

A money-transfer app stored customer passports on an unencrypted, publicly accessible server for nearly five years - Silicon Canals

Fintech companies face regulatory pressure to collect identity documents but lack enforceable obligations to protect them, leading to data breaches.
Artificial intelligence
fromTearsheet
1 day ago

What a bank-client relationship looks like when banks control the data behind the UX - Tearsheet

Grasshopper's Model Context Protocol enables secure AI integration with banking data while maintaining client control and data security.
#cybersecurity
Information security
fromThe Hacker News
1 day ago

ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories

The ThreatsDay Bulletin provides a concise overview of current cybersecurity threats and trends affecting system safety.
Information security
fromComputerWeekly.com
1 day ago

NCSC warns high-risk individuals of Signal and WhatsApp social engineering attacks | Computer Weekly

High-risk individuals must reduce exposure to social engineering attacks targeting encrypted messaging apps like Signal, WhatsApp, and Facebook Messenger.
Information security
fromThe Hacker News
7 hours ago

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

TA416 has intensified cyberattacks on European government and diplomatic organizations since mid-2025, utilizing advanced malware delivery techniques.
Information security
fromThe Hacker News
1 day ago

ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories

The ThreatsDay Bulletin provides a concise overview of current cybersecurity threats and trends affecting system safety.
Information security
fromComputerWeekly.com
1 day ago

NCSC warns high-risk individuals of Signal and WhatsApp social engineering attacks | Computer Weekly

High-risk individuals must reduce exposure to social engineering attacks targeting encrypted messaging apps like Signal, WhatsApp, and Facebook Messenger.
Privacy technologies
fromThe Hacker News
3 days ago

Android Developer Verification Rollout Begins Ahead of September Enforcement

Google is rolling out Android developer verification to combat harmful app distribution by requiring identity confirmation for developers.
Information security
fromSecurityWeek
14 hours ago

React2Shell Exploited in Large-Scale Credential Harvesting Campaign

Threat actor exploits Next.js vulnerabilities to exfiltrate credentials and compromise systems at scale, affecting over 766 systems and collecting more than 10,000 files.
Privacy professionals
fromAdvocate.com
1 day ago

How the Kash Patel hack turned a college-linked username into a security warning

FBI Director Kash Patel's personal email was hacked, exposing over 300 emails and photos, raising concerns about digital security and identity management.
#password-managers
Apple
fromZDNET
2 weeks ago

Why I use Apple's and Google's password managers - and don't mind the chaos

Apple and Google offer free, beginner-friendly password managers that securely store passwords across devices, with Apple best for iOS users and Google best for Android or mixed-device environments.
Apple
fromZDNET
2 weeks ago

Why I use Apple's and Google's password managers - and don't mind the chaos

Apple and Google offer free, beginner-friendly password managers that securely store passwords across devices, with Apple best for iOS users and Google best for Android or mixed-device environments.
Privacy technologies
fromEngadget
3 days ago

Proton adds a secure video conferencing service called Meet to its toolbox

Proton launches Meet, a privacy-focused video-calling service, competing with Microsoft and Google while ensuring user anonymity and security.
fromComputerworld
6 hours ago

A core infrastructure engineer pleads guilty to federal charges in insider attack

Rhyne's attack involved unauthorized remote desktop sessions, deletion of network administrator accounts, and changing of passwords, showcasing significant security vulnerabilities.
Information security
Privacy technologies
fromWIRED
3 days ago

This App Makes Even the Sketchiest PDF or Word Doc Safe to Open

Dangerzone is a free tool that safely opens potentially harmful documents by converting them into secure image-based PDFs.
Deliverability
fromWIRED
3 weeks ago

How to Avoid Getting Locked Out of Your Google Account

Set up Recovery Contacts and two-factor authentication to protect your Google account and regain access if locked out.
#whatsapp
Privacy professionals
fromTechCrunch
2 days ago

WhatsApp notifies hundreds of users who installed a fake app that was actually government spyware | TechCrunch

WhatsApp notified 200 users about a malicious fake app containing spyware created by Italian firm SIO.
Information security
fromTheregister
3 days ago

Don't open that WhatsApp message, Microsoft warns

WhatsApp messages are being exploited to deliver malicious files that allow attackers to control victims' machines and access their data.
fromTechCrunch
2 months ago
Privacy technologies

WhatsApp is rolling out a new stricter security setting to protect users from cyber attacts | TechCrunch

Privacy professionals
fromTechCrunch
2 days ago

WhatsApp notifies hundreds of users who installed a fake app that was actually government spyware | TechCrunch

WhatsApp notified 200 users about a malicious fake app containing spyware created by Italian firm SIO.
Information security
fromTheregister
3 days ago

Don't open that WhatsApp message, Microsoft warns

WhatsApp messages are being exploited to deliver malicious files that allow attackers to control victims' machines and access their data.
fromTechCrunch
2 months ago
Privacy technologies

WhatsApp is rolling out a new stricter security setting to protect users from cyber attacts | TechCrunch

Privacy technologies
fromZDNET
1 week ago

5 telltale signs that your phone has been compromised (and how to combat them)

Phone hacking can be detected through signs like battery drain, slow performance, unfamiliar logins, and reduced storage space.
fromTechCrunch
2 days ago

Hasbro says it was hacked, and may take 'several weeks' to recover | TechCrunch

Hasbro detected an intrusion on March 28, prompting the company to take down some of its systems. Parts of Hasbro's website appeared down, with error messages indicating maintenance.
Privacy professionals
Information security
fromThe Hacker News
15 hours ago

Drift Loses $285 Million in Durable Nonce Social Engineering Attack Linked to DPRK

Drift decentralized exchange lost $285 million due to a sophisticated attack involving unauthorized access and social engineering.
Privacy professionals
fromHer Campus
3 days ago

Who's Watching The Watchers? AI, Age Verification, And Online Privacy

Parents are increasingly concerned about children's exposure to harmful online content despite regulations like CIPA and platforms like YouTube Kids.
#malware
Information security
fromThe Hacker News
15 hours ago

New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images

A new version of SparkCat malware targets cryptocurrency users on mobile platforms, concealing itself in benign apps and evolving its technical capabilities.
Information security
fromThe Hacker News
15 hours ago

New SparkCat Variant in iOS, Android Apps Steals Crypto Wallet Recovery Phrase Images

A new version of SparkCat malware targets cryptocurrency users on mobile platforms, concealing itself in benign apps and evolving its technical capabilities.
#phishing
Privacy professionals
fromSecurityWeek
1 week ago

Tycoon 2FA Fully Operational Despite Law Enforcement Takedown

Tycoon 2FA continues to operate despite international takedown efforts, facilitating phishing attacks and compromising accounts without alerts.
Information security
fromThe Hacker News
2 days ago

CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails

A phishing campaign impersonating CERT-UA distributed malware called AGEWHEEZE targeting various organizations in Ukraine.
Information security
fromThe Hacker News
2 days ago

Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures

A phishing campaign targets Spanish-speaking users in Latin America and Europe, delivering banking trojans via malware called Horabot.
Information security
fromSecuritymagazine
4 days ago

Tax Season Means Phishing Season: How Individuals and Businesses Can Protect Themselves

Phishing attacks during tax season have become more sophisticated, leveraging generative AI to impersonate trusted entities like the IRS.
Information security
fromTechzine Global
4 days ago

Major phishing campaign on GitHub using fake security alerts

A large-scale phishing campaign targets developers on GitHub, exploiting Discussions to spread fake security alerts about Visual Studio Code and distribute malware.
Information security
fromThe Hacker News
1 week ago

Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

A phishing campaign targets French-speaking corporations with fake resumes, deploying malware for credential theft and cryptocurrency mining.
Privacy professionals
fromSecurityWeek
1 week ago

Tycoon 2FA Fully Operational Despite Law Enforcement Takedown

Tycoon 2FA continues to operate despite international takedown efforts, facilitating phishing attacks and compromising accounts without alerts.
Information security
fromThe Hacker News
2 days ago

CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails

A phishing campaign impersonating CERT-UA distributed malware called AGEWHEEZE targeting various organizations in Ukraine.
Information security
fromThe Hacker News
2 days ago

Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures

A phishing campaign targets Spanish-speaking users in Latin America and Europe, delivering banking trojans via malware called Horabot.
Information security
fromSecuritymagazine
4 days ago

Tax Season Means Phishing Season: How Individuals and Businesses Can Protect Themselves

Phishing attacks during tax season have become more sophisticated, leveraging generative AI to impersonate trusted entities like the IRS.
Information security
fromTechzine Global
4 days ago

Major phishing campaign on GitHub using fake security alerts

A large-scale phishing campaign targets developers on GitHub, exploiting Discussions to spread fake security alerts about Visual Studio Code and distribute malware.
Information security
fromThe Hacker News
1 week ago

Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

A phishing campaign targets French-speaking corporations with fake resumes, deploying malware for credential theft and cryptocurrency mining.
Information security
fromFortune
1 day ago

I knew about North Korean hackers-they still tricked me and got into my computer | Fortune

North Korean hackers are increasingly targeting individuals in the crypto industry, employing sophisticated deception tactics.
Information security
fromThe Hacker News
1 day ago

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation exploits the React2Shell vulnerability to steal sensitive data from compromised hosts across multiple regions.
Privacy professionals
fromMedCity News
2 weeks ago

The Evolving Landscape of Privacy and Cybersecurity: Essential Strategies for Legal and Compliance Professionals - MedCity News

Organizations must combine strong controls with comprehensive employee training and accountability culture to effectively protect sensitive data and comply with evolving privacy laws.
Privacy technologies
fromZDNET
3 weeks ago

I switched password managers without losing a single login - here's how

Switching password managers involves exporting passwords to CSV and importing them into a new app, then reviewing settings before deleting the old manager.
Information security
fromSecurityWeek
3 days ago

Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks

Stolen credentials significantly enhance ransomware attacks, enabling illegitimate access and operational disruption within networks.
Information security
fromSecurityWeek
3 days ago

The Next Cybersecurity Crisis Isn't Breaches-It's Data You Can't Trust

Data integrity now encompasses data trust, emphasizing the importance of reliable data in AI-driven decision-making.
fromblog.logrocket.com
2 months ago

What are the key challenges in scaling MFA for large organizations? - LogRocket Blog

Most design specs break down in development because they're built for designers, not developers. This article shows how to write specs that reflect real-world logic, states, constraints, and platform behavior not just pixels. Rafael Basso Jan 20, 2026 11 min read A practical guide to AI in UX design, covering predictive UX, generative assistance, personalization, automation, and the risks of overusing AI. Shalitha Suranga Jan 14, 2026 11 min read
UX design
Information security
fromComputerWeekly.com
3 days ago

Banning routers won't fix what's already broken | Computer Weekly

The FCC's ban on foreign-made routers addresses future procurement, not current security risks, as routers are already vulnerable and widely deployed.
Information security
fromSecurityWeek
3 days ago

Exploitation of Critical Fortinet FortiClient EMS Flaw Begins

Threat actors exploit a critical SQL injection vulnerability in Fortinet FortiClient EMS, allowing remote code execution without authentication.
Information security
fromSecurityWeek
6 days ago

Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs

macOS users are targeted by a ClickFix campaign delivering a Python-based information stealer through a fake Cloudflare verification page.
Information security
fromTNW | Offers
1 week ago

Team password manager costs $1.50 & just added the features businesses actually need

Stolen credentials are a major security risk; using a password manager like Passpack can mitigate this threat effectively.
fromComputerworld
1 week ago

Chrome encryption bypass discovered: New malware steals passwords and cookies

The bypass requires neither privilege escalation nor code injection, making it a stealthier approach compared to alternative ABE bypass methods.
Information security
Information security
fromTechzine Global
2 weeks ago

Identity has become malleable for cyber attackers

Modern cyberattacks combine psychological manipulation, deepfakes, voice phishing, and stolen data to breach even well-defended organizations without exploiting software vulnerabilities.
Information security
fromZDNET
2 weeks ago

As AI agents spread, 1Password's new tool tackles a rising security threat

AI agents require credentials to access systems, creating enterprise security risks similar to managing human employee access, necessitating unified credential management solutions.
#credential-theft
fromSecurityWeek
2 weeks ago
Information security

Threat Actor Targeting VPN Users in New Credential Theft Campaign

Storm-2561 uses SEO poisoning and GitHub hosting to distribute trojans impersonating VPN software, stealing credentials through signed malware that evades detection.
Information security
fromTheregister
3 weeks ago

Credential-stealing crew spoofs Ivanti, Fortinet, Cisco VPNs

Storm-2561 cybercriminals distribute fake VPN clients through manipulated search results to steal user credentials via malicious MSI installers.
Information security
fromSecurityWeek
2 weeks ago

Threat Actor Targeting VPN Users in New Credential Theft Campaign

Storm-2561 uses SEO poisoning and GitHub hosting to distribute trojans impersonating VPN software, stealing credentials through signed malware that evades detection.
Information security
fromTheregister
3 weeks ago

Credential-stealing crew spoofs Ivanti, Fortinet, Cisco VPNs

Storm-2561 cybercriminals distribute fake VPN clients through manipulated search results to steal user credentials via malicious MSI installers.
Privacy technologies
fromWIRED
2 months ago

8 WhatsApp Features to Boost Your Security and Privacy

Enable Privacy Checkup, disappearing messages, two-step verification, encrypted backups, screen lock, and cautious contact discovery to reduce WhatsApp account hijack and personal data exposure.
Information security
fromThe Hacker News
4 weeks ago

Where Multi-Factor Authentication Stops and Credential Abuse Starts

Many Windows authentication paths bypass MFA protections, allowing attackers to compromise networks using valid credentials despite MFA deployment on cloud applications.
Information security
fromComputerworld
1 month ago

OAuth phishers make 'check where the link points' advice ineffective

Attackers use phishing emails with malicious OAuth links containing broken parameters to redirect users to attacker-controlled destinations through legitimate identity providers.
Information security
fromTheregister
1 month ago

Microsoft OAuth scams abuse redirects for malware delivery

Microsoft warns of ongoing OAuth abuse scams using phishing emails and URL redirects to deliver malware and compromise organizational devices, primarily targeting government and public-sector entities.
#password-security
fromFast Company
1 month ago
Information security

What if everything you think you know about passwords is wrong? Here's what really makes a strong password in 2026

fromFast Company
1 month ago
Information security

What if everything you think you know about passwords is wrong? Here's what really makes a strong password in 2026

fromWIRED
1 month ago

Password Managers Share a Hidden Weakness

An FBI informant helped run the Incognito dark web market and allegedly approved the sale of fentanyl-laced pills, including those from a dealer linked to a confirmed death, WIRED reported this week. Meanwhile, Jeffrey Epstein's ties to Customs and Border Protection officers sparked a Department of Justice probe. Documents say that CBP officers in the US Virgin Islands were still friendly with Epstein years after his 2008 conviction, illustrating the infamous sex offender's tactics for cultivating allies.
Information security
fromLogRocket Blog
1 month ago

How to design 2FA: Comparing methods, user flows, and recovery strategies - LogRocket Blog

2FA or two-factor authentication is a specific type of multi-factor authentication. As the name suggests, 2FA requires two distinct forms of user verification factors to access a specific protected, registered user-only software system. In the past, software teams used only a one-factor authentication strategy with users' passwords, but nowadays, with growing security concerns and user authentication evolution, every digital product uses 2FA with password-based authentication, starting from simple SMS OTPs (One Time Tokens) to futuristic AI-powered adaptive 2FA methods and high-security hardware keys.
Information security
Information security
fromFortune
2 months ago

You probably use the same password for 30 different websites. It's time for a passkey. | Fortune

Passkeys offer secure, user-friendly authentication but adoption lags due to low awareness, misconceptions, AI concerns, and implementation challenges; treat passkeys as UX initiatives.
fromComputerworld
1 month ago

11 steps to smarter Google account security

While you're thinking about third-party add-ons for your computer and phone, take a moment to review everything you have installed on both fronts and consider how many of those programs you actually still use. The fewer cracked windows you allow on your Google account, the better - and if you aren't even using something, there's no reason to keep it connected.
Information security
fromThe Hacker News
2 months ago

Password Reuse in Disguise: An Often-Missed Risky Workaround

Near-identical password reuse occurs when users make small, predictable changes to an existing password rather than creating a completely new one. While these changes satisfy formal password rules, they do little to reduce real-world exposure. Here are some classic examples: Adding or changing a number Summer2023! → Summer2024! Appending a character Swapping symbols or capitalization Welcome! → Welcome? AdminPass → adminpass Another common scenario occurs when organizations issue a standard starter password to new employees, and instead of replacing it entirely, users make incremental changes over time to remain compliant.
Information security
Information security
fromSecuritymagazine
2 months ago

What You Need to Know About the New LinkedIn Phishing Scheme

Attackers post LinkedIn-style comments claiming account restrictions to trick users into clicking lnkd.in links that lead to credential-harvesting pages.
Information security
fromSecurityWeek
1 month ago

Webinar Today: Identity Under Attack - Strengthen Your Identity Defenses

Adopt an identity-first security strategy to protect sensitive data, meet compliance requirements, and balance security, user experience, and operational efficiency against identity threats.
Information security
fromComputerworld
2 months ago

Enterprises still aren't getting IAM right

Employees frequently bypass identity and access controls while agentic AI worsens privilege risk, leaving most organizations with inadequate just-in-time privileged access models.
[ Load more ]