Identity Security

Binance Is Reopening After a $6.3B Theft. Recovery Is Not Remediation

Binance has resumed withdrawals, replaced 95% of affected assets, and received an FBI attribution. None of that yet explains or closes the original breach path.

MFA Fatigue: How Push Bombing Works and How to Stop It

Learn how MFA push bombing turns a stolen password into account access, what the warning signs look like, and which controls actually stop it.

Session Cookie Theft: How Attackers Bypass MFA

A stolen session can bypass the login screen entirely. Learn how cookie theft works, how to detect replay, and how to contain it correctly.

187 Laptops in Texas: How North Korean IT Workers Borrowed a Local Presence

Operation Lonestar Roundup exposes the gap between a local company laptop and the person operating it. Follow the access chain, its evidence limits, and the checks employers need.

ShinyHunters Claims an FBI Breach: What the Jobs-Site Evidence Actually Shows

The FBI now describes a cyber incident involving FBIJobs.gov. New reporting strengthens the evidence of personnel data theft, while the full scope and entry path remain unresolved.

Map Your Login Chain Before Attackers Do: A Practical Guide to Finding Workflow Gaps

A login screen is only one step in an identity workflow. Map every entry, recovery, session, and high-risk action path, then test where the server actually enforces the rules.

Passkey Lures, Stolen Sessions, and the Microsoft 365 Data Trail

Microsoft describes intrusions that start with fake passkey support calls and continue through new MFA methods, Graph reconnaissance, and cloud data access.

Week 37 Security Priorities: Revoke Trust Before You Chase Malware

Berlin's published data, exploited SonicWall gateways, a Chrome zero-day, AI-accelerated intrusion, payment-system abuse, and PostGREShell all point to the same task: identify and revoke inherited trust.

BREEZE COMET Did Not Steal Card Numbers. It Manipulated the Payment System

Google and Mandiant say BREEZE COMET compromises the identities, certificates, applications, and networks authorized to move money through Brazil's payment systems.

AI Compressed an Enterprise Intrusion Into Ten Hours. Speed Was the Weapon

Unit 42 reports that a human attacker used AI agents to move from an exposed API to cloud, identity, source code, secrets, and CI/CD control in under ten hours. The evidence shows acceleration, not a magical new exploit.

Rhysida Published Berlin's Stolen Data. The Incident Is Only Starting

Berlin's stolen government data has been released after an extortion deadline expired. The next phase is credential rotation, exposure analysis, victim notification, and long-term fraud monitoring.

153M Driver's License Scans for Sale: ID Verification Became the Breach Surface

KrebsOnSecurity reports that the FBI is investigating a dark web service selling more than 153 million driver's license scans. The lesson is not just identity theft. It is vendor concentration around identity proofing.

KerberLoss and ResetNightmare: Kerberos Can Fail Without Stealing a Ticket

Two Active Directory logic flaws presented at Black Hat show how SPN handling and password reset behavior can enable downgrade, disruption, and domain takeover.

WhatsApp Usernames: A Privacy Win That Opens a New Impersonation Surface

WhatsApp usernames reduce phone-number exposure, but they also create a new global namespace where brands, public bodies, and lookalike handles can become fraud infrastructure.

LSHIY Password Spray: ROPC and MFA Gaps in Microsoft 365

A June 2026 password spray from LSHIY LLC's IPv6 range compromised 78 Microsoft accounts across 64 organizations by abusing Azure CLI ROPC sign-ins that MFA policies did not cover.

SaaS Hacking: The New Internal Network Attackers Already Use

Attackers no longer need malware on every endpoint. With one valid identity, token, or integration, they can move through Microsoft 365, Google Workspace, Salesforce, Slack, GitHub, and other SaaS platforms like an internal network.

OAuth Consent Phishing in 2026: MFA Stops Password Theft, Not Bad App Grants

Attackers do not always need your password. A single OAuth consent grant can give a malicious or compromised app durable access to mail, files, calendars, and SaaS data.

AitM Phishing: How Attackers Bypass MFA and How to Stop Them

Adversary-in-the-Middle phishing silently proxies real login pages and steals session tokens — making MFA useless. Here's how it works and how to detect it.

AWS IAM Privilege Escalation to Data Exfil: The Full Attack Chain

How attackers escalate from a low-privilege AWS IAM credential to full S3 data theft — and the CloudTrail events, GuardDuty findings, and Sigma rules that expose them.

Non-Human Identities: The Attack Surface Your Security Team Isn't Managing

Service accounts, API keys, OAuth tokens and machine credentials now outnumber human identities 144 to 1. Most organizations have zero visibility into them. Attackers do.

Passkeys and FIDO2: The End of Passwords — and What Attackers Do Next

How passkeys and FIDO2 work, why they defeat phishing and credential stuffing, and how attackers are already adapting with downgrade attacks and fallback abuse.