September 11, 2024 at 01:37PM Starting October 1st, WordPress.org requires two-factor authentication for accounts that can push updates to plugins and themes. This decision aims to reduce the risk of unauthorized access and supply-chain attacks. The 2FA security feature needs to be activated, and SVN-specific passwords have been added for making code changes. Technical limitations … Read more
March 25, 2024 at 01:02PM Cybercriminals are increasingly using the ‘Tycoon 2FA’ PhaaS platform to target Microsoft 365 and Gmail accounts, bypassing two-factor authentication. Sekoia’s report details the multi-step attacks and the evolution of the kit, including enhancements to JavaScript and HTML code, with substantial operations involving over 1,800 transactions and numerous cybercriminals utilizing the … Read more
January 15, 2024 at 07:07AM A vulnerability in GitLab’s email verification process (CVE-2023-7028, CVSS score 10) allows attackers to hijack the password reset process by sending reset messages to unverified email addresses. This affects GitLab CE/EE versions 16.1 to 16.7.1, with patches released in versions 16.5.6, 16.6.4, and 16.7.2. Users are advised to update instances … Read more
January 11, 2024 at 12:35PM Mandiant’s investigation of the takeover of its X account revealed a successful brute-force attack due to a change in two-factor authentication policy. The use of SMS-based 2FA was removed, leaving accounts vulnerable. The compromise led to a scam pushing CLICKSINK drainer-as-a-service, highlighting the rise of such attacks targeting valuable cryptocurrency … Read more