Authentication

Microsoft 365 users fall victim to one-in-a-million password spray attack

The attack exploited previously exposed credentials and flaws in enterprises’ multi-factor authentication configurations.

Security experts caution MFA alone can no longer stop threat actors

Current campaigns are allowing even novice attackers to scoop up authentication tokens with increasing frequency, bypassing what used to be considered foolproof protection.

Human-centric failures: Why BEC continues to work despite MFA

Hackers don't need to break your MFA if they can just trick your team into sending money, which is why your "unauthorized action" risk is a process design flaw.

Stopping AiTM attacks: The defenses that actually work after authentication succeeds

AiTM attacks don't steal passwords; they copy the result of a real login. You need to watch what happens after the user logs in to catch a hijacked session.

Are fingerprint IDs really secure?

Offer customers passkeys by default, UK’s NCSC tells enterprises

Developers of enterprise apps and websites will need to get to grips with passkeys: The UK's National Cyber Security Center the agency recommends them for their resistance to phishing and credential reuse, and warns that passwords are inherently vulnerable.

Critical nginx UI tool vulnerability opens web servers to full compromise

The MCP endpoint authentication weakness has been under active exploitation since March.