A critical Telegram Desktop account takeover vulnerability (CVE-2026-107181) exposes users to session hijacking. Exploit details and PoC are now public.
#Telegram #Cybersecurity #CVE2026107181 #AccountTakeover #PoC
#account-takeover — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #account-takeover, aggregated by home.social.
-
UK Police Urge Passkey Adoption Amid 425% Surge in Hacking Profits
Hackers are raking in a whopping 425% more profits, with cybercrime linked to email and social media hacking hitting £6.3m in 2025/6 - and experts warn it's time to ditch passwords for good and switch to passkeys to protect yourself. The UK's Report Fraud service is sounding the alarm and launching a public campaign to help you…
#PasskeyAdoption #AccountTakeover #Cybercrime #Uk #EmergingThreats
-
Microsoft confirmed unauthorized access to its official X account @microsoft on Thursday. The hijack was used to amplify a Clippy-branded crypto token to over 13 million followers. It shows how verified corporate accounts can be weaponized for large-scale scam distribution. #MicrosoftBreach #AccountTakeover #CryptoScam
https://cyberworldops.eu/en/microsoft-s-x-account-was-used-to-boost-a-clippy-branded-crypto-token
-
Sourcehut account takeover via build logs (XSS in ansi2html)
https://blog.arusekk.pl/posts/srht-account-takeover/
Comments: https://news.ycombinator.com/item?id=49835996
#HackerNews #Sourcehut #XSS #AccountTakeover #BuildLogs #CyberSecurity #Vulnerability
-
A serious authentication flaw in several WSO2 products is being used in real access attempts, according to watchTowr.
Fake access keys with administrator privileges were found in a test network on 13 September 2026.
A successful attack could allow account takeover and possible access to application secrets or internal services, but those outcomes have not been confirmed for the recorded attempts.
Affected product…
-
HBO Max's verified Reddit account (u/hbomax) was compromised and used to publish 108 ClickFix ads over 48 hours targeting Windows and macOS. The campaign confirms continued abuse of trusted platforms for manual-execution social engineering. #ClickFix #ThreatIntel #AccountTakeover
https://cyberworldops.eu/en/hijacked-hbo-max-reddit-account-pushed-108-clickfix-malware-ads
-
Microsoft is warning about a social-engineering campaign targeting corporate Microsoft 365 accounts.
Scammers pose as IT support, study the target company, then use calls or messages to direct employees to fake sign-in pages or obtain a code.
In cases reviewed by Microsoft, the attackers accessed company accounts, searched email, files and connected services, and downloaded large numbers of documents.…
#Microsoft365 #SocialEngineering #AccountTakeover #DataProtection
-
There is a spate of #AccountTakeover underway.
Service providers may receive reports for accounts that have a display name beginning with "Hacked -" or linking to "t[.]me/HomeFucker5"
These accounts may be longstanding valid accounts that have been hijacked.
While investigating, consider
1. deleting any offensive posts,
2. freezing the account until the rightful owner can reclaim it,
3. use of two-factor authentication for accounts shown to be at risk -
A Dropbox Lenovo ID SSO flaw let attackers take over accounts with just an email address, no password needed. Dropbox has revoked sessions and hardened login.
#Dropbox #Lenovo #SSO #AccountTakeover #Cybersecurity
https://securityonline.info/dropbox-lenovo-id-flaw/?utm_source=mastodon&utm_medium=jetpack_social
-
Attackers exploit CVE-2026-71362, an unauthenticated Adobe Commerce account takeover flaw (CVSS 9.1). Details and PoC are public. Patch now.
#AdobeCommerce #Magento #CVE202671362 #AccountTakeover #ecommerce #InfoSec
-
Keycloak Flaw Exposes Accounts to Unauthenticated Takeover
A critical flaw in Keycloak, rated 9.1 by Red Hat, allows hackers to hijack any account, including admin ones, by manipulating the password reset process. This vulnerability, CVE-2026-18963, lets attackers take control without even logging in.
#Cve202618963 #Keycloak #AccountTakeover #AuthenticationBypass #RedHat
-
CVE-2026-68067 (CVSS 9.8) lets attackers control user accounts on the Mira Hormone Monitor by bypassing the cloud login. Eight flaws total.
#MiraMonitor #CVE202668067 #MedicalDevice #AccountTakeover #CISA #IoTSecurity #Cybersecurity
-
AI Compresses Identity Attacks, Forces Device Trust Reassessment
Identity security is buckling under the strain of increasingly sophisticated threats, with stolen credentials remaining a top vulnerability - a whopping 44.7% of breaches involve compromised login details. AI is now compressing the time and effort attackers need to launch identity attacks, forcing a urgent reevaluation of device trust.
#IdentitySecurity #Ai #StolenCredentials #AccountTakeover #DeviceTrust
-
WSO2 patched four critical account takeover flaws, including CVE-2026-5430 at CVSS 10 via JWT auth bypass. Details and fixes inside.
-
Malware Exploits Google Passkey Ecosystem for Account Takeover
Malware is now exploiting Google's Passkey ecosystem to hijack accounts, with researchers uncovering three new attack classes that allow hackers to take control of passkey-protected accounts. This alarming vulnerability lets malware running on a victim's device authenticate without needing user interaction or elevated…
#GooglePasskey #AccountTakeover #MalwareOperations #MfaBypass #EmergingThreats
-
CVE-2026-18577 is being exploited in the wild for N-central account takeover. An incomplete patch let attackers gain admin access. Update to 2026.3.1.7.
#Nable #Ncentral #CVE202618577 #AccountTakeover #RMM #CyberSecurity
-
Illinois Hacker Sentenced for Exploiting Snapchat Accounts
A 26-year-old Illinois man, Kyle Svara, has been sentenced to 76 months in prison for hacking over 750 Snapchat accounts, using social engineering tactics to phish access codes and trading stolen images online. He'll also face three years of supervised release after serving his time.
#SocialEngineering #Snapchat #AccountTakeover #ImageTheft #EmergingThreats
-
Kimai vulnerability CVE-2026-52824 (CVSS 9.1) lets attackers forge cookies for account takeover via a default Docker APP_SECRET. Update to 2.58.0 now.
#Kimai #AccountTakeover #Docker #CVE202652824 #OpenSource
https://securityonline.info/kimai-account-takeover/?utm_source=mastodon&utm_medium=jetpack_social
-
A Zoom critical vulnerability (CVE-2026-53412, CVSS 9.8) lets attackers hijack accounts on Windows with no user interaction. Update your client now.
#Zoom #CVE202653412 #Vulnerability #CyberSecurity #Windows #AccountTakeover
https://securityexpress.info/cve-2026-53412-zoom/?utm_source=mastodon&utm_medium=jetpack_social
-
Zoom vulnerability CVE-2026-53412 (CVSS 9.8) allows unauthenticated account takeover over the network. Update Zoom Workplace for Windows to 7.0.0 now.
#Zoom #CVE202653412 #AccountTakeover #Windows #CyberSecurity
-
A vishing attack tricks Microsoft 365 users into passkey phishing, letting O-UNC-066 enroll its own passkey and hijack Entra accounts for extortion.
#Vishing #Passkey #Phishing #MicrosoftEntra #AccountTakeover
http://securityonline.info/entra-passkey-phishing/?utm_source=mastodon&utm_medium=jetpack_social
-
Waarschuwing voor "Browser in the Browser" aanvallen
Bij een BitB-aanval toont een nepwebsite een nep pop-up-venster dat eruit ziet als een (deels of geheel) nieuw browser-venster. Gesuggereerd wordt dat u uw inloggegevens moet invoeren op bijvoorbeeld:
https:⧸⧸accounts.google.com/signin/v3/
maar dat is allemaal fake: door u ingevoerde nloggegevens vallen zo in handen van de eigenaar van de onderliggende website, die daarmee als u kan inloggen en uw account kan kapen.
Onderin https://gist.github.com/BushidoUK/57c38d5ee75481fb237e968a537de778 ziet u een lijst van criminele domeinnamen waar deze techniek op werd of nog wordt toegepast.
De hieronder getoonde website is gehost bij Amazon (zie het RELATIONS tabblad van https://www.virustotal.com/gui/domain/marriott-hiring.com). Als u zou openen (dat raad ik af):
https:⧸⧸marriott-hiring․com
moet u eerst een vinkje zetten, zogenaand om te bevestigen dat u een mens bent. Daarna verschijnt het beeld dat linksonder te zien is.
De feitelijke BitB-aanval ziet u in het 2e plaatje (meer info onder ALT).
Nb. met een passkey is deze aanval niet mogelijk omdat de domeinnaam niet klopt. Zwakke 2FA (SMS, TOTP of Number Matching) voorkómt *niet* dat u slachtoffer wordt.
#AmazonIsEvil #BigTechIsEvil #LetsEncryptIsEvil #BitB #Phishing #NepWebSites #ATO #AccountTakeOver #AitM #MitM
-
A critical Poweradmin host header injection flaw (CVE-2026-54588) lets attackers hijack DNS admin accounts. Update to 4.2.4 or 4.3.3 now.
#Poweradmin #PowerDNS #CVE202654588 #AccountTakeover #CyberSecurity #DNS
-
The Silent Breach and the Persistence of Unauthorized Access
938 words, 5 minutes read time.
Once the session token is successfully exfiltrated, the nature of the intrusion shifts from external deception to internal subversion. The attacker does not need to crack passwords or trigger further security alerts, as they are now effectively operating with the digital identity of a trusted employee. Analyzing these incidents, I see that the primary goal is often the establishment of persistence within the target environment, which is achieved through the modification of inbox rules or the creation of clandestine mailbox delegates. By silently forwarding incoming emails to an external address or creating hidden folders for sensitive correspondence, the adversary can monitor ongoing business deals, intercept financial instructions, and identify high-value targets for subsequent business email compromise attacks. This stage of the operation is characterized by extreme patience, as the threat actor avoids loud, disruptive actions in favor of a low-and-slow approach that can remain undetected for months. The tragedy is that the victim often remains entirely unaware of the breach, believing they are still securely authenticated while their environment is being methodically picked apart from the inside.
Challenging the Failure of Traditional Defensive Postures
When considering why these attacks continue to succeed with such alarming frequency, it becomes evident that the industry’s reliance on legacy defensive postures is a failing strategy. Many organizations still treat email security as a static barrier, implementing blacklists and rudimentary heuristic scans that are easily circumvented by adversaries who control their own infrastructure and rotating IP addresses. Furthermore, the human-centric nature of these scams renders technical controls inherently insufficient unless they are paired with a cultural shift toward skeptical verification. It is not enough to deploy an automated solution if the culture within a firm encourages speed over accuracy and ignores the red flags of irregular communication patterns. Consequently, the defense against these campaigns must evolve into a proactive, threat-hunting discipline that monitors for anomalous login locations, unexpected session durations, and unauthorized changes to account configurations. Without this layer of vigilant oversight, the technical barriers essentially act as a screen door, providing the illusion of protection while failing to stop the actual threat.
Implementing Rigorous Verification Protocols in a High-Stakes Environment
The path forward requires a departure from the convenience-first mindset that dominates modern digital work environments. Organizations must adopt hardware-backed authentication methods, such as FIDO2-compliant security keys, which are resistant to the proxy-based interception tactics that currently plague mobile-based push notifications and SMS codes. Additionally, the adoption of strict device posture checks ensures that an attacker cannot simply use a stolen session token from an unauthorized machine or an unrecognized geographic region. Beyond the hardware, there must be a fundamental hardening of organizational processes, such as implementing mandatory out-of-band verification for any request involving financial transfers or the sharing of sensitive credentials. It is a harsh reality that trust is the primary vulnerability in any system, and the most secure posture is one that treats every incoming request as potentially malicious until proven otherwise through independent channels. While this might introduce friction into the workflow, that friction is the necessary price of security in an age where the cost of a single successful breach is often the survival of the entity itself.
Call to Action
The time for passive observation has passed, as the threats currently infiltrating our inboxes are not waiting for an invitation to compromise your organization. You must decide whether to continue relying on outdated defensive protocols that offer only the illusion of safety or to begin the hard work of hardening your infrastructure against the reality of modern adversarial tactics. I urge you to conduct an immediate audit of your current authentication stack and evaluate the necessity of migrating to hardware-backed security keys, as this is the single most effective step you can take to neutralize the threat of proxy-based session hijacking. Furthermore, initiate a comprehensive review of your internal communication policies to ensure that your team is empowered to question anomalies rather than blindly following the path of least resistance. Security is not a product you purchase, but a discipline you practice, and the responsibility to bridge the gap between your existing defenses and the current threat reality rests entirely with you. Do not wait for a compromised session to force your hand, because by the time the impact of a breach is visible, the damage is already absolute.
SUPPORTSUBSCRIBECONTACT MED. Bryan King
Sources
- CISA: Business Email Compromise (BEC) Resources
- FBI: Business Email Compromise Information
- FIDO Alliance: Defining Phishing-Resistant Authentication
- Microsoft: Analyzing Adversary-in-the-Middle (AiTM) Techniques
- NIST: Digital Identity Guidelines
- CrowdStrike: Phishing and Social Engineering Analysis
- Palo Alto Networks: Business Email Compromise Explained
- SANS Institute: Protecting Against Advanced Email Threats
- Cybereason: BEC Threat Landscape Report
- Check Point: The Evolution of Phishing
- Proofpoint: Understanding BEC Attacks
- Dark Reading: The Mechanics of Session Hijacking
- ZDNet: The New Era of Targeted Phishing
- Wired: Why Modern Phishing is Succeeding
- Trend Micro: BEC Comprehensive Guide
- Recorded Future: BEC Trend Analysis
- Infosecurity Magazine: FIDO2 and Phishing Resistance
- Varonis: Modern Phishing Techniques Deep Dive
- CSO Online: The Mechanics of BEC
- Fortinet: Cybersecurity Glossary on BEC
- SANS: Analyzing MFA Bypass Tactics
- BleepingComputer: Evolution of Phishing Kits
- Secureworks: BEC Defensive Strategies
- CISA: Mitigating Phishing Campaigns
- Mandiant: Evolving Tactics in BEC
- NIST: Phishing Training Resources
- TechTarget: BEC Definition and Prevention
- Elastic: Detecting Phishing Infrastructure
- Rapid7: The Threat of Session Token Theft
- Cloudflare: Understanding FIDO2 Protocol
Disclaimer:
The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.
Related Posts
Rate this:
#accountTakeover #adversaryInTheMiddle #AiTM #ATO #authenticationProtocols #BEC #businessEmailCompromise #corporatePhishing #corporateSecurity #credentialHarvesting #cyberResilience #cyberThreatIntelligence #cyberWarfare #cybersecurity #cybersecurityBestPractices #dataBreachPrevention #digitalFraud #digitalIdentity #emailScams #emailSecurity #emailThreats #enterpriseSecurity #FIDO2 #hardwareSecurity #identityTheftProtection #incidentResponse #informationSecurity #infosec #maliciousInfrastructure #MFABypass #multiFactorAuthentication #networkDefense #onlineSafety #passwordless #phishingAttacks #phishingAwareness #phishingKits #phishingResistantAuthentication #riskManagement #secureAuthentication #securityAudit #securityCulture #securityHardening #securityKeys #sessionTokenTheft #socialEngineering #threatDetection #threatLandscape #zeroTrust -
Meta's AI Chatbot Exposed to Account Takeover Vulnerability
A recent vulnerability in Meta's AI chatbot has raised red flags about the security of LLM chatbots, which can be exploited through various tactics that are difficult to block. This alarming weakness was demonstrated in a video showing an attacker taking over an Instagram account by simply interacting with Meta's AI support chatbot.
-
Signal Encounters Social Engineering Waves, Not Encryption Breaches
Signal users in Germany targeted by Russian hackers using social engineering to take over accounts. No encryption was broken. Learn how to protect yourself.
#SignalHack, #SocialEngineering, #CyberSecurity, #RussiaHacking, #AccountTakeover
https://newsletter.tf/signal-account-takeover-social-engineering-russia/
-
Around 300 Signal accounts were targeted by Russian hackers, a significant number aiming to bypass security.
#SignalHack, #SocialEngineering, #CyberSecurity, #RussiaHacking, #AccountTakeover
https://newsletter.tf/signal-account-takeover-social-engineering-russia/ -
LinkedIn Account Attack Alert Issued For 1.2 Billion Users https://www.forbes.com/sites/daveywinder/2026/04/04/linkedin-account-attack-alert-issued-for-12-billion-users/ #cybersecurity #LinkedIn #socialengineering #AccountTakeover #credentialstealing
-
One does not simply exfiltrate a reset token using an email array.
And yet, Frodo (Matei "Mal" Bădănoiu) and Samwise (Raul Bledea) from Pentest-Tools.com did exactly that in FuelCMS.
Know someone's email? That's enough. Slip your address alongside theirs in a “forgot password” request and the token lands in your inbox. Their account is yours. You shall not (safely) parse!🧙
Chain it with PTT-2025-026 and you're looking at a 9.8 Critical unauthenticated RCE. One array to rule them all! 💍
Full PoC here: https://pentest-tools.com/research
#offensivesecurity #vulnerabilityresearch #infosec #accounttakeover
-
How I Found a Critical IDOR Leading to Account Takeover in Two EdTech Platforms
The vulnerability was an Insecure Direct Object Reference (IDOR) in two EdTech platforms, allowing account takeover through user profile manipulation. The flaw resulted from improper input validation, leading to user profiles being accessible via URL parameters. By constructing carefully crafted URLs containing other users' IDs, the researcher accessed their profiles without proper authentication. The attack vector involved using Burp Suite's Intruder tool to automate IDOR requests, sending payloads with incremental user IDs. The mechanism revolved around the application trusting the provided IDs without verifying their ownership or performing proper authorization checks. This IDOR flaw enabled the researcher to impersonate other users, potentially causing serious account takeovers. The researcher did not disclose specific bounty amounts or program responses. Proper mitigation requires implementing strict input validation and enforcing proper access control checks. Key lesson: Always validate user inputs and enforce proper access control to prevent unauthorized data access. #BugBounty #Cybersecurity #WebSecurity #IDOR #AccountTakeover #InputValidation -
Operational Summary:
Jurisdiction: Poland / Germany
Target Platform: Facebook
Impact: 100,000+ credentials seized
Suspects Charged: 11
Alleged Crimes: 400+Tactics Observed:
• Fake news portal infrastructure
• Credential harvesting via spoofed login forms
• Account takeover operations
• Fraud leveraging payment systems (BLIK referenced)
• Money launderingStrategic lesson:
Phishing + credential reuse + weak authentication continues to scale across borders.Mitigation priorities:
• Phishing-resistant MFA
• FIDO2 / hardware keys
• Domain monitoring & takedown speed
• User education + anomaly detectionSource: https://the420.in/poland-cybercrime-bureau-facebook-phishing-100k-logins-germany-case/
Follow @technadu for threat intelligence updates.
Add your technical mitigation strategies below.
#Infosec #ThreatIntel #Phishing #AccountTakeover #FacebookSecurity #FraudPrevention #MFA #Cybercrime #SecurityOperations #EUCyber #TechNadu
-
“Starkiller” phishing service proxies real login pages and relays MFA in real time.
Targets include brands like Microsoft and Google.Result:
Passwords captured.
MFA intercepted.
Session cookies stolen.
Reported by Abnormal AI.Phishing is evolving into enterprise-grade tooling.
Source: https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/
Are passkeys the only sustainable defense?
Follow @technadu for independent cybersecurity reporting.Join the discussion below.
#CyberSecurity #Phishing #MFA #AccountTakeover #ZeroTrust #Infosec #DigitalIdentity #ThreatIntel
-
Germany’s advisory underscores a critical shift: identity and account compromise via trusted features.
Threat actors are leveraging:
• Device-linking QR workflows
• SMS verification interception
• Support impersonation tacticsThis is a reminder that encrypted transport ≠ secure endpoint usage.
Source: https://therecord.media/germany-warns-phishing-campaign-signal-gov-officials-journalists
💬 How are you mitigating messaging account takeover risks in high-risk user groups?
🔔 Follow @technadu for threat intelligence updates#Infosec #ThreatIntelligence #SocialEngineering #SignalSecurity #CyberEspionage #AccountTakeover #ZeroTrust #TechNadu
-
Germany’s BfV and BSI warn of Signal account hijacking via social engineering, not exploits.
Threat actors impersonate support services or abuse the linked-device feature to access chats and contacts of high-value targets. The campaign underscores how legitimate platform features can be weaponized in espionage operations.
💬 What mitigations actually work against messaging-based account takeover?
🔔 Follow @technadu for ongoing threat intelligence coverage
#InfoSec #SignalSecurity #AccountTakeover #SocialEngineering #CyberEspionage #ThreatActors #DigitalSecurity #TechNadu
-
Researchers have disclosed a coordinated campaign involving malicious Chrome extensions impersonating enterprise HR and ERP platforms, including Workday and NetSuite.
The extensions demonstrated capabilities such as:
- Continuous cookie exfiltration
- Blocking of security administration pages via DOM manipulation
- Session hijacking through injected authentication statesThe activity highlights persistent risks within browser extension ecosystems, especially when tools present themselves as productivity enhancers.
What detection or control mechanisms do you rely on for extension risk management?
Source: https://thehackernews.com/2026/01/five-malicious-chrome-extensions.html
Engage in the discussion and follow @technadu for vendor-neutral cybersecurity reporting.
#InfoSec #ThreatResearch #BrowserExtensions #SaaSSecurity #AccountTakeover #TechNadu
-
Recent activity involving unsolicited Instagram password reset notifications highlights how account takeover attempts often exploit user behavior rather than technical weaknesses.
Even amid reports of exposed account datasets, basic safeguards - such as monitoring recovery options and login alerts - remain effective risk-reduction measures.
What controls do you recommend users prioritize on consumer platforms?
Join the discussion and follow @technadu for objective infosec reporting.
#InfoSec #AccountTakeover #PasswordSecurity #SocialMediaRisk #CyberHygiene #TechNadu
-
#FBI: Kontoübernahme-Betrug mit mehr als 262 Millionen US-Dollar Schaden | Security https://www.heise.de/news/FBI-warnt-vor-Kontouebernahme-Betrug-mit-mehr-als-262-Millionen-US-Dollar-Schaden-11093745.html #CyberCrime #AccountTakeover
-
Account Takeover Fraud Caused $262 Million in Losses in 2025: FBI https://www.securityweek.com/account-takeover-fraud-caused-262-million-in-losses-in-2025-fbi/ #Fraud&IdentityTheft #accounttakeover #Cybercrime #cybercrime #Report #fraud #FBI
-
Account Takeover Scams Surge as FBI Reports Over $262 Million in Losses https://thecyberexpress.com/account-takeover-fraud-sees-sharp-spike/ #InternetCrimeComplaintCenter(IC3) #phishingdomainsandwebsites #AccountTakeover(ATO)fraud #MultifactorAuthentication #TheCyberExpressNews #socialengineering #phishingwebsites #AccountTakeover #BlackFridaySale #TheCyberExpress #FirewallDaily #SEOpoisoning #Governance #CyberNews #ATOFraud #FBI
-
Account Takeover: What Is It and How to Fight It https://hackread.com/account-takeover-what-is-it-how-to-fight-it/ #AccountTakeover #Cybersecurity #Security #ATO
-
Vulnerability Exposed All Open VSX Repositories to Takeover https://www.securityweek.com/vulnerability-exposed-all-open-vsx-repositories-to-takeover/ #Vulnerabilities #accounttakeover #vulnerability #opensource #OpenVSX
-
Vulnerability Exposed All Open VSX Repositories to Takeover https://www.securityweek.com/vulnerability-exposed-all-open-vsx-repositories-to-takeover/ #Vulnerabilities #accounttakeover #vulnerability #opensource #OpenVSX