How a Tiny USB Stick Became My Most Powerful Security Upgrade - Once I Figured Out What It Actually Does

Security keys based on FIDO2/WebAuthn provide a passwordless authentication method, enhancing security against phishing and credential…

DeviceCodePhishing exploits OAuth Device Code Flow to bypass MFA and FIDO protections, redirecting victims to real sites with no phishing signs.

This post is produced in collaboration with Resonance Security — cybersecurity for all.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Cybercriminals from PoisonSeed are bypassing FIDO2 protection by tricking users into approving cross-device login requests via legitimate QR codes, exploiting a convenient feature.

Social engineering offensives are undergoing a sophisticated metamorphosis—adversaries now amalgamate telephonic directives with dynamic phishing kits that facilitate

Microsoft warns of a massive AiTM phishing campaign targeting 13,000+ orgs. Using fake disciplinary lures, attackers bypass MFA to hijack active sessions.

A user may enter the correct password, complete MFA verification, and still lose their Microsoft 365 account. The phishing platform BigBear 2.0 intercepts the authenticated session after the secon…