@socket.dev
Fake PDF verifier steals Google session cookies and can reset passwords.
-
IOCs: pdf[.]gusercontent[.]com, pdf[.]gusercontent[.]com/api/accounts/collect/, pdf-para-texto@extensao[.]local
-
#AccountTakeover #Malware #ThreatIntel
Fake PDF verifier steals Google session cookies and can reset passwords.
-
IOCs: pdf[.]gusercontent[.]com, pdf[.]gusercontent[.]com/api/accounts/collect/, pdf-para-texto@extensao[.]local
-
#AccountTakeover #Malware #ThreatIntel
Malicious Firefox Extension Hijacks Google Accounts
socket.dev
September 24, 2026 at 4:04 AM
@socket.dev
Fake PDF verifier steals Google session cookies and can reset passwords.
-
IOCs: pdf[.]gusercontent[.]com, pdf[.]gusercontent[.]com/api/accounts/collect/, pdf-para-texto@extensao[.]local
-
#AccountTakeover #Malware #ThreatIntel
Fake PDF verifier steals Google session cookies and can reset passwords.
-
IOCs: pdf[.]gusercontent[.]com, pdf[.]gusercontent[.]com/api/accounts/collect/, pdf-para-texto@extensao[.]local
-
#AccountTakeover #Malware #ThreatIntel
May 27, 2026 at 2:07 AM
Edgewear techdom findom nsfwtwt femdom kidsloxs pctakeover accounttakeover tech sub parentalcontrols Finsub 2dfd aifd succubus hentai lose NNN nonutnovember loctober denial chastity porn
November 9, 2024 at 5:09 AM
Edgewear techdom findom nsfwtwt femdom kidsloxs pctakeover accounttakeover tech sub parentalcontrols Finsub 2dfd aifd succubus hentai lose NNN nonutnovember loctober denial chastity porn
⚠️ #sw_isac_advisory
There is a spate of #accounttakeover underway.
Service providers may receive reports for accounts that have a display name beginning with "Hacked -" or linking to "t[.]me/HomeFucker5"
These accounts may be longstanding valid […]
[Original post on mastodon.iftas.org]
There is a spate of #accounttakeover underway.
Service providers may receive reports for accounts that have a display name beginning with "Hacked -" or linking to "t[.]me/HomeFucker5"
These accounts may be longstanding valid […]
[Original post on mastodon.iftas.org]
September 7, 2026 at 2:51 AM
⚠️ #sw_isac_advisory
There is a spate of #accounttakeover underway.
Service providers may receive reports for accounts that have a display name beginning with "Hacked -" or linking to "t[.]me/HomeFucker5"
These accounts may be longstanding valid […]
[Original post on mastodon.iftas.org]
There is a spate of #accounttakeover underway.
Service providers may receive reports for accounts that have a display name beginning with "Hacked -" or linking to "t[.]me/HomeFucker5"
These accounts may be longstanding valid […]
[Original post on mastodon.iftas.org]
📰 EvilTokens PhaaS Dibekuk Setelah Membobol 12.000 Akun Microsoft
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/eviltokens-phaas-bobol-12000-akun-microsoft/
#accountTakeover #ai #bec #businessEmailCompromise #cloudSecurity #credentialTheft #cybercrime #cybersecurity #devic
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/eviltokens-phaas-bobol-12000-akun-microsoft/
#accountTakeover #ai #bec #businessEmailCompromise #cloudSecurity #credentialTheft #cybercrime #cybersecurity #devic
September 23, 2026 at 5:40 AM
📰 EvilTokens PhaaS Dibekuk Setelah Membobol 12.000 Akun Microsoft
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/eviltokens-phaas-bobol-12000-akun-microsoft/
#accountTakeover #ai #bec #businessEmailCompromise #cloudSecurity #credentialTheft #cybercrime #cybersecurity #devic
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/eviltokens-phaas-bobol-12000-akun-microsoft/
#accountTakeover #ai #bec #businessEmailCompromise #cloudSecurity #credentialTheft #cybercrime #cybersecurity #devic
📰 TrustSink: Penyedia MFA Eksternal Nakal Bisa Mencuri Password Saat Login Microsoft Entra
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/trustsink-microsoft-entra-rogue-mfa-provider-curi-password/
#accountTakeover #authentication #authenticationPolicyAdministrator #cloudSe
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/trustsink-microsoft-entra-rogue-mfa-provider-curi-password/
#accountTakeover #authentication #authenticationPolicyAdministrator #cloudSe
September 23, 2026 at 5:57 AM
📰 TrustSink: Penyedia MFA Eksternal Nakal Bisa Mencuri Password Saat Login Microsoft Entra
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/trustsink-microsoft-entra-rogue-mfa-provider-curi-password/
#accountTakeover #authentication #authenticationPolicyAdministrator #cloudSe
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/23/trustsink-microsoft-entra-rogue-mfa-provider-curi-password/
#accountTakeover #authentication #authenticationPolicyAdministrator #cloudSe
⚡ CVE-2025-9803 — Lunary AI
Flawed Google OAuth validation lets attackers hijack accounts using tokens from rogue apps. Update to 1.9.35!
🔗 basefortify.eu/cve_reports/...
#CVE #Lunary #OAuth #AccountTakeover #Infosec
Flawed Google OAuth validation lets attackers hijack accounts using tokens from rogue apps. Update to 1.9.35!
🔗 basefortify.eu/cve_reports/...
#CVE #Lunary #OAuth #AccountTakeover #Infosec
November 25, 2025 at 8:53 AM
⚡ CVE-2025-9803 — Lunary AI
Flawed Google OAuth validation lets attackers hijack accounts using tokens from rogue apps. Update to 1.9.35!
🔗 basefortify.eu/cve_reports/...
#CVE #Lunary #OAuth #AccountTakeover #Infosec
Flawed Google OAuth validation lets attackers hijack accounts using tokens from rogue apps. Update to 1.9.35!
🔗 basefortify.eu/cve_reports/...
#CVE #Lunary #OAuth #AccountTakeover #Infosec
LinkedIn Account Attack Alert Issued For 1.2 Billion Users www.forbes.com/sites... #cybersecurity #LinkedIn #socialengineering #AccountTakeover #credentialstealing
April 6, 2026 at 1:35 PM
LinkedIn Account Attack Alert Issued For 1.2 Billion Users www.forbes.com/sites... #cybersecurity #LinkedIn #socialengineering #AccountTakeover #credentialstealing
From Exploit to Payday-Chaining Stored XSS in PDF Upload to Full AccountTakeover via Email change…
https://medium.com/@meljith6355484/from-exploit-to-payday-chaining-stored-xss-in-pdf-upload-to-full-accounttakeover-via-email-change-d36e855e0575?source=rss------bug_bounty-5
https://medium.com/@meljith6355484/from-exploit-to-payday-chaining-stored-xss-in-pdf-upload-to-full-accounttakeover-via-email-change-d36e855e0575?source=rss------bug_bounty-5
January 9, 2025 at 10:08 AM
From Exploit to Payday-Chaining Stored XSS in PDF Upload to Full AccountTakeover via Email change…
https://medium.com/@meljith6355484/from-exploit-to-payday-chaining-stored-xss-in-pdf-upload-to-full-accounttakeover-via-email-change-d36e855e0575?source=rss------bug_bounty-5
https://medium.com/@meljith6355484/from-exploit-to-payday-chaining-stored-xss-in-pdf-upload-to-full-accounttakeover-via-email-change-d36e855e0575?source=rss------bug_bounty-5
New research from Proofpoint ‼️
Threat actors are using #phishing tactics to trick users into giving access to #M365 accounts.
⚠️ Successful compromise leads to #accounttakeover, #dataexfiltration, and more.
Blog: brnw.ch/21wYtcM
Here’s what you need to know. 🧵⤵️
Threat actors are using #phishing tactics to trick users into giving access to #M365 accounts.
⚠️ Successful compromise leads to #accounttakeover, #dataexfiltration, and more.
Blog: brnw.ch/21wYtcM
Here’s what you need to know. 🧵⤵️
December 18, 2025 at 4:56 PM
New research from Proofpoint ‼️
Threat actors are using #phishing tactics to trick users into giving access to #M365 accounts.
⚠️ Successful compromise leads to #accounttakeover, #dataexfiltration, and more.
Blog: brnw.ch/21wYtcM
Here’s what you need to know. 🧵⤵️
Threat actors are using #phishing tactics to trick users into giving access to #M365 accounts.
⚠️ Successful compromise leads to #accounttakeover, #dataexfiltration, and more.
Blog: brnw.ch/21wYtcM
Here’s what you need to know. 🧵⤵️
Meta’s BO Reset Instagram Passwords for Mashers Who Just Asked #Potatosecurity #AccountTakeover #SocialEngineering
June 2, 2026 at 9:45 PM
Meta’s BO Reset Instagram Passwords for Mashers Who Just Asked #Potatosecurity #AccountTakeover #SocialEngineering
👀Seeing weird logins lately?
That’s where attackers hide.
CyberLens Newsletter guide: Build an AI Mini Threat Hunter to detect dangerous login behavior early 🔍🤖
#CyberSecurity #ZeroTrust #AccountTakeover #ThreatHunt
thecyberlens.com/p/build-a-mi...
That’s where attackers hide.
CyberLens Newsletter guide: Build an AI Mini Threat Hunter to detect dangerous login behavior early 🔍🤖
#CyberSecurity #ZeroTrust #AccountTakeover #ThreatHunt
thecyberlens.com/p/build-a-mi...
Build a Mini Threat Hunter — Using AI to Detect Anomalous Login Behavior
An actionable walk-through for cybersecurity practitioners and enthusiasts
thecyberlens.com
November 8, 2025 at 3:27 AM
👀Seeing weird logins lately?
That’s where attackers hide.
CyberLens Newsletter guide: Build an AI Mini Threat Hunter to detect dangerous login behavior early 🔍🤖
#CyberSecurity #ZeroTrust #AccountTakeover #ThreatHunt
thecyberlens.com/p/build-a-mi...
That’s where attackers hide.
CyberLens Newsletter guide: Build an AI Mini Threat Hunter to detect dangerous login behavior early 🔍🤖
#CyberSecurity #ZeroTrust #AccountTakeover #ThreatHunt
thecyberlens.com/p/build-a-mi...
Threat researchers at Proofpoint are tracking two ongoing, highly targeted campaigns combining OAuth redirection mechanisms with brand impersonation techniques, malware proliferation, and #Microsoft365 themed #credentialphishing for #AccountTakeover. #ATO
March 12, 2025 at 5:25 PM
Threat researchers at Proofpoint are tracking two ongoing, highly targeted campaigns combining OAuth redirection mechanisms with brand impersonation techniques, malware proliferation, and #Microsoft365 themed #credentialphishing for #AccountTakeover. #ATO
GhostPairing campaign hijacks WhatsApp accounts by abusing the legitimate device-linking feature. Victims are tricked into pairing an attacker’s browser—no password or MFA bypass required—granting full access to chats and media.
#WhatsApp #CyberSecurity #AccountTakeover #Phishing
#WhatsApp #CyberSecurity #AccountTakeover #Phishing
December 19, 2025 at 12:39 PM
GhostPairing campaign hijacks WhatsApp accounts by abusing the legitimate device-linking feature. Victims are tricked into pairing an attacker’s browser—no password or MFA bypass required—granting full access to chats and media.
#WhatsApp #CyberSecurity #AccountTakeover #Phishing
#WhatsApp #CyberSecurity #AccountTakeover #Phishing
~Cofense~
Live phishing campaign abuses Google Forms & vercel.app to steal Meta credentials and 2FA tokens in real time.
-
IOCs: verifybadge-trustix[. ]vercel[. ]app, 64. 29. 17. 3, 216. 198. 79. 3
-
#AccountTakeover #Meta #Phishing #ThreatIntel
Live phishing campaign abuses Google Forms & vercel.app to steal Meta credentials and 2FA tokens in real time.
-
IOCs: verifybadge-trustix[. ]vercel[. ]app, 64. 29. 17. 3, 216. 198. 79. 3
-
#AccountTakeover #Meta #Phishing #ThreatIntel
Meta 2FA Phishing: Real-Time Account Takeover
cofense.com
May 2, 2026 at 1:35 AM
~Cofense~
Live phishing campaign abuses Google Forms & vercel.app to steal Meta credentials and 2FA tokens in real time.
-
IOCs: verifybadge-trustix[. ]vercel[. ]app, 64. 29. 17. 3, 216. 198. 79. 3
-
#AccountTakeover #Meta #Phishing #ThreatIntel
Live phishing campaign abuses Google Forms & vercel.app to steal Meta credentials and 2FA tokens in real time.
-
IOCs: verifybadge-trustix[. ]vercel[. ]app, 64. 29. 17. 3, 216. 198. 79. 3
-
#AccountTakeover #Meta #Phishing #ThreatIntel
Kimai vulnerability CVE-2026-52824 (CVSS 9.1) lets attackers forge cookies for account takeover via a default Docker APP_SECRET. Update to 2.58.0 now.
#Kimai #AccountTakeover #Docker #CVE202652824 #OpenSource
#Kimai #AccountTakeover #Docker #CVE202652824 #OpenSource
CVE-2026-52824: Default Docker Secret in Kimai Enables Account Takeover of Super Admin Accounts
TL;DR A critical Kimai vulnerability, CVE-2026-52824 (CVSS 9.1), affects the open-source time-tracking app's official Docker image. The image shipped with a publicly known default APP_SECRET, letting an unauthenticated attacker forge signed cookies and hijack accounts. Version 2.58.0 fixes the flaw. A proof-of-concept was created but withheld for security reasons, and no in-the-wild exploitation has been confirmed. Why It Matters Kimai serves freelancers and companies with hundreds of users.
securityonline.info
July 20, 2026 at 1:02 AM
Kimai vulnerability CVE-2026-52824 (CVSS 9.1) lets attackers forge cookies for account takeover via a default Docker APP_SECRET. Update to 2.58.0 now.
#Kimai #AccountTakeover #Docker #CVE202652824 #OpenSource
#Kimai #AccountTakeover #Docker #CVE202652824 #OpenSource
CVE-2026-18577 is being exploited in the wild for N-central account takeover. An incomplete patch let attackers gain admin access. Update to 2026.3.1.7.
#Nable #Ncentral #CVE202618577 #AccountTakeover #RMM #CyberSecurity
#Nable #Ncentral #CVE202618577 #AccountTakeover #RMM #CyberSecurity
CVE-2026-18577: N-central Account Takeover Exploited in the Wild
TL;DR: Attackers are actively exploiting a N-central account takeover flaw tracked as CVE-2026-18577. N-able says an incomplete patch for an earlier bug left the door open. A hotfix for version 2026.3.1.7 closes the gap. Why it matters N-central is a remote monitoring and management platform used by managed service providers. A N-central account takeover on this platform can cascade into every customer environment it oversees.
securityonline.info
August 3, 2026 at 4:25 PM
CVE-2026-18577 is being exploited in the wild for N-central account takeover. An incomplete patch let attackers gain admin access. Update to 2026.3.1.7.
#Nable #Ncentral #CVE202618577 #AccountTakeover #RMM #CyberSecurity
#Nable #Ncentral #CVE202618577 #AccountTakeover #RMM #CyberSecurity
Fake admin-level access keys were found in a watchTowr test network, linked to real access attempts against WSO2 products.
Fixes are availa…
https://en.hacks.gr/apopeires-epithesis-sta-proionta-tis-wso2-mporei-na-dosoyn-prosvasi-se-logariasmoys-diacheiriston/
#WSO2 #AccountTakeover #AccessControl
Fixes are availa…
https://en.hacks.gr/apopeires-epithesis-sta-proionta-tis-wso2-mporei-na-dosoyn-prosvasi-se-logariasmoys-diacheiriston/
#WSO2 #AccountTakeover #AccessControl
September 17, 2026 at 10:25 AM
Fake admin-level access keys were found in a watchTowr test network, linked to real access attempts against WSO2 products.
Fixes are availa…
https://en.hacks.gr/apopeires-epithesis-sta-proionta-tis-wso2-mporei-na-dosoyn-prosvasi-se-logariasmoys-diacheiriston/
#WSO2 #AccountTakeover #AccessControl
Fixes are availa…
https://en.hacks.gr/apopeires-epithesis-sta-proionta-tis-wso2-mporei-na-dosoyn-prosvasi-se-logariasmoys-diacheiriston/
#WSO2 #AccountTakeover #AccessControl
Microsoft warns that scammers are impersonating corporate IT support to access Microsoft 365 accounts.
Fake sign-in pages and…
https://en.hacks.gr/kliseis-kai-minymata-paristanoyn-ti-microsoft-gia-na-apoktisoyn-prosvasi-se-etairikoys-logariasmoys/
#Microsoft365 #SocialEngineering #AccountTakeover
Fake sign-in pages and…
https://en.hacks.gr/kliseis-kai-minymata-paristanoyn-ti-microsoft-gia-na-apoktisoyn-prosvasi-se-etairikoys-logariasmoys/
#Microsoft365 #SocialEngineering #AccountTakeover
September 12, 2026 at 7:52 AM
Microsoft warns that scammers are impersonating corporate IT support to access Microsoft 365 accounts.
Fake sign-in pages and…
https://en.hacks.gr/kliseis-kai-minymata-paristanoyn-ti-microsoft-gia-na-apoktisoyn-prosvasi-se-etairikoys-logariasmoys/
#Microsoft365 #SocialEngineering #AccountTakeover
Fake sign-in pages and…
https://en.hacks.gr/kliseis-kai-minymata-paristanoyn-ti-microsoft-gia-na-apoktisoyn-prosvasi-se-etairikoys-logariasmoys/
#Microsoft365 #SocialEngineering #AccountTakeover
~5,000 #Dropbox accounts were breached after attackers exploited a flaw in #Lenovo's email verification to register fake IDs—no password needed. A stark reminder: trust in third-party auth can be a weakest link. #CyberSecurity #DataBreach #AccountTakeover snip.ly/dla9pc
September 2, 2026 at 5:15 PM
~5,000 #Dropbox accounts were breached after attackers exploited a flaw in #Lenovo's email verification to register fake IDs—no password needed. A stark reminder: trust in third-party auth can be a weakest link. #CyberSecurity #DataBreach #AccountTakeover snip.ly/dla9pc
📣 New Podcast! "WordPress Security Alert: MiniOrange SAML SSO Vulnerabilities Enable Admin Account Takeover" on @Spreaker #accounttakeover #authenticationbypass #cve202615981 #cve202661979 #cybersecurity #cybersecuritynews #infosec #miniorange #osint #osintinvestigation #pluginvulnerability
WordPress Security Alert: MiniOrange SAML SSO Vulnerabilities Enable Admin Account Takeover
https://www.osintinvestigate.com
WordPress website owners are facing a new security threat involving the MiniOrange SAML 2.0 Single Sign-On plugin. Two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981, are being actively exploited in opportunistic attacks against websites running vulnerable versions of the plugin.
www.spreaker.com
September 2, 2026 at 3:00 PM
📣 New Podcast! "WordPress Security Alert: MiniOrange SAML SSO Vulnerabilities Enable Admin Account Takeover" on @Spreaker #accounttakeover #authenticationbypass #cve202615981 #cve202661979 #cybersecurity #cybersecuritynews #infosec #miniorange #osint #osintinvestigation #pluginvulnerability