Explore strategies and tools to defend against credential theft attacks, including password spraying, keylogging, and credential stuffing. This tag covers best practices for safeguarding login credentials, implementing multi-factor authentication, and detecting compromised accounts before attackers exploit them.
posts
In March 2024, a finance employee at a multinational firm in Hong Kong wired $25.6 million to threat actors after a deepfake video call convinced him his CFO had authorized the transfer. One employee. One convincing lure. Twenty-five million dollars gone. That's not a hypothetical — it'
In January 2024, a finance employee at engineering firm Arup wired $25 million to threat actors after joining a video call with what appeared to be the company's CFO and several colleagues. Every person on that call was a deepfake. The attack started the same way almost all
In January 2024, Fulton County, Georgia — home to Atlanta — was crippled by a ransomware attack that knocked court systems offline, disrupted tax processing, and left residents unable to access basic government services for weeks. It wasn't an isolated event. The FBI's Internet Crime Complaint Center (IC3)
A Single Misconfigured S3 Bucket Exposed 3 Billion Records In early 2023, independent security researchers discovered yet another wave of publicly exposed Amazon S3 buckets leaking sensitive customer data — healthcare records, financial documents, personally identifiable information. None of these organizations were hacked in the traditional sense. They simply got their
In March 2022, the Lapsus$ group breached Okta by compromising a third-party support engineer's laptop — and suddenly, thousands of organizations realized their web security posture was only as strong as their weakest vendor's. That single incident forced a reckoning across the industry. If your organization runs
A Single Click Cost One County $1.3 Million In March 2022, Bernalillo County, New Mexico was still recovering from a ransomware attack that started with what investigators believe was a phishing email. The county had to close government buildings, delay jail proceedings, and shut down key services. The remediation
In 2021, the FBI's Internet Crime Complaint Center received 19,954 business email compromise complaints with adjusted losses of nearly $2.4 billion. That made BEC the single most financially damaging cybercrime category — beating ransomware by a factor of almost 49 to 1. And those are just the
One Click Cost This Company Everything In March 2022, a single employee at Nvidia clicked something they shouldn't have. The Lapsus$ threat actor group walked away with over a terabyte of proprietary data, including employee credentials and source code. Nvidia isn't a small shop with weak
Colonial Pipeline shut down 5,500 miles of fuel infrastructure last month because of a single compromised password. One password. No multi-factor authentication. That's the state of security for system administrators in 2021 — and it's a wake-up call that keeps echoing across every industry. I'
Colonial Pipeline just shut down 5,500 miles of fuel infrastructure this week. One compromised password. That's all it took. While forensic details are still emerging, the early reporting points to a single set of stolen credentials — likely obtained through a social engineering attack on an employee. If
