Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
In September 2023, a threat actor called Scattered Spider social-engineered their way into MGM Resorts by calling the company's IT help desk. One phone call. That's all it took to trigger a shutdown that cost MGM an estimated $100 million. No zero-day exploit. No sophisticated malware.
A Single Phone Call Cost MGM Resorts $100 Million In September 2023, a threat actor called MGM Resorts' IT help desk, impersonated an employee found on LinkedIn, and convinced a technician to reset credentials. That one vishing call triggered a ransomware attack that shut down slot machines, hotel key
In 2023, MGM Resorts lost roughly $100 million after a threat actor called Scattered Spider impersonated an employee on a help desk call — a textbook spear phishing technique that bypassed every technical control the company had. The attacker didn't blast out a million generic emails. They researched one
In 2024, the FBI's Internet Crime Complaint Center (IC3) reported that compromised credentials were a factor in a staggering number of the complaints they received, driving billions of dollars in losses. I've personally worked incident response cases where a single set of stolen credentials — purchased on
A Single Fake Identity Website Fueled a $10 Million Fraud Ring In 2023, the FBI dismantled an identity fraud operation that relied heavily on fake identity websites — convincing portals designed to harvest personal data from unsuspecting victims. The ring used stolen credentials to open bank accounts, file fraudulent tax returns,
The $11 Billion Problem You're Probably Ignoring In 2023, the FBI's IC3 received over 21,000 complaints related to business email compromise alone — a category deeply intertwined with account takeover attacks — with adjusted losses exceeding $2.9 billion. That number keeps climbing. And those are just
The Ransomware Gang That Treats Phishing Like a Business In March 2025, CISA and the FBI issued a joint advisory — AA25-071A — warning that the Medusa ransomware gang had compromised over 300 organizations across critical infrastructure sectors. Healthcare, education, legal, insurance, manufacturing. The attack vector in the vast majority of cases?
A Single Email Took Down a $5.8 Billion Pipeline In May 2021, a single compromised password shut down Colonial Pipeline and triggered fuel shortages across the U.S. East Coast. The attack didn't start with some exotic zero-day exploit. It started with a stolen credential and an
The AI-Generated Email That Fooled a Security Engineer In early 2025, a Google Workspace consultant named Sam Mitrovic publicly documented how he nearly fell for an AI-driven phishing attack targeting his Gmail account. The attacker spoofed Google's support number, used a perfectly natural AI-generated voice, and referenced real
Your Old AIM Email Is Still a Threat Vector In December 2017, AOL officially shut down AIM — AOL Instant Messenger — along with the ecosystem of AIM email accounts that millions of people had used for over two decades. Most users moved on. But here's the problem: their credentials
