Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
The Average Company Runs 130 SaaS Apps — And Secures Maybe Half In early 2024, a threat actor breached Snowflake customer environments — not by exploiting a zero-day, but by using stolen credentials harvested from infostealer malware. The result? Hundreds of millions of records exposed across companies like Ticketmaster and AT&
A Single Misconfigured S3 Bucket Exposed 540 Million Facebook Records Back in 2019, researchers at UpGuard discovered that two third-party Facebook app developers had left hundreds of millions of user records sitting in publicly accessible Amazon S3 buckets. No hacking required. No sophisticated exploit. Just wide-open cloud storage that anyone
A Legitimate Invoice From PayPal — That's Also a Scam In late 2024, security researchers at Avanan documented a campaign where threat actors sent real PayPal invoices to victims — not spoofed emails, not lookalike domains, but actual invoices generated through PayPal's own platform. The emails passed every
A Single Input Field Took Down British Airways In 2018, British Airways disclosed a breach that compromised the personal and financial data of approximately 380,000 customers. The attack vector? A modified script injected into their website's payment page. The UK's Information Commissioner's Office
A Single Email Cost This Company $100 Million In 2015, Ubiquiti Networks disclosed that threat actors used carefully crafted emails impersonating company executives to trick finance employees into wiring $46.7 million to overseas accounts. The attackers didn't exploit a software vulnerability. They exploited people — with spear phishing.
The Email That Cost One Company $100 Million In 2024, the FBI's Internet Crime Complaint Center reported that business email compromise — a form of spear phishing — accounted for over $2.9 billion in adjusted losses. That wasn't a typo. Billions. And those are just the cases
In late 2024, the FBI issued a stark warning: AI-driven phishing attacks targeting Gmail users had reached a level of sophistication that made them nearly indistinguishable from legitimate communications. We're not talking about the laughably bad "Nigerian prince" emails anymore. These are pixel-perfect replicas of Google
In 2024, the FBI's Internet Crime Complaint Center reported losses exceeding $16 billion from cybercrime — and compromised credentials were the gateway for a staggering number of those incidents. Right now, billions of username-and-password combinations sit on dark web marketplaces, priced anywhere from $1 to $500 depending on what
In February 2024, Change Healthcare — the largest medical claims processor in the United States — was hit by the ALPHV/BlackCat ransomware group. The attack disrupted billing systems at hospitals and pharmacies nationwide for weeks. The entry point? Stolen credentials used on a remote access portal that lacked multi-factor authentication. One
A Single Fake Email Cost Facebook and Google $100 Million Between 2013 and 2015, a Lithuanian man named Evaldas Rimasauskas sent a series of fake email messages to employees at Facebook and Google. He impersonated a legitimate hardware vendor, attached fraudulent invoices, and directed payments to bank accounts he controlled.
