Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
The Breach That Started With One Reused Password In 2023, a single employee at Norton LifeLock's parent company, Gen Digital, reused a personal password across multiple accounts. Attackers used credential stuffing to compromise nearly 925,000 customer accounts. One password. Nearly a million victims. If you've
Your Home Office Is Now the Attack Surface In 2023, a single remote employee at MGM Resorts answered a social engineering call from a threat actor impersonating IT support. That one interaction led to a ransomware attack that cost the company over $100 million in losses. The attacker didn'
That "Unsubscribe" Click Just Cost Someone Their Entire Network Last year, I worked with a mid-size logistics company that lost access to every file server, customer database, and email system they had. The entry point? A single spam email disguised as a shipping notification. One employee clicked an
A Single Stolen Password Cost One Company $60 Million In 2023, MGM Resorts got hit by a social engineering attack that started with a single phone call to the help desk. The threat actors impersonated an employee, reset credentials, and within hours had enough access to deploy ransomware across the
In March 2024, a threat actor used a simple brute force attack to compromise a Roku employee's credentials, ultimately exposing over 576,000 customer accounts. No zero-day exploit. No sophisticated malware. Just automated password guessing against accounts with weak credentials and no multi-factor authentication. Brute force attack prevention
A Single Email Cost This Company $121 Million In 2019, a Lithuanian national named Evaldas Rimasauskas pleaded guilty to stealing over $121 million from Google and Facebook. His weapon wasn't malware. It wasn't a zero-day exploit. It was phishing — forged emails impersonating a legitimate hardware vendor,
Last year, a mid-size accounting firm in Ohio lost $1.2 million after a single employee clicked one link in a spoofed Microsoft 365 email. The link looked like a routine password-reset page. It wasn't. Within 90 minutes, a threat actor had harvested credentials, bypassed weak authentication, and
In 2023, the FBI dismantled a cybercriminal operation that used the Snake malware — a sophisticated keylogger that had quietly exfiltrated credentials from government networks across 50 countries for nearly two decades. Every password. Every internal message. Every classified document typed into a keyboard. That's the reality of a
In January 2024, a threat actor used stolen credentials to compromise a Microsoft executive's email account — no malware, no zero-day exploit, just a password spray attack against a legacy test tenant that lacked multi-factor authentication. Microsoft disclosed the breach publicly, and it became one of the most talked-about
Your Employees' Credentials Are Already for Sale In March 2024, AT&T confirmed that data from approximately 73 million current and former customers appeared on the dark web. That breach didn't happen overnight — the data had been circulating in underground markets for years before anyone noticed.
