Posts exploring how attackers steal usernames, passwords, and authentication tokens through phishing, keylogging, brute force attacks, and credential stuffing. Includes actionable guidance on multi-factor authentication, password managers, and monitoring for compromised credentials.
posts
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered their way past the help desk with a single phone call. But that attack started the way most do — with a phishing attack that gathered the intelligence needed to make that call convincing.
A Single FakeEmail Cost This Company $37 Million In 2024, the FBI's Internet Crime Complaint Center reported that business email compromise — attacks built on fakeemail messages that impersonate trusted senders — generated over $2.9 billion in adjusted losses. That made BEC the costliest cybercrime category for the fourth
A Phone Call That Sounds Exactly Like Google Support — But Isn't In late 2024, a Microsoft solutions consultant named Sam Mitrovic nearly lost his Google account to an AI-generated voice that sounded indistinguishable from a real Google support agent. The caller ID showed a legitimate Google number. The
A Single Email Cost This Company Everything In 2023, MGM Resorts lost an estimated $100 million after a threat actor used a phone-based social engineering attack — a technique closely related to phishing — to gain access to their systems. The attackers didn't exploit a zero-day vulnerability or brute-force a
In January 2024, a massive dataset called "Naz.API" surfaced on dark web forums containing over 70 million unique email addresses and their associated passwords. Many of these credentials were still active. The breach wasn't the result of one sophisticated attack — it was an aggregation of
In September 2023, a threat actor called Scattered Spider social-engineered their way into MGM Resorts by calling the company's IT help desk. One phone call. That's all it took to trigger a shutdown that cost MGM an estimated $100 million. No zero-day exploit. No sophisticated malware.
A Single Phone Call Cost MGM Resorts $100 Million In September 2023, a threat actor called MGM Resorts' IT help desk, impersonated an employee found on LinkedIn, and convinced a technician to reset credentials. That one vishing call triggered a ransomware attack that shut down slot machines, hotel key
In 2023, MGM Resorts lost roughly $100 million after a threat actor called Scattered Spider impersonated an employee on a help desk call — a textbook spear phishing technique that bypassed every technical control the company had. The attacker didn't blast out a million generic emails. They researched one
In 2024, the FBI's Internet Crime Complaint Center (IC3) reported that compromised credentials were a factor in a staggering number of the complaints they received, driving billions of dollars in losses. I've personally worked incident response cases where a single set of stolen credentials — purchased on
A Single Fake Identity Website Fueled a $10 Million Fraud Ring In 2023, the FBI dismantled an identity fraud operation that relied heavily on fake identity websites — convincing portals designed to harvest personal data from unsuspecting victims. The ring used stolen credentials to open bank accounts, file fraudulent tax returns,
