Low-Detection Phishing Kits Increasingly Bypass MFA
A growing class of phishing kits – transparent reverse proxy kits – are being used to get past multi-factor authentication using MiTM tactics.
Tara Seals
About
Tara Seals has nearly 25 years of experience as a journalist, analyst and editor in the communications and technology space. Prior to Threatpost, Tara was the North American news lead for Infosecurity Magazine, and spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.
Critical Cisco Bugs Open VPN Routers to Cyberattacks
The company’s RV line of small-business routers contains 15 different security vulnerabilities, some unpatched, that could enable everything from RCE to corporate network access and denial-of-service – and many have exploits circulating.
KP Snacks Left with Crumbs After Ransomware Attack
The Conti gang strikes again, disrupting the nom-merchant’s supply chain and threatening supermarket shelves that could stay empty for weeks.
The issue in the file-sharing and interop platform also affects Red Hat, SUSE Linux and Ubuntu packages.
Visitors who shopped on the company’s eCommerce website in January will likely find their payment-card data heisted, researchers warned.
A critical security bug and a months-long, ongoing supply-chain attack spell trouble for WordPress users.
The information-disclosure issue, affecting Macs, iPhones and iPads, allows a snooping website to find out information about other tabs a user might have open.
A security bug in the file-sharing cloud app could have allowed attackers using stolen credentials to skate by one-time SMS code verification requirements.
Zoho’s comprehensive endpoint-management platform suffers from an authentication-bypass bug (CVE-2021-44757) that could lead to remote code execution.
Attackers could access and modify agent resources, telephone queues and other customer-service systems – and access personal information on companies’ customers.
