2FA

A browser-in-the-browser attack, theoretically described in 2022, has been adopted in real-world phishing. We break down how it works, and how to spot a fake authentication window.

We break down a new scam that leverages Telegram Mini Apps, and explain how to avoid taking the bait.

Pixnapping is an Android vulnerability discovered by researchers that allows apps to steal passwords, one-time codes, and other confidential information from the screen without any special permissions from the operating system. How does it work, and what can you do to protect yourself?

A comprehensive guide to configuring privacy and security in ChatGPT: data collection and usage, memory, Temporary Chats, connectors, and account security.

We dive into which corporate systems support passkeys, where compatibility falls short, and why we probably won’t be saying goodbye to passwords anytime soon.

This guide dives into using passkeys to sign in from someone else’s computer, storing them on a removable device, and transferring between devices.

Can you ditch passwords entirely for passkeys? We explore when it’s possible, and when it’s still a challenge.

A dozen short and simple tips on how to use WhatsApp, Telegram, Signal, iMessage, WeChat, and other messaging apps safely and hassle-free.

A year after the ransomware attack on healthcare giant UnitedHealth Group, we’ve compiled all publicly available information about the incident and its aftermath.

We discuss the recently discovered Nearest Neighbor attack method, which enables attackers to compromise a Wi-Fi network from the other side of the world.

A vulnerability that permits bypassing authentication has been found in a popular security hardening plugin for WordPress.

We’ve updated the design of our password manager’s mobile version. Storing and managing passwords is now even more convenient.

Five dead simple tips to greatly improve your defenses against cybercriminals.

Discontinuing mandatory password rotations, banning outdated MFA methods, and other updates in the NIST SP 800-63 standards for digital account authentication and management.

What to do if you receive a text with a two-factor authentication code from a service you’ve never registered for.

Telegram bot sells subscriptions to phishing tools to hack Microsoft 365 accounts, including 2FA bypass.

Cybercriminals are using AitM techniques to compromise accounts of company executives. How do they do this, and how to protect against it?

Two-factor authentication protects your account from theft — until you yourself give away your one-time password.

A credential stuffing attack is one of the most effective ways to take control of accounts. Here’s how it works and what you should do to protect your company.

Dropbox has shared a report on a data breach in the Dropbox Sign e-signature service. What does this mean for users, and what should they do?

SIM swap fraud is back in vogue. We explain what it is, the danger it poses to organizations, and how to guard against such attacks.