SecurityFake Zoom Installer Delivers macOS Backdoor
Researchers at Jamf say a bogus Zoom app installs CloudSyncD, a backdoor that abuses user passwords to run with root privileges.
> Search
21 results for “password”
Security
SecurityRogue MFA Provider Can Siphon Passwords
Researchers show how a compromised Entra admin account can turn a trusted external MFA provider into a credential-stealing prompt.
Cyber CrimeStolen Passwords Expose 1,787 Water Providers
SpyCloud research finds infostealer malware has harvested credentials tied to 1,787 U.S. water and wastewater organizations, some reaching operational networks.
Cyber CrimeSigned Driver, Dead AV: A Fake LastPass Trap
A counterfeit GitHub installer for LastPass Authenticator loads a Microsoft-signed kernel driver that kills security tools before stealing passwords.
SecurityA £3 Wi-Fi Extender Hides Secret Admin Access
Security researcher finds a hardcoded admin account in a Temu-bought Wi-Fi extender, giving remote attackers full control.
SecurityAndroid password switch adds passkey support
Google's new Android feature moves passwords and passkeys between manager apps without CSV files, starting with three partners.
Cyber CrimeStolen AI Tokens Skirt Login Checks
Okta's review of a 7 GB infostealer dump found unexpired AI service tokens that can be replayed without a password or MFA.
SecurityWhatsApp Tightens Account Security With Passkeys, Stronger 2SV
WhatsApp expands passkey support, upgrades 2SV to full passwords, and tests caller context for Android.
SecurityKeycloak flaw lets unauthorized password resets
CVE-2026-18963 allows full account takeover via reset flow; patches out.
How ToFree Software Deals: More Than Students
Beyond student discounts, free and cheap apps are available via employers, device bundles, and genuinely free tools.
SecurityGoogle Doc Credentials Leak Serves as a Cautionary Tale
A developer's habit of storing passwords in a shared Google Doc led to a search-indexed exposure of staging credentials.
SecuritySticky Note Security Failures Exposed
A company’s attempt to simplify hardware deployment led to a significant data breach after IT staff left credentials in plain sight.
SecurityTrueBooker WordPress Plugin Critical Flaw
A critical authorization bypass vulnerability in the TrueBooker plugin allows unauthenticated attackers to reset passwords for any user, including administrators.
SecurityCritical Auth Bypass Found in TNG Plugin
A critical vulnerability in the Single Sign On For TNG WordPress plugin allows unauthenticated attackers to reset any user password and take over sites.
SecurityDecades-Old BMC Flaw Exposes Servers
A legacy vulnerability in IPMI 2.0 leaves over 24,000 servers vulnerable to offline password cracking and potential remote control.
SecurityCritical Pheditor Auth Bypass Found
A flaw in the Pheditor forced password-change flow allows unauthenticated attackers to hijack administrative accounts on systems using default credentials.
Cyber CrimeBorder Device Wipe Leads to Indictment
A federal case involving a duress password suggests new legal risks for travelers using privacy-focused mobile software.
SecurityHCL Aftermarket EPC Flaw Risks Data Loss
A critical business logic vulnerability in HCL Aftermarket EPC allows unauthorized users to intercept passwords via email redirection.
SecurityDelegating Auth to AI: Security Risks
A new integration between 1Password and Claude shifts the model of AI credential management, but challenges remain for user trust.
SecurityLaw Firm's Dangerous Password Policy
A single master password granted unrestricted access to sensitive client files and employee impersonation at a law firm.
SecurityThe Hidden Predictability of AI-Generated Security Credentials
Researchers warn that asking AI chatbots to create passwords results in dangerously predictable patterns rather than true randomness.