REDMOND, WA - Microsoft has issued a new security alert to users of its Microsoft Advertising platform, warning of a wave of OAuth consent phishing attacks - a sophisticated form of credential theft designed to look completely legitimate. In its notice, Microsoft explained that malicious actors are sending out fake login or permission prompts that appear identical to the company’s official consent screens. Once a user clicks “Accept”, the attacker gains access to sensitive … [Read more...]
Massive “Combo List 93M” Surfaces on Dark Web, Exposing Millions of Emails
WEST PALM BEACH, FL - A newly circulated credential database called Combo List 93M has emerged on underground forums, raising concerns for millions of email account holders. The massive compilation - reportedly containing over 93 million records - is being distributed within cybercriminal communities for use in credential-stuffing and phishing campaigns. What Is Combo List 93M? Unlike a traditional “data breach” tied to a single company, Combo List 93M appears to be an … [Read more...]
Massive Data Breach Exposes 184 Million Login Credentials from Major Tech Platforms
WEST PALM BEACH, FL - A significant data breach has compromised over 184 million login credentials, affecting users of major platforms including Google, Apple, Meta (Facebook, Instagram), Microsoft, Snapchat, and others. The exposed information includes email addresses, usernames, plaintext passwords, and login URLs, posing a substantial risk of identity theft and unauthorized account access. Cybersecurity researcher Jeremiah Fowler discovered the unprotected database, … [Read more...]
50 Million Potentially Compromised In PowerSchool Data Breach
SACRAMENTO, CA - On December 28, 2024, PowerSchool, a prominent provider of educational technology services to over 60 million K-12 students worldwide, identified a cybersecurity incident involving unauthorized access to its Student Information System (SIS) through the PowerSource customer support portal. The breach, which occurred between December 19 and December 24, 2024, allowed threat actors to exfiltrate sensitive data, including names, addresses, dates of birth, … [Read more...]
FEDs Seize 17 Domains Suspected of Being Used for Fraud in U.S. by North Korea
WASHINGTON, D.C. - On Wednesday, the United States Justice Department announced it has seized 17 website domains utilized by North Korean information technology (IT) workers to purportedly evade government sanctions, conduct cyberattacks and defraud U.S. businesses, with the millions of dollars in illicit proceeds generated from such activities being used to fund North Korea's weapon development program. The Justice Department confirmed in a statement that the … [Read more...]
Scammers Sending Emails from Spoofed Authoritative Domains Via Forwarding Flaws
LA JOLLA, CA - According to research conducted by the University of California San Diego, due to flaws inherent in the process of forwarding emails, the ability for scammers and attackers to send unsuspecting victims e-mails from the spoofed addresses of top-level government or corporate domains is actually much easier than many experts were initially suspecting, opening up disturbingly new and effective avenues for online fraud. The integrity of emails sent from … [Read more...]