In the wake of a major takedown of phishing's biggest brand name, Tycoon 2FA, phishers worldwide have scattered. Some have stuck around, but many have moved to other phishing service providers, and ...

Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year. In this type of attack, the threat actor sends a ...

A version of the AI coding tool in Anthropic's npm registry included a source map file, which leads to the full proprietary source code. An Anthropic employee accidentally exposed the entire ...

Cybercriminals and state-sponsored hackers are increasingly exploiting Microsoft’s legitimate OAuth 2.0 device authorization process to hijack enterprise accounts, bypassing multifactor authentication ...

A surge in phishing campaigns abusing Microsoft’s OAuth device code authorization flow has been observed with multiple threat clusters using the technique to gain unauthorized access to Microsoft 365 ...

Macworld reports that leaked internal code reveals Apple’s mystery smart home accessory codenamed ‘J229’, expected to launch in spring 2026. The device appears to be a security camera with multiple ...

The Advanced Medical Technology Association (AdvaMed) updated its Code of Ethics effective November 1, 2025, primarily to add a new section on “data-driven technologies,” including the security of ...

Posts from this topic will be added to your daily email digest and your homepage feed. is a senior editor and founding member of The Verge who covers gadgets, games, and toys. He spent 15 years ...

Come along with me on a journey as we delve into the swirling, echoing madness of identity attacks. Today, I present a case study on how different implementations of OAuth 2.0, the core authentication ...