An MFA fatigue attack is a social-engineering technique in which an attacker repeatedly sends multi-factor authentication requests to a person’s device, hoping the person will eventually approve one. The attack is also known as: The victim may receive dozens of login notifications within a short period. They might approve one accidentally, dismiss it without reading, or accept it simply to stop the interruptions. Once the request is approved, the attacker may gain access to the victim’s email, cloud account, company network, customer information, or administrative systems. MFA fatigue demonstrates an important security principle: multi-factor authentication is significantly safer than password-only…
Author: Admin
OAuth consent phishing is a social-engineering attack that tricks a user into granting a malicious application permission to access their online account, cloud data, or workplace resources. Unlike conventional phishing, the attacker may not need to steal the victim’s password. The victim signs in through a legitimate identity provider and is shown a genuine consent screen listing the permissions requested by the application. The danger appears when the user approves an untrusted application without understanding what it will be allowed to do. Depending on the permissions granted, the malicious application may be able to: The consent page can appear trustworthy…
Adversary-in-the-middle phishing, commonly shortened to AiTM phishing, is an advanced phishing technique in which an attacker places a malicious proxy between a victim and a legitimate online service. The victim believes they are interacting directly with the genuine website. In reality, the attacker-controlled system relays information between the victim’s browser and the legitimate service in real time. This allows the attacker to capture: Traditional phishing pages often collect credentials and display an error or redirect the victim afterward. An AiTM phishing site acts as a live intermediary. It forwards the credentials to the real service, displays the genuine authentication process,…
SIM swapping is an identity-based attack in which a criminal transfers a victim’s mobile phone number to a SIM card or eSIM under the criminal’s control. Once the transfer succeeds, calls and text messages intended for the victim may begin arriving on the attacker’s device. The victim’s phone may suddenly lose cellular service because their number is no longer associated with the original SIM. Controlling the phone number can help an attacker intercept text-message verification codes, reset passwords, access financial accounts, impersonate the victim, or take over email and social-media profiles. The attack does not necessarily involve physically stealing or…
An MFA fatigue attack is a social-engineering technique in which an attacker sends repeated multi-factor authentication requests to a user, hoping the user will eventually approve one. The attack is also known as: The attacker usually needs the victim’s username and password before the attack begins. After submitting those credentials to a real login system, the attacker repeatedly triggers authentication notifications on the victim’s registered device. The victim may reject the first few requests. As the notifications continue, however, they may approve one accidentally, assume it was generated by an application they were using, or accept it simply to stop…
Account takeover, commonly shortened to ATO, is a cyberattack in which an unauthorized person gains control of another user’s online account. The attacker may obtain a password, steal an authenticated session, exploit a recovery process, bypass multi-factor authentication, or manipulate customer support into changing the account’s ownership information. Once inside, the attacker appears to the service as an authenticated user. Depending on the account, they may be able to read private information, make purchases, transfer money, change security settings, impersonate the victim, or use the account to attack other people. Account takeover is not one particular vulnerability. It is the…
A brute-force attack is a trial-and-error technique in which an attacker repeatedly tests passwords, encryption keys, security codes, usernames, or other possible values until one works. The method is called “brute force” because it does not depend on discovering a sophisticated software vulnerability. Instead, it relies on persistence, automation, computing power, weak credentials, and inadequate limits on repeated attempts. A basic attack might systematically test every possible password combination. More practical campaigns often begin with common passwords, dictionary words, predictable variations, or information associated with the target. Brute force is most often discussed in relation to account passwords, but attackers…
Password spraying is a password attack in which an attacker tests one commonly used password, or a small group of likely passwords, against many different user accounts. Instead of repeatedly targeting one account, the attacker spreads login attempts across a large number of usernames. This approach can help the activity remain below traditional account-lockout thresholds. For example, a company might lock an account after five incorrect password attempts. Rather than trying hundreds of passwords against one employee, an attacker may test one password against hundreds of employees, wait, and then try another password later. The attack becomes successful when even…
Credential stuffing is an account takeover technique in which attackers use stolen username-and-password combinations to attempt logins on other websites, applications, and online services. The credentials usually originate from an unrelated data breach, phishing campaign, malware infection, or credential leak. Attackers rely on the fact that many people reuse the same email address and password across multiple accounts. If a password exposed by one service is also used for banking, email, shopping, cloud storage, social media, or workplace systems, attackers may be able to access those accounts without discovering a new vulnerability. Credential stuffing does not necessarily mean the targeted…
Session fixation is a cybersecurity attack in which a criminal causes a victim to use a session identifier that the attacker already knows. The victim then signs in using that identifier. If the application keeps the same session ID after authentication, it becomes linked to the victim’s authenticated account. The attacker can reuse their known copy of the identifier and may be treated as the logged-in user. Unlike many other forms of session hijacking, the attacker does not need to steal the session token after login. They arrange for the victim to authenticate with a token already under the attacker’s…