Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published. The vulnerabilities are listed below - CVE-2026-15718, an invalid pointer in the JavaScript: WebAssembly component CVE-2026-15719, a site isolation in t

A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security projects to distribute infostealer malware. [...]

Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems. Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer is

The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times. [...]

Microsoft has announced that passkeys will become the default authentication method for the Entra ID enterprise identity service starting September 2026. [...]

Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform. The way in has been the trust the organization had already extended, usually throug

A new macOS information-stealing malware called CrashStealer pretends to be Apple's crash-reporting tool to steal credentials, keychain data, and crypto wallets. [...]

Two new phishing kits, Jalisco and OmegaLord, have been discovered in attacks targeting Microsoft 365 accounts, using techniques that defeat multi-factor authentication (MFA). [...]

At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry. The activity allows users to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments

Cybersecurity researchers have disclosed details of two access control-related flaws impacting the RabbitMQ message broker service that could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries.

Cybersecurity researchers have flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory (AD) enumeration. "The script looked for the Domain Controller (DC) and mapped users, computers, and domains, before creating a direc

Learn how attackers abuse Entra ID through a free hands-on Capture the Flag. Varonis created the Breach at the Beach CTF to teach defenders how to investigate Entra ID attack techniques using realistic scenarios. [...]

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by Kr

A few days ago, I was sitting with the CISO of a Fortune 50 company, walking through how his security team was thinking about AI agents in the SOC. Smart team. Serious program. They had already connected Claude to a few detection tools and were seeing real value in specific inves

UK authorities charged five people following a National Crime Agency (NCA) investigation into Russian Coms, a major caller ID spoofing platform used by criminals to make over 1.8 million scam calls. [...]

Footie fans? Overreacting? There's a first time for everything

The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on your machine. Published on July 11, 2026, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Li

Microsoft says GigaWiper combines at least 3 malware families into one modular tool

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit,' slipped past AI code reviewers CodeRabbit and Bugbot, which never open image files at all, then convinced a coding agent to read a repo's .env and write

Datadog Security Labs is warning of "several overlapping campaigns" that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. "Operators rely on automated scraping tooling with custom or legitimate-sounding user ag

A threat actor has been targeting organizations spanning multiple sectors with voice-based fake security requests that prompt Microsoft 365 users to enroll a new Entra passkey with an aim to carry out data extortion attacks. The threat actor, tracked by Okta under the moniker O-U

Researchers at Ledger's Donjon security team have shown that a precisely timed laser pulse, aimed at the chip inside a Tangem crypto wallet card, can reset the card's password to anything the attacker picks. No old password. No backup card. Once it is reset, whoever did it contro

Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from. Each is a different way to break a machine: wipe t

A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments. [...]

GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to bypass two-factor authentication (2FA). The Microsoft-owned subsidiary noted that the following npm install beh

Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if successfully exploited, could enable credential theft, privilege escalation, and arbitrary code execution on the host. A brief description of the h

AI agents are accelerating the growth of non-human identities, making it harder for organizations to understand what exists, who owns it, and what it can access. Netwrix explains why stronger visibility and identity governance are essential as AI expands the enterprise attack sur

Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules written to catch human intruders. The agents are not malicious. They just do a lot of things that, to a behavioral engine

A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey. [...]

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications. [...]

Carlsbad, Calif., July 9, 2026 – The FIDO Alliance has announced the agenda for Authenticate U.S. 2026, the only industry conference dedicated to digital identity and authentication. The event will […]

A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. [...]

Specops Software explains how AI is making service desk impersonation attacks more convincing, personalized, and scalable, along with practical steps organizations can take to strengthen onboarding and identity verification. [...]

Dog-eat-dog world for credential-stealing attackers

ExpressVPN has announced a major update to its standalone ExpressKeys password manager, adding passkey support, secure credential sharing, and direct vault imports. Alongside the release, the company published a new […]

A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password pa

A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel. [...]

A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make

A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using ClickFix lures. The activity cluster, tracked by Elastic Security Labs under the moniker REF6045, involves infecting victims through fake CA

Japanese telecommunications giant KDDI says that millions of people had their email addresses and passwords exposed after attackers breached an email platform used by five internet service providers (ISPs) in the country. [...]

For years, account takeover (ATO) followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools, and waited for matches. Credential stuffing was cheap, scalable, and for defenders, relatively well understood. That era is ending. Not

BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices. The vulnerabilities are

BeyondTrust warned customers to patch two critical security flaws in its Remote Support (RS) and Privileged Remote Access (PRA) software that could allow attackers to bypass authentication. [...]

Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumented authentication backdoor that enables administrative access to the devices' web management interfaces, the CERT Coordination Center (CERT/CC) warned Monday.

Campaigners demand investigation and long-delayed action on PEGA Committee recommendations

Microsoft says the Windows settings backup and restore tool will be enabled by default on Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems after upgrading to Windows 11 26H2. [...]

A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews to steal Google account credentials from marketing professionals. [...]

A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access

A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and engineering departments of U.S. and Canadian universities as part of a new campaign. The activity involves the exploitation of now-patched, critical

Tomorrow's webinar explores how behavioral AI can help organizations detect sophisticated phishing, business email compromise, and account takeover attacks while reducing alert fatigue through automated investigation and response workflows. [...]

Software supply chain security was hard enough. Then AI joined the build pipeline. For five years, "software supply chain security" meant one question: what's in your code? Which open-source packages, which versions, which transitive dependencies three layers deep that nobody cho

Cybersecurity researchers have disclosed details of a now-patched critical session isolation vulnerability in Writer, an enterprise generative artificial intelligence (AI) platform, that could result in cross-tenant compromise. The one-click vulnerability has been codenamed Write

Building a shortlist for an AI SOC evaluation can be tough. SIEM, SOAR, and pureplay AI SOC vendors are all saying the same thing. But behind the identical label sit very different products, from chat assistants bolted onto a legacy SIEM to agent platforms that run detection, tri

Financial institutions are putting their clients at risk in the name of convenience.

EMVCo has released a draft framework that could pave the way for a universal standard for verifiable digital credentials in card‑based payments, a move that could make online checkout both […]

A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary. Home devices became a routing cover. Clean code pulled dirt from a de

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon combines credential collection, lateral movement,

Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft. According to JFrog, the packages "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-co

Third-party contractor compromise exposed health information and insurance billing passwords

ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA bypass tactics work and how to defend against them. [...]

A new report from the Citizen Lab has revealed that former Member of the European Parliament Stelios Kouloglou had his mobile device repeatedly hacked with the notorious Pegasus spyware while serving on a committee that was tasked with investigating the abuse of such commercial s

The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes ro

Watch the presentation WEBINAR | Introducción a passkeys Participa en nuestro webinar el 1 de julio de 2026 a las 11 a. m. ET para una introducción a passkeys (llaves […]

Cybersecurity researchers have flagged a new macOS information stealer called PamStealer that employs a series of clever tricks to infect systems and siphon sensitive data. The stealer, discovered by Jamf Threat Labs, is distributed as a compiled AppleScript (.scpt) file imperson

Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remo

Security firm Sysdig says it has found what it believes is the first ransomware attack run from start to finish by an AI agent. Its Threat Research Team calls the operator JADEPUFFER and says a large language model handled the whole job: breaking in, stealing credentials, moving

Yubico will host a virtual developer hackathon for the FIDO Alliance developer community on August 5 to give developers an early look at the company’s upcoming YubiKey 5.8 firmware release and its support […]

The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by federal, state, local, and private-sector partners. [...]

The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions. [...]

The recently discovered financially-motivated FortiBleed campaign has been attributed to INC and Lynx ransomware operations, indicating that the verified, stolen credentials were intended for follow-on intrusions. "An operator tied to FortiBleed's infrastructure was found activel

An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period. [...]

Identity lifecycle management was architected around a person with an employment record, a manager, and a departure date. AI agents have none of those. As autonomous principals proliferate across enterprise environments, the governance model built for humans develops structural b

Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs. Run one, and it quietly lifts you

The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the attackers focused their attention on corporate email communications hos

Modern phishing, business email compromise, and account takeover attacks increasingly exploit trusted identities and legitimate business workflows, making them harder for traditional email defenses to detect. This webinar explores how behavioral AI can help organizations automate

The U.S. Federal Trade Commission (FTC) says Amazon will pay a $2.25 million civil penalty to settle charges that it blocked identity theft victims' access to transaction records. [...]

Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface (CLI), compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range (2a0a:d683::/3

Business Email Compromise is more than an email scam. It's a coordinated operation involving compromised accounts, financial research, and cash-out networks. Flare explores how underground forums reveal how BEC attacks are planned and executed. [...]

An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0)

Open API could reveal everything an attacker needs to impersonate bank officials

The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. [...]

Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking, a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user's credentials and sending them to an attacker.

A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Paym

This week was a reminder that attackers do not always need big tricks. One small mistake, one old access path, one missed patch, and suddenly the door is open. The noise is not all noise, either. Forums are talking, researchers are finding easy cracks, and defenders have more cle

AI agents can access data, trigger workflows, and take action across enterprise systems. Token Security explains why governing these privileged identities is becoming essential for enterprise security. [...]

You don't need Mythos or GPT-5.5-Cyber to find a vuln to exploit when the world's password habits are so sloppy

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts. "This attack avoids the most common npm execution paths through lifecycle

Microsoft has shut down a long-running malicious extension operation on the Edge Add-ons store that hid its payloads inside ordinary image and font files, then woke up days after install to steal credentials and run ad fraud. The company calls it StegoAd, a mash-up of steganograp

A public proof-of-concept is now out for CVE-2026-55200, a critical flaw in libssh2 that lets a malicious or compromised SSH server trigger memory corruption on a connecting client, with possible code execution. No credentials, no user interaction. The bug affects every release u

Today’s encrypted data, such as credentials, may no longer remain confidential in the future because the public-key cryptography protecting it will soon be broken by quantum computers. Although no machine today can break elliptic curve cryptography or RSA, quantum hardware is adv

The Security Service of Ukraine (SSU) said it, together with the U.S. Federal Bureau of Investigation (FBI), uncovered a long-running campaign orchestrated by Russian intelligence services to break into the messaging accounts of government officials, military personnel, politicia

A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it. Tracked as CVE-2026-12957 (CVSS 8

EMVCo has put a draft framework out for consultation that aims to bring verifiable digital credentials into card‑based payment authentication. EMVCo is the technical body that maintains the global EMV Specifications. […]

AI agents are moving through enterprise environments, inheriting permissions, traversing systems, and executing decisions at machine speed with minimal oversight. The identity infrastructure built to govern human access wasn't designed for autonomous actors, and the gap between w

Microsoft says latest attack targets Leo Platform and RStreams packages, harvesting creds and going after more maintainers

One rule for the workers, another for execs

For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security firms concluded t

A coordinated law enforcement operation, in partnership with private sector companies, including Bitdefender, Bitsight, ESET, and Microsoft, has resulted in the takedown of criminal infrastructure powering Amadey and StealC. "The main common goal was to disrupt the 'assembly line

John Edwards says his position had become 'untenable' following investigation into conduct including inappropriate attempts at humor

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts

The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, after instructions began circulating on Telegram showing how to trick Meta's "AI support assistant" b

Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets o

'Permanent biometric surveillance of the public square' incompatible with policing by consent, say critics

Why are you even reading this?! Rotate your passwords!!

Service desks have become a favored target for attackers seeking password resets, MFA changes, and access to corporate accounts. Specops Software breaks down how service desk social engineering attacks work and how organizations can defend against them. [...]

Despite the abundance of telemetry at analysts’ disposal, many security operations teams struggle to answer a few basic questions during incident investigation: What happened? What evidence do we have? How do we know we’re seeing it all, in context? Answering these questions requ

And the admin password was right in the Active Directory description field

Account takeover attacks continue to challenge security teams because attackers often operate through legitimate accounts and trusted services. This webinar explores how behavioral AI can help organizations identify compromised accounts faster and automate response workflows. [..

A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid by victims. This post e

Five ISPs and plenty of users await their fate

As many as 145 npm packages associated with the Mastra namespace ("@mastra/*"), a popular open-source JavaScript and TypeScript framework for building artificial intelligence (AI) applications, have been compromised as part of a software supply chain attack codenamed easy-day-js,

A heap over-read in the Squid web proxy can leak another user's cleartext HTTP request, including any credentials or session tokens it carries, to anyone already allowed to send traffic through the same proxy. The bug traces to a 1997 FTP-parsing change and is still live in Squid

Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution. Steer the agent to load an attacker's web page, and that page's JavaScript can reach a privileged local service on the same mac

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday urged Fortinet customers with FortiGate appliances to take steps to secure against ongoing malicious activity aimed at thousands of internet-accessible devices. The sweeping campaign, believed to be the

An unknown threat actor has been observed leveraging paid or promoted posts on legitimate news websites to drum up buzz for their warez, according to new findings from Check Point Research. The threat actor also has at their disposal a dedicated WordPress phishing page that acts

We are standing at the end of an era we never thought to mourn: the era of human-speed threats. For years, cybersecurity moved to a rhythm organizations could follow. A researcher found a bug, a CVE was cataloged, a vendor navigated a patch cycle, and weeks or even months later,

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure. According to findings from Broadcom-owned S

A Russian-speaking initial access broker (IAB) driven by financial gain is assessed to be behind a large-scale credential-harvesting operation known as FortiBleed that has targeted over 430,000 FortiGate firewalls globally. The campaign, active since February 2026, involves colle

Google has set September 30, 2026, as the day it begins enforcing Android developer verification in the first four countries, and the major device-maker app stores are in from the start. On that date, certified Android phones in Brazil, Indonesia, Singapore, and Thailand will blo

Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is a medium-severity information disclosure flaw that can allow unauthe

A French-speaking attacker broke into a small French automotive business, planted a keylogger, and stole banking and email credentials. Ordinary stuff, until one move near the end. Before his command-and-control server went dark, he installed OpenSSH and Tailscale on a victim's m

LastPass announced that hackers accessed customer data from its Salesforce environment after stealing the company's OAuth tokens in the Klue supply chain attack earlier this month. [...]

A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. [...]

Dutch law enforcement authorities, along with counterparts from Canada , Germany, and the U.S., have disrupted malicious infrastructure associated with SocGholish and cleaned up nearly 15,000 infected WordPress websites. "With these actions we deprive cybercriminals of access to

Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with more than 146,000 GitHub stars, that could allow attackers to stealthily read artificial intelligence (AI) conversions from other customers' application

Salesforce has revealed that it disabled the Klue Battlecards app integration within its platform in response to a security incident impacting the competitive intelligence company on June 11, 2026. To that end, organizations will be unable to connect to Salesforce via the app unt

An independent PCI assessor tested Reflectiz against the new PCI DSS rules. Here is the verdict: See the full QSA assessment here → When a customer types their card number into your checkout, their browser is running far more than your code. Analytics tags, a tag manager, a suppo

It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control. The annoying part is how little of this feels new. Wea

Attackers no longer need to sift through massive credential dumps. They can pay others to do it for them. Flare explores how an emerging underground market searches stolen credential databases for specific companies, domains, and accounts. [...]

By FIDO Alliance’s Andrew Shikar The password is dying. If not in theory, certainly in practice. After years of technical development and cross-platform alignment, passkeys have reached a state of […]

With their fiddly and indirect nature, one-time passwords (OTPs) are a curse of modern life. They’re a security risk and outdated. Frustrated, a maker has built a physical security key […]

A webinar on mobile driver’s licenses (mDLs), presented by the National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST), introduces new resources to help […]

In 2025, Japan accelerated passkey adoption in response to evolving security challenges. Following a rise in unauthorized access incidents across the financial sector, regulators emphasized that “ID/password-only authentication and even email/SMS one-time passwords […

Telegram has introduced support for passkeys in its latest update, marking a significant shift away from SMS-based login systems in favor of modern, phishing-resistant authentication methods. The move to support passkeys brings […]

Security firm SOCRadar says the large-scale FortiBleed campaign targeting Fortinet FortiGate devices used custom sniffers to harvest authentication secrets from compromised firewalls and steal credentials. [...]

In today’s digital-first world, passwords are no longer enough. As phishing attacks and credential theft increase, enterprises require a secure, scalable and user-friendly method for authenticating users. That’s where the FIDO […]

Research Reveals 94% of Enterprises Claim They Can Revoke Employee Access Within 24 Hours, Yet 35% experienced delays or failures in the past two years The FIDO Alliance and HID, […]

Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers' Salesforce environments, as the new "Icarus" extortion group publicly claims the attack. [...]

Corporate Overview MIXI, Inc. (hereafter MIXI) is one of Japan’s leading internet companies, best known for its popular mobile game MONSTER STRIKE, among other entertainment services, with tens of millions […]

Can you remember all your passwords off the top of your head? If so, you probably have too few of them – or, heaven forbid, only one that you use […]

As passkeys move rapidly from a promising new technology to the clear industry standard for simple and secure authentication, the passkey ecosystem continues to evolve. Read about six new capabilities […]

Agentic commerce is steadily rewiring how digital transactions occur. Instead of shoppers manually navigating screens, entering credentials and approving each step, intelligent software agents are beginning to select products, optimise […]

The Passwordless Imperative For decades, passwords have been the default mechanism for securing digital access. They are deeply embedded in enterprise systems and workflows, yet they were never designed to […]

The FIDO (Fast IDentity Online) Alliance has announced a new initiative designed to accelerate the adoption of verifiable digital credentials and identity wallets. Its undertaking hopes to let technology organisations […]

Phishing, BEC, and account takeover attacks continue to overwhelm security teams with alerts and investigations. This webinar explores how behavioral AI can help automate detection and response workflows, reducing alert fatigue and improving operational efficiency. [...]

From friction to fluidity: Why passkeys, biometrics, and magic links are poised to end the password era and increase privacy As cyber threats intensify and user frustration with passwords seemingly […]

Counting Google, Amazon, and Microsoft among its early adopters, the new standard will provide organizations with more visibility and control over external applications. Here’s how it works.

Dashlane has implemented the FIDO Credential Exchange standard on Android to simplify vault transfers. This protocol replaces insecure CSV exports with an encrypted direct transfer between apps. While it enables […]

A presentation from Chief Privacy Officer for the State of Utah Christopher Bramwell at the FIDO Identity Policy Forum looks at how the state’s unique culture has influenced its leadership on digital […]

Passkey champions to develop certification profile as focus turns to digital credentials At the annual Identity Identity & Policy Forum, it’s a tradition for Andrew Shikiar, CEO of the FIDO […]

With 4.7 million enrolled users in a country of roughly 5.6 million people, BankID Norway is one of the most widely adopted digital identity schemes in the world. In 2025 alone, the platform processed […]

Among sectors vulnerable to AI-assisted fraud attacks, the financial industry is perhaps the ripest. With high-stakes remote transactions occurring at scale, increasingly involving AI agents, there are countless attack surfaces, […]

Bitwarden announced support for logging into Windows 11 devices using passkeys stored in the manager’s vault, enabling phishing-resistant authentication. The new feature is available for all plans, including the free tier, […]

It’s not like forgetting the milk at the grocery store. No big deal, just add it to the list for next time. But that kind of oversight in identity management […]

Overview The FIDO Alliance hosted a one-day seminar on “Advancing Authentication, Identity and Payments in Europe.” The seminar gathered many influential leaders and decision-makers to explore Europe’s evolving authentication, identity, and payments […]

Organizations are grappling with an increasingly diverse and sophisticated threat landscape, including AI-powered phishing campaigns, physical presentation attacks, and scalable, automated injection attacks. Join experts from BankID, iProov and FIDO […]

As a largely mobile-first region, there is widespread innovation, especially in payments. At the same time, bad actors are exploiting technologies and processes, putting this progress at risk. That is […]

The Better Identity Coalition has circulated a draft voluntary code of conduct it describes as “rules of the road” for how organizations request and use data from verifiable digital credentials. […]

SK Telecom has been appointed to the FIDO Alliance Board of Directors, adding a major mobile operator to the leadership group shaping industry priorities around passkeys and phishing-resistant authentication. The […]

Digital economies across the Americas are expanding rapidly, presenting both new opportunities and risks. As a largely mobile-first region, there is widespread innovation, especially in payments. At the same time, […]

Unlock your key to a more secure checkout. Use your unique payment passkey to secure your purchases.

Meta shares a novel approach to enabling cross-device passkey authentication for devices with inaccessible displays (like XR devices).

Federal authentication standards and major platform shifts have made passkeys the default login method for most consumer and enterprise accounts, pushing traditional password managers toward obsolescence. The FIDO2 protocol, backed […]

Fraud is evolving faster than ever, with AI-powered scams, deepfake-enabled identity theft, and a surge in account takeovers putting financial institutions on high alert and accountholders at risk. As the […]

Even though everyone knows 12345″ is a terrible password, it still lands at the top of “worst password” lists. We get it, no one likes remembering passwords, and changing them after […]

On December 5, 2025, the digital identity community gathered at Tokyo Port City Takeshiba for the 12th FIDO Tokyo Seminar. Under the theme “Towards a Passwordless World”, the event brought […]

WinMagic exposes the fundamental flaw in modern authentication: passkeys secure the login, but attackers have already moved on to sessions, tokens, and transactions. The company introduces Live Key and Live […]

Yubico, a modern cybersecurity company and creator of the most secure passkeys, today announced the launch of YubiNation Partners, a new global Channel program designed to unite a community of […]

It’s time to ditch passwords for passkeys People in the UK have been urged to start ditching passwords in favour of passkeys, where available, as a way to secure their […]

Creating new passwords on the spot can be really taxing. And that can also lead to some sloppy practices, like repeating old passwords or modifying them. But it turns out […]

Enterprises may be sharpening their understanding of digital identity threats but the industry is still struggling to turn that knowledge into large‑scale execution. Hypr’s latest State of Passwordless Identity Assurance […]

OpenAI is the newest member of the FIDO Alliance, joining the passwordless authentication group to contribute to its efforts to provide the secure and private digital identity frameworks that will be […]

Half of UK IT leaders polled say their organisation is now using passkeys. Passkeys are emerging into the mainstream as a practical and more secure alternative to passwords, promising a […]

Formation of Agentic Authentication Working Group and development of agentic payment frameworks will support trusted, interoperable agentic workflows April 28, 2026 – The FIDO Alliance today announced initiatives to develop […]

Overview The FIDO Alliance hosted a one-day seminar on “Advancing Passkeys in the Workforce.” The seminar gathered senior security and identity leaders for practical insights, meaningful discussion, and networking during […]

Researchers revealed what might be the biggest collection of stolen login credentials ever gathered in one location sometime in the middle of 2025. A compiled dataset, organized and searchable, contains […]

FIDO Alliance launches new standards to secure AI agent interactions, enabling trusted authentication and payments in emerging agentic commerce ecosystems As AI agents move from experimental tools to active participants […]

The landscape of Multi-Factor Authentication is dynamic, driven by new threats and technological advancements.

Crucial Insights Into Identity Threats, Technologies and Trends The sixth annual 2026 State of Passwordless Identity Assurance report, commissioned by HYPR and produced by 451 Research from S&P Global Energy […]

Case Study Authors: Shauna Pettit-Brown, Robert Hughes, Jean-Christophe Laurent, Kenn Chong, and Philip J Corriveau About RSA Security RSA provides the identity intelligence, authentication, access, governance, and lifecycle capabilities needed […]

When an AI agent buys something on your behalf, how does the merchant know you actually authorized it? That question sits at the center of Verifiable Intent, an open-source cryptographic […]

Passkeys are more secure than traditional ways to log in Passkeys offer a more usable, secure replacement for passwords and are already supported by most modern devices. At CYBERUK 2026 […]

Even though everyone knows “password123!” is terrible, it still lands at the top of “worst password” lists. We get it, no one likes remembering passwords, and even if you do have […]

The FIDO Alliance plans to develop standards for artificial intelligence (AI) agentic interactions and commerce that will define trusted mechanisms for how agents authenticate, act and transact on behalf of users. In these initiatives, […]

Authentication has long required an uneasy tradeoff between strong security and smooth user experience. Banks have relied on a mix of passwords, OTPs, SMS codes, voice calls, and push notifications […]

RSA has expanded support between RSA ID Plus and Microsoft 365 E7, extending the companies’ identity security partnership. The update focuses on authentication for workforce users and software-based agents inside […]

Aware, Inc. released a new report, The State of Biometric Security in the Age of AI Fraud, showing that 98% of organizations are interested in biometric orchestration amid rising AI-driven fraud and […]

The way we interact with technology is no longer confined to the browser. Cars, smart homes, wearable devices, and industrial systems are now deeply connected, driving unprecedented convenience and innovation, […]

CISOs know that the human element can be the weakest link in an enterprise’s cybersecurity defenses, often surfacing when end users create weak passwords that threat actors easily crack. Seeking […]

Andrew Shikiar, CEO and Executive Director, FIDO Alliance AI agents are starting to change how people and businesses get things done online. The shift is fundamental: agents can research, make […]

Google has donated its Agent Payments Protocol to the FIDO Alliance and released an updated version, including autonomous payment capabilities. The move is intended to ensure AP2 remains platform-agnostic and […]

Passkeys Are the New Passwords. You Should Start Using Them Now. For 15 years, experts have told me that passwords are the biggest problem with online security and that’s just […]

AI agents may soon be buying your stuff for you. The FIDO Alliance has teamed up with Google and Mastercard to try to ensure that shopping in the near future […]

With eIDAS 2 requiring every EU member state to offer a Digital Identity Wallet by the end of 2026, readiness now varies widely. Denmark and Ireland have opened test wallets and France and Germany lead on developer access, while Germany has said its state wallet will launch on 2 January 2027.

WEBINAR | Across the Passkey Landscape: Expert AMA Attendees celebrated World Passkey Day with FIDO Alliance in a dynamic, interactive AMA-style webinar on May 7. This special session brought together […]

Singapore has reached a milestone of 5 billion passkeys in use worldwide, as reported by the FIDO Alliance. The adoption of passkeys has been driven by a shift away from […]

The FIDO Alliance today announced agenda themes and program highlights for Authenticate APAC 2026, taking place June 2–3 at the Grand Hyatt Singapore. Bringing together global and regional leaders in authentication […]

Corporate Overview Banesco Banco Universal is the leading private bank in Venezuela, with more than 2.4 million monthly active users across its mobile and web banking platforms. The bank provides […]

Passkeys have made real progress in reducing phishing risk, but they do not tell an organisation much about the device being used to create a credential – whether it was […]

The FIDO Alliance and HID have released new research showing a widening gap between enterprise confidence in identity security and day‑to‑day operational performance. The State of Physical and Digital Identity in the Enterprise report […]

Nishant Kaushik, CTO, FIDO Alliance Our agents are getting more capable by the day. They write code, respond to emails, detect vulnerabilities, and optimize workflows. And increasingly, they will shop […]

Anew report uncovered a significant disconnect between enterprise confidence in identity security and operational reality, according to identity technology providers FIDO Alliance and HID. Of the 500 IT and cybersecurity […]

In this discussion, G. Mark Hardy and Nishant Kaushik explore the necessity of moving beyond traditional passwords, which they define as the original sin of cybersecurity due to their vulnerability […]

xMoney marks a key milestone in the evolution of digital payments, becoming the world’s first Mastercard issuer to launch the creation and enrollment of the Payment Passkey directly through its own mobile banking application. […]

Global innovators from Adidas, Apple, Grab, OpenAI, Samsung Electronics and more to share expertise at Singapore authentication & identity event Singapore, April 30, 2026 – The FIDO Alliance today announced […]

Global research from the FIDO Alliance finds near-universal awareness of passkeys, with high adoption rates among consumers and enterprises MOUNTAIN VIEW, Calif., May 7, 2026 – On World Passkey Day […]

Redefining Cybersecurity Governance: From Vulnerability Detection to Identity-Based Defense 1. Describe your service/platform/product and how it’s using passkeys, based on FIDO authentication. DragonSoft is a leading provider of cybersecurity vulnerability […]

Megan Shamas, CMO, FIDO Alliance On World Passkey Day 2026, we are announcing that an estimated 5 billion passkeys are now in active use worldwide. A decade ago, that scale […]

Why do users still get hacked? In the past, it was often because of weak passwords or the absence of multi-factor authentication (MFA), and for a long time, authentication was […]

Banking’s Authentication Problem Has Changed Banks are no longer fighting simple password reuse. They’re facing real-time phishing kits, MFA fatigue, session hijacking, AI-powered social engineering, and more. Traditional MFA methods, such […]

Enterprises may be more confident about identity security than they should be. A new report from the FIDO Alliance and HID finds a striking disconnect between how organizations perceive their […]

The FIDO Alliance has opened its June interoperability testing event, giving FIDO2 and FIDO UAF implementers a certification step for passwordless authentication products. The remote testing window runs June 8-12, […]

RSA has extended its passwordless authentication platform to Linux, bringing FIDO-based, phishing-resistant sign-in to Linux servers, developer workstations, and critical infrastructure that have typically relied on passwords and other legacy […]

Amazon is sharing new data to suggest passkeys are in favour with 465 million customers now, ensuring expedited, secure authentication six times quicker than traditional passwords. Passkeys achieve an enhanced […]

Research Reveals 94% of Enterprises Claim They Can Revoke Employee Access Within 24 Hours, Yet 35% experienced delays or failures in the past two years  Identiverse, Las Vegas, June 15, […]

FIDO Alliance and HID have launched The State of Physical and Digital Identity in the Enterprise, a new research report examining how organizations manage physical and logical access across their […]

The FIDO Alliance is seeking a specialized consulting partner to guide us through the ISO/IEC 17065 accreditation process. Our objective is to be recognized as a Certification Body (CB) capable […]

Corporate Overview Semperis is an identity security company founded in 2013 and headquartered in Hoboken, New Jersey, with approximately 600 employees across North America, Europe, APAC and Israel. The company’s […]

Passkeys have reached global scale with 5 billion passkeys now in active use. Across both consumer and workforce environments, awareness is now near-universal and adoption has followed: 90% of consumers […]

India's Digital Personal Data Protection Rules, notified in late 2025, are rolling out in phases. The Consent Manager framework becomes operational by 13 November 2026, with the remaining substantive obligations following by 13 May 2027. Penalties reach up to 250 crore rupees for failing to take reasonable security safeguards.

Our takeaways from Identiverse 2026 in Las Vegas: AI agent identity moved from theory to roadmap, passkeys turned operational, deepfakes pressured identity verification, and session security took center stage.

The FIDO Alliance announced an estimated 5 billion passkeys now in use worldwide, with 75 percent of people having enabled a passkey on at least one account. Its State of Passkeys 2026 report, spanning 11,000 consumers and 1,400 enterprises across ten countries, marks passkeys moving firmly into the mainstream.

As NIST post-quantum standards mature, certificate and PKI vendors began planning crypto-agile migrations for machine identity.

Work continued on OAuth 2.1, which folds widely adopted security practices into a single specification and removes legacy grants.

Vendors and standards bodies began addressing identity for AI agents, focusing on scoped, delegated, and revocable credentials and MCP authorization.

Microsoft research found the overwhelming majority of identity attacks target passwords, and that phishing-resistant MFA blocks over 99% of them.

Banks and governments piloted reusable, wallet-based credentials to cut repeat KYC, aligned with eIDAS 2.0 and W3C standards.

IBM Cost of a Data Breach research showed a modest decline in average breach cost, driven by faster identification and containment.

The FIDO Alliance said more than 15 billion online accounts now support passkey sign-in, roughly doubling availability year over year.

Industry analysts continued to position identity as the primary security control plane, driving investment in ITDR, ISPM, and governance.

Palo Alto Networks agreed to acquire privileged access leader CyberArk in a deal valued around $25 billion, its largest acquisition and a major bet that identity security is core to platform consolidation.

Investor interest in non-human identity governance grew, with multiple startups raising rounds to discover and secure service accounts, tokens, and agents.

Analysts and vendors formalized non-human identity governance as its own category, covering discovery, posture, and lifecycle for machine identities.

Ping Identity acquired Procyon and relaunched it as PingOne Privilege, adding cloud just-in-time privileged access to its platform.

The OpenID Foundation advanced OpenID for Verifiable Credentials profiles, improving interoperability for issuing and presenting digital credentials.

Adoption of the Shared Signals Framework and CAEP grew, letting providers share security events and revoke sessions in near real time.

Threat researchers reported a sharp rise in infostealer malware harvesting credentials and live session cookies, enabling attackers to bypass MFA.

Microsoft began defaulting new consumer accounts to passwordless sign-in with passkeys, citing the scale of password-based attacks.

Researchers described one of the largest aggregations of stolen credentials to date, largely sourced from infostealer logs and prior breaches.

CyberArk research found non-human identities vastly outnumber human ones, driven by cloud and AI, and that most organizations lack controls for them.

The W3C finalized the Verifiable Credentials Data Model 2.0 family as Recommendations, a milestone for decentralized identity and the EU Digital Identity Wallet.

The FIDO Alliance marked World Passkey Day with new adoption data and a pledge program to accelerate the shift away from passwords.

The annual Data Breach Investigations Report again highlighted stolen credentials, phishing, and the human element as dominant breach factors.

Identity governance leader SailPoint listed on Nasdaq again under ticker SAIL, while remaining majority-owned by Thoma Bravo.

Reports of exposed cloud credentials drew attention to single-sign-on and federation hygiene, though details and scope were disputed.

GitGuardian found tens of millions of new hardcoded secrets exposed in public commits, with a large share still valid long after leaking.

Developer identity vendors began shipping features to issue and verify identities for AI agents and bots, an early sign of agentic identity going mainstream.

CyberArk acquired cloud-native identity governance vendor Zilla Security to add lightweight access reviews and provisioning to its platform.

Verification vendors reported rapid growth in deepfake and injection attacks against remote identity proofing, raising the bar for liveness detection.

The OAuth 2.0 Security BCP became RFC 9700, consolidating hardening guidance such as PKCE everywhere and sender-constrained tokens.

The Digital Operational Resilience Act began to apply, raising the bar for access controls, identity governance, and third-party risk in EU finance.

A US cybersecurity executive order directed federal agencies toward phishing-resistant authentication such as passkeys and PIV, reinforcing the move off passwords.

The FIDO Alliance published specifications to let users securely move passkeys between providers, addressing a key adoption blocker.

CISA reiterated guidance to move from SMS and push-based MFA to phishing-resistant methods like FIDO2 and passkeys.

Major consumer brands continued rolling out passkeys, with the FIDO Alliance reporting steady growth in passkey-enabled accounts.

Authorities warned that the Scattered Spider group continued to bypass MFA through help-desk social engineering and SIM swapping, hitting major enterprises.

Yubico grew its YubiEnterprise subscription for distributing hardware security keys, easing phishing-resistant rollouts at scale.

Microsoft enabled passkeys in its Authenticator app, expanding phishing-resistant sign-in options for consumer and work accounts.

The NIS2 directive deadline pushed many EU organizations to strengthen MFA, access control, and identity governance as baseline obligations.

CyberArk completed its acquisition of Venafi, combining human and machine identity security as certificate and workload identities proliferate.

Okta detailed hardening and a secure-identity initiative following its 2023 support-system breach, including session and admin protections.

Apple introduced a standalone Passwords app across its platforms, making passkeys and credential sync more visible to consumers.

NIST advanced SP 800-63-4, emphasizing phishing-resistant authentication, syncable passkeys, and revised identity proofing guidance.

Developer-led authorization engines saw rising adoption as teams externalized access decisions from application code.

Okta introduced Identity Threat Protection, using shared signals to detect risk and revoke sessions in real time across the session lifecycle.

Researchers reported a massive aggregation of previously leaked passwords, a reminder that credential reuse keeps fueling account-takeover attacks.

Following customer breaches, Snowflake began letting admins enforce MFA and moved toward mandatory multifactor authentication for accounts.

WorkOS acquired Warrant to add fine-grained, relationship-based authorization to its enterprise-readiness toolkit for B2B SaaS.

A wave of breaches at Snowflake customers was attributed to stolen credentials and accounts without multifactor authentication, fueling major data theft.

Live Nation confirmed a breach of Ticketmaster data hosted in Snowflake, part of a campaign exploiting accounts without multifactor authentication.

The EU adopted eIDAS 2.0, requiring member states to offer digital identity wallets and accelerating verifiable-credential adoption across Europe.

Google began prompting users to create and use passkeys by default, accelerating mainstream passwordless adoption.

Cisco Duo notified customers that a breach at a telephony provider exposed SMS multifactor message logs, underscoring the weakness of SMS-based MFA.

SailPoint expanded through acquisitions including Imprivata governance assets and UK-based PAM vendor Osirium, broadening its identity security platform.

Entrust acquired identity verification specialist Onfido, adding AI-based document and biometric verification to its IAM and PKI portfolio.

Password manager 1Password acquired Passage to accelerate passkey adoption across consumer and business products.

HashiCorp introduced Vault Radar to scan code and systems for unmanaged and leaked secrets, extending its secrets-management footprint.

IBM agreed to acquire HashiCorp, bringing Vault secrets management and Boundary access into its hybrid-cloud portfolio. The deal closed in 2025.

The Change Healthcare ransomware attack, one of the most disruptive in US healthcare, started with compromised credentials on a server lacking MFA.

Microsoft finished renaming Azure Active Directory to Microsoft Entra ID and expanded the Entra family with Internet Access and Private Access.

Microsoft reported the Russia-linked Midnight Blizzard group accessed executive email after password-spraying a legacy test account without MFA.

23andMe attributed a large data exposure to credential stuffing against accounts that reused passwords and lacked MFA, later leading to settlements.

Okta disclosed that attackers accessed its support system using a stolen credential, exposing session tokens and prompting customers to harden configurations.

Tenable acquired Ermetic, folding cloud infrastructure entitlement management into its exposure-management platform.

Attackers reportedly reset an employee credential via the help desk to breach MGM Resorts, a high-profile example of social engineering defeating identity controls.

Thoma Bravo closed its ForgeRock purchase and combined it with Ping Identity, consolidating two enterprise access-management leaders under one owner.

Microsoft disclosed that a China-linked group, Storm-0558, forged authentication tokens using a stolen signing key to access email, intensifying scrutiny of token security.