#accounttakeover

⚠️ #SW_ISAC_ADVISORY

There is a spate of #AccountTakeover underway.

Service providers may receive reports for accounts that have a display name beginning with "Hacked -" or linking to "t[.]me/HomeFucker5"

These accounts may be longstanding valid accounts that have been hijacked.

While investigating, consider

1. deleting any offensive posts,
2. freezing the account until the rightful owner can reclaim it,
3. use of two-factor authentication for accounts shown to be at risk

🚨 Dropbox Hack / Data Breach: Lenovo ID Flaw Enabled Account Takeover A serious Dropbox security incident highlights a dangerous weakness in federated identity. Attackers allegedly registered Lenovo IDs using victims’ email addresses, then abused Dropbox SSO / OIDC federation** to authenticate against existing Dropbox accounts. The disturbing part: • No Dropbox password was required • Victims didn't necessarily have a Lenovo ID • The attack relied on email-based account matching • A rogue identity could become a trusted federated identity • Attackers could obtain a legitimate-looking Dropbox session This is essentially an account takeover through an identity-provider trust failure, not a traditional password compromise. The full technical breakdown covers the Dropbox hack, Lenovo ID vulnerability, OIDC attack chain, federated authentication flaw, affected users, Dropbox's remediation, and defensive recommendations: https://thecybersecguru.com/news/dropbox-breach-lenovo-id-account-takeover/ #Infosec #CyberSecurity #Dropbox #DropboxHack #DropboxBreach #DataBreach #AccountTakeover #Lenovo #LenovoID #OIDC #SSO #FederatedIdentity #IdentitySecurity #CloudSecurity

NPM account takeovers via expired maintainer domains You don't need to exploit npm to poison it. Buy the expired email domain behind a maintainer's account, reset the password, and the package is yours. We scanned 2.1 million packages, extracted 6.7 million maintainer emails, and found 675 expired domains leaving 2,843 packages open to takeover. Those packages sit under 257,000+ dependent repos and 93,000 downstream packages. One lapsed domain renewal, a supply chain full of blast radius. https://laburity.com/research-npm-account-takeovers/ #SupplyChainSecurity #npm #AccountTakeover #AppSec #Laburity

CVE-2026-18577 is being exploited in the wild for N-central account takeover. An incomplete patch let attackers gain admin access. Update to 2026.3.1.7. #Nable #Ncentral #CVE202618577 #AccountTakeover #RMM #CyberSecurity https://securityonline.info/cve-2026-18577-n-central-account-takeover/?utm_source=mastodon&utm_medium=jetpack_social

Kimai vulnerability CVE-2026-52824 (CVSS 9.1) lets attackers forge cookies for account takeover via a default Docker APP_SECRET. Update to 2.58.0 now. #Kimai #AccountTakeover #Docker #CVE202652824 #OpenSource https://securityonline.info/kimai-account-takeover/?utm_source=mastodon&utm_medium=jetpack_social

🤖 Zoom warns of critical Windows account takeover vulnerability. Unauthenticated attackers can exploit the desktop client and SDK to hijack accounts. Patch now. 🔗 https://www.bleepingcomputer.com/news/security/zoom-warns-of-critical-account-takeover-vulnerability/ #CVE #AccountTakeover #Zoom #CyberSec

Zoom vulnerability CVE-2026-53412 (CVSS 9.8) allows unauthenticated account takeover over the network. Update Zoom Workplace for Windows to 7.0.0 now. #Zoom #CVE202653412 #AccountTakeover #Windows #CyberSecurity https://securityonline.info/zoom-account-takeover-flaw/?utm_source=mastodon&utm_medium=jetpack_social