Microsoft has alerted users that hackers are targeting password reset processes to breach accounts. The activity is attributed to the group Storm-2949.
Microsoft issued the warning about ongoing efforts to exploit password resets for unauthorized access. The hackers involved are described as operating a methodical, sophisticated, and multi-layered campaign under the name Storm-2949.
Imeripotiwa na AI Picha iliyoundwa na AI
Hackers exploited Meta's AI support chatbot to take over Instagram accounts by tricking it into changing associated email addresses. The vulnerability allowed password resets without two-factor authentication after matching locations via VPN. Meta resolved the issue with an emergency patch on May 29.
Seventy-three Microsoft open source packages were compromised late last week with malware that steals credentials from cloud services and developer tools. The malicious code activates when opened in AI coding agents.
Imeripotiwa na AI
Security specialists have raised alarms over the vulnerability of online accounts, stating that almost half of all passwords in use today can be broken within minutes.
The US State Department is offering a reward of up to $10 million for information on two Russian state-linked cyber groups behind a phishing campaign targeting Signal and WhatsApp accounts. The operation has compromised thousands of accounts since at least March.
Imeripotiwa na AI
Security researcher Alexander Hagenah has released an updated tool called TotalRecall Reloaded that reveals weaknesses in Microsoft Windows 11's Recall feature. Despite Microsoft's security overhauls, the tool can intercept user data after Windows Hello authentication without needing administrator privileges. Microsoft maintains that this does not represent a vulnerability.