account takeover
6 posts
Passkeys don't stop account takeover
Passkeys stop phishing, but retained recovery paths and synced platform vaults mean the weakest accepted path still defines account takeover risk.
Q1 2026: Iranian crews living off P2P
Compromised P2P accounts are driving lateral movement and exfiltration in Israeli orgs. The fabric, not the platform, is the C2 channel.
The chatbot answered the door for attackers
Meta's Instagram chatbot abuse case is a prompt injection and confused deputy failure. Technical breakdown of the vector, telemetry gap, and residual exposure.
Meta's chatbot handed out accounts
Meta confirmed thousands of Instagram accounts compromised via AI chatbot abuse. The chatbot was treated as a boundary it could not hold.
A license audit caught the breach
A six-week account takeover surfaced during a license audit. The detection vector defines the control failure.
License audit caught a six-week account takeover
A six-week account takeover surfaced in a license audit that never checked access legitimacy. Why that gap is a control failure, not a breach.