ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “FIDO2”

3 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPhishing & fraud 3Policy & legal 1Research 1
SeverityAllcritical 0high 0medium 3low 0info 2

UK Government Begins Moving 23 Million Users Away From Passwords

UK government rolls out passkeys for GOV.UK One Login, giving 23 million users phishing-resistant passwordless access to public services.

The UK government has begun deploying passkeys across GOV.UK One Login for more than 23 million users, replacing passwords and SMS one-time codes with FIDO2 cryptographic credentials. A trial saw over 300,000 people adopt passkeys, and nearly one in ten daily authentications already use them, cutting SMS verification costs by almost £600 per day. Passkeys remain optional, with password-based sign-in retained as a fallback, and the NCSC endorses the approach as phishing-resistant.

Cyber Security News · 1d agoPolicy & legal

Credential Theft: How Attackers Steal & Use Stolen Credentials

Huntress explains how attackers steal credentials through phishing, AitM, infostealers, and dumping, then use them for lateral movement, BEC, and ransomware.

Huntress published an educational overview of credential theft, citing that roughly 70% of confirmed data breaches begin with stolen credentials. It details acquisition methods including phishing, adversary-in-the-middle attacks that capture MFA session tokens, infostealers (nearly a quarter of threats Huntress observed in 2025), Mimikatz-based credential dumping, credential stuffing, and password spraying. The piece then covers post-theft actions such as lateral movement, privilege escalation, account takeover, business email compromise, and ransomware, and closes with behavioral detection guidance and layered prevention strategies.

Huntress · 5d agoResearch

Cybercriminals are building phishing pages that exist only inside victims’ browsers

Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.

Barracuda researchers describe a phishing campaign that starts with DocuSign-themed emails carrying calendar invites pointing to genuine Microsoft OAuth endpoints, then routes victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The login page is assembled entirely inside the victim's browser from a blob URL, registers a service worker, and runs inside a sandboxed iframe that receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and redirect chains, and behavior-based identity controls rather than URL blocklisting.

Help Net Securityupdated · 5d agofirst · 6d agoPhishing & fraud in the wild 3 sources