Danbooru Flash XSS worm stole viewer IPs and hijacked accounts
The site was taken down in about six minutes; roughly 300 people ran the worm and seven got unused API keys.
Stories per day · 30 days
6 RSS
Relatedcapcom5gaming5phishing5capcom-id4data-breach4bec3doj3sentencing3social-engineering3authentication2chatgpt2fraud2syria2syrian-electronic-army2xss2adspower1aitm1android1
83 stories, newest first · one card per story
Stories tagged #account-takeover
Fingerprint launches Fraud Score trained on customer fraud outcomes
Separate models cover payment fraud, account takeover, fake accounts and promotion abuse, and retrain as customers add outcomes.
Default OpenIDM admin password let researchers unlock and start cars
Two unnamed brands fixed the consoles in about two hours; a permitted test also exposed location and telemetry.
FortiMail flaw lets unauthenticated attackers take over IBE accounts
Fortinet rates the IBE account-takeover issue CVSS 9.1; the notice gives no versions, fix, or exploitation status.
Hackers lock out Li Auto EV owners in Russia demanding ransom
Hackers demand $500-$600 to unlock hijacked Li Auto cars in Russia using leaked VINs and eSIMs; number of victims likely exceeds 20.
SkyW4lker phishing kit abuses Microsoft device-code authentication
SkyW4lker, GeorgeGinx and Mir0Auth compromise Microsoft 365 accounts via legitimate device-code flows in October 2026.
3
Parameter Labs finds exploit to take over ChatGPT accounts
Parameter Labs discovered a complex attack chain exploiting ChatGPT's HTML previews via postMessage-triggered MathLive virtual keyboard.
Syrian Electronic Army hacker sentenced to 42 months in US
Ahmad Umar Agha, known as Th3Pr0, was sentenced Thursday after more than a decade as a fugitive; accomplice Firas Dardar remains at large.
1
ChatGPT share links executed JavaScript in signed-in sessions
Researchers read a private chat and sent it off-site; OpenAI fixed the P1 issue on October 26.
Syrian hacker Ahmad Umar Agha sentenced to 42 months in US
Prosecutors say he hit about 47 targets from 2011 to 2024, including a 2013 fake AP tweet that briefly erased $136 billion.
1
Syrian Electronic Army hacker sentenced to 42 months
Ahmad Umar Agha, known as Th3Pr0, was jailed Thursday; co-defendant Firas Dardar remains a fugitive.
1
Stolen K-12 staff logins used to phish other school districts
MS-ISAC notified 808 of 6,116 K-12 members that staff credentials were on underground markets and expects hopping to continue.
Capcom says breach exposed data from 11.7 million Capcom ID accounts
The attacker changed passwords on 196 accounts even though stored passwords were not accessed.
Thieves spoof GPS and hijack broker accounts to steal data-center cargo
Investigators say more than $100 million in data-center freight has been taken since June, and some of the largest loads were never recovered.
1
uCreator Android spyware steals Telegram 2FA and clones WeChat
The rentable kit hides in sideloaded Telegram and WeChat copies; its code and C2 match Doctor Web’s Baohuo.
TransUnion puts US lenders' synthetic identity fraud exposure at $2.4 billion
The June 2026 estimate is potential exposure, not confirmed losses, with auto lending accounting for $1.5 billion.
2
Capcom breach exposes 11.7 million email addresses
Attackers also took account metadata and changed passwords on 196 CAPCOM ID accounts, which Capcom reset.
1
India SIM-binding rules may block WhatsApp without a registered SIM
Covered apps have until December 31, 2026, with the requirement expected to take effect on January 1, 2027.
1
Capcom breach exposes 11.7 million CAPCOM ID records
Stolen data is mostly emails and login metadata; Capcom found no customer passwords taken and reset 196 accounts.
Capcom says breach exposed 11 million CAPCOM ID email addresses
Attackers also changed passwords on 196 accounts; Capcom says stored passwords were not stolen and those accounts were reset.
Capcom confirms CAPCOM ID breach affecting 11.7 million accounts
Exposed data is mostly emails and login metadata; passwords and card data were not exposed for other members.
Kaseya promotes INKY to detect stealthy email account takeover
The sponsored piece says attackers linger in inboxes, then phish customers and suppliers from trusted accounts that ordinary filters accept.
1
Check Point: antidetect browsers hide large fake-account operations
Kameleo, AdsPower, and MultiLogin can isolate profiles, mask fingerprints, and reuse stolen session cookies at scale.
2
Keycloak 26.7.2 unauthenticated account takeover exploit published
Exploit-DB lists a web-app exploit that takes over accounts in Keycloak 26.7.2 without authentication.