Attackers check the victims' Office 365 credentials in real time as they are typed into the phishing landing page, by using authentication APIs.

The Russia-linked threat group is harvesting credentials for Microsoft's cloud offering, and targeting mainly election-related organizations.

Naked Security Live – here’s the recorded version of our latest video. Enjoy.

Tricked-out home offices have led to an influx in printers, many of which have not been set up securely, leaving workers and their companies vulnerable.

With open source developers regularly churning out new tools, the risk landscape has become too fragmented to properly monitor.

If you want to lock down your Nextcloud instance so only certain computers can log in, follow these steps.

Have you tested your network using a breach and attack simulator? If not, Jack Wallen shows you how with Infection Monkey.

Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers

Close to 2,000 e-commerce sites were infected over the weekend with a payment-card skimmer, maybe the result of a zero-day exploit.

Fairfax County Public Schools has launched an investigation following a ransomware attack on some of its technology systems.

The flaws are disclosed as Oracle reportedly partners with TikTok as concerns in the U.S. over spying continue.

A misconfigured, Mailfire-owned Elasticsearch server impacted 70 dating and e-commerce sites, exposing PII and details such as romantic preferences.

A new advisory from CISA outlines recent hacking tactics, techniques, and procedures (TTPs) used by Chinese nation state threat actors to target US agencies; it also includes includes ATT&CK Framework TTPs.

An expert in economics and cybersecurity applies opportunity cost and other concepts of the dismal science to infosec roles.

The campaign targeted sites running Magento Version 1, a version of the e-commerce software that is past end-of-life.