# account takeover Published articles for account takeover. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Expanding Fraud Strategies Beyond Payment Fraud DevFeed: [Expanding Fraud Strategies Beyond Payment Fraud]() Original publisher: [Read original article]() Author: Sift Trust and Safety Team Published: 2026-08-26T18:08:35Z Content type: article Language: en Sources: [Sift Science]() Topics: [account takeover]() Tags: [account-takeover](), [chargeback-disputes](), [chargebacks](), [compliance](), [customer-trust](), [fraud](), [fraud-and-compliance](), [fraud-prevention](), [fraud-strategy](), [loyalty-point-fraud](), [loyalty-points](), [non-payment-fraud](), [payment-fraud](), [promo-abuse](), [trust-and-safety]() ### AI overview This article explains why fraud programs should address risks across the full customer lifecycle rather than focusing only on payment fraud. It discusses account takeover, fake accounts, promo abuse, loyalty points, giveaways, and coordination between fraud, risk, and compliance teams. ### Source excerpt Most fraud programs start with payment fraud, and for good reason. It's the fastest path to measurable loss. But teams that stop there often miss account takeover, fake account creation, and promo abuse until those problems show up in support tickets, chargeback disputes, or a spike in customer complaints. By the time it's visible, it's [...] The post How to Solve for More Than Just Payment Fraud appeared first on Sift. ## What is Trust and Safety? DevFeed: [What is Trust and Safety?]() Original publisher: [Read original article]() Author: Ben Price Published: 2026-08-28T23:00:00Z Content type: article Language: en Sources: [Sift Science]() Topics: [Security, Privacy and Abuse Prevention](), [Transactions](), [account takeover]() Tags: [account-takeover](), [authentication](), [chargebacks](), [digital-platforms](), [digital-trust](), [digital-trust-safety](), [fraud-detection](), [fraud-prevention](), [payment-fraud](), [trust](), [trust-and-safety](), [trust-safety]() ### AI overview This article explains Trust and Safety as an organizational capability for protecting digital platforms, users, transactions, and interactions. It describes how the discipline brings together fraud prevention, content moderation, abuse prevention, and policy enforcement across the user journey, including payment fraud, fake account creation, account takeover, and content integrity. ### Source excerpt Trust and Safety is the practice of protecting the integrity of digital platforms, their users, and the transactions and interactions that take place on them. As a discipline, trust and safety spans fraud prevention, content moderation, abuse prevention, and policy enforcement across the full user journey. For fraud teams and platform operators, it represents a [...] The post What is Trust and Safety? appeared first on Sift. ## Loyalty points fraud is funding hacker holidays (Lock and Code S07E18) DevFeed: [Loyalty points fraud is funding hacker holidays (Lock and Code S07E18)]() Original publisher: [Read original article]() Author: Malwarebytes Labs Published: 2026-09-07T18:23:18Z Content type: article Language: en Sources: [Malwarebytes]() Topics: [Cybercrime](), [passwords]() Tags: [account-takeover](), [airline](), [airline-miles](), [credit-card-points](), [cybercrime](), [fraud](), [hotel-rewards](), [loyalty-account](), [loyalty-points](), [loyalty-points-fraud](), [podcast](), [points](), [rewards-account](), [rewards-points]() ### AI overview A Lock and Code podcast episode examines loyalty-points theft, why criminals target points balances, and ways companies and consumers can protect against fraud. ### Source excerpt This week on the Lock and Code podcast, we speak with Kim Sutherland about loyalty points fraud and how everyday people can stay safe. ## X Money rollout linked to password-reset attacks DevFeed: [X Money rollout linked to password-reset attacks]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-04T12:29:41Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [passwords]() Tags: [account-takeover](), [attacks](), [breach](), [financial-services](), [how-to](), [news](), [password-reset](), [scams](), [security](), [social-engineering](), [x-money]() ### AI overview X is investigating unsolicited password-reset emails sent to users amid the wider availability of X Money. The company says it has found no evidence of a breach, successful account takeovers, or access to X Money funds. ### Source excerpt As X expands into payments, users are receiving password-reset emails they didn't request. Here's what may be happening and how to stay safe. ## Tata's B2B platform returned OTPs in API responses DevFeed: [Tata's B2B platform returned OTPs in API responses]() Original publisher: [Read original article]() Author: Eaton Published: 2026-08-24T14:25:14Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [account takeover](), [API](), [Encryption](), [Binance]() Tags: [account-takeover](), [api](), [b2b](), [encryption](), [platform](), [vulnerability]() ### AI overview A security write-up describes a vulnerability in Tata nexarc that returned OTPs in API responses. Because the responses could be decrypted client-side, an attacker with a target's phone number could obtain the OTP and take over the account, including accounts with administrative privileges. ### Source excerpt Tata's nexarc platform had a vulnerability where OTPs could be decrypted from API responses, making it easy to take over any account. ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Exploiting Volvo/Eicher's fleet management platform to gain control over all users and vehicles DevFeed: [Exploiting Volvo/Eicher's fleet management platform to gain control over all users and vehicles]() Original publisher: [Read original article]() Author: Eaton Published: 2026-07-27T14:31:47Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [Exploit](), [account takeover](), [API](), [Security](), [data](), [App](), [Website](), [Android](), [iphone]() Tags: [account-takeover](), [android](), [api](), [app](), [automotive](), [data](), [india](), [iphone](), [security](), [vulnerability]() ### AI overview The article reports vulnerabilities in VE Commercial Vehicles' My Eicher fleet-management platform that exposed hidden unauthenticated APIs and could enable account takeover and control of users' vehicle fleets. It also describes potentially exposed customer, user, vehicle, and identity-document data. A July 28, 2026 update says the concerns were remediated in coordination with the VECV team and that there was no current threat to customers or vehicles. ### Source excerpt VE Commercial Vehicles' My Eicher platform had a critical vulnerability that let you take over anyone's account and gain control over their vehicle fleets. ## EvilTokens: A phishing attack that doesn't steal your password DevFeed: [EvilTokens: A phishing attack that doesn't steal your password]() Original publisher: [Read original article]() Author: Christian Ali Bravo Published: 2026-06-15T08:55:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [OAuth 2.0](), [account takeover](), [microsoft 365](), [Microsoft](), [MFA](), [Reconnaissance](), [Authorization]() Tags: [account-takeover](), [attacks](), [authentication](), [cybercrime](), [microsoft](), [microsoft-365](), [oauth](), [phishing](), [process](), [time](), [tokens]() ### AI overview EvilTokens is a phishing-as-a-service kit that abuses Microsoft 365's OAuth 2.0 device authorization flow to compromise accounts without directly stealing passwords. Victims authenticate on Microsoft's genuine login page, unknowingly approving an attacker-controlled device; the resulting access and refresh tokens can enable account takeover and business email compromise. ### Source excerpt A phishing kit subverting Microsoft's legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages ## Introducing Advanced Account Security DevFeed: [Introducing Advanced Account Security]() Original publisher: [Read original article]() Published: 2026-04-30T00:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [Security](), [ChatGPT](), [account takeover](), [codex](), [Passkeys](), [Cybersecurity](), [passwords]() Tags: [account-takeover](), [attacks](), [chatgpt](), [codex](), [data](), [phishing](), [privacy](), [product](), [recovery](), [security]() ### AI overview OpenAI introduces Advanced Account Security, an opt-in setting for ChatGPT accounts that also protects Codex through the same login. It combines stronger sign-in requirements, tighter account recovery, reduced exposure from compromised sessions, and greater visibility into account activity. The setting requires passkeys or physical security keys, disables password-based login and email or SMS recovery, and supports backup passkeys, security keys, and recovery keys. ### Source excerpt Introducing Advanced Account Security: phishing-resistant login, stronger recovery, and enhanced protections to safeguard sensitive data and prevent account takeover. ## Chargeback Fraud Prevention: How to Protect Your Digital Business Revenue DevFeed: [Chargeback Fraud Prevention: How to Protect Your Digital Business Revenue]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-04-04T00:00:00Z Content type: tutorial Language: en Sources: [Dodo Payments Blog]() Topics: [Security, Privacy and Abuse Prevention](), [Software as a service](), [account takeover](), [Software]() Tags: [account-takeover](), [chargebacks](), [data-breaches](), [digital-products](), [fraud-prevention](), [merchant-of-record](), [payment-fraud](), [payments](), [phishing](), [revenue](), [saas]() ### AI overview A guide to preventing chargeback fraud for SaaS and digital product businesses. It explains types of chargeback fraud, signals to monitor, fraud-prevention tools, and how the Merchant of Record model can shift fraud liability. ### Source excerpt Stop chargeback fraud with proven prevention strategies for digital product sellers and SaaS companies, from fraud signals to MoR protection. ## Compromised axios npm package delivers cross-platform RAT DevFeed: [Compromised axios npm package delivers cross-platform RAT]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm packages](), [Remote Access Trojan](), [backdoor](), [account takeover](), [payload](), [npm](), [OpenID connect (OIDC)](), [GitHub Actions](), [Linux](), [Windows]() Tags: [account-takeover](), [backdoor](), [ci-cd](), [github-actions](), [linux](), [npm-packages](), [oidc](), [payload](), [remote-access-trojan](), [supply-chain](), [windows]() ### AI overview The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages. ### Source excerpt An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. ## OfferUp scammers are out in force: Here's what you should know DevFeed: [OfferUp scammers are out in force: Here's what you should know]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-02-04T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [App](), [account takeover](), [Authentication](), [Mobile]() Tags: [account-takeover](), [app](), [authentication](), [consumer](), [fraud](), [marketplace-app](), [mobile](), [phishing](), [scams]() ### AI overview This article describes common scams targeting OfferUp buyers and sellers, including counterfeit items, payment fraud, account takeover attempts, empty-box listings, and phishing links. It explains warning signs and how scammers exploit off-platform payments or verification codes. ### Source excerpt The mobile marketplace app has a growing number of users, but not all of them are genuine. Watch out for these common scams. ## The future of pentesting is Human x AI, and it's already in Burp Suite Professional DevFeed: [The future of pentesting is Human x AI, and it's already in Burp Suite Professional]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2025-10-07T13:17:41Z Content type: opinion Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Security](), [Testing](), [Automation](), [Bug Bounty](), [account takeover]() Tags: [2025](), [account-takeover](), [ai](), [ai-tools](), [automation](), [bug-bounty](), [security]() ### AI overview The article argues that AI-assisted penetration testing is already widespread, while human expertise remains essential. It presents Burp AI in Burp Suite Professional as a human-controlled tool for summarizing data, iterating payloads, scaffolding proofs of concept, and helping testers identify complex vulnerabilities such as account takeover. ### Source excerpt The latest Hacker-Powered Security Report from HackerOne makes one thing clear: AI-assisted pentesting isn't a future trend; it's today's reality. In HackerOne's 2025 report, 70% of surveyed researche ## Registries and the npm Breach: Securing the Weakest Link in the Software Supply Chain DevFeed: [Registries and the npm Breach: Securing the Weakest Link in the Software Supply Chain]() Original publisher: [Read original article]() Published: 2025-09-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [npm](), [chainguard libraries](), [Malware](), [Software]() Tags: [account-takeover](), [api-keys](), [chainguard-libraries](), [chainguard-libraries-for-java](), [chainguard-libraries-for-python](), [ci-cd](), [malware](), [malware-prevention](), [npm](), [npm-compromise](), [security](), [software-supply-chain](), [supply-chain](), [supply-chain-attacks]() ### AI overview The article examines a compromise affecting 20 popular npm packages and explains how package-registry attacks can steal environment variables and API keys, establish production backdoors, compromise CI/CD processes, and evade existing supply-chain controls. It presents Chainguard Libraries as a defense based on going back to source repositories. ### Source excerpt Chainguard Libraries provides a different and proven defense against supply chain attacks like the recent npm breach. See why preventing malware is important. ## Top 10 web hacking techniques of 2024 DevFeed: [Top 10 web hacking techniques of 2024]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-02-04T15:01:48Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Hacking](), [Application Security](), [Security](), [web applications](), [OAuth](), [Cache](), [account takeover](), [LocalStorage](), [JavaScript]() Tags: [2025](), [account-takeover](), [cache](), [chatgpt](), [cookies](), [hacking](), [oauth](), [research](), [security](), [techniques](), [web](), [xss]() ### AI overview This annual community-powered review identifies notable web security research and hacking techniques from 2024. The supplied excerpts discuss OAuth flow hijacking through Cookie Tossing, risks involving cookies and JavaScript's Same-Origin Policy, and a ChatGPT account takeover using inconsistent decoding, path traversal, and Web Cache Deception. ### Source excerpt Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year ## CSRF Attacks: Examples and Mitigations DevFeed: [CSRF Attacks: Examples and Mitigations]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2021-03-25T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Exploit](), [web applications](), [browser](), [Cookies](), [HTML](), [HTTP](), [account takeover](), [Code]() Tags: [account-takeover](), [browser](), [code](), [cookies](), [exploit](), [html](), [http](), [xss]() ### AI overview This tutorial explains how Cross-Site Request Forgery (CSRF) attacks use browsers, HTML elements, cookies, and ambient credentials to submit requests as a logged-in user. It presents examples of state-changing requests and discusses their security impact and mitigations. ### Source excerpt Understanding Cross-Site Request Forgery (CSRF) and its Mitigations.