# account takeover An account takeover attack is unauthorized access to a user's online-account credentials, potentially enabling fraud, identity theft, and other cyberattacks. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Expanding Fraud Strategies Beyond Payment Fraud DevFeed: [Expanding Fraud Strategies Beyond Payment Fraud]() Original publisher: [Read original article]() Author: Sift Trust and Safety Team Published: 2026-08-26T18:08:35Z Content type: article Language: en Sources: [Sift Science]() Topics: [account takeover]() Tags: [account-takeover](), [chargeback-disputes](), [chargebacks](), [compliance](), [customer-trust](), [fraud](), [fraud-and-compliance](), [fraud-prevention](), [fraud-strategy](), [loyalty-point-fraud](), [loyalty-points](), [non-payment-fraud](), [payment-fraud](), [promo-abuse](), [trust-and-safety]() ### AI overview This article explains why fraud programs should address risks across the full customer lifecycle rather than focusing only on payment fraud. It discusses account takeover, fake accounts, promo abuse, loyalty points, giveaways, and coordination between fraud, risk, and compliance teams. ### Source excerpt Most fraud programs start with payment fraud, and for good reason. It's the fastest path to measurable loss. But teams that stop there often miss account takeover, fake account creation, and promo abuse until those problems show up in support tickets, chargeback disputes, or a spike in customer complaints. By the time it's visible, it's [...] The post How to Solve for More Than Just Payment Fraud appeared first on Sift. ## What is Trust and Safety? DevFeed: [What is Trust and Safety?]() Original publisher: [Read original article]() Author: Ben Price Published: 2026-08-28T23:00:00Z Content type: article Language: en Sources: [Sift Science]() Topics: [Security, Privacy and Abuse Prevention](), [Transactions](), [account takeover]() Tags: [account-takeover](), [authentication](), [chargebacks](), [digital-platforms](), [digital-trust](), [digital-trust-safety](), [fraud-detection](), [fraud-prevention](), [payment-fraud](), [trust](), [trust-and-safety](), [trust-safety]() ### AI overview This article explains Trust and Safety as an organizational capability for protecting digital platforms, users, transactions, and interactions. It describes how the discipline brings together fraud prevention, content moderation, abuse prevention, and policy enforcement across the user journey, including payment fraud, fake account creation, account takeover, and content integrity. ### Source excerpt Trust and Safety is the practice of protecting the integrity of digital platforms, their users, and the transactions and interactions that take place on them. As a discipline, trust and safety spans fraud prevention, content moderation, abuse prevention, and policy enforcement across the full user journey. For fraud teams and platform operators, it represents a [...] The post What is Trust and Safety? appeared first on Sift. ## Tata's B2B platform returned OTPs in API responses DevFeed: [Tata's B2B platform returned OTPs in API responses]() Original publisher: [Read original article]() Author: Eaton Published: 2026-08-24T14:25:14Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [account takeover](), [API](), [Encryption](), [Binance]() Tags: [account-takeover](), [api](), [b2b](), [encryption](), [platform](), [vulnerability]() ### AI overview A security write-up describes a vulnerability in Tata nexarc that returned OTPs in API responses. Because the responses could be decrypted client-side, an attacker with a target's phone number could obtain the OTP and take over the account, including accounts with administrative privileges. ### Source excerpt Tata's nexarc platform had a vulnerability where OTPs could be decrypted from API responses, making it easy to take over any account. ## Use OpenID Connect issuer and subject identifiers instead of email as primary keys DevFeed: [Use OpenID Connect issuer and subject identifiers instead of email as primary keys]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-06T00:02:33Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [OpenID connect (OIDC)](), [account takeover]() Tags: [auth](), [data](), [identity](), [oidc](), [openid-connect](), [schema]() ### AI overview The article explains why email addresses are unsafe as identity keys because they can be reassigned or recycled. It recommends storing the OpenID Connect issuer and subject identifier pair as the stable key for provider logins, while retaining email as mutable profile data. ### Source excerpt Email addresses get reassigned and recycled. If you key identity or link accounts on email, you built an account-takeover path yourself. Here's the fix. ## Exploiting Volvo/Eicher's fleet management platform to gain control over all users and vehicles DevFeed: [Exploiting Volvo/Eicher's fleet management platform to gain control over all users and vehicles]() Original publisher: [Read original article]() Author: Eaton Published: 2026-07-27T14:31:47Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [vulnerability](), [Exploit](), [account takeover](), [API](), [Security](), [data](), [App](), [Website](), [Android](), [iphone]() Tags: [account-takeover](), [android](), [api](), [app](), [automotive](), [data](), [india](), [iphone](), [security](), [vulnerability]() ### AI overview The article reports vulnerabilities in VE Commercial Vehicles' My Eicher fleet-management platform that exposed hidden unauthenticated APIs and could enable account takeover and control of users' vehicle fleets. It also describes potentially exposed customer, user, vehicle, and identity-document data. A July 28, 2026 update says the concerns were remediated in coordination with the VECV team and that there was no current threat to customers or vehicles. ### Source excerpt VE Commercial Vehicles' My Eicher platform had a critical vulnerability that let you take over anyone's account and gain control over their vehicle fleets. ## EvilTokens: A phishing attack that doesn't steal your password DevFeed: [EvilTokens: A phishing attack that doesn't steal your password]() Original publisher: [Read original article]() Author: Christian Ali Bravo Published: 2026-06-15T08:55:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [OAuth 2.0](), [account takeover](), [microsoft 365](), [Microsoft](), [MFA](), [Reconnaissance](), [Authorization]() Tags: [account-takeover](), [attacks](), [authentication](), [cybercrime](), [microsoft](), [microsoft-365](), [oauth](), [phishing](), [process](), [time](), [tokens]() ### AI overview EvilTokens is a phishing-as-a-service kit that abuses Microsoft 365's OAuth 2.0 device authorization flow to compromise accounts without directly stealing passwords. Victims authenticate on Microsoft's genuine login page, unknowingly approving an attacker-controlled device; the resulting access and refresh tokens can enable account takeover and business email compromise. ### Source excerpt A phishing kit subverting Microsoft's legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages ## Introducing Advanced Account Security DevFeed: [Introducing Advanced Account Security]() Original publisher: [Read original article]() Published: 2026-04-30T00:00:00Z Content type: article Language: en Sources: [OpenAI News]() Topics: [Security](), [ChatGPT](), [account takeover](), [codex](), [Passkeys](), [Cybersecurity](), [passwords]() Tags: [account-takeover](), [attacks](), [chatgpt](), [codex](), [data](), [phishing](), [privacy](), [product](), [recovery](), [security]() ### AI overview OpenAI introduces Advanced Account Security, an opt-in setting for ChatGPT accounts that also protects Codex through the same login. It combines stronger sign-in requirements, tighter account recovery, reduced exposure from compromised sessions, and greater visibility into account activity. The setting requires passkeys or physical security keys, disables password-based login and email or SMS recovery, and supports backup passkeys, security keys, and recovery keys. ### Source excerpt Introducing Advanced Account Security: phishing-resistant login, stronger recovery, and enhanced protections to safeguard sensitive data and prevent account takeover. ## Chargeback Fraud Prevention: How to Protect Your Digital Business Revenue DevFeed: [Chargeback Fraud Prevention: How to Protect Your Digital Business Revenue]() Original publisher: [Read original article]() Author: Ayush Agarwal Published: 2026-04-04T00:00:00Z Content type: tutorial Language: en Sources: [Dodo Payments Blog]() Topics: [Security, Privacy and Abuse Prevention](), [Software as a service](), [account takeover](), [Software]() Tags: [account-takeover](), [chargebacks](), [data-breaches](), [digital-products](), [fraud-prevention](), [merchant-of-record](), [payment-fraud](), [payments](), [phishing](), [revenue](), [saas]() ### AI overview A guide to preventing chargeback fraud for SaaS and digital product businesses. It explains types of chargeback fraud, signals to monitor, fraud-prevention tools, and how the Merchant of Record model can shift fraud liability. ### Source excerpt Stop chargeback fraud with proven prevention strategies for digital product sellers and SaaS companies, from fraud signals to MoR protection. ## Compromised axios npm package delivers cross-platform RAT DevFeed: [Compromised axios npm package delivers cross-platform RAT]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm packages](), [Remote Access Trojan](), [backdoor](), [account takeover](), [payload](), [npm](), [OpenID connect (OIDC)](), [GitHub Actions](), [Linux](), [Windows]() Tags: [account-takeover](), [backdoor](), [ci-cd](), [github-actions](), [linux](), [npm-packages](), [oidc](), [payload](), [remote-access-trojan](), [supply-chain](), [windows]() ### AI overview The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages. ### Source excerpt An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. ## OfferUp scammers are out in force: Here's what you should know DevFeed: [OfferUp scammers are out in force: Here's what you should know]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-02-04T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [App](), [account takeover](), [Authentication](), [Mobile]() Tags: [account-takeover](), [app](), [authentication](), [consumer](), [fraud](), [marketplace-app](), [mobile](), [phishing](), [scams]() ### AI overview This article describes common scams targeting OfferUp buyers and sellers, including counterfeit items, payment fraud, account takeover attempts, empty-box listings, and phishing links. It explains warning signs and how scammers exploit off-platform payments or verification codes. ### Source excerpt The mobile marketplace app has a growing number of users, but not all of them are genuine. Watch out for these common scams. ## The future of pentesting is Human x AI, and it's already in Burp Suite Professional DevFeed: [The future of pentesting is Human x AI, and it's already in Burp Suite Professional]() Original publisher: [Read original article]() Author: Andrzej Matykiewicz Published: 2025-10-07T13:17:41Z Content type: opinion Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Security](), [Testing](), [Automation](), [Bug Bounty](), [account takeover]() Tags: [2025](), [account-takeover](), [ai](), [ai-tools](), [automation](), [bug-bounty](), [security]() ### AI overview The article argues that AI-assisted penetration testing is already widespread, while human expertise remains essential. It presents Burp AI in Burp Suite Professional as a human-controlled tool for summarizing data, iterating payloads, scaffolding proofs of concept, and helping testers identify complex vulnerabilities such as account takeover. ### Source excerpt The latest Hacker-Powered Security Report from HackerOne makes one thing clear: AI-assisted pentesting isn't a future trend; it's today's reality. In HackerOne's 2025 report, 70% of surveyed researche ## Top 10 web hacking techniques of 2024 DevFeed: [Top 10 web hacking techniques of 2024]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-02-04T15:01:48Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Hacking](), [Application Security](), [Security](), [web applications](), [OAuth](), [Cache](), [account takeover](), [LocalStorage](), [JavaScript]() Tags: [2025](), [account-takeover](), [cache](), [chatgpt](), [cookies](), [hacking](), [oauth](), [research](), [security](), [techniques](), [web](), [xss]() ### AI overview This annual community-powered review identifies notable web security research and hacking techniques from 2024. The supplied excerpts discuss OAuth flow hijacking through Cookie Tossing, risks involving cookies and JavaScript's Same-Origin Policy, and a ChatGPT account takeover using inconsistent decoding, path traversal, and Web Cache Deception. ### Source excerpt Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year ## Blog: Using Falco to Create Custom Identity Detections DevFeed: [Blog: Using Falco to Create Custom Identity Detections]() Original publisher: [Read original article]() Published: 2023-11-28T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [okta](), [Security](), [threat detection](), [audit](), [password reset](), [account takeover](), [Threat Research]() Tags: [architecture](), [audit](), [blog](), [event-source](), [falco](), [identity](), [okta](), [password-reset](), [security](), [threat-detection]() ### AI overview This blog post explains how the open-source Falco Okta plugin can support Identity Threat Detection and Response by analyzing Okta audit logs. It describes default rules, adaptable rule logic, and a custom rule example focused on password-reset activity and potential account takeover. ### Source excerpt Identity Threat Detection & Response (ITDR) in the cloud is of paramount importance to limit access to sensitive data and maintain the integrity of cloud infrastructure. Leading cloud providers like AWS, Microsoft Azure, and Google Cloud have implemented robust Identity and Access Management (IAM) controls, as well as Multi-Factor Authentication (MFA) options, to ensure that users have the standardized access control limitations. However, as the saying goes, "Trust, but verify." Even with these layers of security, there's a growing concern about what happens when a rogue employee or an external adversary manages to compromise an identity provider. Recent months have witnessed a surge in attacks targeting popular identity providers like Okta, underscoring the critical need for timely and effective detection capabilities. In fact, (Crowdstrike's 2023 Threat Hunting) report had classified 62% of all interactive cyber intrusions as having involved some form of compromised identities. Without proper detection, incidents such as the attacks on organizations like Caesars and MGM might go unnoticed until it's too late. Fortunately, open source Falco offers a Dedicated plugin for the Okta identity platform, empowering security teams to respond swiftly and with the context required to take real action against potential threats. In this blog post, we will delve into how Falco fulfills the requirements for ITDR capabilities. We'll illustrate the significance of Falco's adaptable rule logic and provide readers with a real-world example of crafting custom rules derived directly from Okta audit logs. Understanding the rule logic The Falco Okta plugin comes with a set of valuable default rules for Okta logs, which are designed to assist you in enhancing the security of your Okta platform. A typical illustration of the importance of these rules lies in the process of initiating a password reset within the Okta platform. In practice, an insider threat might reset a password, opt not ## CSRF Attacks: Examples and Mitigations DevFeed: [CSRF Attacks: Examples and Mitigations]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2021-03-25T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Exploit](), [web applications](), [browser](), [Cookies](), [HTML](), [HTTP](), [account takeover](), [Code]() Tags: [account-takeover](), [browser](), [code](), [cookies](), [exploit](), [html](), [http](), [xss]() ### AI overview This tutorial explains how Cross-Site Request Forgery (CSRF) attacks use browsers, HTML elements, cookies, and ambient credentials to submit requests as a logged-in user. It presents examples of state-changing requests and discusses their security impact and mitigations. ### Source excerpt Understanding Cross-Site Request Forgery (CSRF) and its Mitigations.