11 stories tagged account-takeover, newest first.
448 points by g-b-r | 285 comments
A security research blog post describing a one-click account takeover in Telegram Desktop via an unescaped separator in its single-instance IPC, enabling arbitrary file theft.
136 points by arusekk | 27 comments
A vulnerability writeup describing a wormable XSS in SourceHut's ansi2html.py that let attackers take over accounts of users viewing injected build logs.
345 points by Thrashed | 128 comments
A Tell HN post describing how Namecheap support handed over a user's account to an unverified third party who simply called and asked.
643 points by speckx | 233 comments
Newsletter article reporting Meta confirmed thousands of Instagram accounts without 2FA were hijacked by tricking its Meta AI chatbot into resetting passwords.
2099 points by ssiddharth | 466 comments
Blog post describing an Instagram account takeover wave, including the Obama White House account, reportedly done by abusing Meta's AI support bot.
338 points by davidscoville | 536 comments
A Substack post by David Scoville recounting how he lost $130,000 to scammers using a fake Google call, spoofed Google email, and authenticator sync.
345 points by zachlatta | 147 comments
A GitHub Gist by Zach Latta describing a sophisticated phone-based phishing attempt impersonating Google that abused the g.co domain to steal Google accounts.
836 points by mooreds | 144 comments
Blog post by Sean Kahler describing how he ethically found a vulnerability enabling takeover of 700 million Electronic Arts accounts.
322 points by stulle123 | 235 comments
A security researcher's writeup of a 1-click exploit chain in KakaoTalk using a deep link, DOM XSS, and Kakao Mail takeover to hijack accounts.
841 points by todsacerdoti | 312 comments
KrebsOnSecurity article reporting that Experian still lets identity thieves hijack consumer accounts by simply re-registering them with a different email address.
358 points by alosch7 | 96 comments
Wiz Research blog post explaining how a common Azure Active Directory misconfiguration exposed Microsoft apps, enabling Bing.com result manipulation and account takeover.