Password spraying attacks surge 155x as hackers exploit MFA gaps
Teaser from the source
Huntress observed a 155x increase in password spraying attacks in H1 2026, including a campaign that generated more than 81 million login attempts in two weeks. The attacks exploited legacy authentication and gaps in MFA policies that left some login flows unprotected. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on Password
Other advisories
- HighCVE-2026-18199Zohocorp ManageEngine Password Manager Pro: Betriebssystem-Befehlsinjektion
- HighCVE-2026-18199Zohocorp ManageEngine Password Manager Pro: Betriebssystem-Befehlsinjektion
- Not ratedosv:CLEANSTART-2024-YV49525When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog
- Not ratedosv:CLEANSTART-2024-VZ65902attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, passwo...
- Not ratedosv:CLEANSTART-2024-TJ47241It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords
- Not ratedosv:CLEANSTART-2024-BK15179In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue
- Not ratedosv:CLEANSTART-2024-VN57998slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash
- Not ratedosv:CLEANSTART-2024-DH33215use of hard-coded password vulnerability may allow authentication abuse
Other news entries
- ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and MoreNewsThe Hacker News
- Alpine Linux rebuilds GitLab after attempted RCE attackNewsBleepingComputer
- Passkeys Are Better Than Passwords. But They Are Not Enough.NewsSecurityWeek
- Chainalysis says an attacker using agentic techniques accessed its systems; customer user names, emails and roles exposedBreachpwn.watch
- ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More StoriesNewsThe Hacker News
- Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-netNewsSecurityWeek
- Admin dropped the F-bomb in a password to show hackers who was really 1337NewsThe Register — Security
- AO3 (Archive of Our Own) down for 2-4 weeks after security incident; user database theft not ruled outBreachpwn.watch
ID