The National Institute of Standards and Technology and the Cybersecurity and Infrastructure and Security Agency have released ...

Stronger monitoring, shorter-lived tokens, and tighter controls over how tokens are used after authentication are needed as AI agents complicate who and what enterprises can trust inside their systems ...

Sentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access ...

N0va phishing abuses legitimate authentication flows to capture access and refresh tokens and establish SSO access to ...

MCP credential exposure puts API keys and access tokens at risk as hardcoded secrets remain in public GitHub configuration files.

Researchers using Anthropic's Claude uncovered vulnerabilities in OpenAI systems, while OpenAI has reported cases of its own ...

Learn how TrustSink abuses rogue Entra external authentication providers to capture passwords and why removing the provider matters after a reset.

Four threat teams, one week: machine credentials are now the weapon, the target and the product. Most IAM policies can't tell them from a human login.

Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single ...

iM-FRM-2608TPM - TPM Version: Integrates SEALSQ TPM183 with TPM 2.0 architecture, supporting Windows ESS and Windows Hello ...

WSO2 API Manager JWT bypass faces active exploitation attempts using forged tokens with administrator privileges.

A malicious Twitch browser extension has been reportedly forwarding the live OAuth session tokens of around 31,000 users to ...