UPDATE: Dashlane Confirms Encrypted Vaults Downloaded in Attack
June 2, 2026
Dashlane now confirms attackers downloaded encrypted password vaults from fewer than 20 accounts by brute-forcing 2FA codes to register unauthorized
Identity and Access Management
UPDATE: Dashlane Confirms Encrypted Vaults Downloaded in Attack
Dashlane now confirms attackers downloaded encrypted password vaults from fewer than 20 accounts by brute-forcing 2FA codes to register unauthorized devices.
Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
A confused deputy flaw in Meta's AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space Force.
WP Maps Pro Flaw Exploited to Create Unauthorized Admin Accounts
An unauthenticated privilege escalation flaw in WP Maps Pro, a WordPress plugin with 15,000 paid sites, is actively exploited to create unauthorized administrator accounts.
Dashlane Suspends Accounts After Multi-Country Brute-Force Campaign
Dashlane temporarily suspended customer accounts after detecting coordinated brute-force login attempts originating from multiple countries simultaneously targeting its login infrastructure.
Dashlane Suspends Accounts After Multi-Country Brute-Force Campaign
Dashlane temporarily suspended customer accounts after detecting coordinated brute-force login attempts originating from multiple countries simultaneously targeting its login infrastructure.
FBI Warns Kali365 PhaaS Platform Bypasses Microsoft 365 MFA
The FBI warns Kali365, a PhaaS platform on Telegram, exploits Microsoft device code authentication to bypass MFA entirely and capture persistent OAuth tokens.
Deleted Google API Keys Stay Active for Up to 23 Minutes
Aikido Security found deleted Google API legacy keys stay functional up to 23 minutes after revocation, a significant window during active incident response.
EvilTokens Service Breaches 340 Microsoft 365 Orgs via OAuth Tokens
EvilTokens, a phishing service launched in February 2026, bypassed MFA in 340 Microsoft 365 organizations by stealing OAuth tokens instead of passwords.
SonicWall Gen6 MFA Bypass CVE-2024-12802 Left Open by Incomplete Patch
SonicWall's patch for CVE-2024-12802 needed a manual LDAP reconfiguration most admins skipped, leaving Gen6 VPN open to MFA bypass and ransomware access.
Nx Console VS Code Extension Poisoned to Steal 1Password, AWS Keys
Version 18.95.0 of the Nx Console VS Code extension was weaponized for 11 minutes to steal 1Password vaults, AWS credentials, and Claude Code secrets.
Meta AI Chatbot Flaw Lets Attackers Hijack Instagram Accounts
June 2, 2026
A confused deputy flaw in Meta’s AI support chatbot let attackers hijack Instagram accounts including @obamawhitehouse, Sephora, and U.S. Space
WP Maps Pro Flaw Exploited to Create Unauthorized Admin Accounts
June 1, 2026
An unauthenticated privilege escalation flaw in WP Maps Pro, a WordPress plugin with 15,000 paid sites, is actively exploited to
Dashlane Suspends Accounts After Multi-Country Brute-Force Campaign
June 1, 2026
Dashlane temporarily suspended customer accounts after detecting coordinated brute-force login attempts originating from multiple countries simultaneously targeting its login infrastructure.
Dashlane Suspends Accounts After Multi-Country Brute-Force Campaign
June 1, 2026
Dashlane temporarily suspended customer accounts after detecting coordinated brute-force login attempts originating from multiple countries simultaneously targeting its login infrastructure.
FBI Warns Kali365 PhaaS Platform Bypasses Microsoft 365 MFA
May 22, 2026
The FBI warns Kali365, a PhaaS platform on Telegram, exploits Microsoft device code authentication to bypass MFA entirely and capture
Deleted Google API Keys Stay Active for Up to 23 Minutes
May 22, 2026
Aikido Security found deleted Google API legacy keys stay functional up to 23 minutes after revocation, a significant window during
EvilTokens Service Breaches 340 Microsoft 365 Orgs via OAuth Tokens
May 21, 2026
EvilTokens, a phishing service launched in February 2026, bypassed MFA in 340 Microsoft 365 organizations by stealing OAuth tokens instead
SonicWall Gen6 MFA Bypass CVE-2024-12802 Left Open by Incomplete Patch
May 21, 2026
SonicWall’s patch for CVE-2024-12802 needed a manual LDAP reconfiguration most admins skipped, leaving Gen6 VPN open to MFA bypass and
Nx Console VS Code Extension Poisoned to Steal 1Password, AWS Keys
May 20, 2026
Version 18.95.0 of the Nx Console VS Code extension was weaponized for 11 minutes to steal 1Password vaults, AWS credentials,
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.