PoisonSeed网络钓鱼活动通过滥用WebAuthn中的跨设备登录功能来绕过FIDO2安全密钥保护，诱骗用户同意来自虚假公司门户的登录认证请求。
众所周知，PoisonSeed攻击者利用大规模网络钓鱼攻击来进行金融欺诈。在过去，分发包含加密种子短语的电子邮件用于耗尽加密货币钱包。
在Expel最近观察到的网络钓鱼攻击中，PoisonSeed攻击者并没有利用FIDO2的安全漏洞，而是滥用了合法的跨设备身份验证功能。
跨设备认证是一种WebAuthn功能，允许用户使用另一台设备上的安全密钥或认证应用程序在一台设备上登录。身份验证请求不需要物理连接，比如插入安全密钥，而是通过蓝牙或二维码扫描在设备之间传输。
这种攻击首先将用户引导到一个仿冒企业登录门户的网络钓鱼网站，比如Okta或Microsoft 365。当用户向门户输入凭据时，该活动使用中间对手（AiTM）后端，使用提交的凭据在合法登录门户上实时静默登录。
攻击中的目标用户通常会使用他们的FIDO2安全密钥来验证多因素身份验证请求。但是，网络钓鱼后端会告诉合法登录门户使用跨设备身份验证进行身份验证。
这将导致合法门户生成QR码，该QR码被传输回网络钓鱼页面并显示给用户。当用户使用智能手机或身份验证应用扫描这个二维码时，它就会批准攻击者发起的登录尝试。
PoisonSeed攻击流绕过FIDO2保护
这种方法允许攻击者发起依赖于跨设备身份验证而不是用户的物理FIDO2密钥的登录流，从而有效地绕过了FIDO2安全密钥保护。
Expel说，这种攻击并没有利用FIDO2实现中的漏洞，而是滥用了降低FIDO密钥身份验证过程的合法功能。为了降低风险，Expel建议采取以下防御措施：
·限制允许用户登录的地理位置，并为个人旅行建立注册流程。
·定期检查来自未知地点的未知FIDO密钥和不常见的安全密钥品牌的注册。
·考虑强制基于蓝牙的身份验证作为跨设备身份验证的要求，这将大大降低远程网络钓鱼攻击的有效性。
Expel还观察到一个单独的事件，一个威胁者在通过被认为是网络钓鱼的方式破坏了一个账户并重置了密码后，注册了自己的FIDO密钥。然而，这种攻击不需要任何欺骗用户的方法，比如QR码。
这种攻击突出了威胁者如何通过欺骗用户完成登录流程来绕过使用安全密钥进行物理交互的需要，从而找到绕过抗网络钓鱼认证的方法。
The Paris Prosecutor’s Office has announced the arrest in Ukraine of an alleged administrator of the Russian-language forum XSS.is, a site long recognized as one of the largest hubs of the cybercriminal underworld. The...
The post Kingpin of Notorious XSS.is Cybercrime Forum Arrested in Ukraine After Europol-Led Sting appeared first on Penetration Testing Tools.
Open-source software forms the bedrock of today’s digital infrastructure, powering 77% of all applications and valued at over $12 trillion. Yet its widespread adoption renders it an increasingly attractive target for supply chain attacks,...
The post Google Launches OSS Rebuild: A New Weapon Against Open-Source Supply Chain Attacks appeared first on Penetration Testing Tools.
Microsoft has confirmed that three China-linked threat groups were behind the recent wave of attacks targeting on-premises SharePoint Server installations. According to the company’s report, since early July, the vulnerabilities identified as CVE-2025-53770 and...
The post Microsoft Confirms China-Backed APTs Actively Exploiting SharePoint Zero-Days (CVE-2025-53770, -53771) appeared first on Penetration Testing Tools.
A newly uncovered malicious campaign involving the infostealer DeerStealer has been identified by researchers at ANY.RUN. Threat actors are employing a sophisticated tactic—combining Windows shortcut files (LNK) with trusted system utilities known as Living-off-the-Land...
The post DeerStealer: New Malware Uses Stealthy LNK & LOLBins for Undetectable Data Theft appeared first on Penetration Testing Tools.
In 2023, one of the United Kingdom’s oldest transport companies—established 158 years ago—declared bankruptcy following a devastating ransomware attack. The cyber assault brought the operations of Knights of Old (also known as KNP) to...
The post Weak Password Destroys 158-Year-Old UK Transport Company: Akira Ransomware Claims 700 Jobs appeared first on Penetration Testing Tools.