phishing
5 posts
The record is the authority
A for-sale DNS record sells naming authority itself, and every control above DNS keeps validating the name for whoever now holds the record.
One PIN unlocks the vault
Vaultjacking turns one captured PIN into full retrieval of a Google Password Manager vault. Operator breakdown of the control collapse.
Microsoft issued a login code no one requested
A single-use Microsoft code arriving unrequested is evidence an identity boundary acted without its owner - a control that must be verified, not trusted.
Microsoft sent you a code you didn't request
An unrequested Microsoft single-use code email is evidence of external interaction with your identity surface. What it proves and what it does not.
European Commission AWS Compromise: Identity Boundary Failure Confirmed
Analysis of the European Commission AWS compromise reveals a confirmed failure in identity boundary enforcement. Credential harvesting via phishing led to direct access using valid elevated credentials, exposing systemic gaps in cloud authentication controls.