Last week on Malwarebytes Labs:
Stay safe!
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
X says attackers may be targeting accounts because its X Money payments service is now more widely available.
The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X says it has found no evidence of a breach or successful account takeovers so far.
X users began reporting unexpected password-reset emails and codes on September 1. In a public post, X product engineer Mridul Singhai said:
“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts.”
Singhai said X was actively investigating, apologized for the repeated emails, and added that the company had found “no evidence of any breaches.”
X Money gives eligible US users access to financial services within X, including interest-bearing accounts, a Visa debit card, and peer-to-peer payments. Cross River Bank provides the banking infrastructure behind the service.
This could make some X accounts more attractive targets, particularly accounts with payment access, high follower counts, business use, or valuable social-engineering potential.
The activity itself appears consistent with attackers submitting password-reset requests in bulk against X accounts. Requesting a password reset is not the same as resetting a password, however, and neither automatically means that an account has been taken over. X’s recovery process requires access to the email address or phone number associated with the account before someone can complete the reset.
There is no evidence that anyone has accessed X Money accounts or funds. Nor has X confirmed that X Money caused the password-reset activity. The timing is notable, but it does not prove a technical connection between the two.
Earlier this year, we saw a flood of Instagram password-reset emails, showing that similar activity can happen on platforms without payment services.
It could be a cover for something more serious. Even if an attacker cannot complete a reset, large volumes of legitimate-looking reset messages can provide useful cover for scams.
Reset flooding can also be a nuisance tactic. Repeated messages may pressure someone into changing their password unnecessarily, obscure more important security notifications, or encourage them to disable security controls in an attempt to stop the alerts.
If you receive an X password-reset email that you did not request:
If you’re unsure whether a message is real, use Malwarebytes Scam Guard to check it and get advice about what to do next.
Scammers don’t need to hack you. They just need you to click once.
Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.
Passkeys were supposed to make stolen passwords a thing of the past. No password to phish, no secret to reuse, and no string of characters sitting in a database waiting to be leaked.
Over time, it’s thought that passkeys will replace passwords entirely. But what happens when malware steals the master key?
Researchers have found a way for malware to hijack passkey-protected accounts through Google Password Manager, highlighting an important exception: passkeys can be very secure but the software surrounding them still has weaknesses.
Passkeys are a password replacement based on public‑key cryptography. Instead of a secret you remember and type, each account gets a key pair where the private key never leaves your devices, and the website only ever sees the public key and signed challenges. Because there’s nothing reusable to phish or reuse on another site, passkeys are marketed as “phishing‑resistant” and safer than passwords stored in a browser or password manager.
By the end of 2024 Google reportedly said that 800 million Google accounts used passkeys.
Passkeys have a major advantage over passwords: there is nothing useful for a phishing site to steal. A passkey is also tied to the website it was created for, making it much harder to trick into authenticating to the wrong domain.
The other significant difference is that if malware steals a password vault, an attacker still often needs to get past a second factor on another device, such as an authenticator app on your phone, before they fully own the account. With passkeys, many services relying on them simply trust the passkey assertion, and in some cases even trust a single “user verified” flag without confirming whether a real biometric or PIN event occurred.
The researchers, however, started with a malware infected Windows computer and came up with three possible attack scenarios to steal Google synchronized passkeys. Google Password Manager can synchronize passkeys between devices, which is convenient since you don’t want to register a new passkey every time you buy a new computer. But it also opens them up to abuse.
From bad to worse the attacks are:
The researchers urge services to stop blindly trusting the user verification flag and to properly validate that a real User Verified event occurred before granting access. Google, in turn, is encouraged to harden device registration and recovery, and verify that new devices and keys are backed by genuine hardware rather than accepting them at face value.
For end users, passkeys still offer strong protection against classic phishing websites and credential stuffing attacks based on reused passwords. The weak point highlighted here is not so much the concept of passkeys, but the way they’re implemented, synchronized, and trusted without enough verification on the server side.
Until vendors close these gaps, basic anti‑malware hygiene remains critical. The best ways to prevent malware from using your passkeys are:
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Explore how passkey implementation gaps undermine security when relying parties fail to validate the User Verified flag, reducing MFA to a single factor.
The post Pass the Passkey: A Novel Attack Surface in Passwordless Authentication appeared first on Unit 42.
Last week on Malwarebytes Labs:
Stay safe!
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Entrar