Loading story…
Organizations face increasing regulatory pressure to manage credentials and access controls effectively, as highlighted by evolving laws such as the EU's GDPR and NIS 2 Directive, the US HIPAA Security Rule, and the Gramm-Leach-Bliley Act. Password managers are now seen as essential tools for demonstrating compliance, providing structured logging and access review capabilities that auditors expect. The complexity of managing authentication across numerous SaaS applications and sensitive environments, such as healthcare and finance, underscores the need for both secure and user-friendly solutions, including federated single sign-on (SSO) and fine-grained access controls.
The shift toward more sophisticated authentication mechanisms is driven by the dual need to protect sensitive data and maintain usability for end users. As organizations adopt federated SSO and fine-grained access policies, they must balance security requirements with operational efficiency, ensuring that only authorized individuals can access critical information without introducing unnecessary friction. This landscape is further complicated by the proliferation of digital services and the growing importance of demonstrating compliance to regulators and stakeholders.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations continue to rely heavily on passwords for customer authentication, despite widespread recognition that these methods are both insecure and detrimental to user experience. Research from Descope highlights a persistent gap between security leaders’ stated priorities and the authentication technologies actually deployed, with 87% of organizations still using passwords as a primary method. While most companies claim to use multi-factor authentication (MFA), coverage is inconsistent, leaving exploitable gaps for attackers. The transition to more secure options like passkeys is hindered by technical debt, resource constraints, and internal misalignment, even as over 70% of organizations plan to adopt such technologies. Industry experts and practitioners are debating whether passwordless authentication is ready for widespread adoption or if it simply introduces new challenges. The evolution of identity management now includes managing non-human identities, implementing privilege access management, and adopting risk-based authentication. Security leaders are urged to align MFA, governance, and zero trust principles to resist account takeover and policy drift, but practical barriers remain in rolling out modern authentication at scale. The consensus is clear: while the future of authentication is moving beyond passwords, organizations face significant hurdles in making this transition both secure and user-friendly.
Jun 29, 2026
Cybercriminals are increasingly targeting enterprise credentials through phishing, brute force attacks, and exploitation of password reuse, leading to widespread compromise and monetization of login details. Attackers use tactics such as convincing phishing emails, credential stuffing, and the sale of stolen credentials on underground markets, enabling further exploitation including data theft and ransomware. The prevalence of password reuse and weak password management practices among employees exacerbates the risk, as users often rotate between a small set of passwords or make only minor variations, making it easier for attackers to gain access to multiple accounts once a single credential is compromised. Security experts are urging organizations to move away from traditional password-based authentication and adopt phishing-resistant, device-bound cryptographic solutions such as FIDO2, passkeys, and certificate-based authentication. These measures are seen as essential to counter the growing threat posed by automated attacks leveraging AI agents and large-scale credential theft. SaaS providers are also encouraged to integrate with identity platforms that support these advanced authentication methods to strengthen overall security posture and reduce the risk of credential-based breaches.
Jul 12, 2026
Organizations are facing increasing risks from the proliferation of hardcoded credentials, access tokens, and API keys, which are often exposed in code repositories and other unexpected locations. Recent high-profile attacks, such as those targeting Salesforce customers through stolen OAuth tokens, have demonstrated how attackers exploit poor secret management practices to gain unauthorized access to sensitive systems. Security experts warn that both cybercriminals and nation-state actors are capitalizing on this widespread issue, urging organizations to improve their secret hygiene and reduce over-privileging of credentials. In response to these threats, enterprises are moving away from static secrets and adopting managed identities and platform-native identity services. This transition is driven by the need to eliminate manual credential management, reduce the risk of credential leakage, and streamline authentication across complex, multicloud environments. Case studies show that organizations implementing managed identities experience significant reductions in time spent managing credentials and improved security posture, highlighting the importance of modernizing identity and access management strategies to counter evolving attacker tactics.
Jul 2, 2026