--- title: "#account-takeover articles | Hashnode" description: "Explore 28 articles tagged #account-takeover on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/account-takeover" --- Tag # #account-takeover 28 posts · 1 followers [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Oct 26](https://hashnode.com/posts/repointing-17-610-fake-github-repos-that-were-never-deleted-only-re-aimed/6adebc2987a91600d878998c) ### [RePointing: 17,610 Fake GitHub Repos That Were Never Deleted, Only Re-Aimed](https://blog.fiscybersec.com/repointing-17-610-fake-github-repos-that-were-never-deleted-only-re-aimed?utm_source=hashnode&utm_medium=feed) Summary 17,610 fake GitHub repositories are serving SmartLoader, and Apiiro verified a malicious ZIP behind every single one. That is nearly double the largest list published before. What matters is n 17 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/repointing-17-610-fake-github-repos-that-were-never-deleted-only-re-aimed?utm_source=hashnode&utm_medium=feed) [Dimakatso Sebatane](https://hashnode.com/@ovawatch-security) · [Oct 10](https://hashnode.com/posts/case-study-pre-account-takeover-via-oauth-misconfiguration/6ad60608308bcb754693225b) ### [Case Study: Pre-Account Takeover via OAuth Misconfiguration](https://ovawatch-security.hashnode.dev/case-study-pre-account-takeover-via-oauth-misconfiguration?utm_source=hashnode&utm_medium=feed) How weaknesses in OAuth account linking and authentication flows can allow attackers to compromise user accounts before legitimate registration. Full video at : https://youtu.be/tDXNoB5-\_2o 12 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-pre-account-takeover-via-oauth-misconfiguration?utm_source=hashnode&utm_medium=feed) [yewei](https://hashnode.com/@paydd) · [Jun 2](https://hashnode.com/posts/blog-email-security-phishing/6a47d5e34a955ab067b5f5f4) ### [Email Alias Phishing Protection: How Unique Aliases Stop Account Takeover](https://quantaflow.hashnode.dev/blog-email-security-phishing?utm_source=hashnode&utm_medium=feed) Stop phishing with email aliases. Learn how unique aliases per service reveal data breaches instantly and block account takeover attempts. 10 min read · [quantaflow.hashnode.dev](https://quantaflow.hashnode.dev/blog-email-security-phishing?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Jun 1](https://hashnode.com/posts/sweet-just-ask-meta-ai-nicely-an-get-someone-else-s-instagram/6a1ded54cb7a80b4b790511e) ### [Sweet. Just Ask Meta AI Nicely an Get Someone Else's Instagram](https://404-founders.com/blog/sweet-just-ask-meta-ai-nicely-an-get-someone-else-s-instagram?utm_source=hashnode&utm_medium=feed) Attackers reportedly tricked Meta's AI support chatbot into changing recovery emails and handing over access to Instagram accounts. 3 min read · [404-founders.com](https://404-founders.com/blog/sweet-just-ask-meta-ai-nicely-an-get-someone-else-s-instagram?utm_source=hashnode&utm_medium=feed) [Niranjan G](https://hashnode.com/@securityinsights) · [May 25](https://hashnode.com/posts/the-hidden-threat-after-login-session-hijacking/6a146d157d85e6a1afeb1506) ### [The Hidden Threat After Login: Understanding Session Hijacking](https://blog.securityinsights.io/the-hidden-threat-after-login-session-hijacking?utm_source=hashnode&utm_medium=feed) Attackers can bypass MFA and passkeys by stealing your session after login. Learn how session hijacking works and how to stop it. 6 min read · [blog.securityinsights.io](https://blog.securityinsights.io/the-hidden-threat-after-login-session-hijacking?utm_source=hashnode&utm_medium=feed) [shemkar](https://hashnode.com/@shemkar) · [Apr 26](https://hashnode.com/posts/one-extra-json-key-how-a-harmless-profile-endpoint-became-an-ato-candidate/69ee7c173d6a492cdd4ecfcd) ### [One Extra JSON Key: How a Harmless Profile Endpoint Became an ATO Candidate](https://shemkar.hashnode.dev/one-extra-json-key-how-a-harmless-profile-endpoint-became-an-ato-candidate?utm_source=hashnode&utm_medium=feed) A real bug bounty lesson about mass assignment, impact proof, and learning from weak reports. 6 min read · [shemkar.hashnode.dev](https://shemkar.hashnode.dev/one-extra-json-key-how-a-harmless-profile-endpoint-became-an-ato-candidate?utm_source=hashnode&utm_medium=feed) [Satyam Rastogi](https://hashnode.com/@satyamrastogi) · [Apr 18](https://hashnode.com/posts/draftkings-credential-trafficking-post-plea-monetization-detection-gaps/69e38e22a298120011dd3dc0) ### [DraftKings Credential Trafficking: Post-Plea Monetization & Detection Gaps](https://satyamrastogi.hashnode.dev/draftkings-credential-trafficking-post-plea-monetization-detection-gaps?utm_source=hashnode&utm_medium=feed) Originally published on satyamrastogi.com Kamerin Stokes monetized DraftKings credentials through underground marketplaces post-plea, revealing systemic gaps in credential revocation and underground market monitoring. DraftKings Credential Traffick... 6 min read · [satyamrastogi.hashnode.dev](https://satyamrastogi.hashnode.dev/draftkings-credential-trafficking-post-plea-monetization-detection-gaps?utm_source=hashnode&utm_medium=feed) [RisingWave Labs](https://hashnode.com/@RisingWaveLabs) · [Apr 7](https://hashnode.com/posts/account-takeover-detection-real-time-features/69d452e55432c08dcb4c7ab4) ### [Real-Time Risk Scoring with Streaming SQL: Account Takeover, Marketplaces, Credit, and Insurance Claims](https://risingwave.com/blog/account-takeover-detection-real-time-features?utm_source=hashnode&utm_medium=feed) Five risk domains, one streaming architecture: signals as materialized views, decisions as point lookups 19 min read · [risingwave.com](https://risingwave.com/blog/account-takeover-detection-real-time-features?utm_source=hashnode&utm_medium=feed) [Cyber Safety Zone](https://hashnode.com/@cyber8080) · [Feb 24](https://hashnode.com/posts/oauth-attacks-us-businesses/699df7040daf99859e558c4f) ### [OAuth Attacks Explained: Why U.S. Businesses Are Losing Accounts Without Password Leaks](https://blog.cybersafetyzone.com/oauth-attacks-us-businesses?utm_source=hashnode&utm_medium=feed) Discover how OAuth attacks let hackers access U.S. business accounts without stealing passwords. 2 min read · [blog.cybersafetyzone.com](https://blog.cybersafetyzone.com/oauth-attacks-us-businesses?utm_source=hashnode&utm_medium=feed) [Lakshay Dhoundiyal](https://hashnode.com/@LakshayDhoundiyal) · [Feb 8](https://hashnode.com/posts/ghostpairing-attack-the-whatsapp-hack/69888003e5c366f6e87a42f7) ### [Ghostpairing Attack: The WhatsApp Hack That Lets Strangers Read Your Chats 👻](https://lakshaydhoundiyal.hashnode.dev/ghostpairing-attack-the-whatsapp-hack?utm_source=hashnode&utm_medium=feed) No password theft. No alerts. Just silent access to your private life. 📱 6 min read · [lakshaydhoundiyal.hashnode.dev](https://lakshaydhoundiyal.hashnode.dev/ghostpairing-attack-the-whatsapp-hack?utm_source=hashnode&utm_medium=feed)