“MFA已过时？”Tycoon 2FA钓鱼套件掀起会话劫持风暴，全球超6万账户沦陷

2025年10月，一家位于波士顿的医疗科技公司遭遇一场“教科书式”的网络攻击。攻击者并未暴力破解密码，也没有利用零日漏洞，而是通过一封看似普通的会议邀请邮件，附带一个名为“Q3_Investor_Briefing.html”的附件。财务总监Sarah点击后，浏览器跳转至一个与Microsoft 365登录页几乎无法区分的页面。她输入账号密码，随后手机收到一条来自微软的验证码短信——她照常输入。 几 ...
Security Boulevard

Microsoft’s January Security Update of High-Risk Vulnerability Notice for Multiple Products

Overview On January 14, NSFOCUS CERT detected that Microsoft released the January Security Update patch, which fixed 112 security issues involving widely used products such as Windows, Microsoft ...