LastPass 2022: The Dev-Environment Breach That Came Back
August’s ‘contained’ developer-account compromise returned in December as stolen vault backups. Inside the two-act breach.
Plex’s 15M Credential Leak: When Your Forum Post Becomes a Combo List
A forums database with bcrypt hashes and salts hit a criminal forum. The real blast radius was everywhere else users reused passwords.
Solana’s 9,000-Wallet Drain: Who Logged the Seed Phrases?
Slope’s telemetry backend held plaintext seed phrases, and attackers harvested them. The chain saw only valid signatures — and that is the whole lesson.
0ktapus: The SMS Phishing Wave That Hit 130+ Companies
Fake Okta pages, real-time MFA relay, and one crew harvesting 10,000 identities. Why Cloudflare walked away clean and Twilio didn’t.
Twitter’s 5.4M Scrape: When an API Becomes a Breach Oracle
A patched OAuth endpoint answered one question too honestly: which phone belongs to which handle. The dataset sold for $30k — the class lesson is still with us.
Your Phone Is a Beacon: BLE Location Tracking Goes Mainstream
Rotating MAC addresses were supposed to make Bluetooth anonymous. May 2022’s synthesis of research, stalker hardware, and detection tools proved they never did.
Heroku Held the Keys: Anatomy of a Vendor-Token Breach
GitHub’s OAuth tokens lived in Heroku’s infrastructure. One compromised CI cache later, an ecosystem learned where vendor tokens really live.
GitHub’s OAuth supply chain: the Heroku Token Heist That Reached npm
Attackers stole GitHub integration tokens from Heroku and Travis CI, pivoted into npm, and downloaded ~109,000 publishing credentials.
Lapsus$ vs Microsoft: When Teen Hackers Beat a Hyperscaler’s Odds
37GB claimed, one account compromised, no customer data lost — and a DEV-0536 profile that taught the industry how social engineering beats MFA.
Okta’s Weak Link: When Your IdP’s Vendor Gets Pwned
One contractor’s stolen credentials reached super-admin support tooling across 366 Okta tenants. The identity supply chain’s hardest lesson.
OpenSea’s $1.7M Phish: The Signature Trap
Seventeen users, one fake migration flow, and $1.7M in Apes gone — the phishing heist that made signature UX a security discipline.
Lapsus$ Rising: Identity-Driven Extortion’s Breakout
No zero-days, no malware — just MFA fatigue, SIM swaps, and help-desk social engineering. How Lapsus$ broke every assumption.