Authy 2FA Service Breached SlowMist Cybersecurity Urges Vigilance Against Phishing

Authy 2FA Service Breached SlowMist Cybersecurity Urges Vigilance Against Phishing

Authy 2FA Service Breached SlowMist Cybersecurity Urges Vigilance Against Phishing

According to cybersecurity firm SlowMist’s security chief 23pds, on the X platform:

Warning:
The 2FA service Authy has been compromised by hackers, exposing phone numbers of 33 million users. The official developer Twilio has confirmed the vulnerability.

23pds noted that many cryptocurrency professionals use Authy and warned users of this 2FA software to be vigilant against phishing attacks.

Source:
23pds
According to the foreign media “TechCrunch” report:

Last week, prominent hacking group ShinyHunters claimed on a well-known hacker forum to have breached Twilio and stolen 33 million phone numbers. Twilio spokesperson Kari Ramirez confirmed to TechCrunch on Tuesday (2nd) that the company “detected threat actors able to access data related to Authy accounts, including phone numbers, due to an unauthenticated endpoint.” Twilio has taken steps to secure the endpoint, no longer allowing unauthenticated requests.

Ramirez stated:
Rachel Tobac, CEO of SocialProof Security, commented in an interview that if attackers can enumerate lists of user phone numbers, they could impersonate Authy/Twilio to increase the credibility of phishing attacks targeting those phone numbers.

Related articles: “Travelers Becoming Targets of AI-Generated Phishing Emails and ‘Juice Jacking’ Schemes on the Rise” and “SlowMist Analysis: Private Key Leaks Among Top Reasons for Cryptocurrency Thefts in Q2”.