Cyber threats and credential attacks
All AmbiSecure engineering content tagged Cyber Threats, newest first. Newer entries reflect current thinking; earlier entries come from the engineering archive.
Cyber threats against identity systems span credential phishing, adversary-in-the-middle proxies, SIM-swap and OTP interception, malware that scrapes software-held keys, and physical attacks on devices. Understanding the threat model is what separates security theatre from engineering: each control should map to a concrete adversary capability it removes.
This category tracks the threat landscape relevant to authentication and connected-device security — how attacks actually work, which are rising, and why phishing-resistant, hardware-bound credentials neutralise entire attack classes. The consistent lesson is that shared secrets (passwords, OTPs) are the attacker's easiest path, and origin-bound hardware credentials close it.
Frequently asked questions
Why are one-time passwords no longer enough?
OTPs are phishable and interceptable: an adversary-in-the-middle proxy or SIM-swap can relay or capture the code in real time. They raise the bar over passwords alone but do not resist a determined phishing attack.
What makes FIDO2 phishing-resistant?
FIDO2/WebAuthn credentials are bound to the origin (relying-party ID) and signed by a key that never leaves the authenticator. A look-alike phishing domain cannot elicit a valid signature, so the credential simply does not work for the attacker.
Do hardware credentials stop malware?
They contain it. Malware cannot extract a non-exportable key from a secure element, so even a compromised host cannot clone the credential or authenticate elsewhere without the physical device.
What is credential stuffing?
Replaying username and password pairs stolen from one breach against unrelated services, which works because password reuse is near-universal. Credentials that cannot be replayed remove the attack entirely.
Why does phishing survive user training?
Because it targets a decision the user cannot reliably make. A convincing page is indistinguishable by eye, so the durable fix moves the check to the authenticator, which verifies the origin cryptographically.