Mmastodon BusinessBanking first seen 3 d ago, last 2 d ago, peak #8
Attackers placed trades in 7 Iwai Cosmo accounts despite mandatory MFA
Original: Iwai Cosmo Securities had made MFA mandatory after Japan's 2025 account-takeover wave. On Oct 14, attackers placed order
Attackers bypassed Iwai Cosmo Securities' mandatory multi-factor authentication on October 14, placing orders in seven customer accounts, five of which executed, without logging in as the customers. The intrusion reportedly exploited a misconfigured admin function at Trade Works, the vendor running the brokerage's system, amid Japan's 2025 wave of securities account takeovers.
Why now: It shows MFA alone cannot stop attacks when a vendor's admin function is misconfigured, fuelling concern over Japan's ongoing account-takeover wave.
Iwai Cosmo SecuritiesTrade WorksJapan
Rank over time, top of the chart is #1. 12 snapshots from 3 d ago to 2 d ago.
Evidence
- Iwai Cosmo Securities had made MFA mandatory after Japan's 2025 account-takeover wave. On Oct 14, attackers placed orders in 7 customer accounts anyway (5 executed), without logging in as them: through a misconfigured admin function at Trade Works, the vendor that runs its… · japancyberwatch@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/3109894