At first glance, the security stories from the first week of November look unrelated: a web platform update, a network switch flaw, a hosting provider breach, a hacked game launcher and a cyberattack on medical cold storage. Look closer, though, and a single pattern emerges. Attackers are not only trying to break through the perimeter. They are going after the passwords, login sessions and trusted suppliers that sit quietly behind everyday operations, and the consequences are increasingly reaching the physical world.
A stolen session is as good as a password
When you sign in to a website, it gives your browser a session cookie so you do not have to log in again on every page. Information-stealing malware now routinely copies these cookies, which lets an attacker use your session from their own computer without ever needing your password or your multi-factor authentication (MFA) code.
On 4 November, cloud platform Vercel began rolling out Device Bound Session Credentials (DBSC) to its users. The feature ties a login session to the user's device using a key stored in the computer's security chip, so a stolen cookie no longer works on another machine. For now it works in Chrome on Windows and macOS, and is being rolled out gradually. It is a welcome step, but most business applications do not offer anything like it yet, which means a stolen session cookie remains a very effective way in.
When your provider's tool leaks your logins
Hosting company DreamHost has confirmed a breach of the server behind its web-based File Manager. An attacker exploited a flaw in the software and, from around August until the breach was discovered on 23 October, collected the FTP and SFTP usernames and passwords of customers who logged in through it. Webmail session details, including credentials, were also exposed for a limited number of users.
DreamHost has reset the affected passwords and told customers to check their websites for unauthorised changes, review webmail forwarding rules and change any other accounts that use the same password. It says it found no evidence that control panel logins or payment details were accessed. The lesson for every business that relies on a hosting or software provider is simple: their security incident can hand an attacker the keys to your website and mailbox.
When trusted software turns against you
The PC launcher for NIKKE, a popular mobile and PC game with more than 45 million downloads, was hijacked in a supply-chain attack. According to a security researcher, script files on the publisher's own content delivery network were altered on 27 September so that the launcher downloaded malicious code every time it was opened. The malware could run commands remotely, browse and download files, take screenshots and steal information stored in web browsers. A further component was designed to steal cryptocurrency wallet details. The publisher issued a fix on 4 November.
A game launcher may seem a long way from business IT, but the pattern is familiar. Staff install software on work laptops, or use personal devices for work, and that software updates itself from its maker's servers. If those servers are compromised, the trusted updater becomes the attack.
Stolen credentials last longer than the flaw
In the attacks on Zyxel GS1900 switches, which hit nearly 1,000 devices in 48 countries, the attackers took device configurations, hashed root passwords and network information. Zyxel has now released new firmware, but installing it does not change passwords that were already taken. Any switch that was exposed needs its credentials changed as well.
From stolen access to real-world damage
In France, a cyberattack on a refrigeration equipment provider changed temperature and defrost settings at three facilities of the national blood service. The provider said the incident involved its remote monitoring software and a flaw in a third-party component. Blood products were moved or secured in time, and no health impact has been reported. As we explained in our article on Europe's fridge hacks, remote access to building and equipment controls is now a target in its own right.
What UAE and GCC organisations should do now
- Protect sessions, not just passwords. Keep session lifetimes short for sensitive systems, require users to sign in again for high-risk actions, and enable device-bound or token-protection features wherever your platforms offer them.
- Stop information stealers at the endpoint. Use modern endpoint protection, keep browsers updated and limit which extensions staff can install.
- Control what software runs on work devices. Maintain an approved software list and keep games and personal applications off machines that access business systems.
- Assume a provider breach means a password reset. When a hosting, email or software provider reports an incident, change the related passwords and check for unexpected changes, even if you are told you were not affected.
- Change credentials after patching exposed devices. Patching closes the hole; it does not undo what was taken through it.
- Review supplier remote access. List which providers can reach your systems or equipment remotely, require MFA, and limit access to what each one needs.
- Never reuse passwords. A password manager and unique passwords stop one breach from unlocking several systems.
Trust, but verify the session
Credentials, sessions and suppliers are the quiet foundations of every business system, which is exactly why attackers target them. Treating each as something that can be stolen or turned against you, and planning for that, is now part of basic security hygiene.
COMMPRO Technologies supplies identity, endpoint protection and secure remote access solutions from leading vendors across the UAE and GCC. If you would like help reviewing how your organisation protects logins and supplier access, contact our team.
