Hackers abused API to verify millions of Authy MFA phone numbers
Twilio has confirmed that millions of Authy multi-factor authentication users' phone numbers were validated by threat actors using an unprotected API endpoint, possibly leaving them open to SIM swapping and SMS phishing assaults.
When you enable multi-factor authentication on websites, the mobile app Authy produces codes for you to use.
Attacker ShinyHunters released a CSV text file in late June that purportedly contained 33 million phone numbers registered with the Authy service.
33,420,546 rows total—account ID, phone number, account status, "over_the_top" column, and device count—are included in the CSV file.
Twilio has now acknowledged to BleepingComputer that the threat actors used an unauthenticated API endpoint to create the phone number list read more about Hackers abu...