Hackers abused API to verify millions of Authy MFA phone numbers

Twilio has confirmed that an unsecured API endpoint allowed threat actors to verify the phone numbers of millions of Authy multi-factor authentication users, potentially making them vulnerable to SMS phishing and SIM swapping attacks. [...]

api attacks authentication authy endpoint factor hackers making mfa millions multi-factor multi-factor authentication numbers phishing phone phone numbers security sim sim swapping sim swapping attacks sms sms phishing threat threat actors twilio unsecured verify vulnerable