Yahoo deploys two-factor authentication for email

Initial compromise of the package was evident with "sync.py" script modifications in aiocpa version 0.1.13 that facilitated the execution of a blob code subjected to multiple encoding and compression that ultimately allowed Telegram bot-based exfiltration of Crypto Pay API tokens.

Malicious actors could leverage the vulnerability, which stems from improper user check error management in the two-factor REST API action, to facilitate high-privileged account breaches that could then be used for additional attacks, according to Defiant, a WordPress security provider.

While WhatsApp proceeded to disable the "Eden" exploit leveraged by NSO Group, the Israeli firm proceeded to create the "Erised" vector to target the app's users until May 2020, noted a court filing from Meta, which also noted that NSO Group, and not its customers, was primarily behind the spyware attacks.