[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOSsXgWkwvs15pA5WLc2BQHMjihiImvpozFqgcbTCbus":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"a2184486-a543-4e6c-a2f5-8971817bba8b","asos-app-hijacked-to-deliver-phishing-notifications-disguised-as-snowflake-breach-alert","4878d555-1057-494e-84cc-5b2fe01b3380","ASOS App Hijacked to Deliver Phishing Notifications Disguised as Snowflake Breach Alert","Attackers gained unauthorized access to ASOS's official mobile app notification infrastructure, weaponizing a trusted channel to distribute phishing messages to unsuspecting users. By falsely claiming a Snowflake data breach, they exploited user anxiety around known cloud provider risks to increase click-through rates on malicious links. This attack demonstrates how compromised push notification systems can bypass traditional email phishing defenses, as users inherently trust alerts from apps they've installed. The incident highlights the danger of insufficient access controls around third-party notification APIs and mobile backend services. When a brand's own infrastructure becomes the delivery mechanism, it dramatically erodes user trust and amplifies the attack's effectiveness.","**Immediate actions:**\n- Audit and rotate all API keys, tokens, and credentials associated with mobile push notification services immediately.\n- Disable or restrict unauthorized notification dispatch capabilities while the investigation is ongoing.\n- Issue a public advisory to ASOS users warning them not to click links in recent push notifications.\n\n**Long-term improvements:**\n- Implement strict role-based access control (RBAC) and multi-factor authentication for all mobile backend and notification management platforms.\n- Establish a content approval workflow and allowlist for outbound push notification messages to prevent unauthorized broadcasts.\n- Conduct regular third-party penetration testing of mobile app backend infrastructure, including notification pipelines.\n\n**Detection measures:**\n- Deploy real-time alerting on anomalous notification dispatch volume or content patterns within mobile backend systems.\n- Integrate mobile backend logs with a SIEM to correlate unusual API activity with authentication events.\n- Implement user-facing reporting mechanisms (e.g., 'Report this notification') to crowdsource early detection of malicious pushes.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 IR-6 (Incident Reporting)","NIST SP 800-53 SI-3 (Malicious Code Protection)","GDPR Article 33 – Notification of a Personal Data Breach to the Supervisory Authority","GDPR Article 34 – Communication of a Personal Data Breach to the Data Subject","OWASP Mobile Top 10 – M1: Improper Platform Usage","ITIL – Incident Management & Problem Management processes",{},"published","2026-10-06T22:20:24.704375+00:00","2026-10-06T22:20:24.428+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fhackread.com\u002Fasos-hackers-hijack-app-notifications-snowflake-data-breach\u002F","asos-hackers-hijack-app-notifications-claim-snowflake-data-breach-2e5cbe","ASOS Hackers Hijack App Notifications, Claim Snowflake Data Breach",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":39,"name":40,"slug":41,"description":42,"color":43},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":45,"name":46,"slug":47,"description":48,"color":49},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":57,"name":58,"problem":59},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":61,"name":62,"problem":63},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]