CyberNew CyberNew
Threat Intelligence & APT The Record 1 week ago

ASOS: Hackers tricked way into employee account before sending rogue push notification

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Image: Nix Company via Unsplash ASOS: Hackers tricked way into employee account before sending rogue push notification British online fashion retailer ASOS said Thursday that hackers gained access to an employee’s account by “impersonating a trusted contact,” allowing them to send an unauthorized push notification to customers. The company said its investigation, carried out with external..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
clothing
Image: Nix Company via Unsplash

ASOS: Hackers tricked way into employee account before sending rogue push notification

British online fashion retailer ASOS said Thursday that hackers gained access to an employee’s account by “impersonating a trusted contact,” allowing them to send an unauthorized push notification to customers.

The company said its investigation, carried out with external experts, found the attackers had accessed “some personal information, including names and contact details, and certain non-personal account related information.”

ASOS did not say how many customers were affected nor whether it believed data had been copied out of its systems.

The company’s explanation came two days after customers received an alert from ASOS’ own app claiming it had been hacked. Shares in the business fell more than 10% on the London Stock Exchange and remained down by more than 9.5% from their value before the alert.

ASOS said login credentials obtained through the duped ASOS employee’s account “were then used to access information on certain third-party platforms.”

The original notification linked to a Telegram channel run by an entity calling itself Xuanye Group. It claimed the attackers had compromised the company’s Snowflake cloud data environment.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →