Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks

- Between July 9 and July 12, attackers exploited account-creation and migration weaknesses during Squarespace’s takeover of Google Domains to claim uninitialized domain-associated email accounts, hijack at least a dozen domains (notably crypto businesses), and in some cases redirect them to phishing sites; researchers point to missing email verification and disabled MFA during migration as root causes while Squarespace later reported an OAuth-related issue.