100 links
tagged with phishing
Click any tag below to further narrow down your results
Links
A misconfigured Azure Blob storage container belonging to TalentHook has exposed nearly 26 million resumes, containing sensitive personal information of US job seekers. This breach poses significant risks for identity theft and targeted phishing attacks, leading to potential harassment and fraud against individuals whose data was leaked.
The article discusses the release of the source code for Ermac v3.0, a sophisticated banking Trojan that has been used to steal sensitive information from users. It highlights the potential risks associated with this malware and urges users to be vigilant against security threats.
Threat actors are using a Japanese Unicode character to create deceptive phishing links that mimic legitimate Booking.com URLs, tricking users into visiting malicious sites. This technique exploits visual similarities in characters, making it difficult for users to discern the real domain. Security measures are suggested to help users identify and avoid such phishing attempts.
Scammers are increasingly posing as legitimate customer support representatives by using fake support numbers for popular services like Apple, Netflix, and PayPal. These fraudulent operations exploit unsuspecting users, often leading to financial loss and compromised personal information. Awareness and vigilance are crucial in protecting oneself from these scams.
Google Threat Intelligence Group reported a novel phishing campaign attributed to a suspected Russian espionage actor, UNC5837, targeting European government and military organizations. Attackers used signed .rdp files to establish Remote Desktop Protocol connections, enabling them to access victim systems and potentially exfiltrate sensitive information, highlighting the risks associated with lesser-known RDP functionalities.
HMRC has reported a loss of £47 million due to a phishing scam that compromised 100,000 taxpayer accounts, although affected individuals will not incur any financial loss. The breach involved organized crime using stolen personal information, but HMRC clarified that it was not a cyber-attack and has since secured the accounts and removed any incorrect information. Affected taxpayers will receive notifications from HMRC in the coming weeks.
AMEOS Group, a major healthcare network in Central Europe, has disclosed a security breach that may have compromised sensitive information of customers, employees, and partners. In response, the organization has shut down its IT systems and engaged external experts to investigate the incident, which remains under investigation with no evidence of data dissemination so far.
A recent blackout in Spain and Portugal has been exploited by scammers, leading to a phishing scheme targeting passengers of TAP Air Portugal. Victims are being lured into providing personal information under the pretense of claiming refunds for canceled flights, highlighting the need for increased vigilance against such scams.
China-based SMS phishing groups, known as the "Smishing Triad," are increasingly targeting customers of international financial institutions by converting stolen payment card data into mobile wallets. Utilizing innovative phishing techniques and a vast cybercrime infrastructure, these groups are bypassing traditional SMS methods by sending messages through iMessage and RCS, achieving high delivery rates and expanding their operations globally. Experts emphasize the need for financial institutions to adopt more secure methods for verifying card enrollments to combat this rising threat.
Google has introduced new AI tools designed to enhance security for Chrome users, specifically targeting phishing and scam threats. These tools aim to proactively identify and block malicious sites, thereby improving the overall safety of browsing experiences for users worldwide.
An ongoing infostealer campaign is targeting Mac users through fraudulent GitHub repositories that masquerade as legitimate software downloads. The LastPass TIME team is raising awareness of this threat, which employs SEO tactics to position malicious links prominently in search results, and has already initiated takedown efforts against some of these fraudulent sites.
The article provides a comprehensive checklist for businesses to protect against business email compromise (BEC) scams, outlining key steps, best practices, and preventive measures. It emphasizes the importance of employee training and vigilance to recognize and respond to suspicious emails effectively. Additionally, it highlights the necessity of implementing security protocols and technologies to safeguard sensitive information.
Scammers are exploiting unsecured cellular routers from Milesight IoT to launch SMS phishing campaigns, known as smishing, that have been active since October 2023. Researchers found over 18,000 routers exposed online, with many allowing unauthorized access and running outdated firmware, making them an effective tool for decentralized phishing efforts targeting users in multiple countries.
A novel Device Code phishing technique automates the authentication process, allowing attackers to bypass FIDO's phishing resistance by redirecting victims to a legitimate authentication page without needing them to manually enter codes. Despite Microsoft's fixes for normal Entra tenants, vulnerabilities remain for federated tenants. The article emphasizes the dangers of this attack model, which can exploit users’ trust in established authentication methods.
A cybersecurity researcher has introduced FileFix, a new variant of the ClickFix social engineering attack, which exploits the Windows File Explorer address bar to execute malicious PowerShell commands. This method tricks users into pasting commands by disguising them within what appears to be a legitimate file-sharing notification, making it a more user-friendly approach for attackers. FileFix highlights the adaptability of phishing techniques, as it presents a familiar interface to users while executing harmful commands.
Clicking the "unsubscribe" link in emails may seem like a straightforward way to reduce inbox clutter, but cybersecurity experts warn it could expose users to greater risks. Once you click the link, you leave the safety of your email client and potentially face new online threats. It’s crucial to evaluate the security of the source before taking such actions.
DPRK hackers have successfully stolen approximately $137 million from users of the Tron blockchain. The attack involved sophisticated phishing techniques and targeted the platform's infrastructure, highlighting ongoing security vulnerabilities in cryptocurrency networks.
The article discusses how Vercel's new AI tool has been exploited by malicious actors to automate and enhance phishing attacks. As a result, organizations are urged to bolster their cybersecurity measures to counteract the increasing sophistication of such threats. The misuse of AI in this context raises concerns about the broader implications for digital security and user safety.
French retailer Auchan has reported a data breach affecting several hundred thousand customers, compromising sensitive information linked to loyalty accounts, such as names, addresses, and contact details. The company has notified affected individuals and the French Data Protection Authority, advising them to be cautious of potential phishing attempts. However, bank data and passwords remain secure following the incident.
Threat actors are exploiting Google Apps Script to create convincing phishing pages that steal login credentials by mimicking legitimate login screens. By hosting these fraudulent pages within Google's trusted environment, the attackers bypass typical security checks, making it easier to deceive victims into providing sensitive information. Security experts recommend enhancing email security measures to scrutinize links to cloud services like Google Apps Script to mitigate these threats.
Phishing emails are increasingly targeting both human users and AI-based defenses, exploiting gaps in security measures to bypass traditional filters. The evolving tactics used by cybercriminals highlight the need for improved defenses to protect sensitive information and maintain user trust in digital communications.
Kaspersky uncovered a cyber espionage campaign dubbed Operation ForumTroll, where sophisticated phishing emails led to infections via a zero-day exploit in Google Chrome. The malware identified, known as "Dante," was traced back to the Italian company Memento Labs and utilized advanced techniques to bypass browser security measures, highlighting ongoing vulnerabilities in web applications.
The blog post discusses a sophisticated phishing scam that impersonates Google Careers, highlighting its various tactics and the challenges it presents in identifying and preventing such attacks. It emphasizes the need for heightened awareness and security measures among users to protect their credentials from these evolving scams.
VirusTotal uncovered a phishing campaign that utilizes SVG files to create deceptive portals mimicking Colombia's judicial system, leading users to download malware. The AI Code Insight feature enabled the detection of these previously undetected SVG files, which cleverly employ JavaScript to simulate a legitimate download process. This highlights the growing use of SVGs in cyberattacks and the importance of AI in identifying such threats.
OktaGinx is a phishlet designed for Evilginx that enables the bypassing of Okta authentication when used in conjunction with Azure. It incorporates techniques to evade framebusters, enhancing its phishing capabilities.
Slow Pisces, a North Korean state-sponsored threat group, has stolen over $1 billion from the cryptocurrency sector in 2023 by targeting developers through disguised job offers on LinkedIn. They use malware hidden within coding challenges and have been linked to significant thefts from cryptocurrency companies, prompting action from GitHub and LinkedIn to remove malicious accounts. The malware employs advanced techniques like YAML deserialization to evade detection and execute additional payloads.
iCloud Calendar invites are being exploited to send phishing emails that appear to be legitimate purchase notifications from Apple's email servers, thereby evading spam filters. These emails aim to trick recipients into believing their PayPal accounts have been charged fraudulently, leading them to call a scammer's support number for assistance. The phishing scheme leverages authentic email authentication methods, making the scams appear trustworthy.
Researchers at Mandiant have discovered a new malware strain dubbed "UNC6032," which utilizes AI-generated video content to deceive victims. The malware operates primarily through phishing campaigns, leveraging convincing videos to trick users into downloading malicious software. This highlights a growing trend in cyber threats where AI technology is exploited for malicious purposes.
Cloudflare has introduced a new email service designed to enhance security and simplify email management for users. The service aims to protect users from spam and phishing attacks while providing a user-friendly experience with features such as custom domain support and email forwarding. This initiative reflects Cloudflare's commitment to improving digital communication safety and efficiency.
An artist recounts a phishing experience where a seemingly legitimate journalist's email led to the installation of malware on his Mac. After realizing his mistake, he took immediate action to secure his accounts and reported the incident to authorities, while also analyzing the malware to better understand the threat it posed.
A new cyber espionage campaign named "Blind Eagle" has been linked to the Russian group known as Proton66, targeting organizations in Latin America. The attacks primarily focus on stealing sensitive information using sophisticated malware and phishing techniques to compromise victim systems. Experts warn that this campaign illustrates the increasing threat posed by state-sponsored actors in the region.
A newly discovered WinRAR vulnerability, tracked as CVE-2025-8088, has been exploited in phishing attacks to deploy RomCom malware. The flaw allows attackers to create malicious archives that can extract executables into paths that enable remote code execution when a user logs in. Users are urged to update to WinRAR 7.13 to mitigate this risk.
Coinbase experienced a significant data breach in 2025 that compromised the personal information of nearly 70,000 users due to unauthorized access by outsourced call center agents in India. The attackers leveraged social engineering tactics, leading to a rise in phishing attempts, while Coinbase faced estimated remediation costs between $180 million to $400 million and launched a bounty for information on the perpetrators. The incident has sparked discussions on the vulnerabilities associated with outsourcing sensitive customer data management.
A new phishing kit named SessionShark has been discovered, capable of bypassing multi-factor authentication (MFA) to steal Office 365 login credentials. This kit employs sophisticated techniques that make it easier for attackers to gain unauthorized access to sensitive accounts, raising concerns about the effectiveness of current security measures.
Check Point Research reveals that the cyber threat group Scattered Spider is expanding its attacks to include aviation and enterprise sectors, employing sophisticated phishing techniques to compromise organizations. Recent incidents, including a major breach affecting Qantas, highlight the group's tactics such as MFA fatigue and voice phishing, prompting a call for enhanced security measures across affected industries. The report outlines specific phishing domain patterns and offers defensive strategies to mitigate these emerging threats.
Over 4,000 victims in 62 countries have been targeted by the PXA Stealer malware, which has stolen hundreds of credit card numbers, 200,000 passwords, and over 4 million browser cookies. This Python-based infostealer uses sophisticated phishing techniques and has evolved to evade detection, exfiltrating sensitive data through Telegram-based marketplaces.
Yes24, South Korea's leading K-pop ticketing platform, suffered a ransomware attack, rendering its website and app inaccessible and causing widespread cancellations of events. Fans are advised to be cautious of phishing attempts and wait for updates on refunds and compensation.
MokN Baits are advanced defensive phishing pages designed to lure attackers into revealing compromised credentials. By filtering out noise and providing tailored threat intelligence, MokN helps organizations effectively monitor and respond to real threats targeting their systems, enhancing security beyond traditional methods like dark web monitoring and MFA.
VoidProxy is a new phishing service that effectively bypasses multi-factor authentication (MFA) from major platforms such as Microsoft and Google. It allows cybercriminals to exploit vulnerabilities in the MFA process, increasing the risk of account breaches for users who rely on these security measures. The service is designed to steal user credentials and session tokens, making it a significant threat to online security.
A new FileFix social engineering attack mimics Meta account suspension alerts to deceive users into installing the StealC infostealer malware. It utilizes a multi-language phishing page that instructs victims to copy a disguised PowerShell command into the File Explorer address bar, ultimately leading to the execution of malicious code hidden within a JPG image. Acronis highlights the evolution of this attack method and emphasizes the need for heightened awareness against such sophisticated phishing tactics.
A sophisticated phishing campaign is leveraging weaknesses in Google Sites to spoof Google no-reply email addresses, allowing attackers to bypass email authentication checks. By redirecting users to deceptive Google Sites pages, the campaign exploits the platform's trusted domain and SSL certificates to appear legitimate.
PyPI users are being targeted by a phishing attack that attempts to trick them into logging into a fake PyPI site via a fraudulent email. The email, which appears to be from PyPI but uses a similar but incorrect domain, prompts users to verify their email, potentially compromising their credentials. Users are advised to delete the email if received and change their passwords if they have already clicked on the link.
Toys “R” Us Canada has notified customers of a data breach in which threat actors leaked personal customer information, including names, addresses, emails, and phone numbers, but not passwords or credit card details. The breach was discovered on July 30, 2025, when the data was posted on the dark web, prompting the company to enhance its cybersecurity measures and notify regulatory authorities. Customers are advised to be vigilant against phishing attempts following the breach.
A recent phishing attempt exploited a legitimate Zoom email notification to deceive users into entering their Gmail credentials on a fake login page. The attackers used a "bot protection" gate to enhance the page's legitimacy, allowing for real-time credential exfiltration via WebSocket connections, showcasing how trusted platforms can be manipulated for cybercrime.
Facebook has announced support for passkeys, a feature designed to enhance security by reducing the risk of phishing attacks. This move aligns with the broader industry trend towards passwordless authentication methods, aiming to make online experiences safer for users. The integration of passkeys allows users to log in using biometric data or security keys instead of traditional passwords.
iClicker's website was compromised in a ClickFix attack that used a fake CAPTCHA to trick users into executing a PowerShell script that potentially installed malware on their devices. The attack, targeting college students and instructors, aimed to steal sensitive data, but the malware's specific nature varied based on the visitor type. Users who interacted with the fake CAPTCHA between April 12 and April 16, 2025, are advised to change their passwords and run security checks on their devices.
ThreatLocker Cloud Control offers a robust solution to safeguard Microsoft 365 tenants against phishing and token theft by allowing only trusted network connections. By leveraging built-in intelligence, it automatically updates named locations with commonly used IP addresses, effectively blocking unauthorized access even if credentials are compromised. The solution aims to mitigate cyber risks and ensure business continuity.
Scammers are targeting LastPass users by sending deceptive messages claiming that the users are deceased in an attempt to extract their login credentials. These phishing attempts exploit users' emotions and trust to gain unauthorized access to their accounts. Users are advised to remain vigilant and report any suspicious communications.
The article discusses the exploitation of Microsoft Teams for delivering malware through direct messages, highlighting the tactics employed by cybercriminals to bypass security measures. It emphasizes the need for organizations to enhance their cybersecurity protocols to mitigate such threats.
Hackers are employing a sophisticated phishing technique that leverages legitimate Microsoft links and Active Directory Federation Services (ADFS) to redirect users to a counterfeit site designed to steal Microsoft 365 logins. By utilizing a trusted domain for redirection, attackers can bypass standard security measures, including multi-factor authentication. Researchers recommend monitoring for ADFS redirects and scrutinizing Google ads for potential malicious links.
ParkMobile has settled a class action lawsuit regarding a 2021 data breach that affected 22 million users, offering a meager $1 in-app credit to victims. Users must manually claim the credit, which comes with an expiration date, and the company denies any wrongdoing despite the settlement. Caution is advised as phishing attempts targeting ParkMobile customers have increased following the breach announcement.
A malicious campaign is targeting macOS developers through fake Homebrew, LogMeIn, and TradingView platforms that distribute infostealing malware such as AMOS and Odyssey. The campaign uses deceptive tactics to trick users into executing harmful commands in Terminal, leading to the theft of sensitive information from their systems. Researchers identified over 85 domains involved in this scheme, which are promoted via Google Ads to appear in search results.
Threat actors are exploiting the ConnectWise ScreenConnect installer to create signed remote access malware through a method called authenticode stuffing, which alters hidden settings in the software's digital signature. This has led to infections reported via phishing attacks that trick users into downloading malicious executables disguised as legitimate software. ConnectWise has since revoked the certificate used for these binaries, but the campaign highlights the risks of using modified enterprise tools.
A series of data breaches affecting companies such as Qantas, Allianz Life, LVMH, and Adidas has been attributed to the ShinyHunters extortion group, which uses voice phishing to compromise Salesforce CRM accounts. The attackers impersonate IT support to manipulate employees into entering connection codes that link malicious applications to Salesforce environments, leading to data theft and potential extortion attempts without public leaks so far. Salesforce has confirmed that their platform is not compromised, emphasizing the importance of customer vigilance against social engineering attacks.
A recent phishing attack targeted executives in the aviation industry, leading to a significant financial loss for a customer who was tricked into paying a fraudulent invoice. The investigation revealed links to a long-standing Nigerian cybercrime group known as SilverTerrier, which specializes in business email compromise scams and has been implicated in numerous similar attacks. Experts recommend organizations familiarize themselves with the financial fraud kill chain to recover funds lost to such schemes.
A new phishing method called 'CoPhish' exploits Microsoft Copilot Studio agents to issue fraudulent OAuth consent requests, allowing attackers to steal session tokens through social engineering tactics. Researchers from Datadog Security Labs have highlighted the risks associated with Copilot Studio's flexibility and noted that Microsoft plans to address these vulnerabilities in future updates. Users are advised to limit administrative privileges and enforce stricter governance policies to mitigate the risks.
Visa's ARIC Risk Hub, utilizing advanced AI technology, has enabled Norway's Eika Group to reduce phishing losses by 90% within a year. The platform creates user profiles to distinguish fraudulent activities and adapts to evolving threats, enhancing fraud prevention for financial institutions globally.
A credential harvesting campaign targeting ScreenConnect super administrators has been identified, leveraging low-volume spear phishing tactics with the EvilGinx framework. The operation aims to capture super admin credentials for potential ransomware deployment, utilizing sophisticated techniques to bypass traditional security measures. Mimecast has implemented protective measures and recommends user education and technical controls to mitigate the threat.
The official Stellar Blade account on the platform X was hacked, leading to unauthorized posts promoting a fake token and phishing schemes. Users were warned against engaging with the posts, which falsely promised airdrops and in-game rewards. The Stellar Blade team is working on recovering the account and advised the community to remain cautious.
Spanish authorities have arrested a 25-year-old Brazilian national known as GoogleXcoder, who is accused of leading the GXC Team crime-as-a-service operation that sold phishing kits and Android malware. The GXC Team targeted banks and other organizations, contributing to significant financial losses through their phishing campaigns.
Emails originating from IT or HR departments are increasingly being targeted by phishing attacks, leading to a rise in successful breaches. These phishing attempts often leverage the trust associated with internal communications, making it crucial for organizations to educate employees about recognizing and reporting suspicious messages. Strengthening email security measures can help mitigate these risks.
Cybersecurity experts warn that malicious PDFs are increasingly being used as delivery mechanisms for phishing attacks, particularly targeting Gmail users. These PDFs can masquerade as legitimate documents but contain links or scripts designed to steal user credentials and sensitive information. Awareness and caution are crucial for users to avoid falling victim to these deceptive tactics.
A recent phishing scam has been exploiting Google's email system by using "no-reply" addresses to trick users into revealing sensitive information. The scam takes advantage of legitimate-looking emails to bypass security measures, highlighting the need for better user awareness and email authentication practices. Google has taken steps to improve its security protocols to combat such fraudulent activities.
Cyberattacks surged during the summer of 2025, with ransomware groups targeting healthcare and retail sectors, while nation-state actors engaged in geopolitical cyber activities. Major incidents included the rise of the Interlock and Qilin ransomware groups, significant data breaches in retail, and the exploitation of Microsoft SharePoint vulnerabilities in a widespread campaign. Organizations are urged to improve their defenses by patching vulnerabilities, training personnel, and monitoring for lateral movement post-intrusion.
A fake version of ChatGPT, disguised as an InVideo AI tool, is tricking users into downloading ransomware. This malicious software locks users out of their systems and demands a ransom for access. The incident highlights the urgent need for vigilance against such deceptive schemes in the AI landscape.
A sophisticated phishing scheme named BeaverTail masquerades as a job offer for an AI engineering role, tricking developers into executing malicious code from a fake GitHub repository. This malware operates in five stages, stealing sensitive information, establishing remote access, and deploying additional malicious components while exploiting trust through social engineering tactics.
Google is leveraging advancements in AI to combat online scams across its platforms, including Search, Chrome, and Android. By enhancing their detection systems and implementing on-device models like Gemini Nano, they aim to significantly reduce scams such as phishing, tech support fraud, and deceptive notifications while adapting to new threats in real-time.
BitMEX successfully thwarted a social engineering attack by the Lazarus Group, a North Korean hacking collective, uncovering potential IP addresses and significant security lapses in the process. The attack involved an employee being targeted for malicious code execution, which led to an investigation revealing critical insights into the group's methods and operational weaknesses.
A recent phishing campaign targeting Ukraine impersonates government agencies, using malicious SVG files to deliver malware including Amatera Stealer and PureMiner. Upon opening the attachment, victims unwittingly download a CHM file that executes a series of malicious actions, ultimately compromising sensitive information and hijacking system resources.
Microsoft and Cloudflare have collaborated to take down the Raccoon365 phishing service, which targeted Microsoft 365 users. This operation aimed to protect users from credential theft and enhance overall cybersecurity measures against such phishing threats. The dismantling of Raccoon365 marks a significant step in combating cybercrime related to phishing schemes.
Trezor has issued a warning about a phishing campaign that exploits its automated support system to send deceptive emails that appear legitimate. Attackers use this system to generate urgent messages that trick users into visiting a phishing site to steal their wallet seed phrases. Trezor is working on implementing measures to prevent such abuse in the future and advises users to never share their seed phrases.
A multi-stage reverse proxy card skimming attack has been discovered that exploits fake GIFs to capture sensitive payment information. The attack involves complex techniques to evade detection and highlights the importance of securing payment processes against such sophisticated threats.
A new Android banking Trojan named Anatsa has been discovered, targeting users by mimicking legitimate banking applications. It employs advanced techniques to steal sensitive information and bypass security measures, posing a significant threat to users’ financial security. The malware is spread through malicious apps and phishing campaigns, highlighting the need for increased vigilance among mobile users.
Cybercriminals are increasingly targeting brokerage accounts using sophisticated phishing schemes to execute "ramp and dump" scams, manipulating stock prices without traditional social media promotions. By utilizing compromised accounts, they purchase shares to inflate prices and then sell at a profit, leaving victims with worthless stocks. The scheme highlights vulnerabilities in multi-factor authentication processes that many financial institutions still rely on.
A phishing campaign is targeting LastPass and Bitwarden users with fake emails claiming that the companies were hacked, prompting recipients to download a malicious desktop application. The downloaded software installs a remote management tool called Syncro, enabling threat actors to remotely access users' computers and potentially steal sensitive information. LastPass has clarified that these claims are false and users should verify security alerts through official channels.
A critical vulnerability in the Windows NTFS file system, identified as CVE-2025-49689, allows for exploitation through specially crafted virtual disks (VHD). This vulnerability leads to multiple memory corruptions due to insufficient checks on integer overflow, facilitating potential escalation of privileges for attackers using malicious virtual disks in phishing attempts.
Payroll fraud has emerged as a significant threat, with attackers leveraging SEO poisoning to steal paychecks from unsuspecting employees. By manipulating search engine results, these fraudsters lead victims to phishing sites designed to harvest sensitive payroll information. Organizations need to enhance their cybersecurity measures to protect against these evolving tactics.
Attackers are exploiting link wrapping services from companies like Proofpoint and Intermedia to mask malicious URLs that lead to Microsoft 365 phishing pages. By compromising protected email accounts, the threat actor is able to disguise harmful links in phishing campaigns, thus increasing the likelihood of credential theft from victims.
Microsoft Teams will implement automatic warnings for private messages containing links flagged as malicious, including spam, phishing, and malware. This feature, available for Microsoft Defender for Office 365 and Teams enterprise customers, is set to begin public preview in September 2025 and become generally available by November 2025. Admins can enable or manage these warnings through the Teams Admin Center.
The article highlights an innovative security awareness training program that includes interactive deepfake experiences, custom AI-generated content, and various phishing tests to prepare employees for real-world cybersecurity threats. It emphasizes the importance of engaging training methods to ensure users are adequately prepared for potential security risks.
An analysis of over 2.6 million AI-related posts from underground sources reveals how threat actors are leveraging AI technologies for malicious purposes. The research highlights 100,000 tracked illicit sources and identifies five distinct use cases, including multilingual phishing and deepfake impersonation tools. This comprehensive insight offers unmatched visibility into adversaries' strategies and innovations in AI exploitation.
A phishing scam targeting Booking.com users is spreading, utilizing a fake CAPTCHA to deceive victims into revealing their personal information. The scam is designed to look legitimate, making it crucial for users to remain vigilant and verify any unexpected requests for sensitive data. Cybersecurity experts are urging users to report suspicious activities promptly.
Microsoft has issued a warning about a phishing scam known as "Payroll Pirate" that compromises employee accounts on Workday and other HR platforms. Attackers gain access through deceptive emails and adversary-in-the-middle tactics, allowing them to redirect payroll deposits to their own accounts. The scam has targeted multiple universities, resulting in compromised accounts and widespread phishing attempts.
Trustifi offers a comprehensive cloud-based email security platform powered by AI, designed to protect against various email threats, including phishing, spoofing, and account takeovers. Their services include threat detection, archiving, compliance solutions, and user training to enhance overall email security.
APT36 is a sophisticated phishing campaign targeting Indian government entities, primarily using deceptive emails to harvest sensitive information. The campaign employs various tactics to circumvent security measures, posing significant risks to national cybersecurity. Continuous monitoring and awareness are crucial for mitigating these threats.
The article provides a comprehensive guide on enhancing email security to protect against various threats such as phishing, malware, and spam. It discusses essential practices and tools for safeguarding your inbox, including the importance of strong passwords, multi-factor authentication, and the use of security software. Additionally, it highlights workplace strategies for maintaining email security to ensure a safer communication environment.
A hacker successfully executed a voice phishing attack targeting Cisco customers, managing to steal their personal information. This incident highlights the ongoing risks associated with social engineering tactics in cybersecurity. Cisco has urged its clients to remain vigilant against such fraudulent schemes.
AegisAI has secured a $13M seed round to enhance its AI-native email security platform, which promises rapid deployment and significant reductions in false positives. The solution utilizes a multi-agent AI architecture to autonomously detect and respond to sophisticated threats, including phishing and business email compromise, without the complexity of traditional rule-based systems.
A significant rise in phishing activities using .es domains has been reported, with a 19-fold increase in malicious campaigns since January, making it the third most common TLD for such activities. Most of these campaigns focus on credential phishing, primarily spoofing Microsoft, and are often hosted on Cloudflare services. Researchers warn that this trend may indicate a growing tactic among various threat actors rather than just a few specialized groups.
A significant rise in identity-based cyberattacks, driven by advanced phishing kits and infostealers, has led to a 156% increase in login-targeting attacks, making them 59% of all investigations by eSentire. Organizations are urged to adopt stronger security measures, such as passkeys, to combat the growing threat of business email compromise (BEC) and ransomware, which are often facilitated by phishing-as-a-service platforms.
Takuya shares a frightening experience of receiving a phishing email disguised as a user support inquiry. The email led him to a malicious link that prompted him to execute a dangerous command in his terminal, highlighting the increasing sophistication of phishing attempts and the importance of staying vigilant against such threats.
The Python Software Foundation has issued a warning about new phishing attacks targeting PyPI users, urging them to reset their credentials after receiving fake emails from a fraudulent site. Victims are being misled into verifying their email for account maintenance, which could lead to credential theft and subsequent malware attacks on published packages. Users are advised to change passwords immediately and implement stronger security measures like two-factor authentication.
Authorities in Pakistan have arrested 21 individuals linked to the “Heartsender” malware service, which facilitated spam and cybercrime for over a decade, resulting in extensive financial losses. The operation, which targeted various internet companies, was identified by KrebsOnSecurity in 2021, and included notorious figures like Rameez Shahzad, the alleged ringleader. The arrests follow a series of raids conducted by the National Cyber Crime Investigation Agency amid ongoing investigations into transnational organized crime.
Discord users are at risk from a new phishing attack involving invite link hijacking, which leads to the installation of malware on victims' devices. The attack exploits the trust users place in Discord links, making it crucial for users to verify the authenticity of links before clicking. Security experts recommend staying vigilant and using protective measures to avoid falling victim to such scams.
Russian hackers have successfully bypassed Gmail's multi-factor authentication by employing sophisticated social engineering tactics to obtain app-specific passwords from targeted academics and critics of Russia. The attackers impersonated U.S. Department of State officials, convincing victims to share their passwords under the pretense of accessing a secure communication platform. Security researchers have linked these activities to the state-sponsored group APT29, known for attacking high-profile targets since 2008.
Stormshield's CTI team discovered servers linked to APT35, an Iranian APT group known for phishing campaigns. The team provided insights on how to identify these servers, highlighting ongoing phishing tactics targeting various sectors, particularly in Israel. They shared specific indicators of compromise and methods for tracking related domains.
A vulnerability in Apple's Safari browser allows attackers to exploit the fullscreen browser-in-the-middle (BitM) technique, enabling them to steal user credentials by obscuring the address bar and tricking victims into entering sensitive information. Unlike other browsers, Safari does not provide a clear alert when entering fullscreen mode, making these attacks particularly deceptive. SquareX researchers have noted a rise in this malicious activity and reported Apple's dismissal of the issue as a "wontfix."
Cybercriminals are impersonating job seekers to deliver ransomware through malicious resumes. By establishing trust on platforms like LinkedIn and using phishing tactics, they manipulate recruiters into opening harmful files. Security experts advise organizations to implement stricter measures to protect against these sophisticated social engineering attacks.
Phishing sites are masquerading as legitimate downloads from DeepSeek, distributing a proxy backdoor that compromises users' systems. These malicious sites exploit trust to lure victims into downloading harmful software. Users are advised to be cautious and verify sources before downloading applications.
Google Gemini for Workspace can be exploited through prompt-injection attacks that generate misleading email summaries, potentially leading users to phishing sites without attachments or direct links. Researcher Marco Figueroa revealed this vulnerability, highlighting how hidden instructions in emails can manipulate Gemini's output, prompting users to trust false security alerts. Google is aware of the issue and is implementing defenses against such attacks.