Tag: social engineering
439 articles
Microsoft 365 Phishing Attacks Expose Data Theft Tactics
Microsoft warns that cyber attackers are using clever social engineering tactics, like impersonating IT help desks, to trick employees into spilling sensitive info and gaining access to Microsoft 365 accounts. These scammers do their homework, researching companies and staff on social media and professional networks to make their attacks convincing.
Android Malware Mantax Otax Encrypts Devices, Steals Data, and Harasses Victims
Beware of Mantax Otax, a sneaky Android malware that's encrypting devices, swiping sensitive data, and even harassing victims - all thanks to clever tricks by Indonesian operators who are using sideloaded APKs to spread the threat.
Data Breaches Expose Vulnerable Supply Chains
Recent data breaches at the Pokémon Center, McKesson, and other major players in freight, retail, airports, finance, and healthcare reveal a disturbing trend: third-party vulnerabilities and social engineering are leaving supply chains exposed. A staggering 284 million records were allegedly stolen, highlighting the urgent need for stronger security measures.
Cyber Attacks Exploit Legitimate Tools for Rogue Access
Cyber attackers are sneaking into systems through the front door - by exploiting legitimate tools and services to gain rogue access, with a recent dark-web claim boasting of 153 million stolen U.S. and Canadian driver's licenses. Attackers are finding clever ways to impersonate trusted sources, like IT personnel, to get inside and take control.
Researchers Expose Employment Scam Tactics with Novel Experiment
To uncover the sneaky tactics used by employment scammers, a team of researchers took a bold approach: they created a fake company to study these scams firsthand. By doing so, they gained valuable insights into the methods scammers use to deceive job seekers.
AI-Generated Emails Flood Inbox in Apparent Scam
Beware of the sudden surge of brief, upbeat responses flooding your inbox - they might not be from genuine subscribers, but rather AI-generated emails trying to trick you. A recent flood of one-line replies to a newsletter confirmation email is raising red flags about a potential scam.
FBI Warns of Sophisticated Phishing Campaign Targeting High-Profile Individuals
Beware of a sneaky phishing scam that's targeting high-profile individuals, using a clever tactic to gain long-term access to their cloud accounts without needing their passwords. This sophisticated attack convinces victims to grant a malicious app permission to their accounts, allowing hackers to stay logged in for good.
Cyberattackers Favor Repeatable Playbooks Over Innovative Tactics
Cyberattackers are ditching creative tactics for a straightforward, repeatable playbook - and it's surprisingly effective, with a simple trick called ClickFix accounting for 47% of attacks. This sneaky method involves guiding users through a CAPTCHA-style interaction, then tricking them into pasting a command into a terminal, all without needing attachments or vulnerabilities.
Microsoft Exposes TerminalFix Attacks Deploying Reverse Tunnels
Beware of TerminalFix attacks that use fake Cloudflare CAPTCHA prompts on compromised websites to trick you into executing malicious PowerShell commands in Windows Terminal. These sneaky attacks can lead to more complex threats, making it crucial to stay vigilant online.
Microsoft Warns of TerminalFix Malware Hiding in PNGs
Microsoft researchers have uncovered a sneaky malware campaign, dubbed TerminalFix, that hides in plain sight by masquerading as harmless PNG images - only to delete them after extraction, leaving behind a trail of PowerShell commands that can compromise your system. This fresh variant of the ClickFix social-engineering trick tricks victims into pasting malicious commands into Windows Terminal or PowerShell.
Microsoft Teams Targeted in Voice Phishing Campaigns
Beware of voice phishing scams on Microsoft Teams! A recent campaign, dubbed Spring Ring, used fake IT help desk accounts to trick over 150 employees across 10 organizations into granting remote access.
Botnets Leverage AI, Public Infrastructure in Sophisticated Attacks
A sneaky botnet called Dysphoria has compromised nearly 296,000 devices, paving the way for a wave of clever attacks that use social engineering and public infrastructure to catch victims off guard. One recent impersonation campaign even tricked employees into handing over credentials with a fake single sign-on page and a convincing phone call.
OpenAI Disrupts LLM-Driven Social Engineering Scams
Meet the scammers who got caught out by ChatGPT - literally, as OpenAI recently disrupted a sophisticated social engineering operation from Cambodia that leveraged the AI tool to run multiple scams in tandem. This cunning network blended romance scams with investment pitches, effortlessly shifting tactics mid-conversation to swindle unsuspecting victims.
Phishing Platform Targets Apple Device Owners with AI Voice Scams
Meet AnonyMousKIT, a sophisticated phishing platform that's masquerading as a legitimate business, but actually uses AI voice scams to target Apple device owners, particularly those who've recently lost or stolen their devices. This credit-based service offers a disturbingly user-friendly experience, complete with tiered subscriptions and customer support.
ReliaQuest Exposes ShinyHunters' Social Engineering Tactics
ReliaQuest sets the record straight: claims of a ransomware attack or breach are completely false. The company recently thwarted a social engineering scheme by ShinyHunters, swiftly investigating and publicly rebutting the misinformation.
Apollo Breach Exposes Sensitive Data Via Social Engineering
A recent data breach at Apollo Global Management exposed sensitive personal info, including Social Security numbers, when an unauthorized user gained cloud access for just four days, from July 6 to July 10, 2026. The breach was triggered by a social engineering attack, highlighting the importance of robust security measures.
ReliaQuest Foils ShinyHunters' Data-Theft Attack via Social Engineering
ReliaQuest swiftly foiled a sneaky social engineering attack by ShinyHunters, who tried to trick employees into spilling sensitive info, but thankfully, only had view-only access and didn't touch customer data. The company's quick response contained the threat, protecting its systems and customers from harm.
Russian Hackers Exploit Google OAuth, WhatsApp to Hijack High-Value Accounts
Meet the sneaky Russian hackers who are hijacking high-value accounts using clever tricks and fake emails to get their hands on sensitive info. They're using Google OAuth and WhatsApp to pull off their phishing scams, and experts warn that no one is safe.
Phishers Target Def Con Attendees with Persistent Campaign
Meet the sneaky phishing scam that hit Def Con attendees, using a clever Google Doc trick that looked legit - but led to a malicious web page instead. A security researcher got roped in by a scammer impersonating a CoinDesk executive, and things quickly escalated.
ShinyHunters Breach Exposes 1.6M RingCentral Accounts
A massive data breach at RingCentral has exposed the sensitive information of 1.6 million customers, including names, addresses, phone numbers, and email addresses, which have been posted online by the hacker group ShinyHunters. This breach was discovered on July 28, and although RingCentral took swift action to stop the unauthorized activity, the damage has already been done.
ShinyHunters Breach Exposes 1.6 Million RingCentral Accounts
RingCentral has confirmed that a breach, known as ShinyHunters, compromised 1.6 million of its accounts, but has since taken swift action to prevent further unauthorized activity. The company is now directly contacting affected customers and has assured that its core platform remains secure and operational.
AmnesiaStealer Targets macOS via ClickFix Social Engineering
Mac users beware: a new threat called AmnesiaStealer is targeting macOS devices through clever social engineering tactics known as ClickFix, tricking victims into installing malware via a fake GitHub download page. One wrong click could compromise your entire system.
Malware Combo Targets Android Users With Loans, Credit Card Theft
In just 13 minutes, a sophisticated scam combining malware and social engineering tricked Android users into handing over their accounts and credit card info, with the thieves monetizing stolen cards in real time. The attack started with a convincing phone call from someone posing as a bank employee, leading victims to unwittingly download a remote administration tool masquerading as a legitimate app.
Lazarus Exploits Windows Zero-Day to Deploy Trojan Backdoor
Meet the sneaky Trojan backdoor, Troy, that's been secretly infiltrating defense and aerospace companies worldwide by exploiting a newly discovered Windows zero-day vulnerability. This stealthy attack, part of Operation Dream Job, tricks victims with fake job offers on LinkedIn before deploying the malware.