Phishing news

AI tools are making it easier for less-skilled hackers to launch sophisticated attacks. This puts critical but under-resourced sectors like local hospitals, banks, and nonprofits at significantly greater risk of costly data breaches.

Booking flights, hotels, and rentals involves sharing sensitive data across multiple platforms, creating opportunities for criminals. Common travel scams and frequent data breaches in the hospitality sector increase the risk. Awareness of these threats is key to protecting information while planning travel.

A new Drainer-as-a-Service platform called Lucifer is enabling crypto theft at scale. It uses sophisticated phishing kits and automation to trick users into signing malicious transactions, which then drains their wallets. The service highlights a shift from direct hacking to social engineering in crypto theft.

This week's security landscape saw several critical developments. A new vulnerability was discovered in the Linux kernel, while a significant exploit targeted Palo Alto Networks' PAN-OS. Additionally, the use of AI in crafting sophisticated attacks is on the rise, alongside new OAuth-based phishing campaigns.

The FBI has issued a warning about fraudulent websites impersonating FIFA for the 2026 World Cup. These sites aim to steal personal and financial data by selling fake tickets, merchandise, and hospitality packages. Businesses and individuals should exercise caution and verify all event-related communications and websites.

The Pakistan-aligned hacking group SideCopy is reportedly targeting Afghanistan's Ministry of Finance. The cyber-espionage campaign uses spear-phishing emails containing a ZIP archive. Inside is a malicious LNK file with a Pashto filename, which deploys an open-source remote access trojan called Xeno RAT to compromise systems.

The Belarus-aligned hacking group Ghostwriter is targeting Ukrainian government organizations with a new phishing campaign. The attackers send emails disguised as communications from Prometheus, a popular Ukrainian online learning platform, to trick officials into compromising their systems. The campaign was identified by Ukraine's CERT-UA.

A new malspam campaign is using Google's DoubleClick domain to bypass security filters and deliver a remote access trojan (RAT). By routing traffic through the trusted Google service first, attackers can evade detection before redirecting victims to their own malicious infrastructure.

A new phishing campaign uses emails disguised as LinkedIn business inquiries to steal user credentials. Attackers are abusing Adobe's infrastructure to host a fake contract attachment. After victims enter their details, they are redirected to the legitimate LinkedIn website, making the attack harder to detect.

A new China-linked cybercrime group, TA4922, has expanded its phishing attacks to target organizations in the U.K., Germany, Italy, and South Africa. The group operates at a high tempo, using an evolving arsenal of malware that includes known families like ValleyRAT and Atlas RAT.

For months, scammers have exploited a loophole to send spam from an internal Microsoft email address. By creating new accounts, they can send phishing links that appear to be legitimate alerts from Microsoft, bypassing standard email filters and potentially tricking employees into clicking on malicious links.

A new phishing campaign is targeting Signal users with text messages pretending to be from Signal Support. The scam aims to trick users into revealing their backup recovery keys by creating a false sense of urgency about data loss due to a supposed "sync issue."

A new phishing campaign, "Operation Dragon Weave," is targeting organizations in Taiwan and the Czech Republic. Attributed to a China-aligned group, the attacks use emails with ZIP attachments to install malware, targeting government, technology, academic, and financial sectors for cyber espionage.

This week's security landscape saw the discovery of new Linux vulnerabilities and a zero-day flaw in Microsoft Defender. The incidents highlight ongoing risks from unpatched systems and complex supply chains. Additionally, old bugs resurfaced, and phishing attacks have become more targeted, posing a continued threat.

Researchers have discovered a vulnerability in ChatGPT, dubbed ChatGPhish. The flaw exploits how the AI assistant processes Markdown links and images, allowing attackers to create convincing phishing attacks. This technique abuses the platform's implicit trust to trick users into clicking malicious links disguised within AI-generated responses.

A North Korean hacking group is targeting developers with fake job offers and code review requests. The sophisticated phishing campaigns aim to trick technical staff into installing malware, posing a direct threat to company security.

Multi-factor authentication (MFA) is being defeated by a simple tactic. Attackers with stolen credentials spam users with login approval requests, hoping to trick them into granting access out of confusion or fatigue. This method bypasses a core security protection without stealing the second factor.

Security experts are warning that MFA alone is insufficient against sophisticated attacks. Phishing campaigns are increasingly targeting Microsoft 365 access tokens, allowing attackers to bypass MFA entirely. These attacks use specialized kits, highlighting a critical evolution in identity-based threats for organizations.

An INTERPOL-led operation shut down Sniper Dz, a phishing service that operated for a decade. The takedown, involving 13 countries, disrupts a major tool used by cybercriminals to launch attacks against businesses and individuals.

The FBI, with help from Google, shut down a massive Phishing-as-a-Service operation called Outsider Enterprise. The platform used thousands of sites to steal credit card data, highlighting the growing scale of automated cybercrime tools.

Google's Threat Intelligence Group reports a rapid rise in Chinese-language Phishing-as-a-Service (PhaaS) platforms. These services are evolving beyond simple credential theft, now using real-time interception and token hijacking to bypass multi-factor authentication, marking a significant shift in the threat landscape.

AI presents both opportunities and significant risks for growing businesses. Cybercriminals are leveraging AI to launch more effective and targeted attacks. For example, AI-automated phishing has proven to be 4.5 times more effective than traditional methods, creating new challenges for business leaders balancing growth and security.

Phishing emails that bypass security filters create a dangerous gap for businesses. After a single click, security teams are often unsure about the extent of the exposure. Early detection systems are crucial for closing this gap, helping teams quickly understand the risk and respond effectively to threats.

A new phishing-as-a-service platform called EvilTokens has compromised over 340 Microsoft 365 organizations. The attack tricks users into authorizing a malicious app via a device login flow, effectively bypassing multi-factor authentication and granting attackers access to their accounts without needing passwords or MFA codes.

A new variant of the 'SHub' macOS infostealer is targeting users with fake Apple security update prompts. The malware uses AppleScript to display a convincing dialog box, tricking users into entering their password. This installs a backdoor, giving attackers access to steal browser data and cryptocurrency wallets.

INTERPOL's 'Operation Ramz' has led to the arrest of over 200 individuals in the Middle East and North Africa. The operation successfully dismantled significant cybercrime infrastructure, seizing 53 servers used for malware distribution and phishing attacks. This coordinated effort highlights a major crackdown on regional cyber threats.

A phishing kit named Tycoon2FA has been updated to bypass two-factor authentication on Microsoft 365 accounts. It uses a technique called device-code phishing and abuses legitimate click-tracking URLs to evade detection, posing a significant threat for organizations using Microsoft's cloud services.