#phishing
#phishing
[ follow ]
#cybersecurity #malware #npm #supply-chain-attack #social-engineering #data-breach #identity-theft #email-security
Information security
fromThe Hacker News
5 days agoAxios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks
Threat actors exploit Axios and Microsoft Direct Send to spoof trusted senders, bypass gateways, and drive highly successful phishing and account takeover campaigns across industries.
Information security
fromThe Hacker News
5 days agoFrom MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks
MostereRAT uses EPL-developed staged payloads, mTLS-protected C2, security-tool disabling, and plugin deployment to gain full control and stealthily persist on infected systems.
Information security
fromThe Hacker News
1 week agoVirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages
Attackers use obfuscated SVG files with embedded JavaScript to deliver Base64-encoded phishing pages impersonating Colombia's judiciary and trigger hidden ZIP malware downloads.
fromwww.theguardian.com
2 weeks agoThe good news is, you're owed a tax refund. The bad news? It's a scam
Tax calculations can be, well, taxing, so a message from HMRC saying that there's been a mistake may not ring too many alarm bells. Some bring good news: you have overpaid and are owed a refund, but others claim you owe money. In both cases there's an imminent deadline to act sometimes with the threat of legal action, or penalties if you don't. Scammers are taking advantage of people's fears over bills to steal personal and banking information.
Information security
fromWIRED
2 weeks agoScammers Will Try to Trick You Into Filling Out Google Forms. Don't Fall for It
These forms can be created in minutes, with clean and clear formatting, official-looking images and video, and-most importantly of all-a genuine Google Docs URL that your web browser will see no problem with. Scammers can then use these authentic-looking forms to ask for payment details or login information. It's a type of scam that continues to spread, with Google itself issuing a warning about the issue in February.
Information security
Information security
fromTechzine Global
2 weeks agoPhishing campaign targets Teams and Zoom with RMM tool
Attackers hijack ConnectWise ScreenConnect via AI-driven phishing that impersonates Zoom/Teams, using cloud obfuscation to gain administrator access and enable lateral movement and credential theft.
Information security
fromABC7 Los Angeles
3 weeks agoDon't click on that text claiming to be from Amazon. Here's what to know about the scam
Scammers send fake Amazon texts claiming refunds or recalls to phish for personal information and money; verify via the Amazon app/website and report spam to 7726.
fromThe Hacker News
1 month agoClickFix Malware Campaign Exploits CAPTCHAs to Spread Cross-Platform Infections
"Like a real-world virus variant, this new 'ClickFix' strain quickly outpaced and ultimately wiped out the infamous fake browser update scam that plagued the web just last year."
Privacy professionals
fromCSO Online
1 month agoSupply chain attack compromises npm packages to spread backdoor malware
In a newly discovered supply chain attack, attackers last week targeted a range of npm-hosted JavaScript type testing utilities, several of which were successfully compromised to distribute malware.
JavaScript
fromIT Pro
2 months agoArrests made after huge HMRC scam campaign hit 100,000 accounts
These arrests show we work across borders with our international partners to combat tax crime in all its forms. We have a number of live criminal investigations, and we are grateful to our Romanian partners for their support.
Privacy professionals
fromZDNET
2 months agoGot a suspicious UPS text? Don't reply - it might be a scam. Here's how to tell
This particular UPS scam is a savvy one, at least in some ways. I received the message on my iPhone, with the sender labeled as unknown. By default, links in a text message from an unknown sender are disabled, so you can't click on them to open them. But the scammer used a sneaky trick to get around this obstacle.
Privacy professionals
Privacy professionals
fromIT Pro
2 months agoHackers are using Microsoft 365 features to bombard enterprises with phishing emails - and they've already hit more than 70 organizations
A new phishing campaign exploits Microsoft's 365 Direct Send feature, targeting organizations without needing user credentials, leading to successful credential theft.
[ Load more ]