Tag: email
-
Identity Under Siege: What the Salt Typhoon Campaign Reveals About Trusted Access Risks
A recent disclosure confirms that email accounts belonging to U.S. congressional staff were compromised as part of the Salt Typhoon cyber-espionage campaign, targeting personnel supporting key House committees and exploiting trusted identities rather than software vulnerabilities, according to TechRadar. While no immediate operational disruption was publicly reported, the incident sends a clear message: identity systems…
-
‘Dual-channel’ attacks are the new face of BEC in 2026
Business email compromise remains a significant threat as cyber fraudsters deploy a more diverse range of tactics against their potential victims, according to a report. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366637242/Dual-channel-attacks-are-the-new-face-of-BEC-in-2026
-
Betterment confirms data breach after wave of crypto scam emails
U.S. digital investment advisor Betterment confirmed that hackers breached its systems and sent fake crypto-related messages to some customers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/betterment-confirms-data-breach-after-wave-of-crypto-scam-emails/
-
Betterment confirms data breach after wave of crypto scam emails
U.S. digital investment advisor Betterment confirmed that hackers breached its systems and sent fake crypto-related messages to some customers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/betterment-confirms-data-breach-after-wave-of-crypto-scam-emails/
-
Email is Not Legacy. It’s Infrastructure.
Discover why business email remains mission-critical infrastructure, and how governance, automation, and AI integration future-proof it. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/email-is-not-legacy-its-infrastructure/
-
Spanish police disrupt Black Axe, arrest alleged leaders in action spanning four cities
The criminal organization specialized in business email compromise scams and generated billions of dollars in criminal proceeds annually from many small-scale operations, officials said. First seen on cyberscoop.com Jump to article: cyberscoop.com/black-axe-disruption-arrests-spain/
-
Notorious BreachForums hacking site hit by ‘doomsday’ leak of 324,000 criminal users
Tags: access, breach, crime, cyber, cybercrime, dark-web, data, data-breach, email, extortion, group, hacking, intelligence, law, leak, password, penetration-testing, ransomware, risk, service, threatHave I Been Pwned, the data breach happened last August, two months before the police takedown of the BreachForums data extortion site after threats by Scattered Lapsus$ Hunters to use it to release one billion records stolen from Salesforce customers.This tallies with the August 11 date on the database leaked last week; that was the…
-
FBI Flags Quishing Attacks From North Korean APT
A state-sponsored threat group tracked as Kimsuky sent QR-code-filled phishing emails to US and foreign government agencies, NGOs, and academic institutions. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/fbi-quishing-attacks-north-korean-apt
-
Meta fixes Instagram password reset flaw, denies data breach
Meta fixed an Instagram password reset flaw that let third parties send reset emails, while denying a data breach despite leak claims. Meta confirmed fixing an Instagram password reset vulnerability that allowed third parties to trigger reset emails, while denying any breach despite claims of leaked user data. >>We fixed an issue that let an…
-
Instagram Confirms Password-Reset Spam Flood, Denies Breach
Security Experts See Coincidental Timing After Leak of Scraped Instagram User Data. Instagram said a massive wave of password reset emails sent to its users traced to malicious abuse of a legitimate feature, but didn’t result from any breach of its systems. Separately, security experts said a threat actor leaked 6.2 million users’ email addresses,…
-
Web3 Dev Environments Hit by Fake Interview Software Scam
Web3 and cryptocurrency developers are facing a new wave of targeted attacks driven not by cold outreach, but by carefully engineered “inbound” traps. Instead of chasing victims through phishing emails or unsolicited Telegram messages, threat actors are now building fake companies, posting appealing job openings, and waiting for high-value targets to walk into their infrastructure.…
-
Instagram Confirms No System Breach After External Password Reset Problem
Instagram has dismissed security breach concerns, clarifying that recent unexpected password reset emails were caused by an external party exploiting a now-patched vulnerability rather than a complete system compromise. The social media giant confirmed that a flaw in its systems allowed unknown threat actors to request password reset emails on behalf of users without actually…
-
Google Integrates Gemini Into Gmail, Rolling Out New Capabilities
Google has announced a major upgrade to Gmail, bringing its advanced Gemini AI directly into the email platform. The integration transforms Gmail into a personal, proactive inbox assistant designed to help users manage the ever-increasing volume of emails more efficiently. With 3 billion users relying on Gmail daily, this move represents a significant evolution in…
-
Instagram Denies Breach After Password Reset Emails Alarm Users
Instagram says no breach occurred after attackers abused its password reset system, underscoring how trusted features can still enable phishing risk. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/instagram-denies-breach-after-password-reset-emails-alarm-users/
-
Iran-linked MuddyWater APT deploys Rust-based implant in latest campaign
Rust offers evasion advantages: CloudSEK researchers said RustyWater was developed in Rust, which they said is increasingly used by malware authors for its memory safety features and cross-platform capabilities, according to the blog post. Other state-sponsored groups, including Russia’s Gossamer Bear and China-linked actors, have also deployed Rust-based malware in recent campaigns, according to security…
-
Fake Employee Performance Reports Deliver Guloader Malware
Organizations are being warned about a new phishing campaign that weaponizes fake employee performance reports to deploy the Guloader malware and ultimately install Remcos RAT on compromised systems. In the observed cases, threat actors send phishing emails that purport to share an employee performance report for October 2025. The email body claims that management is…
-
Instagram denies breach amid claims of 17 million account data leak
Instagram says it fixed a bug that allowed threat actors to mass-request password reset emails, amid claims that data from more than 17 million Instagram accounts was scraped and leaked online. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/instagram-denies-breach-amid-claims-of-17-million-account-data-leak/
-
Massive Instagram Data Scare Ties 17.5M Accounts to Leak, But Meta Denies Breach
A major cybersecurity scare has put Instagram, one of the world’s largest social networks, under intense scrutiny after millions of users globally reported unexpected password reset emails, fueling fears of a large-scale data breach. While evidence of leaked account data has surfaced, Instagram’s parent company Meta insists that its systems were not compromised and that……
-
Security Affairs newsletter Round 558 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. A massive breach exposed data of 17.5M Instagram users North Korealinked APT Kimsuky behind quishing attacks,…
-
Europol Raids Disrupt Black Axe Cybercrime Ring in Spain
Authorities caught 34 members of the notorious Black Axe gang in Spain known for stealing millions of Euros through online romance scams and email fraud. First seen on hackread.com Jump to article: hackread.com/europol-black-axe-cybercrime-ring-spain/
-
A massive breach exposed data of 17.5M Instagram users
A massive breach exposed data of 17.5M Instagram users, triggering mass password reset emails and fears that stolen data is already circulating online. A major data breach has exposed the personal data of about 17.5 million Instagram users, Malwarebytes Labs researchers warn. Exposed data includes usernames, physical addresses, phone numbers, and email addresses,. Since January…
-
Massive Instagram Data Breach Exposes Personal Details of 17.5 Million Users
A staggering cybersecurity incident has come to light, with 17.5 million Instagram users’ personal information exposed in a data breach advertised on dark web marketplaces. Cybersecurity firm Malwarebytes first alerted the public via X (formerly Twitter), confirming the leak’s severity as stolen data, including usernames, emails, phone numbers, and partial locations, circulates for sale. Affected…
-
North Korealinked APT Kimsuky behind quishing attacks, FBI warns
FBI warns that North Korealinked APT group Kimsuky is targeting governments, think tanks, and academic institutions with quishing attacks. North Korealinked APT group Kimsuky is targeting government agencies, academic institutions, and think tanks using spear-phishing emails that contain malicious QR codes (quishing), the FBI warns. >>As of 2025, Kimsuky actors have targeted think tanks, academic…
-
ZombieAgent ChatGPT attack shows persistent data leak risks of AI agents
Worm-like propagation: The email attack even has worming capabilities, as the malicious prompts could instruct ChatGPT to scan the inbox, extract addresses from other email messages, exfiltrate those addresses to the attackers using the URL trick, and send similar poisoned messages to those addresses as well.If the victim is the employee of an organization that…
-
Salt Typhoon Hackers Hit Congressional Emails in New Breach
Staff Working on China, Intel, Military Oversight Targeted in Espionage Operation. U.S. officials are probing a suspected Chinese cyber campaign tied to Salt Typhoon that breached congressional staff email systems supporting national security committees, exposing sensitive discussions and raising concerns about unclassified federal network defenses. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/salt-typhoon-hackers-hit-congressional-emails-in-new-breach-a-30484
-
Email security needs more seatbelts: Why click rate is the wrong metric
Click rate misses the real email security risk: what attackers can do after they access a mailbox. Material Security explains why containment and post-compromise impact matter more than phishing metrics. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/email-security-needs-more-seatbelts-why-click-rate-is-the-wrong-metric/
-
Enterprises still aren’t getting IAM right
Tags: access, ai, api, authentication, automation, cloud, control, credentials, cybersecurity, data, email, governance, iam, identity, incident response, infrastructure, least-privilege, password, risk, saas, service, toolJust 1% have fully implemented a modern just-in-time (JIT) privileged access model;91% say at least half of their privileged access is always-on (standard privilege), providing unrestricted, persistent access to sensitive systems;45% apply the same privileged access controls to human and AI identities;33% lack clear AI access policies.The research also revealed a growing issue with “shadow…