Tag: phishing
-
APT42 impersonates cyber professionals to phish Israeli academics and journalists
Iran-linked APT42 targets Israeli experts with phishing attacks, posing as security professionals to steal email credentials and 2FA codes. Iran-linked group APT42 (aka Educated Manticore, Charming Kitten, and Mint Sandstorm) is targeting Israeli journalists, cybersecurity experts, and academics with phishing attacks, posing as security professionals to steal email credentials and 2FA codes, according to Check Point.…
-
Don’t trust that email: It could be from a hacker using your printer to scam you
Tags: authentication, control, credentials, data, defense, dkim, dmarc, email, endpoint, exploit, framework, hacker, infrastructure, iot, login, mail, microsoft, monitoring, network, phishing, powershell, qr, risk, scam, tactics, tool, vulnerability, zero-daytenantname.mail.protection.outlook.com, and companies’ internal email address formats can be trivial to figure out or easy to scrape from public sources or social media. Once an attacker has the domain and a valid email address, they are able to send emails that appear to come from inside the organization.In the campaign observed by Varonis’ forensics experts,…
-
China-Aligned Hive0154 APT Strikes Tibetan Community: Pubload Backdoor Delivered via Phishing Lures
The post China-Aligned Hive0154 APT Strikes Tibetan Community: Pubload Backdoor Delivered via Phishing Lures appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/china-aligned-hive0154-apt-strikes-tibetan-community-pubload-backdoor-delivered-via-phishing-lures/
-
New crypto phishing attack harnesses Trezor support platform
First seen on scworld.com Jump to article: www.scworld.com/brief/new-crypto-phishing-attack-harnesses-trezor-support-platform
-
Cryptohack Roundup: Malware Targets Wallets Via Photos
Also: CoinMarketCap Attack, BitPro Blames Lazarus for $11M Hack. This week, a new malware targeted crypto wallets via photos, CoinMarketCap faced attack, BitoPro blamed Lazarus for heist, Trezor warned of phishing scam, France saw another crypto kidnapping, cops re-arrested teen after second theft, Hacken blamed human error for exploit and Self Chain ousted CEO. First…
-
Microsoft 365 ‘Direct Send’ abused to send phishing as internal users
An ongoing phishing campaign abuses a little”‘known feature in Microsoft 365 called “Direct Send” to evade detection by email security and steal credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-365-direct-send-abused-to-send-phishing-as-internal-users/
-
SAP-Schwachstellen gefährden Windows-Nutzerdaten
Tags: access, compliance, cve, cvss, cyberattack, encryption, fortinet, GDPR, PCI, phishing, risk, sap, spear-phishing, update, vulnerability, windowsSchwachstellen in SAP GUI geben sensible Daten durch schwache oder fehlende Verschlüsselung preis.Die Forscher Jonathan Stross von Pathlock, und Julian Petersohn von Fortinet warnen vor zwei neuen Sicherheitslücken in einer Funktion von SAP GUI, die für die Speicherung der Benutzereingaben in den Windows- (CVE-2025-0055) und Java-Versionen (CVE-2025-0056) zuständig ist .Dadurch werden sensible Informationen wie Benutzernamen,…
-
Iranian Spear-Phishing Attack Impersonates Google, Outlook, and Yahoo Domains
Check Point Research has uncovered a renewed global spear-phishing campaign orchestrated by the Iranian threat actor Educated Manticore, also known as APT42, Charming Kitten, and Mint Sandstorm. Linked to the IRGC Intelligence Organization, this group has intensified its operations amid growing Iran-Israel tensions, targeting high-value individuals with meticulously crafted attacks. The campaign, which has seen…
-
Chinese Hackers Deploy Pubload Malware Using Tibetan Community Lures and Weaponized Filenames
IBM X-Force researchers have uncovered a series of targeted cyberattacks orchestrated by the China-aligned threat actor Hive0154. Throughout 2025, this group has been deploying the Pubload malware, a potent backdoor, through meticulously crafted phishing lures aimed at the Tibetan community. The timing of these campaigns is particularly notable, coinciding with significant events such as the…
-
ClickFix attacks skyrocketing more than 500%
ClickFix, a deceptive attack method, saw a surge of more than 500% in the first half of 2025, making it the second most common attack vector after phishing, according to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/26/clickfix-attacks-fakecaptcha-eset-report/
-
Iranian APT35 Hackers Targeting Israeli Tech Experts with AI-Powered Phishing Attacks
An Iranian state-sponsored hacking group associated with the Islamic Revolutionary Guard Corps (IRGC) has been linked to a spear-phishing campaign targeting journalists, high-profile cyber security experts, and computer science professors in Israel.”In some of those campaigns, Israeli technology and cyber security professionals were approached by attackers who posed as fictitious assistants to First seen on…
-
That WhatsApp from an Israeli infosec expert could be a Iranian phish
Charming Kitten unsheathes its claws and tries to catch credentials First seen on theregister.com Jump to article: www.theregister.com/2025/06/26/that_whatsapp_from_an_israeli/
-
Charming Kitten APT Tries Spying on Israeli Cybersecurity Experts
Israel’s cyber pros are having to put theory into practice, as a notorious nation-state APT sponsored by Iran targets them with spear-phishing attacks. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/iran-apt-spying-israeli-cybersecurity-experts
-
Beware of Weaponized Wedding Invite Scams Delivering SpyMax RAT to Android Devices
A sophisticated Android phishing campaign, aptly named “Wedding Invitation,” has emerged as a significant threat targeting mobile users across India. According to a detailed report from K7 Computing, this malicious operation leverages the guise of digital wedding invitations to deceive unsuspecting users into installing compromised APK files. Stealthy Phishing Campaign Distributed primarily through popular messaging…
-
SAP GUI flaws expose sensitive data via weak or no encryption
Tags: attack, breach, cve, data, encryption, exploit, flaw, phishing, sap, spear-phishing, threat, update, vulnerability, windowsThe impact could be much greater: Dani noted that a breach through these vulnerabilities can facilitate further targeted attacks. “Not undermining the fact that this extracted data provides attackers with enough gunpowder for reconnaissance activities, a threat actor could comprehend organizational structure, usage patterns, and system configurations from the exploitation of these vulnerabilities and weaponize…
-
APT Attackers Leverage Microsoft ClickOnce to Run Malware as Trusted Applications
The Trellix Advanced Research Center has exposed a highly sophisticated Advanced Persistent Threat (APT) malware campaign dubbed >>OneClik,
-
Schutz vor Cybercrime: Verbraucher werden nachlässiger
Tags: authentication, bsi, cyber, cyberattack, cybercrime, cyersecurity, fraud, Internet, mail, mfa, password, phishing, updateLaut einer Umfrage des BSI verzichten immer mehr Bürger auf Cyberschutzmaßnahmen.Ein angeblicher Lottogewinn, für den noch Daten fehlen, ein allzu billiges Produkt im Online-Handel, das nie ankommt oder gar ein Virus. Cybercrime hat viele Facetten. Wie schützen sich die Bürger? Bei einer Umfrage des Bundesamt für Sicherheit in der Informationstechnik (BSI) gaben nur noch 44…
-
APT36 Unleashes Advanced Phishing Against Indian Defense Personnel: New Anti-Analysis Malware NIC Impersonation
The post APT36 Unleashes Advanced Phishing Against Indian Defense Personnel: New Anti-Analysis Malware NIC Impersonation appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/apt36-unleashes-advanced-phishing-against-indian-defense-personnel-new-anti-analysis-malware-nic-impersonation/
-
Sweeping DMV phishing campaign hits US
Tags: phishingFirst seen on scworld.com Jump to article: www.scworld.com/brief/sweeping-dmv-phishing-campaign-hits-us
-
Trezor’s support platform abused in crypto theft phishing attacks
Trezor is alerting users about a phishing campaign that abuses its automated support system to send deceptive emails from its official platform. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trezors-support-platform-abused-in-crypto-theft-phishing-attacks/
-
Over 2,000 Devices Compromised by Weaponized Social Security Statement Phishing Attacks
CyberArmor analysts have uncovered a meticulously crafted phishing campaign that has already compromised over 2,000 devices by exploiting the trusted theme of Social Security Administration (SSA) statements. Cybercriminals behind this operation deployed a highly convincing email lure masquerading as an official SSA communication, deceiving users into downloading malicious software. The campaign’s technical sophistication, coupled with…
-
Weaponized DMV-Themed Phishing Scam Targets U.S. Citizens to Steal Personal and Financial Data
A highly coordinated phishing campaign impersonating various U.S. state Departments of Motor Vehicles (DMVs) has emerged as a significant threat, targeting citizens across multiple states with the intent to harvest personal and financial data. This sophisticated operation employs SMS phishing, commonly known as smishing, by sending alarming text messages from spoofed numbers that often appear…
-
Russia-linked APT28 use Signal chats to target Ukraine official with malware
Russia-linked group APT28 uses Signal chats as an attack vector to phish Ukrainian officials with new malware strains. Russia-linked cyberespionage group APT28 is targeting Ukrainian government officials using Signal chats to deliver two new types of malware, tracked as BeardShell and SlimAgent. While Signal itself remains secure, attackers are exploiting its growing popularity in official…
-
Phishing-Kampagne missbraucht EUSurvey-Plattform
Diese Kampagne zeigt, wie geschickt Angreifer legitime Dienste und die menschliche Psychologie kombinieren, um Sicherheitsmaßnahmen zu umgehen. Auch wenn EUSurvey an sich ein seriöses Tool ist First seen on infopoint-security.de Jump to article: www.infopoint-security.de/phishing-kampagne-missbraucht-eusurvey-plattform/a41201/
-
Vom Phish zum Casino: Krypto-Scammer verzockt Millionenbeute beim Glücksspiel
Ein Blockchainexperte hat die Aktivitäten eines Betrügers aufgedeckt. Kryptos im Wert von Millionen von US-Dollar, die er anderen gestohlen hat, sind wohl weg. First seen on golem.de Jump to article: www.golem.de/news/vom-phish-zum-casino-krypto-scammer-verzockt-millionenbeute-beim-gluecksspiel-2506-197403.html
-
Zero Data on Devices, Full BYOD Freedom Powered by the Cloud
Hypori’s Lewandowski on Eliminating Data and Apps From Personal Devices. Traditional BYOD strategies rely on managing personal devices directly, which introduces privacy concerns and leaves organizations vulnerable to attacks such as phishing, network compromise and device rooting, said Wayne Lewandowski, chief revenue officer at Hypori. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/zero-data-on-devices-full-byod-freedom-powered-by-cloud-a-28797
-
Securing BYOD Without Sacrificing Privacy
Hypori’s Lewandowski on Eliminating Data and Apps From Personal Devices. Traditional BYOD strategies rely on managing personal devices directly, which introduces privacy concerns and leaves organizations vulnerable to attacks such as phishing, network compromise and device rooting, said Wayne Lewandowski, chief revenue officer at Hypori. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/securing-byod-without-sacrificing-privacy-a-28797
-
APT36 Hackers Target Indian Defense Personnel with Sophisticated Phishing Campaign
APT36, also known as Transparent Tribe, a Pakistan-based cyber espionage group, has launched a highly sophisticated phishing campaign targeting Indian defense personnel. According to recent findings by CYFIRMA, this group has meticulously crafted phishing emails that deliver malicious PDF attachments disguised as official government documents. Cyber Espionage Group Transparent Tribe Strikes Again These deceptive files…
-
Shadow Vector Malware Uses SVG Images to Deliver AsyncRAT and RemcosRAT Payloads
Acronis Threat Research Unit (TRU) has discovered a startling development: a malicious campaign called >>Shadow Vector