Tag: phishing
-
Identifying Cyber Attack Patterns Through Threat Actor Infrastructure Analysis
Kudelski Security Research recently published an article detailing advanced methods for tracking and analyzing threat actor infrastructure, providing valuable insights into cyber attack patterns and attribution techniques. Decoding Threat Actor Infrastructure: A Case Study The research team demonstrated their approach using a phishing campaign targeting U.S. and Israeli government officials, attributed to the Iranian group…
-
YouTube warns of AI-generated video of its CEO used in phishing attacks
YouTube warns that scammers are using an AI-generated video featuring the company’s CEO in phishing attacks to steal creators’ credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/youtube-warns-of-ai-generated-video-of-its-ceo-used-in-phishing-attacks/
-
Bankdaten ergaunert und abkassiert: Polizei stoppt Cyber-Betrüger
Ein Cyber-Betrüger schädigte zahlreiche Bankkunden mit Phishing-Methoden. Mit ergaunerten Bankdaten hat er ordentlich abkassiert. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/it-sicherheit/online-betrug/bankdaten-ergaunert-und-abkassiert-polizei-stoppt-cyber-betrueger-311187.html
-
Cybercriminals Impersonate Electronic Frontier Foundation to Target Gaming Community
A sophisticated phishing campaign targeting the Albion Online gaming community has been uncovered, revealing a complex operation involving impersonation of the Electronic Frontier Foundation (EFF) and deployment of advanced malware. The campaign, discovered on March 4, 2025, showcases the evolving tactics of cybercriminals in exploiting trust in reputable organizations and leveraging the immersive nature of…
-
LinkedIn Phishing Scam: Fake InMail Messages Spreading ConnectWise Trojan
Cofense uncovers new LinkedIn phishing scam delivering ConnectWise RAT. Learn how attackers bypass security with fake InMail emails… First seen on hackread.com Jump to article: hackread.com/scammers-fake-linkedin-inmail-deliver-connectwise-trojan/
-
Microsoft pushes a lot of products on users, but here’s one cybersecurity can embrace
Tags: access, attack, authentication, best-practice, business, cisa, cloud, cybersecurity, data-breach, defense, governance, government, identity, mfa, microsoft, monitoring, password, phishing, service, siemEntra monitors for suspicious activity: Entra monitors for activities that are more than likely being carried out by attackers. So, for example, the following actions are monitored:Users with leaked credentials.Sign-ins from anonymous IP addresses.Impossible travel to atypical locations.Sign-ins from infected devices.Sign-ins from IP addresses with suspicious activity.Sign-ins from unfamiliar locations.You can set a threshold for…
-
Threat Actor ‘JavaGhost’ Targets AWS Environments in Phishing Scheme
Palo Alto Networks’ Unit 42 details how a threat actor is dodging detection with careful targeting and the use of Amazon’s native email tools. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/threat-actor-javaghost-targets-aws-environments-phishing-scheme
-
Misconfigured AWS environments exploited to facilitate phishing
First seen on scworld.com Jump to article: www.scworld.com/brief/misconfigured-aws-environments-exploited-to-facilitate-phishing
-
Havoc C2 framework spread in novel ClickFix phishing campaign
First seen on scworld.com Jump to article: www.scworld.com/brief/havoc-c2-framework-spread-in-novel-clickfix-phishing-campaign
-
Massive Phishing Campaign Spreads Lumma Stealer Via Bogus CAPTCHA PDFs
First seen on scworld.com Jump to article: www.scworld.com/brief/massive-phishing-campaign-spreads-lumma-stealer-via-bogus-captcha-pdfs
-
Misconfigured AWS Accounts Are Fueling Phishing Campaigns
Misconfigured AWS accounts are letting hackers hijack cloud services for phishing attacks. Learn how they do it, and how to protect your organization. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/aws-accounts-phishing-campaigns/
-
JavaGhost Uses Amazon IAM Permissions to Phish Organizations
Unit 42 uncovers JavaGhost’s evolving AWS attacks. Learn how this threat actor uses phishing, IAM abuse, and advanced… First seen on hackread.com Jump to article: hackread.com/javaghost-uses-amazon-iam-permissions-to-phish/
-
Fertigungsbranche am häufigsten mit SpearAngriffen konfrontiert
Kürzlich ist eine neue Studie über Cyberangriffe auf Industrieunternehmen erschienen, der zufolge Unternehmen der Fertigungsbranche in den vergangenen sechs Monaten am häufigsten mit Spear-Phishing-Angriffen attackiert worden sind. Ganze 41 Prozent aller ‘True-Positive”-Alarmmeldungen der Branche entfielen auf diesen Angriffstyp. Spear Phishing-Angriffe erfolgen, im Gegensatz zu einfachen Phishing-Angriffen, zielgerichtet auf einzelne Personen oder Organisationen. Sie ermöglichen es…
-
Suspected Iranian Hackers Used Compromised Indian Firm’s Email to Target U.A.E. Aviation Sector
Threat hunters are calling attention to a new highly-targeted phishing campaign that singled out “fewer than five” entities in the United Arab Emirates (U.A.E.) to deliver a previously undocumented Golang backdoor dubbed Sosano.The malicious activity was specifically directed against aviation and satellite communications organizations, according to Proofpoint, which detected it in late October First seen…
-
JavaGhost’s Persistent Phishing Attacks: Exploiting Cloud Environments for Long-Term Access
Security researchers from Unit 42 have uncovered an advanced phishing campaign orchestrated by the JavaGhost threat actor group. First seen on securityonline.info Jump to article: securityonline.info/javaghosts-persistent-phishing-attacks-exploiting-cloud-environments-for-long-term-access/
-
Privacy Roundup: Week 9 of Year 2025
Tags: access, android, apple, attack, backdoor, breach, browser, cctv, control, cyber, cybersecurity, data, data-breach, encryption, endpoint, exploit, firmware, flaw, government, group, hacker, Internet, jobs, law, leak, malware, office, password, phishing, privacy, regulation, router, scam, service, software, switch, technology, threat, tool, update, vpn, vulnerabilityThis is a news item roundup of privacy or privacy-related news items for 23 FEB 2025 – 1 MAR 2025. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things may overlap;…
-
Phishers Wreak ‘Havoc,’ Disguising Attack Inside SharePoint
A complex campaign allows cyberattackers to take over Windows systems by a combining a ClickFix-style attack and sophisticated obfuscation that abuses legitimate Microsoft services. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/phishers-wreak-havoc-disguising-attack-inside-sharepoint
-
Massive phishing campaign taps bogus CAPTCHA PDFs to spread Lumma Stealer
First seen on scworld.com Jump to article: www.scworld.com/brief/massive-phishing-campaign-taps-bogus-captcha-pdfs-to-spread-lumma-stealer
-
New ClickFix attack deploys Havoc C2 via Microsoft Sharepoint
A newly uncovered ClickFix phishing campaign is tricking victims into executing malicious PowerShell commands that deploy the Havok post-exploitation framework for remote access to compromised devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-clickfix-attack-deploys-havoc-c2-via-microsoft-sharepoint/
-
Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail
Threat actors are targeting Amazon Web Services (AWS) environments to push out phishing campaigns to unsuspecting targets, according to findings from Palo Alto Networks Unit 42.The cybersecurity company is tracking the activity cluster under the name TGR-UNK-0011 (short for a threat group with unknown motivation), which it said overlaps with a group known as JavaGhost.…
-
Hackers Use ClickFix Trick to Deploy PowerShell-Based Havoc C2 via SharePoint Sites
Tags: api, communications, control, cybersecurity, framework, hacker, malware, microsoft, open-source, phishing, powershell, threatCybersecurity researchers are calling attention to a new phishing campaign that employs the ClickFix technique to deliver an open-source command-and-control (C2) framework called Havoc.”The threat actor hides each malware stage behind a SharePoint site and uses a modified version of Havoc Demon in conjunction with the Microsoft Graph API to obscure C2 communications within trusted,…
-
Phishing Campaign Uses Havoc Framework to Control Infected Systems
A new phishing campaign has been identified using Havoc to control infected systems, leveraging SharePoint and Microsoft Graph API First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phishing-campaign-havoc-framework/
-
Google Calendar Spoofing: How Attackers Use It for Phishing Scams
Google Calendar spoofing is the latest phishing tactic tricking users with fake invites. Learn how it works and how to protect yourself from these scams. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/google-calendar-spoofing-how-attackers-use-it-for-phishing-scams/
-
JavaGhost: Exploiting Amazon IAM Permissions for Phishing Attacks
Unit 42 researchers have observed a threat actor group known as JavaGhost exploiting misconfigurations in Amazon Web Services (AWS) environments to conduct sophisticated phishing campaigns. Active for over five years, JavaGhost has pivoted from website defacement to leveraging compromised cloud infrastructure for financial gain. The group’s attacks stem from exposed long-term AWS access keys, which…
-
Hackers Abused Google and PayPal’s Infrastructure to Steal Users Personal Data
Tags: cyber, cybersecurity, data, exploit, finance, google, hacker, infrastructure, phishing, vulnerabilityCybersecurity researchers have uncovered a sophisticated phishing campaign leveraging Google Ads and PayPal’s infrastructure to deceive users and steal sensitive personal data. The attackers exploited vulnerabilities in Google’s ad policies and PayPal’s “no-code checkout” feature to create fraudulent payment links that appeared legitimate, tricking victims into engaging with fake customer support agents. Exploitation of Google…