Tag: phishing
-
New Mobile Phishing Targets Executives with Fake DocuSign Links
Cybercriminals are using advanced techniques to target executives with mobile-specific phishing attacks. First seen on hackread.com Jump to article: hackread.com/mobile-phishing-executives-fake-docusign-links/
-
Acumen Threat Analysis: Preparing for 2025
Phishing continues to be the threat vector of choice for adversaries, ransomware continues to deliver the desired financial and destructive results for attackers, while organizations, both public and private, are growing increasingly concerned about the risks posed by insiders. First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/12/acumen-threat-analysis-preparing-for-2025/
-
HubPhish Abuses HubSpot Tools to Target 20,000 European Users for Credential Theft
Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims’ Microsoft Azure cloud infrastructure.The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to the abuse of HubSpot tools in the attack chain. Targets include at…
-
Don’t fall for a mail asking for rapid Docusign action it may be an Azure account hijack phish
Recent campaign targeted 20,000 folk across UK and Europe with this tactic, Unit 42 warns First seen on theregister.com Jump to article: www.theregister.com/2024/12/19/docusign_lure_azure_account_takeover/
-
Ongoing phishing attack abuses Google Calendar to bypass spam filters
An ongoing phishing scam is abusing Google Calendar invites and Google Drawings pages to steal credentials while bypassing spam filters. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ongoing-phishing-attack-abuses-google-calendar-to-bypass-spam-filters/
-
Biggest Crypto Scam Tactics in 2024 and How to Avoid Them
Stay alert to crypto scams with our guide to 2024’s top threats, including phishing, malware, Ponzi schemes, and… First seen on hackread.com Jump to article: hackread.com/biggest-crypto-scam-tactics-in-2024-avoid-them/
-
Russia-linked APT29 group used red team tools in rogue RDP attacks
Russia-linked APT29 group uses malicious RDP configuration files, adapting red teaming methods for cyberattacks to compromise systems. In October 2024, the Russia-linked cyber espionage group APT29 (aka Earth Koshchei, SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes) used rogue RDP attacks via phishing emails targeting governments, think tanks, and Ukrainian entities to steal data and install malware. The…
-
Mobile Spear Phishing Targets Executive Teams
Over the past few months, enterprises have observed a pattern of sophisticated spearphishing attempts targeting their executives, with some specifically targeting their mobile devices. Our blog shares the details. First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/12/mobile-spear-phishing-targets-executive-teams/
-
Phishers Spoof Google Calendar Invites in Fast-Spreading, Global Campaign
Attackers are using links to the popular Google scheduling app to lead users to pages that steal credentials, with the ultimate goal of committing financial fraud. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/phishers-spoof-google-calendar-invites-global-campaign
-
HubSpot phishing targets 20,000 Microsoft Azure accounts
A phishing campaign targeting automotive, chemical, and industrial manufacturing companies in Germany and the UK is abusing HubSpot to steal Microsoft Azure account credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hubspot-phishing-targets-20-000-microsoft-azure-accounts/
-
Manufacturers Lose Azure Creds to HubSpot Phishing Attack
Cyberattackers used fake DocuSign links and HubSpot forms to try to solicit Azure cloud logins from hundreds of thousands of employees across Europe. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/manufacturing-orgs-azure-creds-hubspot-phishing-attack
-
HubPhish Exploits HubSpot Tools to Target 20,000 European Users for Credential Theft
Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims’ Microsoft Azure cloud infrastructure.The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to the abuse of HubSpot tools in the attack chain. Targets include at…
-
Midnight Blizzard Taps Phishing Emails, Rogue RDP Nets
The Russian-based attack group uses legitimate red-team tools, 200 domain names, and 34 back-end RDP servers, making it harder to identify and block malicious activity. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/midnight-blizzard-taps-phishing-email-rogue-rdp-nets
-
Phishing-Masche nimmt Nutzer von Google-Kalender ins Visier
Cyberkriminelle nutzen laut einer Analyse von Sicherheitsforschern offenbar verstärkt Google-Kalender-Invites, um Internetnutzer auf Phishingseiten zu locken. First seen on heise.de Jump to article: www.heise.de/news/Phishing-Masche-nimmt-Nutzer-von-Google-Kalender-ins-Visier-10214705.html
-
Phishing Attacks Double in 2024
SlashNext reports a 202% increase in overall phishing messages and a 703% surge in credential-based phishing attacks in 2024 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/2024-phishing-attacks-double/
-
KI-gestützte Cybersicherheit 10 Prognosen für das Jahr 2025
Schon seit vielen Jahren warnen Cybersicherheitsexperten auf der ganzen Welt vor den Gefahren KI-gestützter Cyberangriffe. Langsam werden diese Warnungen nun Realität. In diesem Jahr kam KI noch vor allem in Deepfake-, Phishing- und Spear Phishing-Kampagnen zum Einsatz. Für die kommenden Jahre ist aber mit einem deutlichen Anstieg der Anwendungsfälle zu rechnen. KI-gestützte Cyberangriffe werden mehr…
-
New VIPKeyLogger Via Weaponized Office Documenrs Steals Login Credentials
The VIPKeyLogger infostealer, exhibiting similarities to the Snake Keylogger, is actively circulating through phishing campaigns. Delivered as attachments disguised as archives or Microsoft 365 files, it employs malicious Microsoft Office documents to spread through command-and-control (C2) infrastructure. It targets sensitive data, including login credentials, financial information, system data, and personally identifiable information, posing a significant…
-
European companies hit with effective DocuSign-themed phishing emails
A threat actor looking to take over the Microsoft Azure cloud infrastructure of European companies has successfully compromised accounts of multiple victims in different … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/12/18/european-companies-docusign-themed-phishing-owa-microsoft-azure/
-
LedgerKampagne: Fake E-Mail will an eure Krypto-Wallets
Achtung Phishing-Welle!! Gut gemachte Phishing-E-Mails zielen auf Ledger-Recovery-Phrasen ab. So schützt ihr eure Krypto-Wallet. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/krypto/ledger-phishing-kampagne-fake-e-mail-will-an-eure-krypto-wallets-306406.html
-
Cybercriminals Exploit Google Calendar and Drawings in Phishing Campaigns
Attackers are ingeniously exploiting Google Calendar and Google Drawings in phishing campaigns, targeting unsuspecting individuals and organizations. Leveraging the inherent trust in Google’s widely used tools, cybercriminals are successfully deceiving users into revealing sensitive information and compromising their accounts. Google Calendar: A Trusted Tool Turned Target Google Calendar, a widely used scheduling tool with over…
-
5 Reasons to Create a Certificate Lifecycle Management Policy for the New Year
A CLM policy also puts you in the best position to mitigate and prevent cyberthreats, including man-in-the-middle attacks and phishing scams. First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/12/5-reasons-to-create-a-certificate-lifecycle-management-policy-for-the-new-year/
-
Key strategies to enhance cyber resilience
Tags: attack, awareness, backup, banking, breach, business, ceo, compliance, control, crowdstrike, cyber, cybersecurity, data, finance, government, group, healthcare, incident, incident response, infrastructure, insurance, metric, network, phishing, programming, ransom, ransomware, resilience, risk, security-incident, service, skills, software, strategy, supply-chain, technology, threat, training, update, vulnerability, windowsThe faulty CrowdStrike software update that triggered IT outages on a global scale in July was a sobering reminder of the importance of incident response and business continuity plans.The update caused more than eight million Windows devices to crash and take down with them airline reservation systems, hospital and government services, financial and banking applications…
-
Phishers cast wide net with spoofed Google Calendar invites
Not that you needed another reason to enable the ‘known senders’ setting First seen on theregister.com Jump to article: www.theregister.com/2024/12/18/google_calendar_spoofed_in_phishing_campaign/
-
New fake Ledger data breach emails try to steal crypto wallets
A new Ledger phishing campaign is underway that pretends to be a data breach notification asking you to verify your recovery phrase, which is then stolen and used to steal your cryptocurrency. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-fake-ledger-data-breach-emails-try-to-steal-crypto-wallets/
-
390,000 WordPress credentials compromised via phishing, GitHub repos
First seen on scworld.com Jump to article: www.scworld.com/news/390000-wordpress-credentials-compromised-via-phishing-github-repos
-
Sophisticated TA397 Malware Targets Turkish Defense Sector
Sophisticated phishing attack targeting Turkey’s defense sector revealed TA397’s advanced tactics First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ta397-malware-targets-turkish/
-
Check Point entdeckt neue Phishing-Angriffsmethode über den Google Calendar
Der Missbrauch von Google Calendar zeigt, wie kreativ Cyberkriminelle vorgehen, um Schutzmechanismen zu umgehen. Unternehmen und Nutzer müssen wachsam bleiben und ihre Sicherheitsvorkehrungen kontinuierlich anpassen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/check-point-entdeckt-neue-phishing-angriffsmethode-ueber-den-google-calendar/a39305/
-
Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks
A new phishing campaign has been observed employing tax-themed lures to deliver a stealthy backdoor payload as part of attacks targeting Pakistan.Cybersecurity company Securonix, which is tracking the activity under the name FLUX#CONSOLE, said it likely starts with a phishing email link or attachment, although it said it couldn’t obtain the original email used to…
-
Hacker missbrauchen Google-Calendar zum Angriff auf Postfächer
Check Point hat eine neue Hacker-Kampagne aufgedeckt: Der Google-Calendar wird missbraucht, um Postfächer anzugreifen. Sie missbrauchen dabei Benachrichtigungen, um Phishing-E-Mails an den Sicherheitsmaßnahmen vieler Postfächer vorbei zu schmuggeln. Google-Calendar ist ein Tool zur Organisation von Zeitplänen und zur Zeitverwaltung, das Einzelpersonen und Unternehmen bei der effizienten Planung ihrer Arbeitszeit unterstützt. Nach Angaben von Calendly.com wird…