Tag: phishing
-
Cybersicherheit braucht Reife und keine Checklisten
Wenn CISOs stärkere Programme, bessere Widerstandsfähigkeit und eine sicherere Zukunft wollen, müssen sie ihren Ansatz weiterentwickeln.Cybersicherheit wird oft wie ein Spiel behandelt. Unternehmen jagen schnellen Erfolgen hinterher, haken Compliance-Listen ab oder klopfen sich nach einem einzigen erfolgreichen Audit selbst auf die Schulter. Auf dem Papier mag das produktiv aussehen, aber in Wirklichkeit schafft es ein…
-
Threat Actors Using Fake Google Forms Site to Harvest Google Logins
A new phishing campaign in which threat actors are using a convincing fake version of Google Forms to steal Google account credentials. Cybercriminals are once again exploiting a trusted brand Google to trick job seekers and steal their credentials. The campaign’s malicious URLs all followed a similar structure: forms.google.ss-o[.]com/forms/d/e/{unique_id}/viewform?form=opportunitysecpromo= At first glance, these links appear…
-
Betterment data breach might be worse than we thought
This breach now appears far more serious. The leaked data includes rich personal and financial details that phishers could use. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/betterment-data-breach-might-be-worse-than-we-thought/
-
Booking.com Phishing Campaign Hijacks Hotel Accounts to Defraud Guests
Tags: phishingA multi-stage Booking.com phishing campaign is hijacking hotel accounts to defraud guests through convincing payment scams. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/booking-com-phishing-campaign-hijacks-hotel-accounts-to-defraud-guests/
-
Anti-phishing rules mistakenly blocked emails, Teams messages
Microsoft says an Exchange Online issue that mistakenly quarantined legitimate emails last week was triggered by faulty heuristic detection rules designed to block credential phishing campaigns. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-anti-phishing-rules-mistakenly-blocked-emails-teams-messages/
-
Job scam uses fake Google Forms site to harvest Google logins
Phishers are using fake Google Forms pages hosted on lookalike domains to trick job seekers into handing over their Google credentials. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/job-scam-uses-fake-google-forms-site-to-harvest-google-logins/
-
EdTech Magazine – What Minimum Viable Cybersecurity Looks Like for K12 Districts
This article was originally published in EdTech Magazine on 02/11/26 by Didi Gluck. As ransomware and phishing attacks grow more sophisticated, districts can’t rely on perimeter defenses alone. Cybersecurity has become a top priority for K12 districts, not just to keep students safe online but to ensure continuity across devices, systems and end user accounts.…
-
Phishing hat bei Cyberkriminellen weiter Hochkonjunktur
Die Mechanik von Cyberangriffen verändert sich spürbar. Technische Schwachstellen spielen weiterhin eine Rolle, doch sie sind immer seltener der eigentliche Einstiegspunkt. Stattdessen rücken digitale Identitäten und vertrauensbasierte Kommunikation in den Mittelpunkt der Angriffe. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/phishing-hochkonjunktur
-
Master XDR Investigations: A Deep Dive into the GravityZone XDR Demo Incident
<div cla An attacker’s initial access, whether through phishing, unmanaged devices, exploited vulnerabilities, or a compromised supply chain, marks the beginning of a dangerous chain of events. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/master-xdr-investigations-a-deep-dive-into-the-gravityzone-xdr-demo-incident/
-
Poorly crafted phishing campaign leverages bogus security incident report
Attackers used a fake PDF incident report hosted on AWS to scare victims into enabling 2FA, though a poorly crafted phishing campaign. Freelance security consultant Xavier Mertens reported a phishing campaign using a fake PDF security incident report hosted on AWS to scare victims into enabling 2FA. The researchers pointed out that the campaign appears poorly…
-
QR Codes Exploited for Phishing Attacks and Malware Spread on Mobile Devices
QR code abuse has become a significant mobile threat vector, with attackers using it to deliver phishing pages, trigger in”‘app account takeovers, and distribute malicious applications outside official app stores. Because people routinely scan QR codes for payments, menus and app downloads, these attacks often bypass enterprise protections by shifting the interaction onto less”‘protected personal…
-
CISO Julie Chatman offers insights for you to take control of your security leadership role
Tags: access, ai, attack, awareness, breach, business, ciso, control, crowdstrike, cyber, cybersecurity, deep-fake, email, finance, firewall, government, healthcare, infrastructure, law, military, office, phishing, risk, service, skills, supply-chain, technology, threat, training, updateFirst, the hopes-and-dreams budget: What would it take to close all the known gaps and operate proactively?Second, the could-live-with-this budget: What’s realistic and gets you to acceptable risk levels?Third, the I-think-I’m-going-to-resign budget: Because you can see a breach coming and you don’t want your name attached to it.You probably won’t end up at that last…
-
CISO Julie Chatman offers insights for you to take control of your security leadership role
Tags: access, ai, attack, awareness, breach, business, ciso, control, crowdstrike, cyber, cybersecurity, deep-fake, email, finance, firewall, government, healthcare, infrastructure, law, military, office, phishing, risk, service, skills, supply-chain, technology, threat, training, updateFirst, the hopes-and-dreams budget: What would it take to close all the known gaps and operate proactively?Second, the could-live-with-this budget: What’s realistic and gets you to acceptable risk levels?Third, the I-think-I’m-going-to-resign budget: Because you can see a breach coming and you don’t want your name attached to it.You probably won’t end up at that last…
-
Operation DoppelBrand: Weaponizing Fortune 500 Brands
GS7 targets US financial institutions, among others, with near-perfect imitations of phishing portals to steal credentials, paving the way for remote access and other threat activity First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/operation-doppelbrand-weaponizing-fortune-500-brands
-
Phishing Evolves Into Multi-Platform Fraud Systems
Bolster AI finds phishing has evolved into scalable, multi-platform fraud that hides in search, ads, and SaaS workflows. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/phishing-evolves-into-multi-platform-fraud-systems/
-
Operation DoppelBrand Weaponizes Trusted Brands For Credential Theft
New phishing campaign dubbed Operation DoppelBrand targeted major financial firms like Wells Fargo First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/operation-doppelbrand-trusted/
-
Noodlophile Malware Authors Use Fake Job Ads and Phishing Schemes to Evolve Tactics
Hey folks in the threat”‘hunting world looks like our coverage of the Noodlophile infostealer has struck a nerve with its creators. The operators used inflated engagement metrics and fake popularity scores to lure victims into downloading malicious ZIP archives. Once executed, these payloads quietly harvested user credentials, crypto”‘wallet data, browser information, and more all exfiltrated through Telegram…
-
KI-gestütztes Phishing: Wie KI Phishing-Webseiten in Echtzeit erzeugt
Es ist nur eine Frage der Zeit, bis reale Bedrohungsakteure diese Technik produktiv einsetzen. Der PoC macht deutlich, wie massiv KI das Risiko erfolgreicher Phishing-Angriffe erhöht. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/ki-gestuetztes-phishing-wie-ki-phishing-webseiten-in-echtzeit-erzeugt/a43742/
-
Finding a common language around risk
Tags: ceo, cio, ciso, corporate, cyber, cybersecurity, defense, framework, governance, guide, intelligence, lessons-learned, metric, monitoring, phishing, ransomware, risk, risk-management, service, strategy, supply-chain, technology, threat, tool, training, updateBuilding one culture from three languages: The Organizational Risk Culture Standard (ORCS) offers something most frameworks miss: it treats culture as the foundation, not the afterthought. You can’t bolt culture onto existing processes and call it done. Culture is how people actually think about risk when no one is watching. It’s the shared beliefs that…
-
CISO Julie Chatman wants to help you take control of your security leadership role
Tags: access, ai, attack, awareness, breach, business, ciso, control, crowdstrike, cyber, cybersecurity, deep-fake, email, finance, firewall, government, healthcare, infrastructure, law, military, office, phishing, risk, service, skills, supply-chain, technology, threat, training, updateFirst, the hopes-and-dreams budget: What would it take to close all the known gaps and operate proactively?Second, the could-live-with-this budget: What’s realistic and gets you to acceptable risk levels?Third, the I-think-I’m-going-to-resign budget: Because you can see a breach coming and you don’t want your name attached to it.You probably won’t end up at that last…
-
Security Affairs newsletter Round 563 by Pierluigi Paganini INTERNATIONAL EDITION
Tags: attack, breach, cisa, data, data-breach, email, fintech, flaw, international, phishing, WeeklyReviewA new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Fintech firm Figure disclosed data breach after employee phishing attack U.S. CISA adds a flaw in…
-
New XWorm RAT Campaign Leverages Phishing and CVE-2018-0802 Excel Exploit to Bypass Detection
Tags: attack, control, cve, cyber, cybercrime, data, ddos, detection, exploit, marketplace, phishing, ransomware, rat, theft, windowsXWorm, a multi-functional .NET”‘based RAT first observed in 2022, remains actively traded across cybercrime marketplaces and continues to attract both low-skilled and advanced operators thanks to its rich feature set and plugin-based architecture. Once deployed, it enables full remote control of compromised Windows systems, including data theft, remote desktop control, DDoS attacks, and ransomware execution.…