Collecting Cyber-News from over 60 sources

Tag: phishing

FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot

Mar 17, 2026 11:10 PM

Tags: ai, attack, injection, microsoft, phishing, risk

Researchers reveal how Microsoft Copilot can be manipulated by prompt injection attacks to generate convincing phishing messages inside trusted AI summaries. The post Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-copilot-prompt-injection-phishing-risk/
Hackers Target Cybersecurity Firm Outpost24 in 7-Stage Phish

Mar 17, 2026 10:10 PM

Tags: cybersecurity, hacker, phishing

The cyberattackers leveraged trusted brands and domains in an attempt to redirect a C-suite executive at Outpost24 to give up his credentials. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/hackers-target-cybersecurity-firm-outpost24-phish
Fake Pudgy World site steals your crypto passwords

Mar 17, 2026 7:10 PM

Tags: crypto, password, phishing

The phishing site it is not affiliated with Igloo Inc or Pudgy Penguins, but is designed to lure fans and steal their crypto passwords. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/fake-pudgy-world-site-steals-your-crypto-passwords/
Georgian Charged for Running Phishing Scam Targeting NBA, NFL Players, While in Federal Custody

Mar 17, 2026 1:09 PM

Tags: phishing, scam

Kwamaine Jerell Ford First seen on thecyberexpress.com Jump to article: thecyberexpress.com/phishing-scam-targeting-pro-athletes/
Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web

Mar 17, 2026 12:11 PM

Tags: ai, attack, data-breach, phishing, phone, scam

Customer conversations with chatbots can include contact information and personal details that make it easier for scammers to launch phishing attacks and commit fraud. First seen on wired.com Jump to article: www.wired.com/story/sears-exposed-ai-chatbot-phone-calls-and-text-chats-to-anyone-on-the-web/
Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware

Mar 17, 2026 12:11 PM

Tags: access, email, group, hacking, intelligence, malicious, malware, north-korea, phishing, spear-phishing, threat

North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim’s KakaoTalk desktop application to distribute malicious payloads to certain contacts.The activity has been attributed by South Korean threat intelligence firm Genians to a hacking group referred to as Konni.”Initial access was achieved through a spear-phishing email disguised…
AI-Driven Phishing Campaign Uses Browser Permissions to Harvest Sensitive Data

Mar 17, 2026 11:10 AM

Tags: ai, data, intelligence, phishing

A new AI-driven phishing campaign, uncovered by Cyble Research & Intelligence Labs (CRIL) First seen on thecyberexpress.com Jump to article: thecyberexpress.com/ai-driven-phishing-campaign/
Intuitive’s Certain Business, Employee, Corporate Data Accessed in Recent Breach

Mar 17, 2026 11:10 AM

Tags: access, attack, breach, business, corporate, credentials, cyberattack, data, login, phishing, unauthorized

Intuitive has disclosed a cyberattack involving a targeted phishing incident that led to unauthorized access to certain internal business systems. The company, known for its robotics-assisted surgical technologies, confirmed that attackers successfully obtained an employee’s login credentials through what can be described as a phishing attack, allowing them to infiltrate certain internal IT business applications.…
Hackers Leverage Safe Links and URL Rewriting to Evade Detection

Mar 17, 2026 10:09 AM

Tags: cyber, detection, hacker, infrastructure, malicious, phishing, threat

Threat actors were already abusing URL rewriting mechanisms in phishing campaigns to mask malicious domains. URL rewriting is designed to protect users by replacing original links with security-vendor URLs that scan destinations at click time. These rewritten links route traffic through the provider’s infrastructure so they can analyze the page in real time, block known…
Hackers Abuse Trusted Websites in New Attacks on Microsoft Teams Users

Mar 17, 2026 8:10 AM

Tags: attack, corporate, cyber, cybersecurity, hacker, infrastructure, malicious, microsoft, phishing, threat, tool

Threat actors are increasingly turning to trusted infrastructure to launch their attacks, making it harder for automated security tools to flag malicious activity. A newly identified phishing campaign highlights this growing trend by abusing compromised websites to harvest valuable corporate credentials. Cybersecurity researchers have uncovered a sophisticated new phishing campaign where attackers hijack legitimate websites…
LiveChat Support Tools Abused in SaaS Phishing Scheme

Mar 17, 2026 7:10 AM

Tags: attack, credentials, cyber, data, finance, login, phishing, saas, service, software, tool

A newly identified campaign shows how Software-as-a-Service (SaaS) platforms like LiveChat are being weaponized to steal sensitive data in real time. Unlike traditional phishing attacks that rely on fake login pages or static forms, this tactic uses live chat conversations to extract credentials, financial data, and personally identifiable information (PII). The campaign begins with phishing…
AI Email Summaries Create a New Phishing Attack Surface

Mar 17, 2026 12:09 AM

Tags: ai, attack, email, microsoft, phishing

Researchers found that hidden email instructions can manipulate Microsoft Copilot summaries to insert phishing-style alerts. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/artificial-intelligence/ai-email-summaries-create-a-new-phishing-attack-surface/
Zero lessons learned: Convicted scammer allegedly ran another athlete-focused phishing scam from federal prison

Mar 16, 2026 11:10 PM

Tags: credentials, lessons-learned, mfa, phishing, scam

Kwamaine Jerell Ford allegedly impersonated an adult film star and tricked his high-profile victims into sharing their iCloud credentials and MFA codes under false pretenses. First seen on cyberscoop.com Jump to article: cyberscoop.com/nba-nfl-athletes-social-engineering-scheme-apple-icloud-mfa/
Robotics surgical biz Intuitive discloses phishing attack

Mar 16, 2026 10:10 PM

Tags: attack, healthcare, network, phishing

Operations and hospital networks not affected, we’re told First seen on theregister.com Jump to article: www.theregister.com/2026/03/16/robotics_surgical_biz_intuitive_discloses/
Robotics surgical biz Intuitive discloses phishing attack

Mar 16, 2026 10:10 PM

Tags: attack, healthcare, network, phishing

Operations and hospital networks not affected, we’re told First seen on theregister.com Jump to article: www.theregister.com/2026/03/16/robotics_surgical_biz_intuitive_discloses/
New Phishing Scam Uses LiveChat to Pose as Amazon and PayPal in Real Time

Mar 16, 2026 8:09 PM

Tags: credit-card, finance, mfa, phishing, scam

Cofense researchers warn of a phishing scam where attackers use LiveChat to impersonate Amazon and PayPal agents and steal credit card and MFA codes. First seen on hackread.com Jump to article: hackread.com/phishing-scam-livechat-pose-as-amazon-paypal/
Attackers Abuse LiveChat to Phish Credit Card, Personal Data

Mar 16, 2026 5:09 PM

Tags: credit-card, data, finance, phishing, social-engineering

A social engineering campaign impersonating PayPal and Amazon uses customer support interactions to acquire sensitive info. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/attackers-livechat-phish-credit-card-personal-data
Researchers Warn of Global Surge in Fake Shipment Tracking Scams

Mar 16, 2026 4:10 PM

Tags: china, phishing, scam, service

Some of these campaigns are linked to Darcula, a Chinese-language phishing-as-a-service platform First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/global-surge-fake-shipment/
LiveChat Abuse: How Phishers Are Exploiting SaaS Support Tools to Steal Sensitive Data

Mar 16, 2026 3:10 PM

Tags: attack, credentials, credit-card, cybercrime, data, email, exploit, finance, mfa, phishing, saas, service, threat, tool

Threat actors are abusing the LiveChat SaaS platform to impersonate brands like PayPal and Amazon in phishing campaigns designed to steal credentials, credit card details, MFA codes, and other sensitive data. Victims are lured through phishing emails and directed to LiveChat pages where attackers use chat interactions to request personal and financial information. The campaign…
Social-Engineering im KI-Zeitalter

Mar 16, 2026 2:09 PM

Tags: ai, deep-fake, phishing, social-engineering

Der Aufstieg von GenAI hat Social-Engineering und Phishing auf ein neues Niveau gehoben. Was früher manuelle Arbeit erforderte, kann nun in Sekundenschnelle generiert werden. Die Folge sind perfekt personalisierte Nachrichten, geklonte Stimmen von beispielsweise Führungskräften und sogar realistische Video-Imitationen. Deepfake-Vorfälle haben sich bereits von einer Online-Kuriosität zu einem echten Geschäftsrisiko entwickelt, welches weltweit zu finanziellen…
MEA Shipment Phishing Scams Surge, Stealing Banking Data in Real Time

Mar 16, 2026 1:10 PM

Tags: banking, cyber, data, phishing, scam, service

Every day, billions of people rely on postal and courier services to deliver everything from handwritten letters to high value online orders.The rapid growth of global e-commerce has made parcel delivery services a critical part of everyday life. According to the Universal Postal Union’s State of the Postal Sector report, postal services now support approximately 7.3 billion…
45,000 malicious IP addresses taken down, 94 suspects arrested

Mar 16, 2026 10:10 AM

Tags: international, law, malicious, malware, phishing, ransomware

An international law enforcement operation has taken down more than 45,000 malicious IP addresses and servers linked to phishing, malware, and ransomware activity. The action … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/16/interpol-operation-synergia-iii-cybercrime-infrastructure-takedown/
Konni Hijacks KakaoTalk Accounts in Spear-Phishing Malware Campaign

Mar 16, 2026 8:09 AM

Tags: access, apt, cyber, malicious, malware, phishing, spear-phishing

Konni APT recently ran a multi-stage malware operation that hijacked KakaoTalk accounts to spread remote access trojans (RATs) through highly targeted spear”‘phishing.”‹ The message used contextual content aligned with the victim’s role to build trust and trick them into opening an attached archive. That archive contained a malicious LNK shortcut masquerading as a document; once…
PDF Phishing: How Cybercriminals Exploit PDF Documents in Modern Email Attacks

Mar 15, 2026 8:09 PM

Tags: attack, credentials, cybercrime, email, exploit, malicious, phishing, qr

Key Takeaways PDF phishing is a fast-growing email attack technique where cybercriminals hide malicious links, QR codes, or credential forms inside seemingly legitimate PDF attachments. Attackers exploit the trust people place in PDFs, disguising phishing documents as invoices, contracts, HR forms, or delivery notifications to trick users into interacting with them. Malicious elements inside PDFs,……
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR

Mar 15, 2026 11:10 AM

Tags: cybersecurity, malware, phishing, WeeklyReview

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Turning expertise into opportunity for women in cybersecurity Speaker … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/15/week-in-review-aitm-phishing-kit-used-to-hijack-aws-accounts-year-long-malware-campaign-targets-hr/
Phishing-Angriffe zu Feiertagen: Ostern droht wieder ein saisonaler Höhepunkt

Mar 15, 2026 5:09 AM

Tags: cyberattack, phishing

First seen on datensicherheit.de Jump to article: www.datensicherheit.de/phishing-angriffe-feiertage-ostern-saisonal-hoehepunkt
Starbucks data breach impacts 889 employees

Mar 14, 2026 7:09 PM

Tags: access, attack, breach, data, data-breach, phishing, unauthorized

Starbucks disclosed a breach after phishing attacks on its employee portal led to unauthorized access to Partner Central accounts, exposing staff data. Starbucks reported a data breach affecting hundreds of employees after phishing attacks targeted its Partner Central employee portal. The security breach was detected on February 6, the incident involved unauthorized access to staff…