Tag: phishing
-
KI-Browser gefährden Unternehmen
Experten warnen vor der Nutzung von KI-Browsern in Unternehmen.Die Gartner-Analysten Dennis Xu, Evgeny Mirolyubov und John Watts empfehlen Unternehmen dringend, alle KI-Browser aufgrund der Cybersicherheitsrisiken auf absehbare Zeit zu blockieren. Sie stützten ihre Empfehlung auf bereits identifizierte Risiken ‘und andere potenzielle Risiken, die noch entdeckt werden müssen, da es sich um eine sehr junge Technologie…
-
KI-Browser gefährden Unternehmen
Experten warnen vor der Nutzung von KI-Browsern in Unternehmen.Die Gartner-Analysten Dennis Xu, Evgeny Mirolyubov und John Watts empfehlen Unternehmen dringend, alle KI-Browser aufgrund der Cybersicherheitsrisiken auf absehbare Zeit zu blockieren. Sie stützten ihre Empfehlung auf bereits identifizierte Risiken ‘und andere potenzielle Risiken, die noch entdeckt werden müssen, da es sich um eine sehr junge Technologie…
-
Auch Paypal betroffen: Phishing-Kit Spiderman gefährdet Kunden deutscher Banken
Ein neues Phishing-Kit namens Spiderman liefert Phishing-Seiten auf Knopfdruck – unter anderem für Comdirect, Postbank, Volksbank und Sparkasse. First seen on golem.de Jump to article: www.golem.de/news/phishing-kit-spiderman-klaut-daten-deutscher-banking-nutzer-2512-203102.html
-
RSF Cyberattack Linked to Russian FSB Foiled by Staff Vigilance
Reporters Without Borders (RSF) has determined that a phishing operation targeting the organization in early 2025 was carried out by a group associated with Russia’s Federal Security Service (FSB). The RSF cyberattack conclusion First seen on thecyberexpress.com Jump to article: thecyberexpress.com/rsf-cyberattack-fsb-linked-phishing/
-
Polymorphic AI malware exists, but it’s not what you think
Tags: access, ai, api, attack, authentication, automation, business, ciso, credentials, cryptography, cyber, cybercrime, detection, edr, email, espionage, government, group, identity, infrastructure, malicious, malware, marketplace, mfa, monitoring, phishing, radius, ransomware, risk, soc, technology, theft, threat, toolwhat the code block should do, or how it’s going to evade an antivirus. It’s just working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn’t). There’s also no entropy to ensure the ‘self-modifying’ code differs from previous versions, or any guardrails to ensure it actually works. The function was…
-
Polymorphic AI malware exists, but it’s not what you think
Tags: access, ai, api, attack, authentication, automation, business, ciso, credentials, cryptography, cyber, cybercrime, detection, edr, email, espionage, government, group, identity, infrastructure, malicious, malware, marketplace, mfa, monitoring, phishing, radius, ransomware, risk, soc, technology, theft, threat, toolwhat the code block should do, or how it’s going to evade an antivirus. It’s just working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn’t). There’s also no entropy to ensure the ‘self-modifying’ code differs from previous versions, or any guardrails to ensure it actually works. The function was…
-
Polymorphic AI malware exists, but it’s not what you think
Tags: access, ai, api, attack, authentication, automation, business, ciso, credentials, cryptography, cyber, cybercrime, detection, edr, email, espionage, government, group, identity, infrastructure, malicious, malware, marketplace, mfa, monitoring, phishing, radius, ransomware, risk, soc, technology, theft, threat, toolwhat the code block should do, or how it’s going to evade an antivirus. It’s just working under the assumption that Gemini just instinctively knows how to evade antiviruses (it doesn’t). There’s also no entropy to ensure the ‘self-modifying’ code differs from previous versions, or any guardrails to ensure it actually works. The function was…
-
Spiderman Phishing Kit Targets European Banks with Real-Time Credential Theft
Varonis threat analysts warn about Spiderman, a dangerous new kit that automates attacks against European banks and crypto customers, stealing a victim’s full identity profile. First seen on hackread.com Jump to article: hackread.com/spiderman-phishing-kit-european-banks-credential-theft/
-
40 000 PhishingMails als Sharepoint- und E-Signing-Dienste getarnt
Check Point Software Technologies ist einer neuen Welle von Betrügereien im Finanzbereich auf der Spur. Mimecast wurde dabei für Phishing-Betrügereien missbraucht, um die Fälschungen legitim erscheinen zu lassen. Auch Docusign musste für die Cyber-Kriminellen als Deckmantel herhalten. Bei diesem Vorfall versendeten die Cyber-Kriminellen in den letzten zwei Wochen über 40 000 Phishing-E-Mails an etwa 6100…
-
KnowBe4 Threat Labs entdeckt hochentwickelte mehrstufige Phishing-Kampagne
Zunächst erhalten die Opfer eine Phishing-E-Mail. Die Nutzlast ein Phishing-Hyperlink ist auf ihr in ‘verschachtelten” PDF-Anhängen versteckt. Wenn ein Opfer den ersten Anhang der Phishing-E-Mail öffnet, sieht es ein gerendertes Dokument mit einem weiteren Hyperlink, auf den es klicken kann. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/knowbe4-threat-labs-entdeckt-hochentwickelte-mehrstufige-phishing-kampagne/a43102/
-
Wie GenAI die ESicherheitslage verändert
Generative KI verändert Prozesse, Workflows und Geschäftsmodelle. Aber sie verändert auch die Art und Geschwindigkeit, mit der Cyberangriffe durchgeführt werden können. Phishing-Mails, die früher an schlechter Sprache oder falschem Namen scheiterten, wirken heute professionell, persönlich und nahezu perfekt. Für Unternehmen ist es daher nicht mehr so leicht, eine Phishing-Mail von einer echten Kunden-Mail zu unterscheiden.…
-
Phishing-Boom: Onlinebetrug nimmt vor Weihnachten zu
Die Zeit rund um Black Friday und Cyber Monday bringt jedes Jahr steigende Verkaufszahlen im Netz. Mit dem wachsenden Interesse an Angeboten steigt jedoch auch die Gefahr, Opfer eines digitalen Betrugs zu werden. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/phishing-boom-onlinebetrug-weihnachten
-
Over 70 Domains Used in Months-Long Phishing Spree Against US Universities
Infoblox Threat Intel reports a campaign that used the Evilginx phishing kit to bypass Multi-Factor Authentication (MFA) and steal credentials from 18 US universities between April and November 2025. First seen on hackread.com Jump to article: hackread.com/us-universities-domains-phishing-attacks/
-
Offensive security takes center stage in the AI era
Tags: ai, attack, automation, business, ciso, control, credentials, cyber, cybersecurity, data, defense, detection, encryption, framework, hacker, hacking, incident response, intelligence, malicious, offense, phishing, RedTeam, regulation, risk, skills, software, strategy, tactics, technology, threat, tool, vulnerability, vulnerability-management, windowsRed teaming, where ethical hackers simulate real-world attacks to test detection and response capabilities. Red teams aim to emulate threat actors by using stealthy tactics to bypass controls and achieve objectives such as data exfiltration or privilege escalation.Adversary emulation, where security pros re-create known threat actor tactics, techniques, and procedures (TTPs) based on threat intelligence…
-
Vaillant CISO: NIS2 complexity and lack of clarity endanger its mission
Tags: ai, attack, awareness, business, ciso, compliance, corporate, country, cyber, cyberattack, cybersecurity, dora, email, germany, infrastructure, intelligence, network, nis-2, office, organized, phishing, ransomware, regulation, risk, service, skills, supply-chain, threat, trainingCSO Germany: The energy sector is increasingly becoming a target for cybercriminals. Experts and the Federal Office for Information Security (BSI) believe that protection in this area must be significantly increased. How do you assess the current situation?Reiß: The geopolitical tensions we are currently witnessing are leading to an increased threat level. This naturally also affects the heating…
-
Offensive security takes center stage in the AI era
Tags: ai, attack, automation, business, ciso, control, credentials, cyber, cybersecurity, data, defense, detection, encryption, framework, hacker, hacking, incident response, intelligence, malicious, offense, phishing, RedTeam, regulation, risk, skills, software, strategy, tactics, technology, threat, tool, vulnerability, vulnerability-management, windowsRed teaming, where ethical hackers simulate real-world attacks to test detection and response capabilities. Red teams aim to emulate threat actors by using stealthy tactics to bypass controls and achieve objectives such as data exfiltration or privilege escalation.Adversary emulation, where security pros re-create known threat actor tactics, techniques, and procedures (TTPs) based on threat intelligence…
-
How to tell if your password manager meets HIPAA expectations
Most healthcare organizations focus on encryption, network monitoring, and phishing prevention, although one simple source of risk still slips through the cracks. Password … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/12/08/password-manager-hipaa-compliance/
-
How to tell if your password manager meets HIPAA expectations
Most healthcare organizations focus on encryption, network monitoring, and phishing prevention, although one simple source of risk still slips through the cracks. Password … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/12/08/password-manager-hipaa-compliance/
-
Wirkliche Cyberresilienz: Cybersicherheit ist eine Angelegenheit der Unternehmenskultur
Im Falle eines erfolgreichen Angriffs sind die Schuldigen mitunter schnell gefunden: Eine Lücke in der Firewall, eine geöffnete Phishing-Mail oder eine übersehene Warnmeldung. Doch ein Blick in die Praxis zeigt: IT-Sicherheit scheitert nicht an Technologien oder Fehlverhalten, sondern bereits grundsätzlich an einem Mangel an Unternehmenskultur. Wenn Cybersicherheit in einer Organisation nur als eine schlecht durchgesetzte……
-
Hardening browser security with zero-trust controls
Tags: access, api, authentication, automation, browser, chrome, cisa, cloud, compliance, container, control, corporate, credentials, crowdstrike, data, data-breach, detection, edr, email, encryption, endpoint, exploit, fido, finance, framework, google, governance, group, Hardware, identity, kubernetes, least-privilege, login, malicious, malware, mfa, microsoft, network, nist, okta, passkey, password, phishing, phone, risk, risk-assessment, sap, service, soar, theft, threat, tool, update, wifi, windows, zero-trust1. Identity-first access control Network proximity is now an inferior trust signal. Only federated, cryptographically verifiable identity tokens issued by centralized enterprise IdPs using OIDC or SAML are permitted as gates to corporate resources. This transition, well-documented by FIDO Alliance and Microsoft research, transfers the very concept of “inside” the organization from the network to…
-
New Variant of ClayRat Android Spyware Seize Full Device Control
The dangerous ClayRat Android spyware has evolved, gaining the ability to steal PINs, record screens, and disable security by abusing Accessibility Services. Users must beware of fake apps spreading through phishing sites and Dropbox. First seen on hackread.com Jump to article: hackread.com/clayrat-android-spyware-variant-device-control/
-
Russian Calisto Hackers Target NATO Research with ClickFix Malware
Tags: credentials, cyber, defense, hacker, intelligence, malicious, malware, phishing, russia, service, spear-phishing, threat, ukraineRussian intelligence-linked cyber threat actors have intensified their operations against NATO research organizations, Western defense contractors, and NGOs supporting Ukraine, employing sophisticated phishing and credential harvesting techniques. The Calisto intrusion set, attributed to Russia’s FSB intelligence service, has escalated its spear-phishing campaigns throughout 2025, leveraging the ClickFix malicious code technique to target high-value entities across…
-
Hackers Abuse Microsoft Teams Notifications to Launch Callback Phishing Attacks
A sophisticated phishing campaign is targeting users through Microsoft Teams notifications, exploiting the platform’s trusted status to deliver deceptive messages that appear legitimate to both recipients and email security filters. Threat actors are leveraging Teams’ official notification system to send emails from the no-reply@teams.mail.microsoft address, creating a false sense of authenticity that makes detection increasingly difficult. The…
-
Hackers Abuse Microsoft Teams Notifications to Launch Callback Phishing Attacks
A sophisticated phishing campaign is targeting users through Microsoft Teams notifications, exploiting the platform’s trusted status to deliver deceptive messages that appear legitimate to both recipients and email security filters. Threat actors are leveraging Teams’ official notification system to send emails from the no-reply@teams.mail.microsoft address, creating a false sense of authenticity that makes detection increasingly difficult. The…