Tag: phishing
-
Illinois man charged with hacking Snapchat accounts to steal nude photos
U.S. prosecutors have charged an Illinois man with orchestrating a phishing operation that allowed him to hack the Snapchat accounts of nearly 600 women to steal private photos and sell them online. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/illinois-man-charged-with-hacking-snapchat-accounts-to-steal-nude-photos/
-
FBI Warns of North Korean QR Phishing Campaigns
The FBI says North Korea’s Kimsuky APT group is using QR codes in spear phishing campaigns First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fbi-warns-north-korean-qr-phishing/
-
FBI Warns of North Korean QR Phishing Campaigns
The FBI says North Korea’s Kimsuky APT group is using QR codes in spear phishing campaigns First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fbi-warns-north-korean-qr-phishing/
-
FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing
The U.S. Federal Bureau of Investigation (FBI) on Thursday released an advisory warning of North Korean state-sponsored threat actors leveraging malicious QR codes in spear-phishing campaigns targeting entities in the country.”As of 2025, Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response (QR) First…
-
FBI warns about Kimsuky hackers using QR codes to phish U.S. orgs
The North Korean state-sponsored hacker group Kimsuki is using malicious QR codes in spearphishing campaigns that target U.S. organizations, the Federal Bureau of Investigation warns in a flash alert. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fbi-warns-about-kimsuky-hackers-using-qr-codes-to-phish-us-orgs/
-
New DocuSign-Themed Phishing Scam Delivers Stealth Malware to Windows Devices
New research has uncovered asophisticated phishingcampaign that abusesDocuSign’sbrand to deliver Vidar malware and infect Windows systems. The operation uses a realistic phishing site, a fake signed installer, access-code checks, andtimebasedexecution barriers to evade both users and automated analysis. DocuSign-themed phishing setup The attack starts with a targeted phishing email that pretends to come fromDocuSignand urges…
-
Phishing-Angreifer setzen vermehrt auf E-Mail-Routing-Lücken
Tags: 2fa, authentication, business, cyberattack, dmarc, dns, email, framework, infrastructure, intelligence, mail, mfa, microsoft, password, phishing, risk, service, spam, threatAngreifer missbrauchen falsch konfigurierte Richtlinien, um Phishing-E-Mails wie interne E-Mails aussehen zu lassen, Filter zu umgehen und Anmeldedaten zu stehlen.Das Threat Intelligence Team von Microsoft hat kürzlich festgestellt, dass Angreifer zunehmend komplexe E-Mail-Weiterleitungen und falsch konfigurierte Domain-Spoofing-Schutzmaßnahmen ausnutzen. Dabei lassen sie ihre Phishing-Nachrichten so aussehen, als würden sie von den angegriffenen Organisationen selbst stammen.In den…
-
Phishing Attacks Exploit Misconfigured Email Routing Settings to Target Microsoft 365 Users
Misconfigurations abused to make phishing emails look like they come from within the organization First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phishing-exploits-misconfigured/
-
Cybercriminals are scaling phishing attacks with ready-made kits
Phishing-as-a-Service (PhaaS) kits lower the barrier to entry, enabling less-skilled attackers to run large-scale, targeted phishing campaigns that impersonate legitimate … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/08/barracuda-phishing-kit-techniques/
-
Anzahl der Phishing-Kits hat sich im Jahr 2025 verdoppelt
Die Bedrohung durch professionelle Phishing-Angriffe hat 2025 eine neue Dimension erreicht. Wie aus dem aktuellen Phishing-Report des Sicherheitsanbieters Barracuda hervorgeht, hat sich die Zahl bekannter Phishing-as-a-Service-Kits (PhaaS) im vergangenen Jahr verdoppelt. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/anzahl-der-phishing-kits-2025
-
Phishers Exploit Office 365 Users Who Let Their Guard Down
Microsoft said that Office 365 tenants with weak configurations and who don’t have strict anti-spoofing protection enabled are especially vulnerable. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/phishers-exploit-office-365-users-guard-down
-
Hackers Using Malicious QR Codes for Phishing via HTML Table
Threat actors are continuing to refine “quishing” phishing delivered through QR codes by shifting from traditional image-based payloads to “imageless” QR codes rendered directly in email HTML, a tactic designed to sidestep security tools that focus on decoding QR images. QR code abuse is not new, but it remains effective because the user experience is…
-
Threat Actors Exploit Google Cloud Services to Steal Microsoft 365 Credentials
Tags: cloud, credentials, cyber, cybersecurity, email, exploit, google, infrastructure, malicious, microsoft, phishing, service, threatA sophisticated phishing campaign is exploiting Google Cloud infrastructure to bypass email security filters and steal Microsoft 365 credentials, demonstrating how attackers increasingly abuse trusted cloud platforms to lend legitimacy to their malicious activities. Cybersecurity researchers at Check Point have uncovered a large-scale operation targeting approximately 3,200 organizations, resulting in over 9,300 phishing emails over…
-
Misconfigured email routing enables internal-spoofed phishing
Attackers exploit misconfigured email routing to spoof internal emails, using PhaaS platforms like Tycoon2FA to steal credentials. Attackers exploit misconfigured email routing and spoof protections to send phishing emails appearing internal, using PhaaS platforms like Tycoon2FA to steal credentials. >>Phishing actors are exploiting complex routing scenarios and misconfigured spoof protections to effectively spoof organizations’ domains…
-
International Threats: Themes for Regional Phishing Campaigns
Cofense Intelligence relies on over 35 million trained employees from around the world, therefore a considerable number of analyzed campaigns are written in languages other than English. This report covers from May 2023 to May 2025 and focuses on the overall themes of campaigns in the top five most commonly seen languages besides English that…
-
Microsoft warns of a surge in phishing attacks exploiting email routing gaps
Hardening configurations can help: The disclosure emphasizes that proper configuration of mail authentication mechanisms is the most effective defense against this spoofing vector. Organizations are advised to adopt strict DMARC reject policies and enforce SPF hard fails so that unauthenticated mail claiming to be from their domains is rejected or safely quarantined.Additionally, recommendations include ensuring…
-
Microsoft Warns Misconfigured Email Routing Can Enable Internal Domain Phishing
Threat actors engaging in phishing attacks are exploiting routing scenarios and misconfigured spoof protections to impersonate organizations’ domains and distribute emails that appear as if they have been sent internally.”Threat actors have leveraged this vector to deliver a wide variety of phishing messages related to various phishing-as-a-service (PhaaS) platforms such as Tycoon 2FA,” the First…
-
Hackers Exploit Routing Misconfigurations to Successfully Spoof Organizations
Cybercriminals are exploiting complex routing scenarios and misconfigured email authentication protections to successfully spoof organizational domains, enabling them to deliver phishing emails that appear to originate from within targeted companies. The attack vector, which has seen increased activity since May 2025, leverages weaknesses in Domain-based Message Authentication, Reporting, and Conformance (DMARC) configurations and third-party email…
-
Ledger Confirms Global-e Breach, Warns Users of Phishing Attempts
Ledger confirms data breach via Global-e partner. Customer info exposed, phishing attacks active. No passwords or crypto recovery phrases leaked. First seen on hackread.com Jump to article: hackread.com/ledger-global-e-breach-phishing-attempts/
-
WordPress Admins Targeted by Renewal Email Phishing Scam
A phishing campaign targeting WordPress admins uses fake renewal emails to steal credit card data and 2FA codes in real time. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/wordpress-admins-targeted-by-renewal-email-phishing-scam/
-
Fake Windows BSODs check in at Europe’s hotels to con staff into running malware
Phishers posing as Booking.com use panic-inducing blue screens to bypass security controls First seen on theregister.com Jump to article: www.theregister.com/2026/01/06/russia_hackers_hotel_bsods/
-
Crypto wallet shop Ledger confirms customer data lifted in Global-e snafu
Order and contact details accessed via ecommerce partner, and phishing has begun First seen on theregister.com Jump to article: www.theregister.com/2026/01/06/ledger_globale_breach/
-
How to Avoid Phishing Incidents in 2026: A CISO Guide
Phishing in 2026 is harder to detect and verify. Learn how CISOs can speed up investigations, reduce noise, and respond with confidence. First seen on hackread.com Jump to article: hackread.com/how-to-avoid-phishing-incidents-2026-ciso-guide/
-
Kontinuierliche Awareness statt Einmal-Schulungen – Phishing und Deepfakes erfordern 2026 eine gelebte Sicherheitskultur
First seen on security-insider.de Jump to article: www.security-insider.de/phishing-deepfakes-sicherheitskultur-2026-a-b792dc4889ba7dc7634552ac2f747a73/
-
What security teams miss in email attacks
Email remains the most common entry point for attackers. This article examines how phishing, impersonation, and account takeover continue to drive email breaches and expose … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/06/rising-email-breach-risks/
-
Trusted Google Notifications Used in Phishing Campaign Targeting 3,000+ Orgs
Researchers warn that attackers are abusing Google notifications and cloud services to deliver phishing emails that bypass traditional email security controls. The post Trusted Google Notifications Used in Phishing Campaign Targeting 3,000+ Orgs appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-notifications-phishing-campaign-email-security/
-
Google Tasks Used to Deliver Stealth Phishing Attacks
Attackers are abusing Google Tasks notifications to deliver trusted-domain phishing emails that bypass traditional email security controls. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/google-tasks-used-to-deliver-stealth-phishing-attacks/