Tag: social-engineering
-
Entwickler werden zum Angriffsvektor
Tags: access, ai, api, application-security, best-practice, ceo, ciso, cloud, cyberattack, cybercrime, cybersecurity, data, exploit, hacker, infrastructure, intelligence, jobs, least-privilege, LLM, malware, open-source, phishing, risk, saas, social-engineering, software, spear-phishing, supply-chain, threat, tool, training, vulnerabilitySoftwareentwickler sind gefragt auch unter kriminellen Hackern.Statt einfach “nur” Fehler in Applikationen auszunutzen, entdecken kriminelle Hacker zunehmend die Tools und Zugriffskanäle für sich, auf die sich Softwareentwickler regelmäßig verlassen. Dabei kombinieren sie längst auch unterschiedliche Cybercrime-Taktiken und beziehen auch künstliche Intelligenz (KI) ein, um an ihr Ziel zu gelangen. “Angreifer versuchen nicht mehr nur, in…
-
Entwickler werden zum Angriffsvektor
Tags: access, ai, api, application-security, best-practice, ceo, ciso, cloud, cyberattack, cybercrime, cybersecurity, data, exploit, hacker, infrastructure, intelligence, jobs, least-privilege, LLM, malware, open-source, phishing, risk, saas, social-engineering, software, spear-phishing, supply-chain, threat, tool, training, vulnerabilitySoftwareentwickler sind gefragt auch unter kriminellen Hackern.Statt einfach “nur” Fehler in Applikationen auszunutzen, entdecken kriminelle Hacker zunehmend die Tools und Zugriffskanäle für sich, auf die sich Softwareentwickler regelmäßig verlassen. Dabei kombinieren sie längst auch unterschiedliche Cybercrime-Taktiken und beziehen auch künstliche Intelligenz (KI) ein, um an ihr Ziel zu gelangen. “Angreifer versuchen nicht mehr nur, in…
-
Entwickler werden zum Angriffsvektor
Tags: access, ai, api, application-security, best-practice, ceo, ciso, cloud, cyberattack, cybercrime, cybersecurity, data, exploit, hacker, infrastructure, intelligence, jobs, least-privilege, LLM, malware, open-source, phishing, risk, saas, social-engineering, software, spear-phishing, supply-chain, threat, tool, training, vulnerabilitySoftwareentwickler sind gefragt auch unter kriminellen Hackern.Statt einfach “nur” Fehler in Applikationen auszunutzen, entdecken kriminelle Hacker zunehmend die Tools und Zugriffskanäle für sich, auf die sich Softwareentwickler regelmäßig verlassen. Dabei kombinieren sie längst auch unterschiedliche Cybercrime-Taktiken und beziehen auch künstliche Intelligenz (KI) ein, um an ihr Ziel zu gelangen. “Angreifer versuchen nicht mehr nur, in…
-
Posting AI-generated caricatures on social media is risky, infosec killjoys warn
The more you share online, the more you open yourself to social engineering First seen on theregister.com Jump to article: www.theregister.com/2026/02/11/ai_caricatures_social_media_bad_security/
-
Posting AI-generated caricatures on social media is risky, infosec killjoys warn
The more you share online, the more you open yourself to social engineering First seen on theregister.com Jump to article: www.theregister.com/2026/02/11/ai_caricatures_social_media_bad_security/
-
LummaStealer infections surge after CastleLoader malware campaigns
A surge in LummaStealer infections has been observed, driven by social engineering campaigns leveraging the ClickFix technique to deliver the CastleLoader malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/lummastealer-infections-surge-after-castleloader-malware-campaigns/
-
UNC1069 Targets Financial Firms With New Tools and AI-Driven Social Engineering Attacks
North Korean threat actor UNC1069 has escalated attacks against the cryptocurrency and decentralized finance (DeFi) sector using sophisticated AI-powered social engineering tactics and seven distinct malware families, according to a recent Mandiant investigation. The financially motivated group, active since 2018, deployed an unprecedented arsenal of tools, including newly discovered malware dubbed SILENCELIFT, DEEPBREATH, and CHROMEPUSH,…
-
AI-driven scams are eroding trust in calls, messages, and meetings
In this Help Net Security video, Miguel Fornés, Governance and Compliance Manager at Surfshark, discusses how AI is changing social engineering attacks. He describes how tasks … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/10/ai-driven-social-engineering-video/
-
Hunderte Frauen betroffen: Mann kapert Snapchat-Konten und klaut Nacktbilder
Tags: social-engineeringDer Beschuldigte drang durch Social Engineering in Snapchat-Konten junger Frauen ein. Er rief intime Bilder ab und verkaufte sie im Internet. First seen on golem.de Jump to article: www.golem.de/news/hunderte-frauen-betroffen-mann-kapert-snapchat-konten-und-klaut-nacktbilder-2602-205173.html
-
Hackers Abuse ClawHub Skills to Evade VirusTotal via Social Engineering
A new evolution in ClawHub skill-based attacks that effectively sidesteps recent security measures. Rather than embedding base64-encoded payloads directly in SKILL.md files, threat actors have now shifted to a simpler approach: hosting malware on convincing lookalike websites and using skills purely as lures. A new iteration of an ongoing ClawHub malicious skills campaign is using…
-
Software developers: Prime cyber targets and a rising risk vector for CISOs
Tags: access, ai, api, application-security, attack, automation, backdoor, breach, ceo, ciso, cloud, container, control, credentials, cyber, cyberattack, cybersecurity, data, data-breach, exploit, flaw, Hardware, identity, infrastructure, intelligence, Internet, jobs, leak, least-privilege, LLM, malicious, malware, marketplace, north-korea, open-source, phishing, programming, resilience, risk, saas, scam, service, social-engineering, software, supply-chain, theft, threat, tool, training, unauthorized, update, vulnerabilityCredential theft and environment compromise: Attackers aren’t just looking for flaws in code “, they’re looking for access to software development environments.Common security shortcomings, including overprivileged service accounts, long-lived tokens, and misconfigured pipelines, offer a ready means for illicit entry into sensitive software development environments.”Improperly stored access credentials are low-hanging fruit for even the most amateur…
-
Apple Pay Users Targeted by Phishing Attack Aimed at Stealing Payment Details
A sophisticated new phishing campaign is targeting Apple Pay users, leveraging high-quality email design and social engineering to bypass security measures. Unlike typical scams that rely on poorly spelled emails and suspicious links, this campaign uses a >>hybrid<>vishing<<, to steal Apple IDs and payment data. […] The post Apple Pay Users Targeted by Phishing Attack…
-
State-Backed Hackers Target Military Officials and Journalists on Signal in Latest Cyberattack
German intelligence and security agencies have issued a high-priority warning regarding a sophisticated cyber espionage campaign targeting military officials, diplomats, and investigative journalists across Europe. The Bundesamt für Verfassungsschutz (BfV) and the Federal Office for Information Security (BSI) identified the attackers as likely state-sponsored actors utilizing social engineering to compromise accounts on the encrypted messaging…
-
Ten career-ending mistakes CISOs make and how to avoid them
Tags: access, ai, attack, awareness, best-practice, breach, business, ciso, cloud, compliance, computing, conference, control, credentials, cyber, cybersecurity, data, defense, detection, encryption, exploit, finance, framework, GDPR, governance, guide, HIPAA, least-privilege, malicious, metric, monitoring, network, password, resilience, risk, social-engineering, strategy, technology, threat, tool, training, vulnerability, zero-trust2. Poor communication with the board and C-suite: Technical expertise alone no longer suffices in the modern CISO role. Security leaders who fail to translate cyber risks into business impact quickly lose credibility with decision-makers who control budgets and strategic direction.When security leaders present endless technical details without connecting them to revenue loss, regulatory fines,…
-
The Human Layer of Security: Why People are Still the Weakest Link in 2026
By 2026 humans remain cybersecurity’s weakest”, and most vital”, link as AI-enabled social engineering rises; prioritize behavioral design, real”‘time interventions, and leadership. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/the-human-layer-of-security-why-people-are-still-the-weakest-link-in-2026/
-
Spam Campaign Distributes Fake PDFs, Deploys Remote Monitoring Tools for Ongoing Access
An ongoing spam campaign that leverages social engineering to deploy legitimate Remote Monitoring and Management (RMM) software on victim networks. By disguising malicious payloads as essential Adobe Acrobat updates, threat actors are successfully bypassing traditional security controls and establishing persistent remote access to sensitive systems. The campaign begins with a deceptive email delivering a PDF…
-
Betterment Data Breach Exposes Sensitive Information of 1.4 Million Customers
Automated investment platform Betterment has confirmed a data breach affecting approximately 1.4 million customers. The incident, which occurred in January 2026, was the result of a targeted social engineering attack rather than a direct exploit of the company’s core infrastructure. The breach sequence began on January 9, 2026. According to Betterment’s forensic investigation, unauthorized actors…
-
Betterment breach may expose 1.4M users after social engineering attack
Breach-tracking site flags dataset following impersonation-based intrusion First seen on theregister.com Jump to article: www.theregister.com/2026/02/05/betterment_hack/
-
Cyberattackers Use Fake RTO Challan Alerts to Spread Android Malware
Tags: android, cyber, data, government, india, infrastructure, malware, office, service, social-engineering, tacticsIndian users’ trust in government services through a sophisticated Android malware campaign that impersonates Regional Transport Office (RTO) challan notifications. This campaign represents an evolution from previous RTO-themed malware, featuring advanced anti-analysis techniques, a modular three-stage architecture, and a structured backend infrastructure for data collection and remote operations. The malware spreads through social engineering tactics,…
-
Weaponized Voicemail Hack Allows Remote Access to Systems, Experts Warn
A sophisticated social engineering campaign that weaponizes fake voicemail notifications to trick victims into installing remote access tools. The attack begins when victims receive communications directing them to compromised websites displaying convincing voicemail-themed landing pages. These pages use bank-related subdomains and minimal, professional design elements to appear legitimate. The interface suggests that a new voice…
-
Cyberattackers Exploit DNS TXT Records in ClickFix Script to Execute Malicious PowerShell Commands
A new evolution in the >>ClickFix<>ClickFix<>Verify […] The post Cyberattackers Exploit DNS TXT Records in ClickFix Script to Execute Malicious PowerShell Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform. First seen on gbhackers.com Jump to article: gbhackers.com/dns-txt-records/
-
Info-Stealing malware expands from Windows to macOS
Microsoft warns info-stealing attacks are expanding from Windows to macOS, using cross-platform languages like Python and abusing trusted platforms. Microsoft warns info-stealing attacks are rapidly expanding from Windows to macOS, using cross-platform languages like Python and abusing trusted platforms. Since late 2025, Microsoft has seen a surge in macOS infostealer attacks using social engineering, fake…
-
Microsoft Warns Python Infostealers Target macOS via Fake Ads and Installers
Microsoft has warned that information-stealing attacks are “rapidly expanding” beyond Windows to target Apple macOS environments by leveraging cross-platform languages like Python and abusing trusted platforms for distribution at scale.The tech giant’s Defender Security Research Team said it observed macOS-targeted infostealer campaigns using social engineering techniques such as ClickFix since First seen on thehackernews.com Jump…
-
Infostealer Attacks Hit macOS, Abusing Python and Trusted Platforms
A sharp rise in campaigns targeting macOS users, while attackers also ramp up Python”‘based stealers and abuse trusted platforms like WhatsApp and popular PDF utilities. These attacks focus on harvesting credentials, browser data, cloud keys, and cryptocurrency wallets, then quietly exfiltrating them to attacker”‘controlled infrastructure. On macOS, threat actors increasingly rely on social engineering and…
-
Fake Party Invites Lure Victims Into Installing Malicious Remote Access Tools
A sophisticated social engineering campaign targeting Windows users across the UK, using fake event invitations to silently install ScreenConnect a legitimate remote access tool that attackers have weaponized to gain complete system control. The attack chain begins with deceptive simplicity: victims receive emails that look like personal invitations from friends or colleagues. These messages are…
-
Malicious Google Play App With 50K+ Downloads Spreads Anatsa Banking Trojan
A malicious application on the Google Play Store masquerading as a legitimate document reader. The deceptive application, which has accumulated over 50,000 downloads, functions as a dropper for the notorious Anatsa banking trojan, a sophisticated malware strain known for targeting financial institutions and compromising user banking credentials. The malicious app leverages social engineering tactics by…
-
ShinyHunters escalates tactics in extortion campaign linked to Okta environments
Researchers are tracking multiple clusters that are using social engineering to gain access to victims. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/shinyhunters-tactics-extortion-okta-environ/811112/
-
ShinyHunters escalates tactics in extortion campaign linked to Okta environments
Researchers are tracking multiple clusters that are using social engineering to gain access to victims. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/shinyhunters-tactics-extortion-okta-environ/811112/
-
ShinyHunters escalates tactics in extortion campaign linked to Okta environments
Researchers are tracking multiple clusters that are using social engineering to gain access to victims. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/shinyhunters-tactics-extortion-okta-environ/811112/
-
Human Risk Management: Das Paradoxon der Sicherheitsschulungen
Security Awareness Trainings sollten auf dem Human-Risk-Management-Ansatz basieren. Unternehmen investieren Millionen von Dollar in Firewalls, Endpunktsicherheit oder Verschlüsselung. Doch eine einzige Person kann eine Katastrophe auslösen. Es reicht, wenn sie eine infizierte Datei herunterlädt oder auf einen betrügerischen Link klickt.Analysen zeigen: Zwischen 70 und 90 Prozent aller Sicherheitslücken entstehen, weil Menschen Fehler machen. Sie fallen…