Tag: social-engineering
-
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware.”BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet First seen on thehackernews.com…
-
Clover Health Reports Social Engineering Attack to SEC
Experts Warn AI Will Make Phishing, Related Threats Even Worse for Healthcare. Clover Health, a provider of Medicare Advantage health plans and a vendor of AI-enabled clinical decision support tools for physicians, has fallen victim to a social engineering attack, according to an SEC filing. Experts warn that AI tools could make such evolving attack…
-
Wenn geteilte KI-Chats zur Malware-Falle werden
Das Threat-Hunting-Team von Zscaler analysierte eine neue Malware-Kampagne, die unter dem Namen ‘ClaudeFix” verfolgt wurde. Cyberkriminelle kombinieren dabei die bewährte Social-Engineering-Taktik ‘ClickFix” mit dem Missbrauch legitimer Funktionen des KI-Assistenten Claude von Anthropic. Das primäre Ziel der aufgedeckten Kampagne sind Softwareentwickler und IT-Experten, welchen über vermeintlich harmlose, geteilte KI-Chats heimlich der MacSync-Stealer zugespielt wird. Vom Fake-Portal…
-
Warum traditionelles Trainings zur Cybersicherheit im KI-Zeitalter nicht mehr greifen
Traditionelle Schulungen und Trainings zum Bewusstsein für Cybersicherheit basieren auf standardisierten Lehrinhalten und -formaten, die sporadisch meist nur einmal im Jahr unterrichtet werden. Ihr Ziel: die Anhebung des Cybersicherheits-Bewusstseins der menschlichen Mitarbeiter eines Unternehmens. Das Problem: ihr erhoffter Effekt bleibt immer häufiger aus. Angreifer setzen zur Unterstützung ihrer Social-Engineering-, Phishing- und Spear-Phishing-Angriffe immer […] First…
-
Iran-Linked APT42 Uses AI-Assisted Phishing and TAMECAT Backdoor to Target Defense Officials
Tags: access, ai, backdoor, cloud, cyber, defense, detection, espionage, government, iran, phishing, powershell, social-engineeringIran-linked APT42 is escalating its espionage operations with AI-assisted phishing and an expanded TAMECAT backdoor, enabling long-lived access to defense and government identities rather than just endpoints. Recent activity shows tightly integrated social engineering, cloud abuse, and fileless PowerShell tradecraft that significantly complicate detection and response. APT42, also tracked as TA453 in some reporting, is…
-
TELEPUZ Web Injector Can Steal Cookies, Execute JavaScript, and Replace IBAN Details
A rapidly evolving malware family dubbed TELEPUZ, a modular and lightweight threat that is gaining traction through a ClickFixVIDAR infection chain. Despite a relatively small command-and-control (C2) footprint, the pace of development and distribution suggests an emerging large-scale operation. The infection begins with ClickFix social engineering, where victims are tricked into executing a malicious PowerShell…
-
6 Empfehlungen für Unternehmen im Umgang mit KI-Risiken
Künstliche Intelligenz verändert die Cybersicherheit-Landschaft grundlegend. KI-gestützte Phishing-Angriffe, Deepfakes und automatisierte Social-Engineering-Kampagnen zählen inzwischen zu den größten Sorgen deutscher Unternehmen. Der aktuelle AI-Security-Report 2026 von Hornetsecurity by Proofpoint zeigt jedoch: Während die Bedrohungslage zunehmend erkannt wird, bleibt die praktische Umsetzung vielerorts hinter den Erwartungen zurück. Die Ergebnisse der Studie verdeutlichen, dass die Herausforderung heute weniger…
-
Forescout analysiert Phishing-Kampagne mit missbrauchten RMM-Tools
SeasonalInvite zeigt, wie wirkungsvoll Angreifer Social Engineering, legitime Verwaltungssoftware und skalierbare Webinfrastrukturen miteinander kombinieren können. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/forescout-analysiert-phishing-kampagne-mit-missbrauchten-rmm-tools/a45806/
-
KnowBe4 und AWS bündeln Kräfte gegen Social Engineering, Deepfakes und Schatten-KI
KnowBe4 und AWS vertiefen ihre Zusammenarbeit, um Unternehmen schneller gegen Social Engineering, Deepfakes, menschliche Risiken und Schatten-KI abzusichern. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/knowbe4-und-aws-buendeln-kraefte-gegen-social-engineering-deepfakes-und-schatten-ki/a45794/
-
Hackers Use PasteRun Commands to Deploy ClickLock Stealer Against Mac Users
Hackers are actively targeting macOS users with a newly identified infostealer dubbed “ClickLock Stealer,” leveraging paste-and-run social engineering techniques to bypass Apple’s native security protections without requiring exploits or elevated privileges. Despite macOS protections such as Gatekeeper, Transparency, Consent, and Control (TCC), System Integrity Protection (SIP), and mandatory code signing, threat actors are increasingly deploying…
-
ACR Stealer Uses ClickFix, WebDAV, and Steganography to Steal Browser Credentials and Tokens
A surge in ACR Stealer activity from late April through mid-June 2026, with operators combining ClickFix social engineering, WebDAV-hosted payloads, PowerShell obfuscation, and steganography to compromise enterprise users. The malware operations rely on ClickFix social-engineering lures to trick victims into pasting attacker-supplied commands into Windows Run dialogs or command prompts, ultimately stealing browser credentials, session…
-
Now, even Russia’s most elite hackers are using Clickfix to infect devices
The social-engineering technique has primarily been a tool of financially motivated criminals. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/07/now-even-russias-most-elite-hackers-are-using-clickfix-to-infect-devices/
-
5,811 arrests, $293 million seized over social engineering scams
Criminals who pose as police officers, romantic partners, and business suppliers have built fraud operations that reach across continents. A four-month enforcement campaign … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/09/interpol-fraud-bust-social-engineering-scams/
-
Microsoft Entra Passkey Enrollment Abused in Operator-Controlled Vishing Campaign
A focused vishing campaign that weaponizes Microsoft Entra passkey enrollment as a social-engineering vector to enable account takeover and downstream data extortion. The threat actor begins by registering domains that include the term “passkey” (for example, assignpasskey[.]com, deploypasskey[.]com, passkeydeploy[.]com, passkeyadd[.]com, setpasskey[.]com) and creating per-target subdomains. Microsoft Entra ID login pages. Pages load generic Microsoft styling…
-
Umbrij Malware Lets ToddyCat Hackers Hijack Gmail Accounts Through Google API Abuse
A targeted campaign in which the ToddyCat (aka APT-style) group leverages a previously observed loader family, Umbrij, to hijack Gmail accounts by abusing Google APIs. Chaining that capability to broad remote access achieved through a malicious MSI installer masquerading as the Kuailian/LetsVPN client. The operation blends social engineering with a sophisticated in-memory loader and a…
-
The fake report message that ends with a stolen Reddit account
A direct message arrives on Reddit from a stranger, and it invites a reply. That reply is the point. This scheme runs on social engineering, with no malware and no malicious … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/09/reddit-false-report-scam-direct-message/
-
ESET Threat Report H1 2026 Highlights Malicious AI Skills, ClickFix Surge, and EDR Killers
ESET’s H1 2026 threat report shows attackers accelerating the use of familiar playbooks with AI-flavored lures, social engineering, and defense evasion rather than inventing entirely new ones. The clearest signals are the rise of malicious AI skills, a doubled ClickFix footprint, first-wave AI-powered Android malware, record QR-code phishing, and a growing ecosystem of EDR killers.…
-
REF6045 Uses SCMBANKER PowerShell Toolkit to Target Mexican Banking Customers
A human-operated Mexican banking fraud campaign tracked as REF6045 has been observed using a bespoke PowerShell toolkit SCMBANKER to turn commodity click-fraud lures into operator-assisted account takeovers and payment diversion. The operation relies on social engineering through fake CAPTCHA/verification pages that trick victims into running a single command from the Windows Run dialog. That command…
-
Hackers Abuse Cross-Tenant Teams Chat to Deliver EtherRAT Through Malicious MSI Loader
A coordinated social-engineering campaign observed in late June 2026 combined email phishing with an abused Microsoft Teams cross”‘tenant chat to deliver a sophisticated EtherRAT implant via a malicious MSI loader. Initial access began with a targeted email masquerading as internal communication: an “Employee Survey” HTML message containing a PDF lure. When the victim opened the…
-
Home Medical Gear Firm Tells SEC Hackers Stole Patient Data
AdaptHealth Says Social Engineering Scam Also Affects External EHR Portal Data. A publicly traded home medical equipment and services supplier has told U.S. regulators that hackers recently stole a potentially large volume of patients’ health and personal information, including data from external electronic health record system portals, in a social engineering scam. First seen on…
-
Gaslight Stealer Embeds Fake System Messages to Mislead AI Malware Analysts
Tags: ai, blockchain, cyber, injection, jobs, macOS, malware, north-korea, social-engineering, softwareA new macOS stealer, tracked as Gaslight and attributed to North Korean operators, demonstrates a worrying evolution in malware design: deliberate prompt-injection to mislead AI-driven security tools. Gaslight arrives as a standalone Mach-O executable commonly luring macOS users with faux meeting software, fake job recruitment materials, blockchain or gaming downloads, and developer test packages social-engineering…
-
Fake Google and Cloudflare Verification Pages Spread StealC, HijackLoader, and NetSupport Malware
Tags: cyber, exploit, google, intelligence, malicious, malware, powershell, rat, social-engineering, threatThreat actors are currently exploiting sophisticated ClickFix social engineering campaigns that mimic Google and Cloudflare verification systems to distribute several high-impact malware families, including StealC, HijackLoader, NetSupport RAT, and newly identified loaders. Recent threat intelligence research indicates that these campaigns have been active since late 2025, tricking users into manually executing malicious PowerShell commands. This…
-
Hackers Use Compromised Websites and transcript.pdf.js Lure to Deliver PureLog Stealer
Hackers are using compromised websites and a deceptive transcript.pdf.js lure to deliver PureLog Stealer through a layered, fileless infection chain that leans heavily on PowerShell, trusted cloud infrastructure, and in-memory execution. The campaign, described in the attached research, shows how modern stealers increasingly rely on social engineering and living-off-the-land techniques rather than noisy malware binaries.…
-
Ransomware Thugs Masquerade as Interpol to Entice Small Biz
The ransomware campaign relies on basic social engineering and stretches across multiple regions, including the US, Europe, Middle East, and elsewhere. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/attackers-use-interpol-lure-target-small-businesses
-
Browser-Only Ransomware Uses File System Access API to Encrypt Files Without Malware Installation
A novel, practical ransomware technique that runs entirely inside the browser by abusing the File System Access API, demonstrating how AI can turn high-level malicious ideas into operational attack chains without any native payload. The proof-of-concept leverages a social engineering lure a fake AI image-enhancement/upscaler web app to convince users to grant folder-level access. Once…
-
And the Winner in Dominant Malware Delivery? ClickFix
Researchers say the highly effective social engineering technique is no longer the exception for malware attacks, it’s now the rule. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix
-
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer
Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs.The activity has been codenamed VEIL#DROP by Securonix. It’s suspected that the initial payloads are distributed either via spear-phishing or a drive-by compromise, which occurs when an unsuspecting user lands on…
-
MacSync Stealer Hijacks macOS via Fake Claude Code Google Ads Full Attack Chain Exposed
Tags: attack, credentials, crypto, cyber, data-breach, google, infection, macOS, malware, social-engineeringMacSync Stealer is a newly discovered macOS infostealer actively distributed through a sophisticated malvertising campaign on Google Ads that impersonates Anthropic’s Claude Code CLI. Security researchers from Beezlebub have uncovered the complete attack chain, revealing a multi-stage infection process that spans from social engineering to deep system compromise, credential harvesting, and persistent hijacking of crypto…
-
Phishers Gain Persistence at EU, Asia Hospitality Orgs
Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social engineering and obsfucation, including blockchain abuse. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs
-
2026: Cybersicherheitslage in deutschen Unternehmen
Management Summary Cybervorfälle bleiben für deutsche Unternehmen ein operatives Kernthema: 75 Prozent der befragten Organisationen waren in den vergangenen zwölf Monaten betroffen. Phishing und Social Engineering dominieren weiterhin die aktuelle Bedrohungslage und stehen für 56 Prozent der erfassten Sicherheitsvorfälle. KI-gestützte Angriffe rücken strategisch in den Fokus: 45 Prozent sehen darin das größte Cyberrisiko der kommenden……