Tag: social-engineering
-
Drittanbieter-Tools ohne PAM können zu gefährlichen Einstiegspunkten für Cyberkriminelle werden
Die Datenpanne bei Workday ist ein perfektes Beispiel für das anhaltende und wachsende Risiko, das von Social-Engineering-Angriffstaktiken auf Drittanbieterplattformen ausgeht. Die Situation spiegelt einen beunruhigenden Trend bei Anbietern von Unternehmenssoftware wider und scheint mit einer breiteren Welle jüngster Angriffe verbunden zu sein, die in ähnlicher Weise CRM-Systeme mehrerer globaler Unternehmen über ausgefeilte Social-Engineering- und OAuth-basierte…
-
Prepping the Front Line for MFA Social Engineering Attacks
Attackers will continue to evolve, and the help desk will always be a target. But with the right mix of training, support, and trust, frontline agents can become your biggest security assets. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/prepping-front-line-mfa-social-engineering-attacks
-
Prepping the Front Line for MFA Social Engineering Attacks
Attackers will continue to evolve, and the help desk will always be a target. But with the right mix of training, support, and trust, frontline agents can become your biggest security assets. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/prepping-front-line-mfa-social-engineering-attacks
-
URL-based threats become a go-to tactic for cybercriminals
Cybercriminals are using advanced social engineering and AI-generated content to make malicious URLs difficult for users to identify, according to Proofpoint. Whether through … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/21/phishing-url-based-threats/
-
Workday Hit by Social Engineering Attack, Third-Party Data Exposed
Workday’s recent data breach might be tied to ShinyHunters, a group accused of exploiting Salesforce CRM at firms like Google, Adidas, Qantas, and Louis Vuitton. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-workday-data-breach-august/
-
Threat Actors Impersonate as Google Support to Sniff Out Your Login Credentials
Threat actors are posing as Google support agents in an increasing number of complex social engineering attacks in order to take advantage of account recovery tools and obtain user credentials without authorization. These campaigns leverage legitimate-looking communication channels, such as spoofed phone numbers associated with Google’s official contact information, to build credibility and manipulate victims…
-
Workday Discloses Data Breach Following CRM-Targeted Social Engineering Attack
Workday, a leading provider of human resources and financial management software, has confirmed that it fell victim to a data breach stemming from a social engineering attack targeting a third-party Customer Relationship Management (CRM) system. According to the company, the breach did not impact its customer tenants or the secure data therein; instead, the compromised…
-
Phishing 2025: URLs als größte Gefahr für Nutzer
Das Cybersecurity-Unternehmen Proofpoint hat in seinem ‘Human Factor Report 2025″ alarmierende Entwicklungen im Bereich Phishing und Social Engineering dokumentiert. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/phishing-urls-gefahr-fuer-nutzer
-
Hackers target Workday in social engineering attack
Researchers cite increasing evidence of collaboration between Scattered Spider and the cybercrime group ShinyHunters in the campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/hackers-target-workday-in-social-engineering-attack/758095/
-
ClickFix Phishing Attacks Surge Nearly 400% in Just One Year
Phishing evolves: ClickFix attacks jump 400% in a year while quishing rises, proving criminals favor social engineering over malware. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/clickfix-phishing-surges-2025/
-
ShinyHunters strike again: Workday breach tied to Salesforce-targeted social engineering wave
Social engineering jackpot for ShinyHunters: The Workday breach slots into a much larger pattern of attacks exploiting Salesforce instances across multiple industries. Reports attribute the campaign to ShinyHunters, the notorious BreachForums admin, whom Google was tracking as UNC6040 when it first disclosed the campaign.Victims include Google itself, which said attackers accessed a Salesforce environment in…
-
Workday: Datenleck bei großem Cloud-Softwarekonzern
Cyberkriminelle sind per Social Engineering in eine CRM-Plattform eingedrungen. Workday ist nur einer von vielen betroffenen Konzernen. First seen on golem.de Jump to article: www.golem.de/news/workday-datenleck-bei-grossem-cloud-softwarekonzern-2508-199297.html
-
Workday hit in wave of social engineering attacks
A campaign of voice-based social engineering attacks targeting users of Salesforce’s services appears to have struck HR platform Workday First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366629343/Workday-hit-in-wave-of-social-engineering-attacks
-
Workday hit by social engineering data breach targeting its CRM platform
The human resources software company Workday announced that some customer information was obtained in a social engineering attack. First seen on therecord.media Jump to article: therecord.media/workday-social-engineering-data-breach
-
Ransomware-Gruppe Interlock zielt auf Command-andInfrastruktur bei deutschen Hosting-Providern
Arctic Wolf Labs, das Threat-Research-Team von Arctic Wolf, hat am 15. August 2025 eine aktualisierte Analyse zur Ransomware-Gruppe Interlock veröffentlicht. Der Akteur setzt auf neue Social-Engineering-Taktiken (ClickFix/FileFix) und zielt häufig auf virtuelle Umgebungen ab. Besonders relevant: Arctic Wolf identifizierte neue Indikatoren für eine Kompromittierung (IOCs) aus eigener Telemetrie, darunter Command-and-Control-Infrastruktur bei deutschen Hosting-Providern (z.B. 168.119.96[.]41).…
-
HR giant Workday discloses data breach after Salesforce attack
Human resources giant Workday has disclosed a data breach after attackers gained access to a third-party customer relationship management (CRM) platform in a recent social engineering attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hr-giant-workday-discloses-data-breach-amid-salesforce-attacks/
-
Workday Data Breach Exposes HR Records via Third-Party CRM Hack
Tags: access, breach, cyber, data, data-breach, risk, security-incident, social-engineering, software, supply-chain, unauthorizedEnterprise software giant Workday has disclosed a security incident involving unauthorized access to employee information through a compromised third-party customer relationship management (CRM) platform. The breach, discovered as part of a broader social engineering campaign targeting multiple large organizations, has raised concerns about supply chain security risks in the enterprise software sector. Incident Details and…
-
HR giant Workday discloses data breach amid Salesforce attacks
Human resources giant Workday has disclosed a data breach after attackers gained access to a third-party customer relationship management (CRM) platform in a recent social engineering attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hr-giant-workday-discloses-data-breach-amid-salesforce-attacks/
-
Scattered Spider and ShinyHunters’ Next Move: Leaking Data
Extortionists Detail Fresh Victims, Although Sensitivity of Stolen Data Unclear. Extortionists tied to the Scattered Spider and ShinyHunters hacking collectives have begun naming victims and leaking data via a new, dedicated Telegram channel. Many of the breaches appear to trace to social engineering attacks that gained attackers access to a victim’s Salesforce instance. First seen…
-
ClickFix macOS Malware Targets User Login Credentials
Security researchers have identified a new malware campaign targeting macOS users through a sophisticated ClickFix technique that combines phishing and social engineering to steal cryptocurrency wallet details, browser credentials, and sensitive personal data. The Odyssey Stealer malware, discovered by X-Labs researchers in August 2025, represents an evolution of earlier ClickFix attacks that previously focused on…
-
Social Engineering laut Unit 42 Haupteinfallstor 2025
Tags: social-engineeringFirst seen on datensicherheit.de Jump to article: www.datensicherheit.de/social-engineering-forschung-unit-42-haupteinfallstor-2025
-
Tips to Protect Yourself on LinkedIn from Fraud, Social Engineering, and Espionage
Tags: business, cyber, cybersecurity, data, espionage, fraud, jobs, linkedin, malicious, phishing, risk, social-engineering, spam, tool, vulnerabilityLinkedIn is a great communication tool for business professionals that informs, provides opportunities, and fosters collaboration”Š”, “Šwhich is exactly why it is attractive to sophisticated cyber adversaries, including aggressive nation state actors, who use LinkedIn for nefarious activities such as information gathering, target profiling, human-asset engagement, fraud, social engineering, and trust building. Urgent and time…
-
Social Engineering als Haupteinfallstor 2025
Die neue Social-Engineering-Edition des 2025 Global Incident Response Report von Unit 42 zeigt: Social Engineering ist 2025 das häufigste Einfallstor für Cyberangriffe [1]. In mehr als einem Drittel der über 700 analysierten Fälle weltweit nutzten Angreifer Social Engineering als Einstieg, also den gezielten Versuch, Menschen durch Täuschung zu bestimmten Handlungen zu verleiten und so Sicherheitskontrollen……
-
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
Tags: access, advisory, ai, attack, authentication, automation, backup, breach, china, cisa, cloud, computer, credentials, cve, cyber, cybersecurity, data, defense, detection, docker, exploit, framework, github, google, government, grc, group, guide, hacker, healthcare, identity, infrastructure, iot, ISO-27001, jobs, kubernetes, malicious, malware, mfa, microsoft, mitigation, monitoring, network, nist, open-source, password, programming, ransomware, resilience, risk, risk-management, service, social-engineering, software, startup, strategy, supply-chain, tactics, technology, threat, tool, update, vulnerability, zero-dayCheck out what CISA found after it dissected malware from the latest SharePoint hacks. Plus, the U.K.’s cyber agency is overhauling its cyber framework to keep pace as threats escalate. In addition, Google is warning that cloud attacks are getting dangerously sophisticated. And get the latest on CISA’s new malware analysis platform and its report…
-
Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework
Tags: access, advisory, ai, attack, authentication, automation, backup, breach, china, cisa, cloud, computer, credentials, cve, cyber, cybersecurity, data, defense, detection, docker, exploit, framework, github, google, government, grc, group, guide, hacker, healthcare, identity, infrastructure, iot, ISO-27001, jobs, kubernetes, malicious, malware, mfa, microsoft, mitigation, monitoring, network, nist, open-source, password, programming, ransomware, resilience, risk, risk-management, service, social-engineering, software, startup, strategy, supply-chain, tactics, technology, threat, tool, update, vulnerability, zero-dayCheck out what CISA found after it dissected malware from the latest SharePoint hacks. Plus, the U.K.’s cyber agency is overhauling its cyber framework to keep pace as threats escalate. In addition, Google is warning that cloud attacks are getting dangerously sophisticated. And get the latest on CISA’s new malware analysis platform and its report…
-
From fake CAPTCHAs to RATs: Inside 2025’s cyber deception threat trends
Cybercriminals are getting better at lying. That’s the takeaway from a new LevelBlue report, which outlines how attackers are using social engineering and legitimate tools to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/08/08/cyber-deception-threat-trends-2025/
-
Social-Engineering ist Haupteinfallstor in 2025
Die neue Social-Engineering-Edition des 2025-Global-Incident-Response-Report von Unit 42 zeigt: Social-Engineering ist 2025 das häufigste Einfallstor für Cyberangriffe. In mehr als einem Drittel der über 700 analysierten Fälle weltweit nutzten Angreifer Social-Engineering als Einstieg, also den gezielten Versuch, Menschen durch Täuschung zu bestimmten Handlungen zu verleiten und so Sicherheitskontrollen zu umgehen. Die zentralen Erkenntnisse auf einen…
-
Here’s how deepfake vishing attacks work, and why they can be hard to detect
Why AI-based voice cloning is the next frontier social-engineering attacks. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/08/heres-how-deepfake-vishing-attacks-work-and-why-they-can-be-hard-to-detect/
-
Here’s how deepfake vishing attacks work, and why they can be hard to detect
Why AI-based voice cloning is the next frontier social-engineering attacks. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/08/heres-how-deepfake-vishing-attacks-work-and-why-they-can-be-hard-to-detect/
-
ShinyHunters Target Chanel in Salesforce Linked Data Breach
ShinyHunters breached Chanel’s US client database via Salesforce-linked access, exposing limited customer details through social engineering tactics. First seen on hackread.com Jump to article: hackread.com/shinyhunters-target-chanel-salesforce-data-breach/