Tag: social-engineering
-
CBI Uncovers Noida Tech Support Scam Targeting Victims in UK and Australia
The Central Bureau of Investigation (CBI) has made a major breakthrough in Operation Chakra-V by taking down a sophisticated global cybercrime network that was primarily targeting people in Australia and the United Kingdom with tech support frauds. This operation highlights the evolving landscape of cyber-enabled fraud, where perpetrators leverage advanced telecommunications infrastructure and social engineering…
-
Google Gemini-Lücke ermöglicht versteckte Phishing-Angriffe
Tags: ai, bug, bug-bounty, cyberattack, google, hacker, LLM, mail, phishing, social-engineering, toolHacker können Google Gemini nutzen, um versteckte Phishing-Attacken durchzuführen.Google Gemini für Workspace kann missbraucht werden, um E-Mail-Zusammenfassungen zu generieren, die legitim erscheinen, aber bösartige Anweisungen oder Warnungen enthalten. Das Problem: Angreifer können ohne Anhänge oder direkte Links ihre Opfer auf Phishing-Sites umleiten. Die Sicherheitslücke wurde von einem Forscher namens Marco Figueroa entdeckt, der der für…
-
Fake Gaming and AI Companies Target Windows and macOS Users with Drainer Malware Attacks
Tags: ai, attack, cyber, cybersecurity, macOS, malware, social-engineering, startup, threat, windowsThe cybersecurity company Darktrace has uncovered a persistent, intricate social engineering campaign that targets bitcoin users, building on earlier findings by Cado Security Labs in December 2024. Threat actors are fabricating elaborate startup companies themed around AI, gaming, video conferencing, Web3, and social media to lure victims into downloading malware disguised as legitimate software. These…
-
ClickFix: The Emerging Technique Threat Actors Use to Dominate Targeted Organizations
Threat actors have increasingly adopted ClickFix, a sophisticated social engineering technique that deceives users into executing malicious commands under the guise of resolving common computer issues like performance lags or pop-up errors. This method, often delivered via compromised websites, malvertising, YouTube tutorials, or fake tech support forums, relies on clipboard hijacking also known as pastejacking…
-
McDonald’s AI hiring tool’s password ‘123456’ exposed data of 64M applicants
Tags: access, ai, authentication, automation, business, ceo, control, credentials, cybersecurity, data, data-breach, endpoint, jobs, password, phishing, privacy, risk, social-engineering, tool, update, vulnerabilityRapid patching saved the day: Following disclosure on June 30, 2025, Paradox.ai and McDonald’s acknowledged the vulnerability within the hour. By July 1, default credentials were disabled and the endpoint was secured. Paradox.ai also pledged to conduct further security audits, Carroll noted in the blog.”Even though there’s no indication the data has been used maliciously…
-
McDonald’s AI hiring tool’s password? ‘123456’: Exposes data of 64M applicants
Tags: access, ai, authentication, automation, business, ceo, control, credentials, cybersecurity, data, endpoint, jobs, password, phishing, privacy, risk, social-engineering, tool, update, vulnerabilityRapid patching saved the day: Following disclosure on June 30, 2025, Paradox.ai and McDonald’s acknowledged the vulnerability within the hour. By July 1, default credentials were disabled and the endpoint was secured. Paradox.ai also pledged to conduct further security audits, Carroll noted in the blog.”Even though there’s no indication the data has been used maliciously…
-
Anatomy of a Scattered Spider attack: A growing ransomware threat evolves
Tags: access, attack, authentication, business, cloud, control, data, detection, endpoint, exploit, finance, firewall, group, iam, identity, incident response, infrastructure, mfa, microsoft, monitoring, ransomware, social-engineering, tactics, technology, threat, tool, vulnerabilityEnsuing battle over IT resources: Despite the stealth of the attack incident response defenders at the compromised company detected the attack and began to fight back, setting up a tug-of-war to establish control over the organization’s IT resources. In response, Scattered Spider abandoned attempts at covert infiltration and began an aggressive attempt to disrupt business…
-
Fake Gaming and AI Firms Push Malware on Cryptocurrency Users via Telegram and Discord
Cryptocurrency users are the target of an ongoing social engineering campaign that employs fake startup companies to trick users into downloading malware that can drain digital assets from both Windows and macOS systems.”These malicious operations impersonate AI, gaming, and Web3 firms using spoofed social media accounts and project documentation hosted on legitimate platforms like Notion…
-
UK Arrests Woman and Three Men for Cyberattacks on MS Co-op and Harrods
Four suspects arrested by the NCA in April/May 2025 cyberattacks on MS, Co-op, and Harrods. Learn about the social engineering, ransomware disruption, and estimated £300M impact on MS. First seen on hackread.com Jump to article: hackread.com/uk-arrests-woman-men-cyberattacks-ms-co-op-harrods/
-
M&S chairman calls for mandatory disclosure of material cyberattacks
The chairman testified before British lawmakers following a major social-engineering attack on the department-store chain. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ms-chairman-mandatory-disclosure-material-cyberattacks/752584/
-
Qantas says cyberattack affected 5.7 million customers
The incident follows a notorious hacker gang’s pivot to targeting transportation companies with its trademark social-engineering attacks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/qantas-cyberattack-57-million-customers/752571/
-
M&S confirms social engineering led to massive ransomware attack
M&S confirmed today that the retail outlet’s network was initially breached in a “sophisticated impersonation attack” that ultimately led to a DragonForce ransomware attack. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/mands-confirms-social-engineering-led-to-massive-ransomware-attack/
-
Researchers Reveal Scatter Spider’s Tools, Tactics, and Key Indicators
Check Point Research has revealed important details about the phishing domain patterns and advanced attack techniques of the infamous Scattered Spider organization, which has brought a new wave of cyberthreats under close investigation. Known for their aggressive social engineering tactics, this financially motivated group active since at least 2022 and comprising young individuals aged 1922…
-
ClickFix-Attacken bedrohen Unternehmenssicherheit
Tags: access, apple, awareness, cyberattack, detection, endpoint, exploit, intelligence, Internet, linux, mail, malware, microsoft, open-source, phishing, powershell, ransomware, social-engineering, spam, threat, tool, windowsCyberkriminelle greifen immer häufiger auf ClickFix-Angriffe zurück.Weniger bekannt als Phishing ist die Social-Engineering-Methode ClickFix. Ziel solcher Attacken ist es, die Opfer dazu zu bewegen, bösartige Befehle in Tools wie PowerShell oder die Windows-Eingabeaufforderung einzufügen. Die Angriffe beginnen in der Regel, nachdem ein Benutzer eine kompromittierte oder bösartige Website besucht oder einen betrügerischen Anhang oder Link…
-
Social-Engineering treibt den weltweiten Anstieg von Angriffen voran
Die weltbekannte Cybersicherheits-plattform KnowBe4, die sich umfassend mit Human-Risk-Management befasst, wirft ein kritisches Licht auf die entscheidende Rolle, die Social-Engineering bei der Zunahme von Ransomware-Angriffen weltweit spielt. Anlässlich des Ransomware-Awareness-Month im Juli ermutigt KnowBe4 Unternehmen, sich mit dem Beitrag des Human-Risk zur Ausbreitung von Ransomware auseinanderzusetzen, und präsentiert fünf entscheidende Strategien, um ihre Abwehrmaßnahmen auf…
-
Cybercriminals Use Fake Cloudflare Verification Screens to Deceive Users into Running Malware
Threat actors have developed a clever social engineering technique to disseminate malware by posing as trustworthy security measures, which is a terrifying new development in the realm of cybercrime. Cybersecurity researchers have uncovered a malicious campaign that leverages fake Cloudflare verification screens to trick unsuspecting users into executing harmful code on their systems. This attack…
-
Phishing Scammers Push for Callbacks in Latest Innovation
Telephone-Oriented Attack Delivery Social Engineering Tactic Thrives. The phishing industry is a never ending font of innovation. Cyber fraudsters are determined to worm their way into your inbox. Recent attacks involve callback phishing, a social engineering tactic designed to break down victims’ defenses by spurring them into calling the scammers themselves. First seen on govinfosecurity.com…
-
Australia’s privacy watchdog warns ‘vishing’ on the rise as Qantas strengthens security after cyber-attack
Tags: access, attack, breach, cyber, cybercrime, data, data-breach, detection, email, privacy, social-engineering, threat, updateAirline has not indicated whether customers will be compensated after the social engineering attack on a third-party system<ul><li>Get our <a href=”https://www.theguardian.com/email-newsletters?CMP=cvau_sfl”>breaking news email, <a href=”https://app.adjust.com/w4u7jx3″>free app or <a href=”https://www.theguardian.com/australia-news/series/full-story?CMP=cvau_sfl”>daily news podcast</li></ul>Qantas has said it will beef up its security and threat detection in the wake of a <a href=”https://www.theguardian.com/business/2025/jul/02/qantas-confirms-cyber-attack-exposes-records-of-up-to-6-million-customers”>cyber-attack affecting up to 6 million customers,…
-
ClickFix Spin-off Attack Bypasses Key Browser Safeguards
A new threat vector exploits how modern browsers save HTML files, bypassing Mark of the Web and giving attackers another social-engineering attack for delivering malware. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/clickfix-spin-off-bypassing-key-browser-safeguards
-
FileFix Attack Chain Enables Malicious Script Execution
By using social engineering tactics, threat actors are able to manipulate their victims into saving and renaming files that will backfire against them. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/filefix-attack-chain-malicious-script
-
Scattered Spider shifts focus to airlines as strikes hit Hawaiian, WestJet, and now Qantas
Tags: attack, authentication, breach, business, cisa, ciso, corporate, credentials, cybersecurity, data, data-breach, government, group, hacker, identity, india, mfa, microsoft, network, password, phone, ransom, ransomware, social-engineering, supply-chain, tactics, unauthorized, vulnerabilitySophisticated help desk deception campaigns: The group has perfected calling corporate help desks and impersonating employees to trick support staff into resetting passwords and adding unauthorized devices to multi-factor authentication systems.Cybercrime syndicates like Scattered Spider operate as compartmentalized organizations, with distinct teams specializing in different attack phases, said Sunil Varkey, advisor at Beagle Security. “One…
-
Hackers Using PDFs to Impersonate Microsoft, DocuSign, and More in Callback Phishing Campaigns
Cybersecurity researchers are calling attention to phishing campaigns that impersonate popular brands and trick targets into calling phone numbers operated by threat actors.”A significant portion of email threats with PDF payloads persuade victims to call adversary-controlled phone numbers, displaying another popular social engineering technique known as Telephone-Oriented Attack Delivery (TOAD First seen on thehackernews.com Jump…
-
PDFs: Portable documents, or perfect deliveries for phish?
A popular social engineering technique returns: callback phishing, or TOAD attacks, which leverage PDFs, VoIP anonymity and even QR code tricks. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/pdfs-portable-documents-or-perfect-deliveries-for-phish/
-
Why every company needs a travel security program
Tags: access, advisory, awareness, business, china, conference, corporate, credentials, cyber, encryption, government, Hardware, infrastructure, intelligence, international, iran, mfa, middle-east, network, password, resilience, risk, risk-assessment, russia, service, social-engineering, strategy, threat, ukraine, vpnGeopolitical flashpoints are multiplying: The war in Ukraine continues to destabilize Europe’s eastern edge. In the Middle East, recent US airstrikes on Iranian nuclear facilities have escalated tensions involving Iran, Israel, and the United States, triggering a worldwide caution advisory and rerouting international air traffic. Demonstrations targeting Western business interests are growing in scale and…
-
Scattered Spider crime spree takes flight as focus turns to aviation sector
Time ticking for defenders as social engineering pros weave wider web First seen on theregister.com Jump to article: www.theregister.com/2025/06/30/scattered_spider_aviation/
-
Scattered Spider nimmt Luftfahrtbranche ins Visier
Tags: cyberattack, cybersecurity, finance, hacker, mandiant, mfa, network, password, phishing, ransomware, service, social-engineering, tool, vulnerabilityScattered Spider nutzt Social Engineering statt Brute Force um sich Zugang zu verschaffen.Die Cybersecurity-Anbieter Mandiant und Palo Alto Networks sowie das FBI warnen vor zunehmenden Cyberangriffen der Hackergruppe ‘Scattered Spider” auf den Luftfahrtsektor. Einen Name machte sich die Bande bereits unter anderem durch Angriffe auf die großen britischen Einzelhändler Marks&Spencer, Harrods sowie Co-op. Das FBI…
-
Scattered Spider shifts focus to airlines with strikes on Hawaiian and WestJet
Tags: attack, authentication, breach, business, cisa, corporate, credentials, cybersecurity, data, data-breach, government, group, hacker, identity, india, mfa, microsoft, network, password, phone, ransom, ransomware, social-engineering, supply-chain, tactics, unauthorized, vulnerabilitySophisticated help desk deception campaigns: The group has perfected calling corporate help desks and impersonating employees to trick support staff into resetting passwords and adding unauthorized devices to multi-factor authentication systems.Cybercrime syndicates like Scattered Spider operate as compartmentalized organizations, with distinct teams specializing in different attack phases, said Sunil Varkey, advisor at Beagle Security. “One…
-
Scattered Spider Targets Tech Companies with Phishing Frameworks like Evilginx and Social Engineering Tactics
Tags: credentials, cyber, finance, framework, group, hacking, phishing, social-engineering, tactics, technology, threatThe notorious hacking collective Scattered Spider, also known as UNC3944 or Octo Tempest, has emerged as a formidable threat to high-value industries, with a particular focus on technology, finance, and retail sectors. Recent research reveals that 81% of the group’s registered domains impersonate technology vendors, aiming to harvest credentials from high-value targets such as system…
-
Cybercriminals take malicious AI to the next level
Tags: ai, automation, breach, chatgpt, cisco, control, credit-card, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, finance, fraud, group, hacking, intelligence, LLM, malicious, marketplace, monitoring, phishing, service, social-engineering, strategy, tactics, threat, tool, vulnerabilityCustom face generation for dating scamsAudio spoofing for voice verification fraudOn-demand video avatars that lip-sync based on customer-submitted scriptsThese services are increasingly offered with add-ons such as pre-loaded backstories,matching fake documents, and automated scheduling for calls. Prompt engineering as a service: Underground communities have also emerged around the art of crafting jailbreak prompts.These “bypass builders”…
-
The FBI warns that Scattered Spider is now targeting the airline sector
The FBI warns that Scattered Spider is now targeting the airline sector. Feds are working with aviation partners to combat the threat and assist affected victims. The FBI reports that the cybercrime group Scattered Spider is now targeting the airline sector. The cybercriminals are using social engineering techniques to gain access to target organizations by…