Tag: social-engineering
-
FBI Warns of Scattered Spider’s Expanding Attacks on Airlines Using Social Engineering
The U.S. Federal Bureau of Investigation (FBI) has revealed that it has observed the notorious cybercrime group Scattered Spider broadening its targeting footprint to strike the airline sector.To that end, the agency said it’s actively working with aviation and industry partners to combat the activity and help victims.”These actors rely on social engineering techniques, often…
-
Beware of Trending TikTok Videos Promoting Pirated Apps That Deliver Stealer Malware
Tags: ai, attack, cyber, malicious, malware, microsoft, powershell, social-engineering, software, windowsA sophisticated social engineering campaign has surfaced on TikTok, leveraging the platform’s massive user base and algorithmic reach to distribute information-stealing malware, specifically Vidar and StealC. Identified by Trend Research, this attack uses potentially AI-generated videos to deceive users into executing malicious PowerShell commands under the guise of activating pirated software like Windows OS, Microsoft…
-
ClickFix Attacks Soar by 500%: Hackers Intensify Use of This Manipulative Technique to Deceive Users
A novel social engineering technique dubbed >>ClickFix
-
Money mule networks evolve into hierarchical, business-like criminal enterprises
In this Help Net Security interview, Michal Tresner, CEO of ThreatMark, discusses how cybercriminals are weaponizing AI, automation, and social engineering to industrialize … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/27/michal-tresner-threatmark-money-mule-networks/
-
Why Are CISOs Prioritizing Snowflake Security? The Breach Playbook Has Changed.
In recent conversations with prospective customers, one request keeps rising to the top: “Can you monitor Snowflake?” At first, it felt like a coincidence. But over multiple engagements, that urgency isn’t random it reflects a deeper industry concern. Security leaders are increasingly prioritizing Snowflake as a high-risk, high-value SaaS application. And they’re right to. The…
-
New FileFix Method Emerges as a Threat Following 517% Rise in ClickFix Attacks
The ClickFix social engineering tactic as an initial access vector using fake CAPTCHA verifications increased by 517% between the second half of 2024 and the first half of this year, according to data from ESET.”The list of threats that ClickFix attacks lead to is growing by the day, including infostealers, ransomware, remote access trojans, cryptominers,…
-
ClickFix Attacks Surge 517% in 2025
The ClickFix social engineering technique has become the second most common attack vector, behind only phishing, according to ESET research First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/clickfix-attacks-surge-2025/
-
New FileFix Exploit Uses Windows File Explorer to Run Malicious Commands
A newly discovered exploit, dubbed >>FileFix,
-
New FileFix attack weaponizes Windows File Explorer for stealthy commands
A cybersecurity researcher has developed FileFix, a variant of the ClickFix social engineering attack that tricks users into executing malicious commands via the File Explorer address bar in Windows. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/
-
FileFix attack weaponizes Windows File Explorer for stealthy commands
A cybersecurity researcher has developed FileFix, a variant of the ClickFix social engineering attack that tricks users into executing malicious commands via the File Explorer address bar in Windows. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/
-
Aflac-Datenleck: Versicherungsbranche im Visier von Hackern
Hinter dem Angriff auf Aflac könnte die berüchtigte Cyberbande Scattered Spider stecken. Experten zufolge hat sie es inzwischen vermehrt auf Versicherungsunternehmen abgesehen.Der US-Versicherungsanbieter Aflac entdeckte am 12. Juni verdächtige Aktivitäten in seinem Netzwerk. Auch wenn der Angriff nach eigenen Angaben innerhalb weniger Stunden gestoppt werden konnte, sind dadurch potenziell Kundendaten gefährdet.So könnten die Täter an…
-
Social engineering and Signal chats led to new Russian malware attacks, Ukraine says
Tags: attack, blizzard, cybersecurity, government, group, malware, russia, social-engineering, ukraineUkraine’s cybersecurity agency said the Russian group tracked as APT28, Fancy Bear or Forest Blizzard was responsible for targeting new malware strains at government officials. First seen on therecord.media Jump to article: therecord.media/ukraine-new-russian-malware-social-engineering-signal-chats
-
North Korean Hackers Use Malicious Zoom Apps to Execute System-Takeover Attacks
Tags: attack, cyber, cybersecurity, hacker, malicious, north-korea, scam, social-engineering, threatCybersecurity researchers and targeted individuals have reported a highly sophisticated scam orchestrated by suspected North Korean hackers. This attack, disguised as a legitimate Zoom meeting, leverages advanced social engineering techniques to trick professionals into compromising their systems. The campaign, which surfaced recently, highlights the growing audacity and technical prowess of state-sponsored threat actors aiming to…
-
OpenAI Used Globally for Attacks FireTail Blog
Jun 23, 2025 – – In 2025, virtually no one is a stranger to OpenAI’s ChatGPT. It is one of the most popular AI applications on the Internet, and almost everyone is using it from your boss, to your neighbor, to the passive-aggressive friend sending you oddly phrased text messages.But since it is relatively new,…
-
BlueNoroff Hackers Exploit Zoom App to Deploy Infostealer Malware in Targeted Attacks
The Field Effect Analysis team has uncovered a targeted social engineering campaign orchestrated by the North Korean state-sponsored threat actor BlueNoroff, a financially motivated subgroup of the notorious Lazarus Group. A Canadian online gambling provider fell victim to a meticulously crafted attack involving impersonation of a trusted contact and the Zoom platform. Sophisticated Social Engineering…
-
71% of new hires click on phishing emails within 3 months
New hires are more likely to fall for phishing attacks and social engineering than longer-term employees, especially in their first 90 days, according to Keepnet. Why new … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/06/23/new-hire-phishing-risk/
-
Russian hackers bypass Gmail MFA using stolen app passwords
Russian hackers bypass multi-factor authentication and access Gmail accounts by leveraging app-specific passwords in advanced social engineering attacks that impersonate U.S. Department of State officials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/russian-hackers-bypass-gmail-mfa-using-stolen-app-passwords/
-
Aflac Discloses Cybersecurity Incident, Customer Data Potentially Exposed Amid Industry-Wide Attacks
Aflac confirms a cyberattack exposed sensitive customer data, citing social engineering tactics amid a wave of breaches targeting US insurers. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/aflac-cyber-security-incident-2025/
-
Mocha Manakin Uses PasteRun Technique to Deceive Users into Downloading Malware
A malicious campaign tracked as Mocha Manakin has been identified employing the deceptive >>paste-and-run
-
Cybersecurity Snapshot: Tenable Report Spotlights Cloud Exposures, as Google Catches Pro-Russia Hackers Impersonating Feds
Tags: access, advisory, ai, api, apple, attack, authentication, best-practice, business, cisa, cisco, cloud, conference, container, control, credentials, cve, cyber, cybersecurity, data, data-breach, detection, email, encryption, endpoint, exploit, google, governance, government, group, guide, hacker, Hardware, identity, infrastructure, intelligence, Internet, kubernetes, linux, macOS, microsoft, mitigation, mobile, monitoring, network, oracle, password, phishing, ransomware, risk, russia, service, social-engineering, software, sql, strategy, tactics, technology, threat, tool, update, vmware, vulnerability, windowsCheck out highlights from Tenable’s “2025 Cloud Security Risk Report,” which delves into the critical risk from insecure cloud configurations. Plus, Google reveals a Russia-sponsored social engineering campaign that targeted prominent academics’ Gmail accounts. And get the latest on AI system security, just-in-time access, CIS Benchmarks and more! Dive into six things that are top…
-
Hackers Use Social Engineering to Target Expert on Russian Operations
Citizen Lab and Google uncovered a new, sophisticated cyberattack linked to Russian state actors that exploits App-Specific Passwords, bypassing Multi-Factor Authentication. Discover how to protect yourself from these evolving threats. First seen on hackread.com Jump to article: hackread.com/hackers-use-social-engineering-expert-russian-operations/
-
Aflac duped by social-engineering attack, marking another hit on insurance industry
Three insurance companies have publicly disclosed cyberattacks in the past week. Scattered Spider, an amorphous band of cybercriminals, has been actively targeting the sector. First seen on cyberscoop.com Jump to article: cyberscoop.com/aflac-cyberattack-insurance-sector-scattered-spider/
-
Chain IQ data theft highlights need to oversee third party suppliers
Tags: access, attack, awareness, breach, ceo, ciso, corporate, data, data-breach, detection, extortion, finance, governance, group, intelligence, international, jobs, law, monitoring, phishing, ransomware, risk, risk-management, service, social-engineering, supply-chain, tactics, theft, threatCSO attempted to contact Chain IQ and UBS for comment, but was unable to reach a spokesperson for either by publication time. What should be of note to CSOs is that this is another example of an attack on a third party supplier that impacts its customers.”Chain IQ’s breach serves as yet another reminder that…
-
Russian APT29 Exploits Gmail App Passwords to Bypass 2FA in Targeted Phishing Campaign
Threat actors with suspected ties to Russia have been observed taking advantage of a Google account feature called application specific passwords (or app passwords) as part of a novel social engineering tactic designed to gain access to victims’ emails.Details of the highly targeted campaign were disclosed by Google Threat Intelligence Group (GTIG) and the Citizen…
-
Scattered Spider Aims at US Insurers After UK Retail Hit, Google Warns
Scattered Spider targets US insurance firms after UK retail attacks, using social engineering to breach help desks and disrupt services, Google warns. First seen on hackread.com Jump to article: hackread.com/scattered-spider-us-insurers-uk-retail-hit-google/
-
What Is Social Engineering? A Guide for K12 School Leaders
Understanding the Human Side of Cyberattacks”, and Why Schools Need Stronger Protection Cybersecurity in schools isn’t just about firewalls and software anymore. One of the most effective”, and dangerous”, threats school districts face today doesn’t start with malware. It starts with a carefully timed and crafted message. It’s called social engineering, and it’s now one…
-
News alert: Arsen launches AI-powered vishing simulation to help combat voice phishing at scale
Paris, Jun. 3, 2025, CyberNewswireArsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced the release of its new Vishing Simulation module, a cutting-edge tool designed to train employees against one of the fastest-growing… (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/06/news-alert-arsen-launches-ai-powered-vishing-simulation-to-help-combat-voice-phishing-at-scale/
-
Cybersecurity Snapshot: NIST Offers Zero Trust Implementation Advice, While OpenAI Shares ChatGPT Misuse Incidents
Tags: access, ai, attack, best-practice, breach, chatgpt, china, cloud, computer, computing, control, credentials, crime, cyber, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, encryption, endpoint, exploit, finance, fraud, government, guide, Hardware, identity, infrastructure, intelligence, Internet, iot, korea, law, least-privilege, linkedin, malicious, malware, military, ml, mobile, monitoring, network, nist, north-korea, openai, phishing, phone, programming, ransomware, risk, russia, scam, service, social-engineering, software, supply-chain, technology, theft, threat, tool, update, vulnerability, zero-trustCheck out NIST best practices for adopting a zero trust architecture. Plus, learn how OpenAI disrupted various attempts to abuse ChatGPT. In addition, find out what Tenable webinar attendees said about their exposure management experiences. And get the latest on cyber crime trends, a new cybersecurity executive order and more! Dive into six things that…
-
Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale
Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced the release of its new Vishing Simulation module, a cutting-edge tool designed to train employees against one of the fastest-growing attack vectors: voice phishing (vishing). This new module usesAI-generated voices and adaptive dialogue systemsto simulate live phone-based social engineering attacks, such as […]…
-
Neue Taktik der 3AMGruppe: Virtuelle Maschine als Tarnkappe
Sophos X-Ops hat eine Ransomware-Angriffswelle analysiert, bei der die Cybercrime-Gruppe ‘3AM” bewährte Social-Engineering-Methoden sowie die Nutzung legitimer Fernwartungstools mit einer technischen Neuerung kombiniert: Den Einsatz einer versteckten virtuellen Maschine, um verdeckt Zugriff auf das Unternehmensnetzwerk zu erlangen unter Umgehung klassischer Endpunktschutzlösungen. Im ersten Quartal 2025 betreute das Sophos X-Ops-Team ein Unternehmen, das einen solchen Angriff First…