Tag: social-engineering
-
Russian Hackers Exploit Microsoft Device Code Authentication in Targeted Attacks Against M365 Accounts
Tags: attack, authentication, cybersecurity, exploit, hacker, microsoft, phishing, russia, social-engineeringCybersecurity researchers at Volexity have uncovered a series of targeted phishing and social engineering campaigns by multiple Russian First seen on securityonline.info Jump to article: securityonline.info/russian-hackers-exploit-microsoft-device-code-authentication-in-targeted-attacks-against-m365-accounts/
-
AI-Powered Social Engineering: Ancillary Tools and Techniques
Social engineering is advancing fast, at the speed of generative AI. This is offering bad actors multiple new tools and techniques for researching, scoping, and exploiting organizations. In a recent communication, the FBI pointed out: ‘As technology continues to evolve, so do cybercriminals’ tactics.’This article explores some of the impacts of this GenAI-fueled acceleration. And…
-
24% of vulnerabilities are abused before a patch is available
Building the case for proactive security: Boris Cipot, senior security engineer at software composition analysis firm Black Duck, said that several factors contribute toward the rise in exploited vulnerabilities, including improvements in monitoring.”The software we use may simply contain more vulnerabilities, or these vulnerabilities are being reported and discovered more effectively,” Cipot said. “Some vulnerabilities…
-
Hackers Manipulate Users Into Running PowerShell as Admin to Exploit Windows
Tags: cyber, cyberattack, data-breach, exploit, group, hacker, hacking, intelligence, microsoft, north-korea, powershell, social-engineering, tactics, threat, windowsMicrosoft Threat Intelligence has exposed a novel cyberattack method employed by the North Korean state-sponsored hacking group, Emerald Sleet (also known as Kimsuky or VELVET CHOLLIMA). The group is exploiting social engineering tactics to deceive individuals into running PowerShell commands with administrative privileges, allowing them to infiltrate systems and pilfer critical information. Emerald Sleet’s new…
-
Phishing Season 2025: The Latest Predictions Unveiled
Tags: access, ai, attack, authentication, automation, cloud, communications, control, credentials, cyber, cyberattack, cybercrime, cybersecurity, data, defense, detection, election, email, exploit, finance, google, government, group, infrastructure, intelligence, login, malware, mfa, mobile, network, passkey, phishing, ransomware, risk, service, social-engineering, strategy, tactics, technology, threat, tool, update, voip, vulnerability, zero-trustEvery year, cybercriminals sharpen their tools and refine their tactics to exploit network and security vulnerabilities. Gone are the days of clumsy emails with glaring typos and suspicious attachments. Instead, we face an era of new sophistication. No longer just stealing credentials, attackers are creating intricate digital narratives that make it difficult to distinguish friend…
-
New Scareware Attack Targeting Mobile Users to Deploy Malicious Antivirus Apps
A new wave of scareware attacks has emerged, targeting unsuspecting mobile users with fake antivirus applications designed to exploit fear and trick victims into downloading malicious software. Scareware, a type of digital fraud, employs social engineering tactics to alarm users with fabricated warnings about security threats, ultimately coercing them into taking risky actions. Scareware: A…
-
AI-Powered Social Engineering: Reinvented Threats
The foundations for social engineering attacks manipulating humans might not have changed much over the years. It’s the vectors how these techniques are deployed that are evolving. And like most industries these days, AI is accelerating its evolution. This article explores how these changes are impacting business, and how cybersecurity leaders can respond.Impersonation attacks: First…
-
Studie: Auch bei Smartphones Phishing Top-Sicherheitsrisiko
Eine neue globale Umfrage unter Smartphone-Nutzern offenbart eine alarmierende Realität: Phishing ist auch für mobile Sicherheit die mit großem Abstand die größte Bedrohung. Cyberkriminelle nutzen raffinierte Täuschungsmanöver, um an persönliche Daten zu gelangen. Auf Platz zwei folgen Malware und Viren meist eingeschleust durch Social-Engineering-Tricks. First seen on itsicherheit-online.com Jump to article: www.itsicherheit-online.com/news/security-management/studie-auch-bei-smartphones-phishing-top-sicherheitsrisiko/
-
Cryptohack Roundup: Critical Ethereum Vulnerability
Also: Conviction in £1.5M Fraud, Sentencing in Torture and Theft Case. This week’s stories include a critical Ethereum vulnerability, conviction in a £1.5M fraud, sentencing in a torture and crypto theft case, SEC’s new roadmap, Jan crypto stats, Coinbase social engineering victims, and U.S. lawmakers’ digital assets working group. First seen on govinfosecurity.com Jump to…
-
Wahlmanipulationen mithilfe von Fehlinformationen, Social-Engineering oder Hacking
Das war mal richtig Oldschool in unserer digitalen Welt: Wenige Sekunden benötigten Angreifende, um sozusagen einen analogen Deepfake zu kreieren: Bauschaum in den Auspuff gesprüht, Aufkleber mit dem Bild des Bündnis 90/Die Grünen-Kanzlerkandidaten Habeck und dem Appell ‘Sei grüner” auf den Lack geklebt und schon war beinahe in Echtzeit die Illusion kreiert, dass die Täter…
-
AI Rise: Can We Still Trust What We See?
AI-Powered Social Engineering and Deepfake Threats in 2025. Security researchers predict threat actors will use artificial intelligence and large language models to enhance phishing attacks and create convincing fake personas, while defensive AI enters a new phase of semiautonomous operations. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-rise-we-still-trust-what-we-see-a-27457
-
Abandoned AWS S3 buckets open door to remote code execution, supply-chain compromises
Tags: access, advisory, antivirus, apt, attack, cisa, cloud, cybersecurity, finance, framework, government, iam, infrastructure, injection, Internet, linux, macOS, malicious, malware, military, network, open-source, programming, ransomware, remote-code-execution, risk, social-engineering, software, supply-chain, tool, update, windowsCode references to nonexistent cloud assets continue to pose significant security risks, and the problem is only growing. Recent research identified approximately 150 AWS S3 storage buckets once used by various software projects to host sensitive scripts, configuration files, software updates, and other binary artifacts that were automatically downloaded and executed on user machines.Because these…
-
Threat Analysis: Einblick in die E-Mail Security-Landschaft für das Jahr 2025
Tags: ai, cyberattack, cyersecurity, deep-fake, group, mail, phishing, qr, social-engineering, threatJährliche Studie zu E-Mail-Bedrohungen prognostiziert, dass Infostealer, BEC-Angriffe sowie KI-gesteuertes Phishing und Social Engineering auch im Jahr 2025 zu den weiter anhaltenden Bedrohungen zählen neben der Verwendung von QR-Codes, Deepfakes und synthetischen Medien. Die VIPRE Security Group, ein weltweit tätiges Unternehmen für Cybersicherheit, Datenschutz und Datensicherheit, stellt seinen jährlich erscheinenden Bericht zur E-Mail-Bedrohungslandschaft unter… First…
-
Hackers Mimic USPS To Deliver Malicious PDF In Attack Targeted Mobile Devices
Tags: attack, communications, credentials, cyber, hacker, malicious, mobile, phishing, service, social-engineering, tacticsIn a detailed analysis published on January 27, 2025, Zimperium’s zLabs team uncovered a sophisticated phishing campaign targeting mobile devices through malicious PDF files. Disguised as communications from the United States Postal Service (USPS), this campaign employs advanced social engineering and obfuscation tactics to steal user credentials and sensitive data. The campaign reportedly spans more…
-
Insurance companies can reduce risk with Attack Path Management
Tags: access, attack, backdoor, blueteam, breach, business, credentials, credit-card, data, identity, insurance, login, microsoft, network, risk, social-engineering, technology, threat, tool, vulnerabilityTL;DR Insurance companies host large amounts of sensitive data (PII, PHI, etc.) and often have complex environments due to M&A and divestitures Most breaches start with human error Fortune 500 companies rely on Microsoft Active Directory as a backbone for Identity and Access Management Attackers target Active Directory to move laterally and escalate privilege An Attack…
-
Hackers Deliver Ransomware on Windows Via Microsoft Teams Voice Calls
Sophos X-Ops’ Managed Detection and Response (MDR) team has uncovered two highly active threat actor clusters exploiting Microsoft Office 365 to target organizations. Identified as STAC5143 and STAC5777, these clusters use advanced social engineering tactics, such as email bombing, fake Microsoft Teams tech support calls, and misuse of Microsoft tools, like Quick Assist and Teams’…
-
25 on 2025: APAC security thought leaders share their predictions and aspirations
Tags: access, advisory, ai, api, attack, authentication, awareness, best-practice, breach, business, ciso, cloud, compliance, control, cryptography, csf, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, data-breach, deep-fake, detection, disinformation, encryption, endpoint, exploit, extortion, finance, framework, fraud, government, group, hacking, Hardware, identity, incident, incident response, infrastructure, injection, intelligence, international, iot, malicious, malware, microsoft, monitoring, network, nist, phishing, privacy, ransomware, regulation, resilience, risk, risk-management, scam, service, skills, social-engineering, software, spear-phishing, strategy, supply-chain, tactics, technology, threat, tool, training, update, vulnerability, warfare, zero-trustAs threat actors and security teams harness the growing potential of artificial intelligence (AI), who will prevail? From generative AI (GenAI) to agentic AI, we look through the lens of 25 of Asia-Pacific’s thought leaders in security and dive into their predictions and goals for the year. src=”https://b2b-contenthub.com/wp-content/uploads/2025/01/Athikom.jpg?quality=50&strip=all” alt=”athikom” loading=”lazy” width=”400px”>Athikom Kanchanavibhu Chief Information Security…
-
Life at SpecterOps Part II: From Dream to Reality
Tags: automation, conference, jobs, linkedin, open-source, RedTeam, social-engineering, software, tool, trainingTL;DR We are hiring consultants at various levels. The job posting can be found under the Consultant opening here: specterops.io/careers/#careers Introduction Hey, it’s me again! The last time we spoke back in August 2024, I told you all about life and some of the intangible benefits of working as a consultant at SpecterOps. In that…
-
Microsoft Teams vishing attacks trick employees into handing over remote access
Tags: access, attack, backdoor, control, credentials, cybercrime, data, detection, email, exploit, group, hacking, lockbit, malicious, malware, microsoft, monitoring, network, office, password, phishing, powershell, ransomware, russia, service, social-engineering, sophos, spam, tactics, threat, tool, vpn, windowsAttackers believed to be affiliated with ransomware groups have recently been observed using a technique in which they bombard employees with spam emails and then call them on Microsoft Teams posing as technical support representatives from their organizations.The goal of this formerly uncovered social engineering tactic is to create a sense of urgency and trick…
-
Gootloader Malware Employs Blackhat SEO Techniques To Attack Victims
The Gootloader malware family employs sophisticated social engineering tactics to infiltrate computers. By leveraging compromised legitimate WordPress websites, Gootloader’s operators manipulate Google search results to redirect users to a deceptive online message board. They link the malware to a simulated conversation featuring fictitious users, effectively answering the exact queries victims input into search engines. Investigate…
-
Scam Yourself attacks: How social engineering is evolving
We’ve entered a new era where verification must come before trust, and for good reason. Cyber threats are evolving rapidly, and one of the trends getting a fresh reboot in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/21/scam-yourself-attacks/
-
CERT-UA Warns of Cyber Scams Using Fake AnyDesk Requests for Fraudulent Security Audits
The Computer Emergency Response Team of Ukraine (CERT-UA) is warning of ongoing attempts by unknown threat actors to impersonate the cybersecurity agency by sending AnyDesk connection requests.The AnyDesk requests claim to be for conducting an audit to assess the “level of security,” CERT-UA added, cautioning organizations to be on the lookout for such social engineering…
-
Privacy Roundup: Week 3 of Year 2025
Tags: access, ai, android, apt, blockchain, breach, cctv, china, computer, cve, cyber, cybersecurity, data, detection, email, exploit, finance, firmware, github, google, group, guide, leak, malicious, malware, microsoft, phishing, privacy, regulation, router, scam, service, smishing, social-engineering, software, technology, threat, tool, update, virus, vulnerability, windowsThis is a news item roundup of privacy or privacy-related news items for 12 JAN 2025 – 18 JAN 2025. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things may overlap;…
-
Microsoft’s January 2025 Patch Tuesday Addresses 157 CVEs (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)
Tags: access, advisory, ai, attack, authentication, best-practice, cloud, cve, defense, email, exploit, flaw, framework, github, group, intelligence, Internet, malicious, marketplace, microsoft, mitigation, ntlm, office, rce, remote-code-execution, saas, service, social-engineering, software, technology, threat, update, vulnerability, windows, zero-day10Critical 147Important 0Moderate 0Low Microsoft addresses 157 CVEs in the first Patch Tuesday release of 2025 and the largest Patch Tuesday update ever with three CVEs exploited in the wild, and five CVEs publicly disclosed prior to patches being made available. Microsoft patched 157 CVEs in its January 2025 Patch Tuesday release, with 10 rated…
-
ScrapedIn: How Bots Turn Social Media into Advanced Social Engineering
See how multi-channel scams target new hires through fake texts and emails, and learn practical steps to protect your organization from persistent social engineering attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/scrapedin-how-bots-turn-social-media-into-advanced-social-engineering/
-
Hackers Using YouTube Links and Microsoft 365 Themes to Steal Logins
Cybercriminals are executing sophisticated phishing attacks targeting Microsoft 365 users by employing deceptive URLs that closely resemble legitimate O365 domains, creating a high degree of trust with unsuspecting victims. The attackers leverage social engineering tactics, often claiming imminent password expiration, to induce panic and pressure users into clicking malicious links. Upon clicking, users are redirected…
-
Phishing click rates tripled in 2024 despite user training
For years organizations have invested in security awareness training programs to teach employees how to spot and report phishing attempts. Despite those efforts, enterprise users were three times as likely in 2024 to land on phishing pages compared to the previous year, according to a report from security vendor Netskope.Based on telemetry collected from its…
-
Legitimate PoC exploited to spread information stealer
A recently copied and abused open source proof of concept (PoC) exploit from a reputable security company, aimed at helping threat researchers, is the latest example of the novel tactics hackers will use to spread malware.PoCs for known vulnerabilities are created to be shared by students, researchers, and IT pros to improve software and toughen…