Tag: social-engineering
-
FEMITBOT Network Exploits Telegram Mini Apps to Spread Crypto Scams and Android Malware
A large-scale fraud and malware operation called FEMITBOT that abuses Telegram Mini Apps to steal cryptocurrency and infect Android devices. The campaign shows how trusted in-app web experiences can be turned into powerful tools for social engineering and credential theft. Telegram Mini Apps are lightweight web applications that run inside Telegram, offering seamless login, payments,…
-
Supply-chain attacks take aim at your AI coding agents
Tags: advisory, ai, attack, business, control, cybersecurity, github, infrastructure, injection, LLM, malicious, programming, risk, skills, social-engineering, software, supply-chain, threat, toolUsing LLMs to trick LLMs: ReversingLabs’ researchers observed clear signs of vibe coding in the creation of these malicious components, including LLM-generated code comments. However, something else stood out: the level of detail in their README files and the way the documentaton boasted about how effective these packages were at performing their tasks.The researchers questioned…
-
Coreview warnt vor Microsoft-Helpdesk-Betrug
Cyberkriminelle nutzen immer häufiger Microsoft-Teams für ihre Zwecke. In jüngster Zeit häufen sich dabei vor allem Vorfälle, in denen sie sich als Mitarbeitende des IT-Supports ausgeben. Hierfür richten sie spezielle Chats mit vermeintlichen IT-Supportanfragen ein, um mittels Echtzeit-Social-Engineering Zugriff auf die Unternehmenssysteme zu erhalten. In aller Regel beginnt eine solche Attacke mit dem Missbrauch externer…
-
Code of Conduct Phish Hits 35,000 Users in Multi-Stage AiTM Attack
A highly sophisticated phishing campaign leveraging code-of-conduct-themed lures has targeted more than 35,000 users across 13,000 organizations. The multi-stage attack, observed between April 14 and April 16, 2026, highlights how threat actors are refining social engineering, delivery infrastructure, and authentication abuse to bypass modern defenses. The campaign primarily impacted users in the United States, accounting…
-
DigiCert breached via malicious screensaver file
A targeted social engineering attack against DigiCert’s support channel led to the compromise of internal systems and the unauthorized issuance of EV Code Signing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/04/digicert-breach-code-signing-certificates-malware/
-
Human-centric failures: Why BEC continues to work despite MFA
Tags: attack, authentication, awareness, banking, breach, business, cio, communications, compliance, control, credentials, cyber, cybersecurity, deep-fake, edr, email, endpoint, exploit, finance, fraud, governance, group, identity, mfa, monitoring, phishing, risk, scam, soc, social-engineering, technology, trainingtechnically compromised at all, which places these attacks outside the protection boundary of MFA controls.In 2019, Toyota Boshoku Corporation fell to a BEC attack with an employee transferring over $30m to scammers following a cloned email from a 3rd party company with urgency citing the need for the transaction to be completed urgently so as…
-
China Has its Sights Set on Scammers, Just Not Those Targeting Americans
A new report from the U.S.-China Economic and Security Review Commission reveals that while China is aggressively prosecuting fraud targeting its own citizens, it continues to turn a blind eye to industrial-scale scam centers victimizing Americans. This selective enforcement has incentivized Chinese criminal syndicates to pivot toward U.S. targets, resulting in over $10 billion in…
-
Lazarus Targets macOS Users With New “Mach-O Man” Malware Kit
Tags: access, corporate, credentials, crypto, cyber, fintech, group, intelligence, lazarus, macOS, malware, social-engineering, threatLazarus Group is abusing “ClickFix” social engineering to push a new macOS malware kit dubbed “Mach-O Man,” giving attackers a direct path to credentials, Keychain secrets, and corporate access in fintech and crypto environments. This research is authored by Mauro Eldritch, an offensive security expert and founder of BCA LTD, a company focused on threat intelligence and…
-
BlueNoroff Deploys Fileless PowerShell in AI-Generated Zoom Lure Campaign
A sophisticated BlueNoroff campaign targeting cryptocurrency executives through fake Zoom meetings enhanced with AI-generated deepfakes and fileless PowerShell malware. The North Korean state-sponsored group successfully compromised a North American Web3 company in January 2026, maintaining persistent access for 66 days through entirely memory-resident attacks. The campaign begins with social engineering through Calendly invitations that contain…
-
Germany Caught Up in Likely Russian Signal Phishing
Governments Have Long Warned About Kremlin Social Engineering Hacks. Signal is defending the security of its systems following a series of phishing attacks that took place on the encrypted messaging platform, and that reportedly compromised members of the German government including the president of the country’s parliament. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/germany-caught-up-in-likely-russian-signal-phishing-a-31535
-
North Korea-linked actor targets Web3 execs in social-engineering campaign
Founders and other top executives were compromised to gain access to crypto wallets. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/north-korea-web3-execs-social-engineering-hacker/818639/
-
North Korea-linked actor targets Web3 execs in social-engineering campaign
Founders and other top executives were compromised to gain access to crypto wallets. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/north-korea-web3-execs-social-engineering-hacker/818639/
-
Arctic Wolf deckt BlueNoroff-Kampagne mit gefälschten Zoom-Meetings auf
Arctic Wolf Labs hat eine gezielte Angriffskampagne identifiziert, hinter der mit hoher Wahrscheinlichkeit die Gruppe BlueNoroff, eine finanziell motivierte Subgruppierung des Lazarus-Kollektivs mit Verbindungen nach Nordkorea, steht. Ziel war ein nordamerikanisches Web3-/Kryptounternehmen. Die Kampagne macht deutlich, dass Angreifer zunehmend mehrstufige Social-Engineering-Techniken nutzen und dabei gezielt auf glaubwürdige Interaktionen setzen. Die Analyse zeigt eine mehrstufige Angriffskette,…
-
Arctic Wolf deckt BlueNoroff-Kampagne mit gefälschten Zoom-Meetings auf
Arctic Wolf Labs hat eine gezielte Angriffskampagne identifiziert, hinter der mit hoher Wahrscheinlichkeit die Gruppe BlueNoroff, eine finanziell motivierte Subgruppierung des Lazarus-Kollektivs mit Verbindungen nach Nordkorea, steht. Ziel war ein nordamerikanisches Web3-/Kryptounternehmen. Die Kampagne macht deutlich, dass Angreifer zunehmend mehrstufige Social-Engineering-Techniken nutzen und dabei gezielt auf glaubwürdige Interaktionen setzen. Die Analyse zeigt eine mehrstufige Angriffskette,…
-
Crypto-Targeting North Koreans Wield Fake Zoom Meetings
Video of Industry Figures Harvested During Meetings and Used to Lure Future Victims. North Korean hackers are pretending to be cryptocurrency insiders, in an attempt to trick targets into accepting Calendly calendar invites. The social engineering ruse is designed to infect Windows and macOS systems with crypto stealers, and to harvest video of real-life people…
-
UNC6692 Combines Social Engineering, Malware, Cloud Abuse
A newly discovered threat actor is using Microsoft Teams, AWS S3 buckets, and custom Snow malware in a multipronged campaign. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/unc6692-social-engineering-malware-cloud-abuse
-
Industrialisierte Geldwäsche: ‘Mule-Account-Fabriken”
Kriminelle missbrauchen die Identitäten von Bürgern, um systematisch verifizierte Bankkonten für Geldwäsche zu erstellen und für bis zu 700 US-Dollar im Darknet zu verkaufen. Durch den Einsatz von SIM-Modem-Farms und perfidem Social Engineering bei der KYC-Prüfung hebelt die Masche herkömmliche Sicherheitsmechanismen aus. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/industrie-geldwaesche
-
Threat actor uses Microsoft Teams to deploy new “Snow” malware
A threat group tracked as UNC6692 uses social engineering to deploy a new, custom malware suite named ‘Snow’ which includes a browser extension, a tunneler, and a backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/threat-actor-uses-microsoft-teams-to-deploy-new-snow-malware/
-
UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware
A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.”As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT help desk employees, convincing their victim to accept a Microsoft Teams chat invitation from…
-
Hackers Impersonate IT Helpdesk Staff to Breach Firms via Microsoft Teams
A newly identified cyber threat group, UNC6692, is using a clever mix of social engineering and custom malware to infiltrate corporate networks. By impersonating IT helpdesk personnel on Microsoft Teams, these hackers trick employees into downloading a sophisticated malware suite that steals sensitive company data. The Social Engineering Trap The attack begins with an aggressive…
-
UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware
A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.”As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk employees, convincing their victim to accept a Microsoft Teams chat invitation from an…
-
Regular Password Resets Aren’t as Safe as You Think
Password resets are one of the easiest ways for attackers to bypass security controls. Specops Software shows how helpdesk social engineering turns a seemingly legitimate reset request into full account compromise. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/regular-password-resets-arent-as-safe-as-you-think/
-
With AI’s help, North Korean hackers stumbled into a near-undetectable attack
For many years, state-sponsored hacking was defined by human expertise in finding security holes, writing malware and exploits, pulling off social engineering and phishing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/23/hexagonalrodent-north-korean-hackers-targeting-developers/
-
Malware-Kit Venom Stealer hebt ClickFix-Angriffe auf ein neues Niveau
Der Ansatz: Das Opfer wird durch geschickte Social-Engineering-Methoden dazu gebracht, einen bereitgestellten Befehl in die Zwischenablage zu kopieren… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/malware-kit-venom-stealer-hebt-clickfix-angriffe-auf-ein-neues-niveau/a44750/
-
Microsoft spots Sapphire Sleet macOS attack using AppleScript and social engineering
Tags: attack, cyber, exploit, flaw, macOS, microsoft, north-korea, social-engineering, software, threat, vulnerabilityA new macOS-focused cyber campaign linked to the North Korean threat actor Sapphire Sleet, highlighting how attackers are increasingly relying on social engineering rather than software vulnerabilities to compromise systems. Rather than exploiting security flaws, the attackers manipulate user trust, allowing them to bypass built-in macOS protections. The attack begins with carefully crafted social engineering…
-
Top techniques attackers use to infiltrate your systems today
Tags: 2fa, access, ai, api, attack, authentication, automation, business, captcha, cloud, container, control, corporate, credentials, cybercrime, cybersecurity, data, deep-fake, defense, detection, email, exploit, flaw, hacking, Hardware, identity, infrastructure, least-privilege, malicious, mfa, microsoft, monitoring, network, password, phishing, powershell, ransomware, risk, saas, scam, service, social-engineering, software, supply-chain, theft, tool, training, vpn, vulnerability, wormNetwork security device hacking: Network edge devices have increasingly drawn attackers’ attention over the past two years, establishing a new battleground where the very devices meant to protect the network have become attractive targets for exploitation.As a result, flaws in security device, such as SSL VPN systems and other gateways, are among the top initial…
-
North Korea-Linked UNC1069 Hacks Crypto Pros via Fake Meetings
North Korea-linked threat actor UNC1069 is running a highly targeted campaign that abuses fake Zoom, Google Meet, and Microsoft Teams meetings to compromise cryptocurrency and Web3 professionals across Windows, macOS, and Linux systems. The goal is long-term access and large-scale theft of digital assets through stealthy social engineering and multi-stage malware deployment. Attackers often hijack…
-
North Korean social engineering campaign targets macOS users
A MacOS-focused social engineering campaign orchestrated by North Korea-based threat actor Sapphire Sleet has been exposed by Microsoft’s Threat Intelligence Unit. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366641953/North-Korean-social-engineering-campaign-targets-macOS-users
-
The Cyber Express Weekly Roundup: Crypto Breaches, State-Linked Schemes, and Platform Exploits
Tags: attack, breach, crypto, cyber, cybercrime, cybersecurity, exploit, fraud, infrastructure, social-engineering, threatIn this week’s weekly roundup, The Cyber Express reviews major developments across the cybersecurity domain. highlighting incidents involving crypto ecosystem attacks, state-linked fraud operations, regulatory scrutiny, and underground cybercrime activity. The broader threat landscape continues to show attackers targeting infrastructure weaknesses, social engineering pathways, and third-party dependencies rather than isolated technical flaws. First seen on thecyberexpress.com…
-
Fake Zoom SDK Update Spreads Sapphire Sleet Malware in New macOS Attack Chain
Tags: apple, attack, cyber, macOS, malicious, malware, north-korea, social-engineering, software, threat, update, vulnerabilityA sophisticated macOS-focused cyber campaign orchestrated by the North Korean threat actor Sapphire Sleet, revealing a shift toward social engineering over traditional software exploitation. Instead of relying on vulnerabilities, the attackers trick users into executing malicious files disguised as legitimate software updates, effectively bypassing Apple’s built-in security protections. The campaign centers on a fake file…