Tag: social-engineering
-
April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs
Tags: access, ai, attack, business, ciso, cloud, cve, cvss, cyber, data, exploit, firewall, flaw, identity, injection, international, ivanti, LLM, malware, microsoft, network, remote-code-execution, sap, social-engineering, software, sql, threat, tool, unauthorized, update, vulnerability, windows, zero-dayblock inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.Breen said that…
-
April Patch Tuesday roundup: Zero day vulnerabilities and critical bugs
Tags: access, ai, attack, business, ciso, cloud, cve, cvss, cyber, data, exploit, firewall, flaw, identity, injection, international, ivanti, LLM, malware, microsoft, network, remote-code-execution, sap, social-engineering, software, sql, threat, tool, unauthorized, update, vulnerability, windows, zero-dayblock inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE;for systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.Microsoft noted that these actions reduce the attack surface, but don’t replace installing the security update.Breen said that…
-
North Korea targets macOS users in latest heist
Social engineering: ‘low-cost, hard to patch, and scales well’ First seen on theregister.com Jump to article: www.theregister.com/2026/04/16/north_korea_social_engineering_macos/
-
New ATHR vishing platform uses AI voice agents for automated attacks
A new cybercrime platform called ATHR can harvest credentials via fully automated voice phishing attacks that use both human operators and AI agents for the social engineering phase. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-athr-vishing-platform-uses-ai-voice-agents-for-automated-attacks/
-
Black Basta’s playbook lives on as former affiliates launch fast-scale intrusion campaign
Tags: social-engineeringThe social engineering campaign spiked last month and has targeted dozens of organizations since May 2025, according to ReliaQuest. First seen on cyberscoop.com Jump to article: cyberscoop.com/black-basta-affiliates-senior-executives-reliaquest/
-
Okta Under Attack as Hackers Skip Phishing for Identity Systems
Hackers are shifting away from email phishing and are directly targeting Okta and other identity providers using voice”‘based social engineering, or “Okta vishing.” This trend turns what used to be a single account compromise into an immediate, organization”‘wide cloud data breach via Single Sign-On (SSO). Instead of sending links, they stay on the phone and…
-
Scheinunternehmen für Social-Engineering-Kampagne – Wie Fake-Startups systematisch Krypto-Wallets plündern
First seen on security-insider.de Jump to article: www.security-insider.de/fake-startups-social-engineering-krypto-wallets-a-4b69b8f7d0e7419def87227920571649/
-
North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware
The North Korean hacking group tracked as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat actors approached targets on Facebook and added them as friends on the social media platform, turning the trust-building exercise into a delivery channel for a remote access trojan called RokRAT.”The threat actor…
-
APT37 Uses Facebook, Telegram, and Trojanzied Installer in New Targeted Cyberattack
APT37 is running a new targeted intrusion campaign that abuses Facebook, Telegram, and a tampered Wondershare PDFelement installer to gain stealthy access and exfiltrate sensitive data, likely from defense”‘related targets. The operation shows a continued evolution of APT37’s social engineering and evasion tradecraft, and demands behavior”‘based EDR capable of spotting process injection, abused cloud storage,…
-
UNC6783 Hackers Use Fake Okta Pages in Corporate Breach Campaign
UNC6783 hackers and extortionists impersonate support staff, using fake Okta login pages and social engineering to access corporate systems and steal sensitive data. First seen on hackread.com Jump to article: hackread.com/unc6783-hackers-fake-okta-pages-corporate-breach/
-
Axios Attack Shows How Complex Social Engineering Is Industrialized
The attack on the popular NPM package Axios is just one of many targeting maintainers and has shone a light on how threat actors can scale sophisticated social engineering campaigns. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/axios-attack-complex-social-engineering-industrialized
-
ClickFix Campaign Abuses macOS Script Editor to Deploy Atomic Stealer
A refreshed ClickFix campaign that swaps macOS Terminal for Script Editor to deliver an Atomic Stealer payload to unsuspecting Mac users quietly. By abusing the applescript:// URL scheme, attackers sidestep Apple’s new paste-protection in Terminal on macOS Tahoe 26.4 while preserving the same underlying “click-to-fix” social engineering pattern. Traditional ClickFix chains rely on fake support or “system cleanup” pages…
-
Linux Foundation Leader Impersonated in Slack Attack on Open Source Developers
A social engineering campaign is actively targeting open source developers through Slack. The warning was shared through the OpenSSF Siren mailing list, a public threat intelligence platform designed to alert developers and security teams about active threats after initial disclosure. The advisory was authored by Christopher “CRob” Robinson, CTO and Chief Security Architect at OpenSSF.…
-
Social engineering attacks on open source developers are escalating
North Korean hackers spent weeks socially engineering an Axios maintainer through a fake Slack workspace, a cloned company identity, and a fabricated Microsoft Teams call that … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/08/social-engineering-open-source-developers/
-
5 practical steps to strengthen attack resilience with attack surface management
Tags: access, api, attack, authentication, automation, backup, breach, business, cloud, container, control, credentials, cvss, cyber, cybersecurity, data, data-breach, detection, dns, email, endpoint, exploit, framework, government, identity, iot, malicious, monitoring, msp, network, nist, phishing, ransomware, resilience, risk, service, social-engineering, software, threat, tool, update, vpn, vulnerability, vulnerability-management, windowsWhat can attackers actually reach right now? By continuously identifying and prioritizing exposure across your environment, ASM transforms raw visibility into measurable cyber resilience.Below are five practical steps security teams can take to strengthen attack resilience using attack surface management principles. Effective attack surface management starts with complete visibility. Security gaps often appear because teams…
-
5 practical steps to strengthen attack resilience with attack surface management
Tags: access, api, attack, authentication, automation, backup, breach, business, cloud, container, control, credentials, cvss, cyber, cybersecurity, data, data-breach, detection, dns, email, endpoint, exploit, framework, government, identity, iot, malicious, monitoring, msp, network, nist, phishing, ransomware, resilience, risk, service, social-engineering, software, threat, tool, update, vpn, vulnerability, vulnerability-management, windowsWhat can attackers actually reach right now? By continuously identifying and prioritizing exposure across your environment, ASM transforms raw visibility into measurable cyber resilience.Below are five practical steps security teams can take to strengthen attack resilience using attack surface management principles. Effective attack surface management starts with complete visibility. Security gaps often appear because teams…
-
5 practical steps to strengthen attack resilience with attack surface management
Tags: access, api, attack, authentication, automation, backup, breach, business, cloud, container, control, credentials, cvss, cyber, cybersecurity, data, data-breach, detection, dns, email, endpoint, exploit, framework, government, identity, iot, malicious, monitoring, msp, network, nist, phishing, ransomware, resilience, risk, service, social-engineering, software, threat, tool, update, vpn, vulnerability, vulnerability-management, windowsWhat can attackers actually reach right now? By continuously identifying and prioritizing exposure across your environment, ASM transforms raw visibility into measurable cyber resilience.Below are five practical steps security teams can take to strengthen attack resilience using attack surface management principles. Effective attack surface management starts with complete visibility. Security gaps often appear because teams…
-
Axios Attack Shows Complex Social Engineering Is Industrialized
The attack on the popular NPM package Axios is just one of many targeting maintainers and has shone a light on how threat actors can scale sophisticated social engineering campaigns. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/axios-attack-complex-social-engineering-industrialized
-
Axios Attack Shows Complex Social Engineering Is Industrialized
The attack on the popular NPM package Axios is just one of many targeting maintainers and has shone a light on how threat actors can scale sophisticated social engineering campaigns. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/axios-attack-complex-social-engineering-industrialized
-
Axios Attack Shows Complex Social Engineering Is Industrialized
The attack on the popular NPM package Axios is just one of many targeting maintainers and has shone a light on how threat actors can scale sophisticated social engineering campaigns. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/axios-attack-complex-social-engineering-industrialized
-
Threat cluster launches extortion campaign using social engineering
Researchers said the hackers are compromising business process outsourcers and targeting help desk support. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/threat-actor-social-engineering-raccoon-persona/816804/
-
Threat Actors Exploit LogMeIn Resolve, ScreenConnect in Phishing Campaigns
Tags: cyber, detection, exploit, malicious, monitoring, phishing, social-engineering, sophos, threat, toolThreat actors are abusing legitimate remote monitoring and management (RMM) tools LogMeIn Resolve and ScreenConnect in a multi”‘stage phishing campaign that blends social engineering, living”‘off”‘the”‘land techniques, and stealthy information”‘stealing malware. Sophos’ Managed Detection and Response (MDR) teams first saw this activity in April 2025, with most malicious activity clustered in OctoberNovember 2025. More than 80…
-
Axios Attack Shows Social Complex Engineering Is Industrialized
The attack on the popular NPM package Axios is just one of many targeting maintainers and has shone a light on how threat actors can scale sophisticated social engineering campaigns. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/axios-attack-complex-social-engineering-industrialized
-
Best of the Worst: The Week Your Security Tools Became the Disguise
Tags: ai, antivirus, attack, authentication, cisco, control, credentials, crime, detection, dkim, dmarc, email, finance, fraud, google, infrastructure, intelligence, Internet, malicious, malware, microsoft, phishing, phone, risk, social-engineering, software, technology, threat, tool, training<div cla TL;DR This week’s Attack of the Day posts revealed a clear pattern: attackers are deliberately routing attacks through legitimate security and platform infrastructure so the tools themselves become trust signals. TitanHQ and Cisco URL wrappers hid a malware payload. Microsoft Safe Links rewrote a phishing URL to look protected. Microsoft Bookings sent a…
-
Hims & Hers says limited data stolen in social engineering attack
The telehealth provider said hackers gained access to a third-party customer service platform, but medical records remained secure. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/hims-hers-data-stolen-social-engineering/816707/
-
North Korean Hackers Pose as Trading Firm to Steal $285M from Drift
North Korean hackers (UNC4736) posed as a trading firm for six months to infiltrate Drift Protocol, using social engineering tactics to steal $285M without suspicion. First seen on hackread.com Jump to article: hackread.com/north-korean-hackers-trading-firm-drift-protocol/
-
Threat Actors Weaponize Fake Microsoft Teams Domains to Target Users
Threat actors associated with North Korea are deploying fake Microsoft Teams domains to conduct social engineering attacks and distribute malware. The threat group, identified as UNC1069, uses convincing meeting lures and compromised communication channels to target unsuspecting professionals. UNC1069 is a financially motivated threat actor linked to the Democratic People’s Republic of Korea (DPRK). On…
-
$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation
Drift has revealed that the April 1, 2026, attack that led to the theft of $285 million was the culmination of a months-long targeted and meticulously planned social engineering operation undertaken by the Democratic People’s Republic of Korea (DPRK) that began in the fall of 2025.The Solana-based decentralized exchange described it as “an attack six…
-
Social Engineering: Hacker nehmen Open-Source-Maintainer ins Visier
Der Social-Engineering-Angriff auf den Axios-Maintainer ist Teil einer Kampagne. Andere Maintainer wurden ebenfalls attackiert. First seen on golem.de Jump to article: www.golem.de/news/social-engineering-hacker-nehmen-open-source-maintainer-ins-visier-2604-207252.html
-
Axios npm hack used fake Teams error fix to hijack maintainer account
The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its developers was targeted by a social engineering campaign believed to have been conducted by North Korean threat actors. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/axios-npm-hack-used-fake-teams-error-fix-to-hijack-maintainer-account/