Tag: social-engineering
-
Social-Engineering-Angriffe auf Basis künstlicher Intelligenz gewinnen rasant an Bedeutung
Künstliche Intelligenz verändert die Bedrohungslandschaft grundlegend, besonders im Bereich Social-Engineering. Was früher oft an auffälligen Rechtschreibfehlern, unnatürlichen Formulierungen oder erkennbaren Manipulationen zu durchschauen war, wirkt heute professionell, individuell zugeschnitten und nahezu fehlerfrei. Texte, Stimmen und sogar Videos lassen sich innerhalb weniger Minuten täuschend echt erstellen. Das macht betrügerische Kontaktaufnahmen glaubwürdiger und erhöht das Risiko für…
-
Rogues gallery: 15 worst ransomware groups active today
Tags: access, ai, alphv, apt, attack, backup, breach, cloud, cyber, cybercrime, dark-web, data, data-breach, defense, detection, email, encryption, endpoint, exploit, extortion, finance, government, group, healthcare, infrastructure, insurance, intelligence, korea, law, leak, linux, lockbit, malicious, malware, moveIT, network, north-korea, organized, phishing, ransom, ransomware, russia, service, social-engineering, software, strategy, threat, tool, usa, vmware, vpn, vulnerability, windows, zero-dayBlack Basta: History: Black Basta appeared on the ransomware scene in early 2022 and is believed to be a spin-off from Conti, a group notorious for attacking major organizations.How it works: Black Basta usually deploys malware through exploitation of known vulnerabilities and social engineering campaigns. “Employees in the target environment are email bombed and then…
-
Fake Claude Code install guides push infostealers in InstallFix attacks
Threat actors are employing a new variation of the ClickFix social engineering technique called InstallFix to convince users into running malicious commands under the pretext of installing legitimate command line interface (CLI) tools. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-claude-code-install-guides-push-infostealers-in-installfix-attacks/
-
Microsoft warns of ClickFix campaign exploiting Windows Terminal to deliver Lumma Stealer
Microsoft warns of ClickFix campaign using Windows Terminal to deliver Lumma Stealer via social engineering attacks. Microsoft revealed a new ClickFix campaign where attackers exploit Windows Terminal to run a complex attack chain, ultimately deploying Lumma Stealer malware. The campaign uses social engineering to trick users into executing malicious commands, highlighting growing risks to Windows…
-
RMM Tools Crucial for IT Operations, But Growing Threat as Attackers Weaponize Them
Threat actors are increasingly weaponizing trusted administrative software to bypass security defenses. By exploiting legitimate software, cybercriminals gain persistent, hands-on-keyboard (HOK) access while hiding within normal network activity. Initial Access and Attack Methods RMM compromises typically begin with targeted social engineering and phishing campaigns. Attackers trick employees into downloading a malicious RMM agent disguised as…
-
Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer
Microsoft on Thursday disclosed details of a new widespread ClickFix social engineering campaign that has leveraged the Windows Terminal app as a way to activate a sophisticated attack chain and deploy the Lumma Stealer malware.The activity, observed in February 2026, makes use of the terminal emulator program instead of instructing users to launch the Windows…
-
2026 Browser Data Reveals Major Enterprise Security Blind Spots
The browser is becoming the operating system for modern work, yet many enterprises still treat it as an extension of network or endpoint security. Keep Aware’s 2026 State of Browser Security Report shows 41% of employees used AI web tools while browser-based phishing, extensions, and social engineering drive new security blind spots. First seen on…
-
ClickFix Campaign Exploits Fake LinkedIn VCs to Spread Malware Among Crypto and Web3 Experts
A highly coordinated malware campaign that targets cryptocurrency and Web3 professionals through fake venture capital (VC) identities on LinkedIn. The operation combines advanced social engineering with cross-platform payloads and a ClickFix-style fake CAPTCHA flow that tricks users into running malicious commands on their own systems. Attackers pose as executives from fictitious funds such as SolidBit…
-
ClickFix Campaign Exploits Fake LinkedIn VCs to Spread Malware Among Crypto and Web3 Experts
A highly coordinated malware campaign that targets cryptocurrency and Web3 professionals through fake venture capital (VC) identities on LinkedIn. The operation combines advanced social engineering with cross-platform payloads and a ClickFix-style fake CAPTCHA flow that tricks users into running malicious commands on their own systems. Attackers pose as executives from fictitious funds such as SolidBit…
-
Invisible Threats: Source Code Exfiltration in Google Antigravity FireTail Blog
Mar 04, 2026 – Viktor Markopoulos – Invisible Threats: Source Code Exfiltration in Google Antigravity”TL;DR: We explored a known issue in Google Antigravity where attackers can silently exfiltrate proprietary source codeBy hiding malicious instructions inside seemingly empty C++ comments, threat actors can force the AI assistant to package up the developer’s code and send it to…
-
Ransomware auf Speed ist die große Herausforderung für CISOs
Künstliche Intelligenz (KI) verändert die Cyberbedrohungslandschaft nicht durch völlig neue Angriffsarten, sondern durch Skalierung, Geschwindigkeit und Präzision. Das bestätigen die Ergebnisse des jüngsten <>. Sie automatisieren bekannte Methoden wie Phishing oder Social-Engineering und passen sie in Echtzeit an. In Folge stehen Unternehmen vor einer neuen Realität, […] First seen on netzpalaver.de Jump to article: netzpalaver.de/2026/03/03/ransomware-auf-speed-ist-die-grosse-herausforderung-fuer-cisos/
-
Operation Epic Fury: Potential Iranian Cyber Counteroffensive Operations
Tags: access, attack, botnet, credentials, cyber, data, ddos, defense, espionage, exploit, government, group, infrastructure, intelligence, Internet, iran, leak, malware, military, monitoring, ransomware, service, social-engineering, technology, theft, threat, tool, update, vulnerabilityFollowing the joint military operation known as Operation Epic Fury, the Tenable Research Special Operations (RSO) team is providing an update regarding potential cyber counteroffensive operations conducted by Iran-linked threat actors. Key takeaways: Following Operation Epic Fury, Iran-linked threat actors are expected to launch counteroffensive operations against critical infrastructure and opportunistic targets. Several Iranian-linked threat…
-
Why Cyber Attackers Benefit More from AI Technology than Defenders
Tags: ai, attack, cyber, cybersecurity, defense, offense, risk, social-engineering, technology, tool, vulnerabilityAI is transforming both cyber offense and defense, but the attackers hold distinct advantages. AI tools can be used for attacks and defense but the attackers are less concerned with quality or problems. They can use risky or unvetted technology with impunity as they aren’t overly concerned if it causes harm. The result is they…
-
Dust Specter APT Targets Government Officials in Iraq
Tags: access, ai, api, apt, attack, backdoor, browser, chrome, cisco, cloud, control, data, detection, encryption, google, government, group, infrastructure, iran, iraq, malicious, malware, monitoring, network, open-source, password, powershell, rat, service, social-engineering, software, threat, tool, update, windowsIntroductionIn January 2026, Zscaler ThreatLabz observed activity by a suspected Iran-nexus threat actor targeting government officials in Iraq. ThreatLabz discovered previously undocumented malware including SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM. Due to significant overlap in tools, techniques, and procedures (TTPs), as well as victimology, between this campaign and activity associated with Iran-nexus APT groups, ThreatLabz assesses with medium-to-high confidence that an…
-
Innovation without exposure: A CISO’s secure-by-design framework for business outcomes
Tags: ai, authentication, awareness, business, chatgpt, cisa, ciso, cloud, control, cyber, cybersecurity, data, detection, firmware, framework, fraud, governance, identity, injection, iot, law, leak, LLM, metric, mitre, network, nist, offense, radius, RedTeam, resilience, risk, risk-management, service, social-engineering, threat, tool, unauthorized, updateA detection engineer owning “detection as code” patterns and test harnessesA threat hunter owning telemetry quality improvements and query optimizationAn incident responder owning tabletop iterations and runbook hardeningA cloud security lead owning guardrailed landing zone enhancementsThe critical constraint is this: every experiment needs an exit plan. Either it becomes a supported capability, or it is…
-
Emerging Global Threat Landscape: A 7-Day Intelligence Analysis for Modern SOCs
Tags: ai, credentials, cyber, exploit, infrastructure, intelligence, soc, social-engineering, strategy, threatExecutive Overview The pace and sophistication of cyber threats continue to accelerate. Over the past seven days alone, multiple high-impact campaigns have targeted enterprise recovery systems, telecommunications infrastructure, academic institutions, and developer ecosystems. These incidents are not isolated. They represent coordinated shifts in attacker strategy toward infrastructure-level compromise, credential exploitation, AI-powered social engineering, and supply…
-
Social Engineering: Berüchtigte Hackergruppe sucht Frauen fürs Team
Die Cybergang Scattered Lapsus$ Hunters will offenbar beim Voice-Phishing effektiver werden. Weibliche Stimmen sollen dabei helfen. First seen on golem.de Jump to article: www.golem.de/news/social-engineering-beruechtigte-hackergruppe-sucht-frauen-fuers-team-2602-205927.html
-
Social Engineering: Berüchtigte Hackergruppe sucht Frauen fürs Team
Die Cybergang Scattered Lapsus$ Hunters will offenbar beim Voice-Phishing effektiver werden. Weibliche Stimmen sollen dabei helfen. First seen on golem.de Jump to article: www.golem.de/news/social-engineering-beruechtigte-hackergruppe-sucht-frauen-fuers-team-2602-205927.html
-
APT37 Adds New Capabilities for Air-Gapped Networks
Tags: access, android, api, attack, authentication, backdoor, cloud, communications, computer, credentials, data, detection, endpoint, google, government, group, Hardware, infection, infrastructure, injection, Internet, malicious, malware, microsoft, monitoring, network, north-korea, powershell, service, social-engineering, threat, tool, update, windowsIntroductionIn December 2025, Zscaler ThreatLabz discovered a campaign linked to APT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima), which is a DPRK-backed threat group. In this campaign, tracked as Ruby Jumper by ThreatLabz, APT37 uses Windows shortcut (LNK) files to initiate an attack that utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK,…
-
APT37 Adds New Capabilities for Air-Gapped Networks
Tags: access, android, api, attack, authentication, backdoor, cloud, communications, computer, credentials, data, detection, endpoint, google, government, group, Hardware, infection, infrastructure, injection, Internet, malicious, malware, microsoft, monitoring, network, north-korea, powershell, service, social-engineering, threat, tool, update, windowsIntroductionIn December 2025, Zscaler ThreatLabz discovered a campaign linked to APT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima), which is a DPRK-backed threat group. In this campaign, tracked as Ruby Jumper by ThreatLabz, APT37 uses Windows shortcut (LNK) files to initiate an attack that utilizes a set of newly discovered tools. These tools, RESTLEAF, SNAKEDROPPER, THUMBSBD, and VIRUSTASK,…
-
Nordkoreanische Hacker locken Entwickler mit FakeInterviews
Das nordkoreanische Hacker gerne einmal versuchen sich selbst als Entwickler anheuern zu lassen, um Unternehmen auszuspionieren ist inzwischen nichts neues mehr. Was aber neu ist, ist, dass sie versuchen Entwickler als Trittbrett auszunutzen. Nach Angaben von Forschern von Recorded Future nehmen sie ebenfalls gezielt Softwareentwickler mit Social-Engineering-Taktiken ins Visier. Eine als ‘PurpleBravo” bezeichnete Gruppe setzt…
-
Scattered Lapsus$ Hunters auditioning female voices to sharpen social engineering
Tags: social-engineeringTelegram posts promise up to $1,000 per call as gang refines IT helpdesk ruse First seen on theregister.com Jump to article: www.theregister.com/2026/02/26/scattered_lapsus_hunters_female_recruits/
-
SLH Offers $500$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks
The notorious cybercrime collective known as Scattered LAPSUS$ Hunters (SLH) has been observed offering financial incentives to recruit women to pull off social engineering attacks.The idea is to hire them for voice phishing campaigns targeting IT help desks, Dataminr said in a new threat brief. The group is said to be offering anywhere between $500…
-
Cyber defense: From reactive to proactive
Tags: access, ai, attack, automation, business, cloud, control, corporate, cyber, cybercrime, cybersecurity, data, deep-fake, defense, detection, endpoint, google, infrastructure, intelligence, malware, microsoft, monitoring, phishing, ransomware, resilience, risk, service, social-engineering, threat“It’s a cat-and-mouse situation. AI is changing the speed and sophistication of attacks, and AI is making phishing and social engineering attacks, thanks to deep fakes, harder to detect,” said Kevin McCall, director, cybersecurity, risk, and regulatory at PwC US, speaking during a webcast titled, “From Risk to Resilience: Building a Smarter Cloud Security Strategy.”McCall…
-
UAC-0050 Targets European Financial Institution With Spoofed Domain and RMS Malware
A Russia-aligned threat actor has been observed targeting a European financial institution as part of a social engineering attack to likely facilitate intelligence gathering or financial theft, signaling a possible expansion of the threat actor’s targeting beyond Ukraine and into entities supporting the war-torn nation.The activity, which targeted an unnamed entity involved in regional First…
-
Malicious OpenClaw Tactics Deceive Users into Manual Password Entry for AMOS Infection
Malicious OpenClaw skills are being weaponized to coerce users into manually entering their passwords, enabling a new Atomic (AMOS) Stealer infection chain that abuses AI agent workflows as a social engineering channel. TrendAI Research has tracked Atomic (AMOS) Stealer’s evolution from crude “cracked” macOS software lures to a refined supply chain attack abusing OpenClaw’s skill…
-
AI is becoming part of everyday criminal workflows
Underground forums include long threads about chatbots drafting phishing emails, generating code snippets, and coaching social engineering calls. A new study examined … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/24/ai-in-cybercrime-research/
-
Hacker stiehlt Daten von Tausenden RTL-Mitarbeitern
Ein Hacker hat sich Zugriff auf Mitarbeiterdaten von RTL verschafft.Die RTL Group wurde offenbar Opfer einer Cyberattacke. Wie Cybernews berichtet, brüstet sich ein Cyberkrimineller namens LuneBF mit gestohlenen Daten von mehr als 27.000 Mitarbeitern der Mediengruppe. In seinem Darknet-Post behauptet der Angreifer, sich Zugriff auf die Intranet-Website der RTL Group verschafft zu haben.Als Beweis für…
-
13 ways attackers use generative AI to exploit your systems
Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-dayFacilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
-
13 ways attackers use generative AI to exploit your systems
Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-dayFacilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…