Security Affairs

NOVEMBER 29, 2024

Phishing tool Rockstar 2FA targets Microsoft 365 credentials, it uses adversary-in-the-middle (AitM) attacks to bypass multi-factor authentication. Trustwave researchers are monitoring malicious activity associated with Phishing-as-a-Service (PaaS) platforms, their latest report focuses on a toolkit called Rockstar 2FA.

Phishing 113

Phishing Accountability Authentication Advertising 113

Security Affairs

JANUARY 16, 2025

The Russian group Star Blizzard targets WhatsApp accounts in a new spear-phishing campaign, shifting tactics to avoid detection. In November 2024, Microsoft researchers observed the Russia-linked APT group Star Blizzard targeting WhatsApp accounts via spear-phishing, shifting tactics to avoid detection.

Accountability 123

Accountability Phishing Government Hacking 123

Krebs on Security

MARCH 14, 2025

In November 2024, KrebsOnSecurity reported that hundreds of hotels that use booking.com had been subject to targeted phishing attacks. Some of those lures worked, and allowed thieves to gain control over booking.com accounts. An alert (PDF) released in October 2024 by the U.S. Source: Sekoia.

Phishing 285

Phishing Malware Scams Passwords 285

Security Affairs

NOVEMBER 4, 2024

for phishing scams that stole millions by hacking email accounts. A Nigerian national was sentenced to 26 years in prison in the US for stealing millions by compromising the email accounts of real estate businesses. for phishing scams that resulted in the compromise of millions of email accounts.

Scams 124

Scams Phishing Identity Theft Accountability 124

Malwarebytes

FEBRUARY 11, 2025

There are plenty of phish in the sea, and the latest ones have little interest in your email inbox. In 2024, Malwarebytes detected more than 22,800 phishing apps on Android, according to the recent 2025 State of Malware report. These Android phishing apps may sound high-tech, but they are not.

Phishing 123

Phishing Passwords Authentication Mobile 123

Krebs on Security

JULY 23, 2024

The Chinese company in charge of handing out domain names ending in “ top ” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. ” Image: Shutterstock. Interisle said.top has roughly 2.76

Phishing 337

Phishing DNS Scams Technology 337

Security Affairs

NOVEMBER 29, 2024

Phishing tool Rockstar 2FA targets Microsoft 365 credentials, it uses adversary-in-the-middle (AitM) attacks to bypass multi-factor authentication. Trustwave researchers are monitoring malicious activity associated with Phishing-as-a-Service (PaaS) platforms, their latest report focuses on a toolkit called Rockstar 2FA.

Phishing 95

Phishing Accountability Authentication Advertising 95

Krebs on Security

APRIL 30, 2025

Buchanan was arrested in Spain last year on a warrant from the FBI, which wanted him in connection with a series of SMS-based phishing attacks in the summer of 2022 that led to intrusions at Twilio, LastPass, DoorDash, Mailchimp, and many other tech firms. A Scattered Spider/0Ktapus SMS phishing lure sent to Twilio employees in 2022.

Identity Theft 195

Identity Theft Phishing Cryptocurrency Cybercrime 195

SecureList

MARCH 3, 2025

The statistics for previous years may differ from earlier publications due to a data and methodology revision implemented in 2024. The year in figures According to Kaspersky Security Network, in 2024: A total of 33.3 Adware, the most common mobile threat, accounted for 35% of total detections. A total of 1.1 A total of 1.1

Mobile 115

Mobile Malware Adware Banking 115

Malwarebytes

FEBRUARY 13, 2025

In May, 2024, the FBI warned about the increasing threat of cybercriminals using Artificial Intelligence (AI) in their scams. Phishers are using AI-based phishing attacks which have proven to raise the effectiveness of phishing campaigns. These often start with a call to users, claiming their Gmail account has been compromised.

Phishing 106

Phishing Artificial Intelligence Identity Theft Accountability 106

SecureList

MARCH 25, 2025

Key findings Phishing Banks were the most popular lure in 2024, accounting for 42.58% of financial phishing attempts. Amazon Online Shopping was mimicked by 33.19% of all phishing and scam pages targeting online store users in 2024. Mamont was the most active Android malware family, accounting for 36.7%

Phishing 77

Phishing Banking Scams Mobile 77

SecureList

FEBRUARY 20, 2025

Security incident statistics for 2024 In 2024, the MDR infrastructure received and processed on average 15,000 telemetry events per host every day, generating security alerts as a result. Human-driven targeted attacks accounted for 43% of high-severity incidents 74% more than in 2023 and 43% more than in 2022. in IT, 18.3%

Social Engineering 101

Social Engineering Phishing Government Threat Detection 101

eSecurity Planet

OCTOBER 28, 2024

We’ll also look at increased phishing attacks, a couple of different Cisco flaws, and a Fortinet vulnerability that took some time to get its own CVE. October 21, 2024 VMware Re-Patches September Vulnerability Type of vulnerability: Heap overflow and privilege escalation. The flaw is tracked as CVE-2024-44068. base score.

Phishing 102

Phishing Authentication Software VPN 102

Krebs on Security

DECEMBER 29, 2024

Maybe it’s indelicate to celebrate the birthday of a cybercrime blog that mostly publishes bad news, but happily many of 2024’s most engrossing security stories were about bad things happening to bad guys. In case you missed any of them, here’s a recap of 2024’s most-read stories.

Scams 241

Scams Cybercrime Cryptocurrency Social Engineering 241

SecureList

NOVEMBER 28, 2024

This is our latest roundup, covering activity we observed during Q3 2024. Based on limited telemetry, we believe with medium to low confidence that some of the initial infections were spear-phishing emails. After that, we did not observe any new activity related to this actor until mid-July 2024.

Malware 117

Malware Government Software Spyware 117

SecureList

NOVEMBER 29, 2024

IT threat evolution in Q3 2024 IT threat evolution in Q3 2024. Non-mobile statistics IT threat evolution in Q3 2024. Mobile statistics Targeted attacks New APT threat actor targets Russian government entities In May 2024, we discovered a new APT targeting Russian government organizations.

Energy and Utilities 103

Energy and Utilities Ransomware Malware Government 103

Krebs on Security

APRIL 4, 2024

The disclosure revealed a profitable network of phishing sites that behave and look like the real Privnote, except that any messages containing cryptocurrency addresses will be automatically altered to include a different payment address controlled by the scammers. A screenshot of the phishing domain privatemessage dot net.

Phishing 293

Phishing Cryptocurrency DDOS Internet 293

Krebs on Security

APRIL 3, 2024

Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called “ The Manipulaters ,” a sprawling web hosting network of phishing and spam delivery platforms. Manipulaters advertisement for “Office 365 Private Page with Antibot” phishing kit sold on the domain heartsender,com.

Phishing 299

Phishing Cybercrime Malware Advertising 299

SecureList

NOVEMBER 29, 2024

IT threat evolution in Q3 2024 IT threat evolution in Q3 2024. Non-mobile statistics IT threat evolution in Q3 2024. Mobile statistics Quarterly figures According to Kaspersky Security Network, in Q3 2024: As many as 6.7 Adware was the most common mobile threat, accounting for 36% of all detected threats.

Mobile 100

Mobile Adware Banking Malware 100

Malwarebytes

FEBRUARY 14, 2025

In October 2024, we found data reported to belong to Zacks containing 8,441 records which includes email addresses, physical addresses, phone numbers, and full names, and potentially other compromised user details. Protecting yourself after a data breach Losing data related to a financial account can have severe consequences.

Accountability 79

Accountability Data breaches Passwords Phishing 79

SecureList

DECEMBER 27, 2024

Statistics across all threats In the third quarter of 2024, the percentage of ICS computers on which malicious objects were blocked decreased by 1.5 The percentage of ICS computers on which malicious objects were blocked during the third quarter of 2024 was highest in July and September, and lowest inAugust. Regions and the world.

Malware 103

Malware Spyware Internet Internet 103

Thales Cloud Protection & Licensing

MAY 7, 2025

Phishing-Resistant MFA: Why FIDO is Essential madhav Thu, 05/08/2025 - 04:47 Phishing attacks are one of the most pervasive and insidious threats, with businesses facing increasingly sophisticated and convincing attacks that exploit human error.

Phishing 71

Phishing Authentication Passwords Social Engineering 71

Krebs on Security

MAY 28, 2025

A report from the Pakistani media outlet Dawn states that authorities there arrested 21 people alleged to have operated Heartsender, a spam delivery service whose homepage openly advertised phishing kits targeting users of various Internet companies, including Microsoft 365, Yahoo, AOL, Intuit, iCloud and ID.me.

Malware 196

Malware Cybercrime Antivirus Scams 196

Digital Shadows

JANUARY 22, 2025

Phishing Remains Top Tactic, Fueled by Teams Abuse Figure 1: Top attack techniques in true-positive customer incidents for finance & insurance sector, H2 2024 vs H2 2023 Phishing dominated cyber attacks in H2 2024, accounting for over 90% of incidents across industries due to its simplicity and effectiveness.

Insurance 65

Insurance Phishing Social Engineering Engineering 65

Security Affairs

JUNE 19, 2025

With over 16 billion login records exposed, cybercriminals now have unprecedented access to personal credentials that can be used for account takeover, identity theft, and highly targeted phishing. While many records overlap, the true number of exposed accounts is still unclear. The leaked datasets range from 16 million to 3.5

Data breaches 112

Data breaches Identity Theft Passwords Malware 112

Graham Cluley

JUNE 5, 2025

ⓘ MailerLite warns of phishing campaign Graham Cluley @ 4:13 pm, June 5, 2025 @grahamcluley.com @ [email protected] The team at MailerLite have contacted their customers warning them about a phishing campaign that is trying to steal login details. Sync across unlimited devices. Integrated 2FA. Sign up to our free newsletter.

Phishing 62

Phishing Accountability Passwords Hacking 62

Security Affairs

DECEMBER 2, 2024

Operation HAECHI V (July-Nov 2024) targeted cyber frauds like phishing, romance scams, sextortion, investment fraud, online gambling, BEC, and e-commerce fraud. Korean and Chinese authorities dismantled a voice phishing syndicate that caused $1.1B million to a fake account in Timor Leste, where authorities intercepted USD 39.3

Cryptocurrency 127

Cryptocurrency Phishing Scams Cybercrime 127

The Hacker News

JANUARY 17, 2025

Cybersecurity researchers have detailed a new adversary-in-the-middle (AitM) phishing kit that's capable of Microsoft 365 accounts with an aim to steal credentials and two-factor authentication (2FA) codes since at least October 2024.

Phishing 130

Phishing Accountability Authentication Cybersecurity 130

eSecurity Planet

MARCH 14, 2025

A recent phishing campaign has raised alarms among cybersecurity professionals after it impersonated Booking.com to deliver a suite of credential-stealing malware. First detected in December 2024 and persisting into early 2025, the threat targets hospitality organizations across North America, Oceania, Asia, and Europe.

Phishing 62

Phishing Malware Social Engineering Authentication 62

The Last Watchdog

DECEMBER 12, 2023

What should I be most concerned about – and focus on – in 2024? In 2024, we will see more targeted, sophisticated business email compromise (BEC) attacks, including VIP impersonation, vendor email compromise (VEC), and autonomous agents used for malicious purposes. Phishing attacks driven by ChatGPT will be harder than ever to detect.

Cybersecurity 258

Cybersecurity Social Engineering Cyber threats Software 258

Responsible Cyber

NOVEMBER 23, 2024

Overview of Vendor Breaches in 2024 In 2024, the cybersecurity landscape has faced an alarming rise in vendor-related breaches, underscoring the vulnerabilities associated with third-party service providers. The healthcare sector has been particularly hard-hit, accounting for over 30% of the total breaches.

Risk 81

Risk Healthcare Education Cybersecurity 81

Penetration Testing

NOVEMBER 3, 2024

A new phishing campaign, tracked by Cisco Talos, has been targeting Facebook business account users in Taiwan since at least July 2024.

Accountability 65

Accountability Phishing Cybersecurity Penetration Testing 65

eSecurity Planet

NOVEMBER 6, 2024

In this video, our expert delves into what cookies are and their function in web browsing, explores the techniques hackers use to steal them — such as session hijacking and cross-site scripting (XSS) — and shares effective strategies and tools to protect your cookies and personal data in 2024. How Does Cookie Stealing Work?

Identity Theft 109

Identity Theft Passwords Phishing Accountability 109

The Last Watchdog

MARCH 19, 2025

Holistic Identity: The New Cyber Battleground Organizations have traditionally focused on securing individual account credentials, but SpyClouds research indicates that cybercriminals have expanded their tactics beyond conventional account takeover. Consumer exposure averages 27 unique emails and 227 credential pairs per user.

Cyber Risk 113

Cyber Risk Risk Phishing Cybercrime 113

Malwarebytes

OCTOBER 25, 2024

UnitedHealth CEO Andrew Witty estimated the attack compromised the data of a third of US individuals when he testified before the Senate Finance Committee on Capitol Hill on May 1, 2024 in Washington, DC. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. He wasn’t exaggerating. Take your time.

Healthcare 112

Healthcare Data breaches Passwords Identity Theft 112

Security Affairs

NOVEMBER 7, 2024

SentinelLabs researchers speculate DPRK-linked actors targeting the crypto industry since July 2024 as part of the Hidden Risk campaign. Phishing messages impersonate a real person and forward a message from a crypto influencer, while the PDF copies genuine research on Bitcoin ETFs to appear legitimate. ” concludes the report.

Malware 123

Malware Architecture Risk Cryptocurrency 123

Malwarebytes

NOVEMBER 4, 2024

The City of Columbus was attacked by a ransomware group on July 18, 2024. On September 12, 2024, the city of Columbus issued a notice of breach that was sent to its clients. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.

Data breaches 108

Data breaches Passwords Ransomware Phishing 108