Malwarebytes

JANUARY 17, 2025

A cybercriminal campaign linked to Russia is deploying QR codes to access the WhatsApp accounts of high-profile targets like journalists, members of think tanks, and employees of non-governmental organizations (NGOs), according to new details revealed by Microsoft. There are a few simple rules that will help you avoid this kind of phishing.

Phishing 138

Phishing Accountability Mobile Risk 138

Security Affairs

APRIL 28, 2025

A large-scale phishing campaign targets WordPress WooCommerce users with a fake security alert urging them to download a ‘critical patch’ hiding a backdoor. Patchstack researchers uncovered a large-scale phishing campaign targeting WordPress WooCommerce users with a fake security alert.

Phishing 88

Phishing Accountability DDOS Hacking 88

SecureList

DECEMBER 17, 2024

The link directed users to a phishing site offering to download Mamont for Android ( 12936056e8895e6a662731c798b27333 ). We reported the scam accounts and channels to Telegram, but the messaging service had done nothing to block them at the time of writing this. Avoid downloading apps from anywhere but official sources.

Scams 99

Scams Malware Social Engineering Banking 99

Malwarebytes

FEBRUARY 13, 2025

Phishers are using AI-based phishing attacks which have proven to raise the effectiveness of phishing campaigns. These often start with a call to users, claiming their Gmail account has been compromised. How to avoid AI Gmail phishing Never click on links or download files from unexpected emails or messages.

Phishing 108

Phishing Artificial Intelligence Identity Theft Accountability 108

Malwarebytes

APRIL 16, 2025

In a new version of the old Hello pervert emails, scammers are relying on classic email spoofing techniques to try and convince victims that they have lost control of their email account and computer systems. The scammer says they know your password or compromised your account. Scammers do this to bypass phishing filters.

Accountability 120

Accountability Scams Passwords Phishing 120

Krebs on Security

MAY 18, 2019

com — a forum popular among people involved in hijacking online accounts and conducting SIM swapping attacks to seize control over victims’ phone numbers — has itself been hacked, exposing the email addresses, hashed passwords, IP addresses and private messages for nearly 113,000 forum users.

Accountability 274

Accountability Hacking Backups Passwords 274

Thales Cloud Protection & Licensing

MAY 7, 2025

Phishing-Resistant MFA: Why FIDO is Essential madhav Thu, 05/08/2025 - 04:47 Phishing attacks are one of the most pervasive and insidious threats, with businesses facing increasingly sophisticated and convincing attacks that exploit human error.

Phishing 71

Phishing Authentication Passwords Social Engineering 71

Malwarebytes

APRIL 3, 2025

Recently weve been seeing quite a few phishing campaigns using QR codes in email attachments. The lure and the targets are varied, but the use of a QR code to get someone to visit the phishing site is fast becoming a preferred method for cybercriminals. DocuSign , Adobe), which increases the perceived legitimacy of the phish.

Phishing 140

Phishing Banking Mobile Accountability 140

Troy Hunt

NOVEMBER 18, 2019

You know how banks really, really want to avoid their customers falling victim to phishing scams? And how they put a heap of effort into education to warn folks about the hallmarks of phishing scams? banks will never do things that look like a phish? Isn't this what NAB was warning us about - "download of data"?

Banking 271

Banking Phishing Scams Accountability 271

eSecurity Planet

OCTOBER 28, 2024

We’ll also look at increased phishing attacks, a couple of different Cisco flaws, and a Fortinet vulnerability that took some time to get its own CVE. The fix: Download the appropriate fixed version, based on your existing version of vCenter Server, from Broadcom’s list of patched software. Broadcom also released patches for the 8.0

Phishing 102

Phishing Authentication Software VPN 102

Krebs on Security

APRIL 3, 2024

Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called “ The Manipulaters ,” a sprawling web hosting network of phishing and spam delivery platforms. Manipulaters advertisement for “Office 365 Private Page with Antibot” phishing kit sold on the domain heartsender,com.

Phishing 297

Phishing Cybercrime Malware Advertising 297

Krebs on Security

MAY 14, 2025

Kev Breen , senior director of threat research at Immersive Labs , said privilege escalation bugs assume an attacker already has initial access to a compromised host, typically through a phishing attack or by using stolen credentials. “Even if you don’t check for updates, Windows 11 24H2 will automatically download at some point.”

Artificial Intelligence 191

Artificial Intelligence Internet Internet Engineering 191

Krebs on Security

AUGUST 4, 2023

One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. For example, when he downloaded and tried to rename the file, the right arrow key on the keyboard moved his cursor to the left, and vice versa.

Phishing 245

Phishing Scams Computers and Electronics Software 245

Security Affairs

MAY 28, 2025

Researchers found a fake Bitdefender site spreading the Venom RAT by tricking users into downloading it as antivirus software. DomainTools Intelligence (DTI) researchers warn of a malicious campaign using a fake website (bitdefender-download[.]com) 160 on port 4449.

Antivirus 117

Antivirus Malware Banking Passwords 117

Malwarebytes

MARCH 4, 2025

PayPal scammers are using an old Docusign trick to enhance the trustworthiness of their phishing emails. The Docusign Application Programming Interface (API) allows customers to send emails that come from genuine Docusign accounts, and they can use templates to impersonate reputable companies.

Scams 137

Scams Accountability Phishing Banking 137

eSecurity Planet

MARCH 14, 2025

A recent phishing campaign has raised alarms among cybersecurity professionals after it impersonated Booking.com to deliver a suite of credential-stealing malware. Heres what comes next: These emails lure victims with urgent requests, from resolving guest review issues to verifying account information.

Phishing 65

Phishing Malware Social Engineering Authentication 65

Malwarebytes

MARCH 17, 2025

But in the background, their system has hidden malware in the file the victim has downloaded, which is capable of gathering information from the affected device such as: Personal identifying information (PII) including Social Security Numbers (SSN). Work with them to take the necessary steps to protect your identity and your accounts.

Malware 138

Malware Adware Education Phishing 138

Malwarebytes

MAY 1, 2025

Phishing In phishing scams, cybercriminals trick people and businesses into handing over sensitive information like credit card numbers or login details for vital online accounts. Lured in by similar color schemes, company logos, and familiar layouts, victims log in to their account by entering their username and password.

Small Business 90

Small Business Cybersecurity Passwords Scams 90

Malwarebytes

MAY 27, 2025

They often arrive via phishing emails, malicious websites, or bundled with cracked software. Since one infected system can leak multiple credentials tied to different accounts and services, the number of victims is likely far smaller than the number of exposed credentials but still alarmingly high.

Identity Theft 135

Identity Theft Passwords Accountability Phishing 135

eSecurity Planet

MAY 11, 2025

Technical support consultant using programming to upgrade artificial intelligence simulation model As AI tools boom in popularity, cyberthieves are exploiting the excitement with fake AI video editing platforms that lure users into downloading malware. Document.docx: A disguised batch file that downloads more malware.

Malware 106

Malware Scams Media Artificial Intelligence 106

Malwarebytes

SEPTEMBER 13, 2023

The consequences of last year's LastPass breach continue to be felt, with the latest insult to users coming in the form of a highly convincing phishing email. Armed with this data, attackers can send targeted phishing emails that attempt to steal the passwords needed to unlock the stolen password vaults.

Phishing 143

Phishing Accountability Passwords Password Management 143

SecureList

MARCH 25, 2025

Key findings Phishing Banks were the most popular lure in 2024, accounting for 42.58% of financial phishing attempts. Amazon Online Shopping was mimicked by 33.19% of all phishing and scam pages targeting online store users in 2024. Cryptocurrency phishing saw an 83.37% year-over-year increase in 2024, with 10.7

Phishing 83

Phishing Banking Scams Mobile 83

Krebs on Security

DECEMBER 1, 2022

ConnectWise , which offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers (MSPs), is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link.

Phishing 313

Phishing Architecture Passwords Accountability 313

eSecurity Planet

OCTOBER 22, 2024

One of the most concerning tactics currently on the rise is the ClickFix campaign — a sophisticated phishing scheme targeting unsuspecting Google Meet users. ClickFix campaigns represent a new wave of phishing tactics that emerged in May 2024, aimed at exploiting users of popular software applications. What Are ClickFix Campaigns?

Scams 123

Scams Malware Phishing Social Engineering 123

SecureWorld News

DECEMBER 4, 2024

The United States retail sector faced an especially aggressive wave of cyber threats, with phishing attacks mimicking major holiday brands [3] including Walmart, Target, and Best Buy increasing by more than 2,000% during peak shopping periods. This makes it easier to spot and shut down fake accounts and copycat websites.

Retail 116

Retail Scams Phishing Cyber threats 116

Krebs on Security

AUGUST 30, 2022

A recent spate of SMS phishing attacks from one cybercriminal group has spawned a flurry of breach disclosures from affected companies, which are all struggling to combat the same lingering security threat: The ability of scammers to interact directly with employees through their mobile devices. Image: Cloudflare.com. 2, and Aug.

Mobile 340

Mobile Phishing Authentication Accountability 340

SecureList

APRIL 5, 2023

They have become adept at using Telegram both for automating their activities and for providing various services — from selling phishing kits to helping with setting up custom phishing campaigns — to all willing to pay. ” Links to the channels are spread via YouTube, GitHub and phishing kits they make.

Phishing 144

Phishing Marketing Scams Accountability 144

Digital Shadows

NOVEMBER 12, 2024

Top MITRE Technique: Spearphishing The construction sector is no stranger to phishing attacks, which topped the list of initial access techniques between October 1, 2023, and September 30, 2024. Phishing is favored by threat actors for its simplicity and effectiveness.

Ransomware 111

Ransomware Phishing Cyber threats Malware 111

SecureList

JUNE 10, 2024

Individual countries have adopted laws that require certain types of organizations to protect users’ accounts with 2FA. You typically do this after you get hold of the victim’s account credentials but before attempting to sign in to their account. Phishing is typically how they get the most up-to-date credentials.

Phishing 144

Phishing Banking Social Engineering Accountability 144

Krebs on Security

FEBRUARY 28, 2024

The profile also linked to Mr. Lee’s Twitter/X account , which features the same profile image. Doug then messaged the Mr. Lee account on Telegram, who said there was some kind of technology issue with the video platform, and that their IT people suggested using a different meeting link. ” Image: SlowMist.

Malware 332

Malware Cryptocurrency Software Phishing 332

Schneier on Security

APRIL 6, 2020

Before this, the threat actors used the stolen credentials to deliver phishing emails to other Fabrikam employees, as well as to their external contacts, with more and more systems getting infected and downloading additional malware payloads. The infection mechanism was one employee opening a malicious attachment to a phishing email.

Malware 248

Malware Phishing Authentication Internet 248

Krebs on Security

AUGUST 30, 2019

But when accounts at those CRM providers get hacked or phished, the results can be damaging for both the client’s brand and their customers. Here’s a look at a recent CRM-based phishing campaign that targeted customers of Fortune 500 construction equipment vendor United Rentals.

Phishing 256

Phishing Marketing Accountability DNS 256

Security Affairs

AUGUST 13, 2024

CERT-UA warned that Russia-linked actor is impersonating the Security Service of Ukraine (SSU) in a new phishing campaign to distribute malware. The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign targeting organizations in the country, including government entities.

Government 136

Government Phishing Malware Banking 136

Jane Frankland

MAY 16, 2025

From AI-generated voices to realistic websites and stolen accounts, scams today are slick, fast, and global. MFA Bypass Methods: SIM swaps, malware, or phishing sites that trick you into revealing or approving access. Passkeys are the gold standard phishing-resistant, cryptographic credentials tied to your device.

Scams 130

Scams Password Management Passwords Banking 130

Malwarebytes

APRIL 15, 2025

A screenshot of some of CL0P’s list of victims (other victims’ names obscured) This leak site is also where the stolen data is available for download. Malwarebytes Labs was unable to figure out how many people were affected, but the number of available archives for download is in the tenfolds. Watch out for fake vendors.

Data breaches 104

Data breaches Ransomware Passwords B2B 104

Malwarebytes

MARCH 25, 2025

How to delete your 23andMe data For 23andMe customers who want to delete their data from 23andMe: Log into your account and navigate to Settings. In the next section, youll be asked which, if there is any, personal data youd like to download from the company (onto a personal, not public, computer). Select View. Take your time.

Passwords 113

Passwords Accountability Data breaches Phishing 113

SecureList

SEPTEMBER 27, 2023

Unlike phishing links that are easy to check and block, QR code is a headache for security solutions. Malevolent uses of QR codes in email Fraudsters use QR codes to encode links to phishing and scam pages. The attackers were distributing messages advising their victims that their corporate email account passwords would soon expire.

Phishing 135

Phishing Passwords Accountability Scams 135