Bleeping Computer

AUGUST 21, 2022

Password-protected ZIP archives are common means of compressing and sharing sets of files—from sensitive documents to malware samples to even malware (phishing "invoices" in emails).

Passwords 98

Passwords Encryption Phishing Malware 98

CyberSecurity Insiders

MAY 11, 2023

Intro In February 2022, Microsoft disabled VBA macros on documents due to their frequent use as a malware distribution method. This move prompted malware authors to seek out new ways to distribute their payloads, resulting in an increase in the use of other infection vectors, such as password-encrypted zip files and ISO files.

Malware 98

Malware Social Engineering Engineering Education 98

Security Affairs

MARCH 14, 2023

Microsoft warns of large-scale phishing attacks orchestrated with an open-source adversary-in-the-middle (AiTM) phishing kit available in the cybercrime ecosystem Adversary-in-the-middle (AiTM) phishing kits are becoming an essential technology in the cybercrime ecosystem that is used by multiple threat actors to launch phishing attacks.

Phishing 76

Phishing Cybercrime Authentication Mobile 76

Krebs on Security

NOVEMBER 2, 2018

Thieves are combining SMS-based phishing attacks with new “cardless” ATMs to rapidly convert phished bank account credentials into cash. That phishing site prompted visitors to enter their account credentials — including usernames, passwords, one-time passcodes and PIN numbers — to unlock their accounts.

Phishing 236

Phishing Banking Scams Accountability 236

Security Affairs

DECEMBER 25, 2021

The phishing messages use weaponized Word or Excel attachments to install the Dridex banking Trojan. “This letter is to inform you that you have been exposed to a coworker who tested positive for OMICRON variant of COVID-19 sometime between December 18th and 20th,” reads a phishing message shared by Bleeping Computer.

Phishing 125

Phishing Passwords Banking Malware 125

Security Affairs

AUGUST 12, 2021

Microsoft warns of a long-running spear-phishing campaign that has targeted Office 365 customers in multiple attacks since July 2020. Microsoft revealed that a year-long spear-phishing campaign has targeted Office 365 customers in multiple attacks starting with July 2020. com , or api[.]statvoo[.]com Pierluigi Paganini.

Phishing 117

Phishing Passwords Encryption Cybercrime 117

The Last Watchdog

SEPTEMBER 28, 2022

Phishing attacks are nothing new, but scammers are getting savvier with their tactics. Other Iranian-based cyberattacks have included hackers targeting Albanian government systems and spear phishing scams. Here are four new phishing trends keeping businesses on their toes. Spear phishing. Phishing via texting.

Phishing 124

Phishing Scams Cybercrime Passwords 124

Malwarebytes

JANUARY 6, 2022

Credential stuffing is the automated injection of stolen username and password pairs in to website login forms, in order to fraudulently gain access to user accounts. Accessing more sensitive information such as credit card numbers, private messages, pictures, or documents which can ultimately lead to identity theft. No more passwords.

Passwords 137

Passwords Accountability Identity Theft Password Management 137

Malwarebytes

MAY 20, 2022

A poor password at the highest levels of an organisation can cost a company millions in losses. Recent findings show that half of IT leaders store passwords in shared documents. On top of that, it seems that folks at executive level are not picking good passwords either. Are CEOs naming their passwords after themselves?

Passwords 134

Passwords Password Management Authentication VPN 134

Krebs on Security

MARCH 26, 2024

Several Apple customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple’s password reset feature. “It was like this system notification from Apple to approve [a reset of the account password], but I couldn’t do anything else with my phone.

Passwords 344

Passwords Accountability Engineering Phishing 344

Security Affairs

JANUARY 28, 2021

Researchers from RiskIQ have discovered a new phishing kit dubbed LogoKit that dynamically compose phishing content. Researchers from RiskIQ discovered a new phishing kit that outstands for its ability to dynamically create phishing messages to target specific users. SecurityAffairs – hacking, Phishing).

Phishing 121

Phishing Cryptocurrency Passwords Hacking 121

Malwarebytes

MAY 2, 2024

Dropbox Sign is a platform that allows customers to digitally sign, edit, and track documents. Even if you never created a Dropbox Sign account but received or signed a document through Dropbox Sign, your email addresses and names were exposed. their documents or agreements), or their payment information.

Passwords 74

Passwords Authentication Accountability Data breaches 74

Dark Reading

JULY 14, 2022

Attackers use scam security checks to steal victims' government documents, photos, banking information, and email passwords, researchers warn.

Scams 131

Scams Phishing Banking Passwords 131

Security Affairs

MAY 2, 2024

Threat actors breached the Dropbox Sign production environment and accessed customer email addresses and hashed passwords Cloud storage provider DropBox revealed that threat actors have breached the production infrastructure of the DropBox Sign eSignature service and gained access to customer information and authentication data.

Hacking 98

Hacking Authentication Passwords Accountability 98

SecureList

MARCH 27, 2023

technologies — the distributed file system IPFS — for email phishing attacks. URL formats can be quite different, for example: [link] [link] Phishing and IPFS In 2022, scammers began actively using IPFS for email phishing attacks. The use of a distributed file system allows attackers to cut back on phishing page hosting costs.

Phishing 97

Phishing Technology Internet Internet 97

SecureWorld News

NOVEMBER 1, 2022

Phishing emails are being sent to verified Twitter Blue users telling them they don't have to pay for that "blue check mark" if they simply state they are a well-known person. It looks like some people (including in our newsroom) are getting crude phishing emails trying to trick people into turning over their Twitter credentials.

Phishing 108

Phishing Scams Accountability Media 108

Malwarebytes

JULY 19, 2022

A new phishing campaign targeting PayPal users aims to get extensive data from potential victims. The data it’s after includes government documents like passport, as well as selfie photos. PayPal phishing sites are a dime a dozen due to the number of people and companies using it as another form of payment method.

Phishing 107

Phishing Social Engineering Accountability Engineering 107

Identity IQ

FEBRUARY 7, 2023

What is Phishing? One of the most common techniques used to exploit web users is the phishing scam. This article will cover what phishing is, cybercriminals’ different approaches, and how to prevent yourself from becoming a victim. What is Phishing? How Does Phishing Work? Spear Phishing.

Phishing 98

Phishing Identity Theft Scams Banking 98

Security Affairs

OCTOBER 24, 2021

Microsoft uncovered an extensive series of credential phishing campaigns that employed a custom phishing kit tracked as TodayZoo. Microsoft researchers uncovered a custom phishing kit, dubbed TodayZoo, that was used in an extensive series of credential phishing campaigns. com domain to send the phishing messages.

Phishing 116

Phishing Passwords Hacking Accountability 116

Security Boulevard

JULY 28, 2022

Emotet is primarily distributed through phishing campaigns ( 1 ). Microsoft Office XLS Document Executes Obfuscated Excel 4.0 The first stage of an attack likely begins with a spam email delivering a Microsoft Office XLS document as an attachment. The XLS document uses obfuscated Excel macros. Macro when Enabled.

Encryption 59

Encryption Malware Phishing Cybercrime 59

SecureList

FEBRUARY 16, 2023

Short-lived phishing sites often offered to see the premieres before the eagerly awaited movie or television show was scheduled to hit the screen. At the beginning of that year, we still observed phishing attacks that used the themes of infection and prevention as the bait.

Phishing 90

Phishing Scams Accountability Energy and Utilities 90

Malwarebytes

AUGUST 13, 2021

In an extensive report about a phishing campaign , the Microsoft 365 Defender Threat Intelligence Team describes a number of encoding techniques that were deployed by the phishers. We just didn’t realize that phishing campaigns was one of them! We just didn’t realize that phishing campaigns was one of them! The campaign.

Phishing 99

Phishing Passwords Computers and Electronics Telecommunications 99

Duo's Security Blog

APRIL 20, 2023

Through the first two months of 2023 alone, the Australian Competition and Consumer Commission’s Scamwatch reported more than 19,000 phishing reports with estimated financial losses of more than $5.2 What is phishing? This is part of what makes phishing attacks so dangerous.

Phishing 67

Phishing Social Engineering Authentication Engineering 67

Security Affairs

JULY 9, 2021

Threat actors have devised a new trick to disable macro security warning that leverage non-malicious docs in phishing attacks. Most of the phishing attacks leverage weaponized Microsoft Office documents and social engineering techniques to trick recipients into enabling the macros. SecurityAffairs – hacking, phishing).

Phishing 97

Phishing Social Engineering Banking Engineering 97

Hot for Security

JULY 2, 2021

According to Bitdefender Antispam Lab researchers, cyber thieves are actively targeting DocuSign and Sharepoint users in phishing attacks designed to mimic legitimate correspondence from the two web-based platforms. The phishing attack spotted on June 24 appears to have originated from the United States.

Phishing 98

Phishing Scams Passwords Accountability 98

Krebs on Security

JANUARY 30, 2024

.” Group-IB dubbed the gang by a different name — 0ktapus — which was a nod to how the criminal group phished employees for credentials. The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. On July 28 and again on Aug. According to an Aug.

Social Engineering 314

Social Engineering Mobile Cybercrime Passwords 314

Security Affairs

JUNE 7, 2021

Ukraine warned of a “massive” spear-phishing campaign carried out by Russia-linked threat actors against its government and private businesses. This is the third massive spear-phishing campaign that the Ukrainian government attributed to Russia-linked threat actors this year. Follow me on Twitter: @securityaffairs and Facebook.

Phishing 92

Phishing Government Antivirus Passwords 92

SecureList

FEBRUARY 15, 2021

The Kaspersky Anti-Phishing component blocked 434,898,635 attempts at accessing scam sites. The most frequent targets of phishing attacks were online stores (18.12 The contact phone trick was heavily used both in email messages and on phishing pages. To access a real Zoom meeting, you need to know the meeting ID and password.

Phishing 136

Phishing Malware Scams Accountability 136

Hot for Security

FEBRUARY 15, 2021

As millions of citizens prepare for what may be the most challenging tax season to date, identity thieves got a head start, deploying phishing campaigns impersonating the agency as early as November 25, 2020. If successful, fraudsters may use stolen customer and tax consultant data to file fraudulent tax returns in their name. © 2021 EFILE.

Phishing 111

Phishing Scams Accountability Passwords 111

Security Affairs

MAY 30, 2021

Workers are going back to offices after months of remote working and crooks are attempting to exploit the situation by conducting spear-phishing attacks against their organizations. Upon clicking on the documents, victims have displayed a login panel that prompts them to provide login credentials to access the files.

Phishing 99

Phishing Authentication Government Accountability 99

Krebs on Security

APRIL 9, 2024

It involves convincing a user to click on a malicious link in an email, which can then steal the user’s password hash and authenticate as the user in another Microsoft service. Adobe has since clarified that its apps won’t use AI to auto-scan your documents, as the original language in its FAQ suggested.

DNS 236

DNS Social Engineering Malware Media 236

SecureList

FEBRUARY 9, 2022

Our Anti-Phishing system blocked 253 365 212 phishing links. Safe Messaging blocked 341 954 attempts to follow phishing links in messengers. Hurry up and lose your account: phishing in the corporate sector. That’s why these e-mails would contain a link to a document, file, payment request, etc.,

Phishing 65

Phishing Scams Accountability Banking 65

Krebs on Security

AUGUST 25, 2023

And there are indications that fraudsters may already be exploiting the stolen data in phishing attacks. Countless websites and online services use SMS text messages for both password resets and multi-factor authentication. ” A phishing message targeting FTX users that went out en masse today. Why do I suggest this?

Mobile 195

Mobile Cyber Risk Cryptocurrency Data breaches 195

CyberSecurity Insiders

JUNE 19, 2022

There are several types of phishing attacks, which are just one form of cybercrime. . A phishing attack takes place when a criminal pretends to be someone they’re not to trick people into giving over their personal information, such as their credit card details. Email phishing is also known as deception phishing.

Phishing 118

Phishing Media Cybercrime DNS 118

Malwarebytes

NOVEMBER 9, 2023

Several patients and court documents say that the stolen data included sensitive personal information, such as names and Social Security numbers, but also nude photos of patients taken before and after surgery. None of the documents posted online were encrypted. Change your password. Enable two-factor authentication.

Data breaches 100

Data breaches Identity Theft Passwords Phishing 100

Hot for Security

FEBRUARY 3, 2021

Fraudsters had an early start anticipating the buzz surrounding tax filing season, with phishing campaigns impersonating the government agency as early as November 25, 2020, according to Bitdefender Antispam Lab. The genuine format of the tax exemption document looks like this: Original W-8BEN form version. IRS phishing email sample.

Phishing 122

Phishing Scams Identity Theft Banking 122

Security Affairs

AUGUST 27, 2019

Researchers at Cofense uncovered an advanced phishing campaign delivering Quasar RAT via fake resumes. Experts at security firm Cofense observed an advanced phishing campaign delivering Quasar RAT via fake resumes. The fake resumes distributed in this phishing campaign detected are password-protected Microsoft Word documents.

Phishing 79

Phishing Passwords Advertising Malware 79