Schneier on Security

AUGUST 25, 2022

Here’s a phishing campaign that uses a man-in-the-middle attack to defeat multi-factor authentication: Microsoft observed a campaign that inserted an attacker-controlled proxy site between the account users and the work server they attempted to log into.

Phishing 319

Phishing Authentication Passwords Accountability 319

Krebs on Security

MAY 26, 2023

The number of phishing websites tied to domain name registrar Freenom dropped precipitously in the months surrounding a recent lawsuit from social networking giant Meta , which alleged the free domain name provider has a long history of ignoring abuse complaints about phishing websites while monetizing traffic to those abusive domains.

Phishing 263

Phishing Malware 263

Krebs on Security

APRIL 3, 2024

Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called “ The Manipulaters ,” a sprawling web hosting network of phishing and spam delivery platforms. Manipulaters advertisement for “Office 365 Private Page with Antibot” phishing kit sold on the domain heartsender,com.

Phishing 223

Phishing Cybercrime Malware Advertising 223

Schneier on Security

JUNE 23, 2023

I get UPS phishing spam on my phone all the time. Turns out that hackers have been harvesting actual UPS delivery data from a Canadian tracking tool for its phishing SMSs. I never click on it, because it’s so obviously spam.

Phishing 215

Phishing Cybercrime 215

Penetration Testing

JULY 25, 2024

A financially motivated hacker group, codenamed FLUXROOT, has been identified in Latin America, utilizing serverless Google Cloud projects to orchestrate phishing attacks.

Phishing 73

Phishing Cybersecurity Malware 73

Security Boulevard

JUNE 19, 2024

IRONSCALES has made generally available a phishing simulation tool that makes use of generative artificial intelligence (AI) to enable cybersecurity teams to create as many as 2,000 simulations of a spear phishing attack in less than an hour.

Phishing 119

Phishing Artificial Intelligence Cybersecurity Security Awareness 119

Security Boulevard

JULY 18, 2024

A crypto phishing campaign has been identified in which a threat actor employs AI-generated content to create 17,000 phishing lure sites impersonating more than 30 major cryptocurrency brands, including Coinbase, Crypto.com, Metamask and Trezor.

Phishing 98

Phishing Cryptocurrency Social Engineering Engineering 98

Security Boulevard

JULY 23, 2024

The post Four Automated Anti-Phishing Techniques appeared first on AI-enhanced Security Automation. The post Four Automated Anti-Phishing Techniques appeared first on Security Boulevard.

Phishing 62

Phishing 62

The Hacker News

JULY 25, 2024

The cybersecurity company said it identified what it described as an unattributed spear-phishing attempt on July 24, 2024, distributing an inauthentic CrowdStrike Crash Reporter

Phishing 108

Phishing Scams Cybersecurity 108

Schneier on Security

JANUARY 27, 2023

This is a good list of modern phishing techniques.

Phishing 291

Phishing 291

Tech Republic Security

JUNE 16, 2023

Threat intelligence firm Abnormal Software is seeing cybercriminals using generative AI to go phishing; the same technology is part of the defense. The post AI vs AI: Next front in phishing wars appeared first on TechRepublic.

Phishing 217

Phishing Technology Software Artificial Intelligence 217

Security Boulevard

JULY 17, 2024

The post Void Banshee Group Used ‘Windows Relic’ IE in Phishing Campaign appeared first on Security Boulevard. The APT group Void Banshee exploited a now-patched Windows security flaw and the retired Internet Explorer browser to distributed the Atlantida malware to steal system information and sensitive data from victims.

Phishing 125

Phishing Internet Internet Malware 125

Bleeping Computer

JULY 1, 2024

BleepingComputer has verified that the helpdesk portal of a router manufacturer is currently sending MetaMask phishing emails in response to newly filed support tickets, in what appears to be a compromise. [.]

Phishing 115

Phishing Manufacturing 115

Security Boulevard

JULY 11, 2024

This is the deceptive power of new FishXProxy Phishing Kit, a new phishing toolkit emerging from the cybercrime underground. The post New FishXProxy Phishing Kit Lowers Barriers for Cybercriminals appeared first on Security Boulevard.

Phishing 70

Phishing Cybercrime 70

Duo's Security Blog

OCTOBER 18, 2023

Once delivered, a phish typically wants to invoke emotion and prey on our natural desires to act and help fix a problem, such as “you have to do X, or else X will happen”. Phishing requires you to act with a specific set of instructions Don’t engage and trust nothing. Look beyond the email sender and website URLs used.

Phishing 130

Phishing Security Awareness Software Media 130

The Hacker News

JULY 26, 2024

A Spanish-speaking cybercrime group named GXC Team has been observed bundling phishing kits with malicious Android applications, taking malware-as-a-service (MaaS) offerings to the next level.

Cybercrime 80

Cybercrime Phishing Malware Cybersecurity 80

Security Boulevard

JULY 23, 2024

Overview Leveraging our global threat hunting system, NSFOCUS Security Research Labs discovered spear-phishing email attacks by the APT group TransparentTribe targeting Indian government departments on February 2, 2024. The post TransparentTribe’s Spear-Phishing Targeting Indian Government Departments appeared first on Security Boulevard.

Government 62

Government Phishing Cyber Attacks 62

Security Boulevard

JULY 10, 2024

Found in Environments Protected By: Microsoft By Andrew Mann, Cofense Phishing Defense Center Everyone today has some form of social media, whether it is Instagram, X, YouTube or Facebook. The post A “Meta” Facebook Phish appeared first on Security Boulevard. The post A “Meta” Facebook Phish appeared first on Security Boulevard.

Phishing 62

Phishing Media 62

Penetration Testing

JUNE 13, 2024

A new phishing technique exploiting Progressive Web Apps (PWAs) has been brought to light by cybersecurity researcher Mr.d0x, highlighting a potential vulnerability in this increasingly popular web technology.

Phishing 111

Phishing Technology Cybersecurity 111

The Hacker News

JULY 22, 2024

A Latin America (LATAM)-based financially motivated actor codenamed FLUXROOT has been observed leveraging Google Cloud serverless projects to orchestrate credential phishing activity, highlighting the abuse of the cloud computing model for malicious purposes.

Phishing 108

Phishing Architecture 108

Tech Republic Security

OCTOBER 24, 2023

Hacker Stephanie "Snow" Carruthers and her team found phishing emails written by security researchers saw a 3% better click rate than phishing emails written by ChatGPT.

Phishing 209

Phishing Artificial Intelligence 209

Tech Republic Security

JUNE 13, 2023

Read the technical details about a new AiTM phishing attack combined with a BEC campaign as revealed by Microsoft, and learn how to mitigate this threat. The post New phishing and business email compromise campaigns increase in complexity, bypass MFA appeared first on TechRepublic.

Phishing 212

Phishing Network Security 212

Security Boulevard

APRIL 22, 2024

Researchers at Proofpoint have found out that the TA547 phishing attack campaigns have been targeting different German companies. The TA547 phishing […] The post TA547 Phishing Attack: German Companies Hit With Infostealer appeared first on TuxCare. This information is then used by several cybercriminal threat actors.

Phishing 122

Phishing Cybersecurity 122

The Hacker News

MAY 27, 2024

Cybersecurity researchers are alerting of phishing campaigns that abuse Cloudflare Workers to serve phishing sites that are used to harvest users' credentials associated with Microsoft, Gmail, Yahoo!, and cPanel Webmail.

Phishing 126

Phishing Cybersecurity 126

Tech Republic Security

OCTOBER 6, 2023

Microsoft, the Dark Web and the name John Malkovich all factor into this EvilProxy phishing attack. The good news is there are steps IT can take to mitigate this security threat.

Phishing 200

Phishing Cybersecurity 200

Bleeping Computer

JUNE 12, 2024

A new phishing campaign uses HTML attachments that abuse the Windows search protocol (search-ms URI) to push batch files hosted on remote servers that deliver malware. [.]

Phishing 130

Phishing Malware 130

SecureList

APRIL 5, 2023

They have become adept at using Telegram both for automating their activities and for providing various services — from selling phishing kits to helping with setting up custom phishing campaigns — to all willing to pay. ” Links to the channels are spread via YouTube, GitHub and phishing kits they make.

Phishing 130

Phishing Marketing Scams Accountability 130

Tech Republic Security

JANUARY 25, 2024

Learn how to protect yourself and your sensitive information from phishing attacks by implementing multi-factor authentication.

Authentication 188

Authentication Phishing 188

Tech Republic Security

MARCH 23, 2023

Microsoft has already seen millions of phishing emails sent every day by attackers using this phishing kit. The post Massive adversary-in-the-middle phishing campaign bypasses MFA and mimics Microsoft Office appeared first on TechRepublic. Learn how to protect your business from this AitM campaign.

Phishing 212

Phishing Authentication Cybersecurity 212

Malwarebytes

DECEMBER 26, 2023

Phishing is the art of sending an email with the aim of getting users to open a malicious file or click on a link to then steal credentials. But most phishers aren’t very good, and the success rate is relatively low: In 2021, the average click rate for a phishing campaign was 17.8%. So how do you recognize AI phishing emails?

Phishing 123

Phishing Software Risk Cybersecurity 123

Security Boulevard

MARCH 13, 2024

As messaging apps like Telegram gain popularity, cybercriminals are increasingly finding they are an attractive vector for phishing attacks. The post Phishing Threats Rise as Malicious Actors Target Messaging Platforms appeared first on Security Boulevard.

Phishing 126

Phishing Social Engineering Engineering Mobile 126

Bleeping Computer

JUNE 12, 2024

A new phishing kit has been released that allows red teamers and cybercriminals to create progressive web Apps (PWAs) that display convincing corporate login forms to steal credentials. [.]

Phishing 121

Phishing 121

The Hacker News

MAY 27, 2024

The transition to the cloud, poor password hygiene and the evolution in webpage technologies have all enabled the rise in phishing attacks. But despite sincere efforts by security stakeholders to mitigate them - through email protection, firewall rules and employee education - phishing attacks are still a very risky attack vector.

Phishing 104

Phishing Firewall Education Passwords 104

SecureWorld News

APRIL 1, 2024

A new Phishing-as-a-Service (PhaaS) threat called "darcula" is taking advantage of encrypted mobile messaging services to unleash a wave of sophisticated smishing attacks targeting organizations across more than 100 countries. Mobile devices tend to have weaker security compared to desktop systems, making them an attractive target vector."

Phishing 100

Phishing Mobile Encryption Technology 100

Security Boulevard

MARCH 15, 2024

In the ever-evolving landscape of cybersecurity, a fresh menace has emerged, targeting crypto enthusiasts through a sophisticated phishing kit. Learning how to avoid crypto phishing is crucial […] The post Crypto Phishing Kit Impersonating Login Pages: Stay Informed appeared first on TuxCare.

Phishing 104

Phishing Cryptocurrency Mobile Engineering 104

Penetration Testing

MARCH 12, 2024

A recently uncovered phishing campaign demonstrates a concerning level of sophistication in its efforts to infiltrate systems and deploy an array of powerful Remote Access Trojans (RATs).

Phishing 143

Phishing Penetration Testing Malware 143

Security Boulevard

JULY 15, 2024

Found in Environments Protected By: Google, Outlook 365, Proofpoint By Sabi Kiss, Cofense Phishing Defense Center Phishing attacks are becoming increasingly sophisticated, and the latest attack strategy targeting employees highlights this evolution.

Phishing 67

Phishing 67