How to Protect Yourself From Identity Theft

Feel free to use this blog post for your own internal security awareness program.

Identity theft is no longer just a financial problem. Criminals can use stolen personal information to open credit accounts, redirect your mail, file fraudulent tax returns, take over online accounts, or even attempt home title fraud. While no solution can eliminate the risk completely, taking a few proactive steps can significantly reduce your chances of becoming a victim.

Freeze Your Credit

A credit freeze is one of the most effective ways to prevent criminals from opening new accounts in your name. When your credit is frozen, lenders cannot access your credit report to approve new credit applications unless you temporarily lift the freeze.

You should freeze your credit with all four consumer credit reporting companies:

• Experian

• TransUnion

• Equifax

• Innovis

In addition, many security professionals recommend freezing your file with the National Consumer Telecommunications and Utilities Exchange (NCTUE):

• NCTUE Security Freeze

A credit freeze is free and can be temporarily lifted whenever you need to apply for credit.

Credit Monitoring

One of the best ways to detect identity theft early is to regularly monitor your credit reports. Review reports from Equifax, Experian, and TransUnion for accounts, inquiries, or activities you don't recognize.

You can obtain free credit reports through AnnualCreditReport.com. Consider using a credit monitoring service that alerts you when changes occur on your credit file. Many people also choose to monitor their children's credit to help identify fraud that may otherwise go unnoticed for years.

Enable MFA

Whenever available, enable multi-factor authentication (MFA). MFA requires an additional verification step beyond a password, making it much more difficult for criminals to gain access even if a password is exposed. Passkeys are the new hotness. Check a recent blog post on What are Passkeys. The post dives into what Passkeys are and how to set them up.

Use a Password Manager

A password manager helps solve this problem by securely storing your passwords and generating strong, unique passwords for every account. Instead of remembering dozens of passwords, you only need to remember one strong master password.

When choosing a password manager, select a reputable provider and protect your account with a strong master password and multi-factor authentication (MFA). Never share your master password with anyone, and be cautious of websites or messages asking you to enter your credentials unexpectedly. Check a blog post from earlier this year on Mastering the Password Manager.

Remember, a password manager doesn't just make life easier. It significantly reduces the risk that one compromised password could lead to multiple account takeovers.

Quick Tip

If you're still reusing passwords across multiple websites, start by updating your most important accounts first:

• Email accounts

• Banking and financial accounts

• Healthcare portals

• Shopping sites with saved payment methods

• Social media accounts

Securing these accounts with unique passwords and MFA can dramatically reduce your risk of identity theft and account compromise.

Monitor Financial Accounts Regularly

Review bank accounts, credit cards, and investment accounts for unauthorized activity. Many financial institutions allow you to configure alerts that notify you whenever purchases, withdrawals, or account changes occur.

Real-time notifications can help you identify and respond to fraud quickly before significant damage is done.

Be Careful What You Share Online

Social media profiles can provide criminals with answers to common security questions, details about family members, and other personal information used in fraud schemes.

Before posting:

• Limit the amount of personal information visible to the public.

• Review privacy settings regularly.

• Avoid sharing details that could be used to verify your identity.

What to Do If You Become a Victim

If you suspect identity theft or fraud:

1. Contact your financial institutions immediately.

2. Place fraud alerts or freezes on your credit files.

3. Review recent account activity.

4. Report the incident to local law enforcement when appropriate.

5. File a complaint through the FBI's Internet Crime Complaint Center (IC3). 

Key Takeaways

Identity theft can happen to anyone, but a few preventive measures can dramatically reduce the risk. Credit monitoring, credit freezes, MFA, secure handling of personal information, and regular review of financial accounts all provide layers of protection. Taking action before a problem occurs is far easier than recovering after your identity has been stolen.

How Cybercriminals Use Public Data to Target Our Employees

This was written for a security awareness program. Feel free to grab within your own program.

Before a hacker ever sends a phishing email, text, or picks up the phone to launch a vishing call, they do their homework. Modern cyberattacks are rarely random. Instead, attackers spend days (sometimes weeks) building a detailed profile of an organization and its employees using information readily available on the internet.

This process is known as Open Source Intelligence (OSINT) gathering. By piecing together small snippets of public data from social media, corporate websites, and job boards, threat actors can craft shockingly convincing scams that bypass human suspicion.

What Attackers Are Looking For

Cybercriminals look for specific pieces of information to make their impersonations look and sound authentic.

1. Organizational Structure and Reporting Lines

Using professional networking platforms like LinkedIn, attackers construct exact organizational charts. They map out who works in finance, who handles IT, and who reports to whom. Knowing that Jane is the direct manager of Alex allows an attacker to call Alex posing as Jane, leveraging natural workplace authority.

2. Internal Software and Tech Stacks

Attackers scrutinize public job postings and employee resumes to see what tools our organization uses. If a job listing mentions experience with specific VPNs, SSO platforms, or cloud infrastructure, attackers know exactly which login portals to spoof or which IT scenarios to invent when calling an employee.

3. Out-of-Office Indicators and Personal Schedules

Public posts on social media about vacation plans, attendance at industry conferences, or business travel give attackers the perfect window to strike. If an executive posts about being in a three-day, off-site meeting, an attacker can email their team claiming: “I'm in a conference with no cell service. Urgently process this request for me!”

4. Personal Identifiers and Contact Information

Phone numbers, work emails, personal email addresses, and even pet names or hometowns (often used to answer security questions) are gathered from public records, personal social channels, and historic data breaches.

How Online Data Turns Into a Cyberattack

Once an attacker builds a profile, they use that context to lower your defenses:

• Hyper-Targeted Spear Phishing: Instead of a generic spam message, you receive an email referencing your actual department, your current project, or a real software vendor the company uses.

• Precision Vishing (Voice Phishing): A caller claims to be from internal IT support and mentions your direct manager's name, your office location, and the exact tool you use to log in every morning. Because they know these details, the call feels legitimate.

• Credential Stuffing: Attackers cross-reference work email addresses against leaked databases from breached personal websites, testing if employees reused personal passwords for work accounts.

 Have I Been Pwned is a great site to identify what breaches your personal email address is included in: https://haveibeenpwned.com/

3 Ways to Shrink Your Digital Footprint

You don't need to delete your online presence to stay safe, but adopting smart digital hygiene makes our organization a much harder target.

1. Audit Your Social Media Privacy Settings

Review privacy settings on personal platforms like Facebook, Instagram, and X. Restrict public viewing so that personal photos, family details, and real-time locations are only visible to trusted connections.

2. Be Mindful of Work-Related Details

Avoid posting photos that reveal security badges, office whiteboards, internal software dashboards, or specific project milestones. On professional platforms like LinkedIn, consider keeping job descriptions high-level rather than detailing specific internal software versions or architecture. 

3. Remember: Familiarity Does Not Equal Authenticity

Just because an inbound caller or email sender knows your manager's name, your job title, or what tools you use does not mean they are who they claim to be. All of that information can be found online in minutes. Always verify unexpected requests through trusted internal channels.

The Bottom Line

Cybersecurity isn’t just about firewalls and complex passwords—it’s about awareness. Attackers rely on us oversharing online to build their attacks, but you hold the power to starve them of that data.

Take 10 minutes today to audit your social media privacy settings, search yourself online, and practice healthy skepticism when unexpected requests hit your inbox. By tightening your digital footprint, you become the strongest line of defense for both your personal life and our organization.

August 2026 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Microsoft: Multi-Stage "Code of Conduct" Phishing Leads to AiTM Compromise 

Summary Microsoft Threat Intelligence has uncovered a sophisticated phishing campaign that exploits corporate compliance workflows. Attackers send a "mandatory" request for employees to review and sign a new "Code of Conduct" via a fake DocuSign or Adobe Sign link. This campaign uses Adversary-in-the-Middle (AiTM) techniques to bypass Multi-Factor Authentication (MFA) and steal session tokens, giving attackers full access to the victim's account without needing their password again. 

Key Takeaways 

• Psychological Lure: By using "Code of Conduct" or "HR Policy" updates, attackers trigger a sense of professional obligation, making users more likely to click through security warnings. 

• Token Theft (AiTM): The phishing site acts as a transparent proxy. When the user enters their credentials and MFA code, the attacker captures the session token, allowing them to "clone" the user's logged-in state. 

• Bypassing MFA: Because the attacker steals a live session token, traditional MFA (like SMS or push notifications) is ineffective once the initial login is completed on the proxy site. 

• Post-Compromise Activity: Once inside, attackers quickly register their own MFA devices, set up email forwarding rules to hide their activity, and pivot to financial systems to initiate fraudulent wire transfers. 

• The Fix: Move toward Phishing-Resistant MFA (such as FIDO2 security keys or Windows Hello for Business) and implement Conditional Access policies that require "Compliant Devices" to access sensitive resources. 

Further Reading: Breaking the Code: Multi-stage Phishing Leads to AiTM Token Compromise 

Steal Smarter, Not Harder: Malicious Use of Vercel for Phishing 

Summary Cofense Intelligence has identified a surge in threat actors leveraging Vercel, a popular cloud platform for frontend developers, to host high-fidelity credential phishing pages. By utilizing Vercel’s legitimate infrastructure and "trusted" subdomains, attackers can easily bypass email security filters and reputation-based blockers that typically flag newly registered malicious domains. 

Key Takeaways 

• Infrastructure Hijacking: Attackers use Vercel’s free tier to deploy phishing sites. Because the URLs often end in *.vercel.app, they inherit the high reputation of Vercel’s global infrastructure, making them invisible to many automated security tools. 

• Automated Scaling: Scammers are using Vercel’s deployment "slugs" to generate unique, personalized URLs for thousands of targets simultaneously, preventing simple URL-based blacklisting. 

• Evading Scanners: Many email gateways are configured to trust major cloud providers (like Vercel, Netlify, or Azure). Attackers exploit this "trusted cloud" status to deliver malicious links directly to the inbox. 

• Targeted Lures: The campaign primarily targets Microsoft 365 credentials, using fake "Document Shared with You" or "Action Required" notifications that redirect to a Vercel-hosted login portal. 

• The Fix: Implement Content Disarming and Reconstruction (CDR) or advanced browser isolation. Security teams should also consider auditing traffic to *.vercel.app and treating cloud-hosted subdomains with increased scrutiny. 

Further Reading: Steal Smarter, Not Harder: Malicious Use of Vercel 

Proofpoint: Phishing via Device Code Authorization 

Summary Proofpoint researchers have identified a rising trend in Device Code Authentication phishing. Attackers exploit a feature designed for "headless" devices (like Smart TVs or printers) to trick users into authorizing a malicious application on their primary corporate account. By convincing a user to enter a short alphanumeric code on a legitimate Microsoft or Google page, the attacker gains a persistent access token, bypassing Multi-Factor Authentication (MFA) entirely. 

Key Takeaways 

• Abuse of "Device Flow": The attack leverages the OAuth 2.0 Device Authorization Grant. It sends the victim a code and a link to a legitimate Microsoft/Google URL (e.g., microsoft.com/devicelogin), making the request appear highly trustworthy. 

• Persistent Access: Once the victim enters the code and clicks "Continue," the attacker receives an access token and a refresh token. This allows them to stay logged in indefinitely, even if the user changes their password. 

• MFA Bypass: Since the user is performing the authorization on their own trusted device and browser, the "approval" satisfies MFA requirements, essentially using the user as a proxy for the attacker’s login. 

• Invisible Presence: There is no "phishing site" to block. The entire interaction happens on the legitimate service provider's domain, rendering traditional URL filters and web scanners useless. 

• The Fix: Disable the Device Code Flow in your tenant for users who do not require it. If it must be used, implement Conditional Access policies to restrict device code logins to known, managed IP ranges. 

Further Reading: Access Granted: Phishing with Device Code Authorization 

New Phishing Attack Weaponizing Event Invitations 

Summary Security researchers have identified a surge in phishing attacks that weaponize calendar and event invitations (ICS files) to bypass email gateways. By sending a malicious invite through platforms like Outlook or Google Calendar, attackers place a clickable "Join Meeting" link directly onto a victim’s calendar. This bypasses traditional email filters because the "malicious" content isn't in the email body, but embedded within a trusted system notification. 

Key Takeaways 

• Trusted Notification Abuse: Because the notification comes from the user’s own calendar service (e.g., "New Meeting Added"), it inherits a high level of trust and often bypasses spam folders. 

• The "Auto-Add" Vulnerability: Many calendar settings are configured to automatically add invitations to the calendar even before the user accepts them, making the malicious link persistent on their schedule. 

• Credential Harvesting: The "Meeting Link" typically leads to a sophisticated spoofed login page (often masquerading as Microsoft Teams or Zoom) designed to steal corporate credentials. 

• Mobile Exploitation: These attacks are particularly effective on mobile devices, where calendar notifications are prominent and users are less likely to inspect the underlying URL before clicking. 

• The Fix: Configure calendar settings to disable "Automatically add invitations" from unknown senders. Security teams should also implement URL rewriting and "Time of Click" protection for links found within calendar events. 

Further Reading: New Phishing Attack Weaponizing Event Invitations 

ClickFix: Fake macOS Utility Lures Deliver Infostealers 

Summary Microsoft Threat Intelligence has analyzed a new wave of ClickFix attacks specifically targeting macOS users. Attackers compromise legitimate websites to display fake "browser update" or "system error" overlays. These overlays prompt users to fix the issue by copying a malicious command and running it via the macOS Terminal or Script Editor. This "copy-paste" tactic allows the malware to bypass macOS Gatekeeper and XProtect to install the Atomic Stealer (AMOS). 

Key Takeaways 

• The "Copy-Paste" Bypass: By tricking the user into manually executing the command, the attacker circumvents many of Apple's built-in security features that normally prevent the execution of unsigned or untrusted software. 

• Malicious Scripting: The pasted commands typically use osascript (AppleScript) or curl to download and execute the primary payload—often Atomic Stealer (AMOS)—directly in memory or hidden directories. 

• Data Exfiltration: Once the stealer is active, it targets high-value data, including keychain passwords, browser cookies, credit card info, and cryptocurrency wallets. 

• High-Pressure Lures: The attack uses sophisticated "system-style" pop-ups that mimic macOS system notifications, creating a false sense of urgency and legitimacy for the "required" fix. 

• The Fix: Users should be trained that no website will ever require a Terminal command to "fix" a browser error. Organizations should monitor for unusual osascript or curl execution patterns via EDR. 

Further Reading: ClickFix campaign uses fake macOS utilities lures to deliver infostealers 

Hackers Abuse Google Ads and Claude AI Chats to Push Mac Malware 

Summary Security researchers have identified a sophisticated campaign where hackers are buying Google Ads to promote fake versions of Claude AI. These ads lead victims to highly convincing websites that mimic Anthropic’s interface but deliver a "ClickFix" style lure. Instead of a chat interface, users are told they need to "update their system" or "install a browser component" to use the AI, which results in the installation of the Atomic Stealer (AMOS) on macOS. 

Key Takeaways 

• Search Engine Hijacking: Attackers are outbidding legitimate companies for top search spots. When a user searches for "Claude AI," the top "Sponsored" result leads to a malware distribution site rather than the real claude.ai. 

• AI Brand Impersonation: The campaign exploits the current high demand for AI tools. By using the Claude brand, attackers target professional and creative users who are likely to be using high-value macOS workstations. 

• The "ClickFix" Evolution: The site uses a fake "terminal fix" pop-up. It provides a string of code for the user to copy and paste into their macOS Terminal, claiming it will "unlock" the AI chat features. 

• Stealer Capabilities: Once the command is run, Atomic Stealer (AMOS) is installed. It immediately targets the macOS Keychain, browser-stored passwords, credit card information, and cryptocurrency wallet extensions. 

• The Fix: Never click on "Sponsored" search results for software downloads. Always navigate directly to the official domain or use the Mac App Store. Organizations should use ad-blocking at the network level and restrict Terminal usage via MDM for non-technical staff. 

Further Reading: Hackers abuse Google Ads, Claude AI chats to push Mac malware 

FBI Alert: ShinyHunters Attacks Learning Management System 

Summary 

The FBI’s Internet Crime Complaint Center (IC3) issued a Public Service Announcement regarding a massive cyber-attack claimed by the cybercriminal group ShinyHunters. The breach targeted a widely used online Learning Management System (LMS)—extensively reported to be Canvas—resulting in widespread service interruptions for educational institutions nationwide and the theft of massive troves of student and faculty data.  

Key Takeaways 

• High-Pressure Extortion: ShinyHunters is known for aggressive pressure tactics. Beyond emailing institutions, they frequently escalate extortion by sending threatening text messages, placing phone calls to victims and their families, and executing dangerous swatting attacks.  

• Bluffing with Sensitive Data: Attackers often exaggerate their access, falsely claiming to possess highly compromised or embarrassing photographs and videos of victims to force quick extortion payments.  

• Follow-on Spearphishing: The stolen database allows threat actors to craft highly convincing, personalized spearphishing campaigns using real-world academic contexts to target students, parents, and faculty.  

• Identity Reuse and Resale: Stolen credentials and profile details are frequently sold to other criminals or reused to impersonate financial aid offices, school faculty, and local campus IT support.  

• The Fix: Educational entities must audit exposed cloud-management platforms and third-party SaaS integrations. Affected individuals should wait for formal institution guidance, treat any out-of-the-blue school or law enforcement communication with extreme skepticism, and immediately protect associated accounts.  

Further Reading: ShinyHunters: Cyber Criminal Group Attacks Learning Management System 

Before the First Whistle: The 2026 World Cup Scams 

The Big Picture With the 2026 World Cup just around the corner, cybercriminals are already working overtime to cash in on the excitement. Fraudsters are using automated artificial intelligence (AI) tools to flood the internet with thousands of fake websites. These sites are designed to look exactly like official platforms but exist solely to steal your hard-earned money and personal information. 

How the Scams Work 

• The "Too Good to Be True" Official Store: Scammers create professional-looking online shops using fake addresses like fifaofficialstore[.]shop. They offer World Cup jerseys, hats, and souvenirs at massive discounts (like "80% off") to trick you into entering your credit card details. 

• The "Guaranteed Cash" Prediction Games: Fraudsters are launching fake online forums and mobile apps (such as fifa2026guess[.]com). They promise that if you deposit a small amount of money and "vote" or predict who will win a match, you will earn guaranteed daily cash profits. In reality, once you deposit your money, it disappears. 

• Shady Betting Hubs: Unofficial betting websites are popping up everywhere, often pushing users to "Download our app now" to get free betting credits. These downloadable apps are actually hidden viruses (malware) that can spy on your phone or computer. 

Further Reading: Before the First Whistle: How Cyber Criminals Are Targeting World Cup 2026 

Microsoft to Stop Sending SMS Codes for Personal Accounts 

Summary In a major shift to digital safety, Microsoft has announced it is phasing out text message (SMS) verification codes for personal accounts. For years, typing in a code sent via text has been the standard way to log in or reset a password. However, Microsoft is pulling the plug on this feature because text messages are no longer safe enough to protect your digital identity. 

How the Changes Work 

• Why SMS is Leaving: Microsoft states that text-message verification has become a leading source of fraud. Scammers have found easy ways to intercept text messages through tricks like "SIM-swapping" (where they steal your phone number) or fake login pages that trick you into typing your code. 

• The New Standards: Microsoft is completely removing the option to add or use a phone number for login codes. Instead, they are forcing a move to more modern, "passwordless" alternatives that hackers cannot easily steal. 

• The "Passkey" Alternative: When logging in, users will see a prompt to "Sign in faster" and create a passkey. A passkey links your account directly to your specific device (like your smartphone or computer) and lets you log in instantly using your face (Face ID), fingerprint, or device PIN. 

• Backup Account Recovery: To ensure you don't get locked out if you lose your device, Microsoft is moving account recovery entirely over to verified secondary email addresses, which will act as the primary safety net alongside passkeys. 

Further Reading: Microsoft to stop sending SMS codes for personal accounts 

Inside a Criminal Phishing Panel 

Summary 

Security researchers at Push Security infiltrated an active, real-time phishing command center used by notorious hacking groups like ShinyHunters and BlackFile. Unlike traditional automated scams, these operations are human-led and highly interactive. Attackers use live admin dashboards (such as "Doko's Panel") to manually manipulate victims in real time, tricking them into handing over passwords and security codes for corporate accounts like Google, Microsoft, Okta, and major cryptocurrency exchanges.  

How the Attacks Work 

• The Live Phone Trap: The attack often begins with a voice call (vishing). A scammer spoofing your company’s IT helpdesk phone number calls you, using real employee names or internal support ticket numbers to sound highly legitimate. They direct you to a fake login web address under the guise of a "mandatory security update."  

• The Real-Time Middleman: When you enter the fake website, you are faced with a spinning loading wheel. Behind the scenes, the hacker is sitting at their admin panel, manually watching you connect. Once they click "accept," the site mirrors a flawless login page for your organization.  

• Stealing Your Multi-Factor Code: When you type in your username and password, it instantly pops up on the hacker's screen or their private Telegram channel. The hacker manually typed those credentials into the real company login portal. If the real portal asks for an SMS code or an authenticator prompt, the hacker pushes a button on their panel to make your screen say "Please enter your SMS code."  

• The Final Deception: You type in your security code, thinking it's a standard login. The hacker steals that code, inputs it into the real system, and completely hijacks your logged-in session. To keep you from realizing what just happened, their panel automatically redirects your browser to a harmless page, like Google Drive or a fake "Support Ticket Closed" confirmation.  

Further Reading: We infiltrated a criminal phishing panel: here's what we found 

How Three Techniques Are Behind ShinyHunters' 2026 Campaigns 

Summary 

Security researchers at Push Security analyzed the massive hack of Instructure, the parent company behind the widely used Canvas learning management platform. The cybercriminal group ShinyHunters claimed responsibility for the breach, which exposed 3.65 terabytes of data across nearly 9,000 schools and universities globally. Investigators revealed that this breach was part of a broader cyber campaign where attackers use sophisticated, browser-based identity tricks to completely bypass a company’s standard network firewalls and security defenses.  

How the Attacks Work 

• The "Helpdesk" Phone Trap (Vishing & AiTM): Scammers call an employee pretending to be company IT support, creating fake urgency about a "mandatory security update." They direct the victim to a fake login website. Working live in the background, the attacker captures the employee's username, password, and multi-factor authentication (MFA) code, using it to completely clone their logged-in browser session.  

• The Fake App Trick (Device Code Phishing): Attackers exploit a login feature meant for smart TVs and office printers. The hacker sets up a malicious application that mimics a trusted business tool (like Salesforce). They call the employee and trick them into typing a short confirmation code into their real work account, which unknowingly grants the hacker permanent, invisible access to the company’s internal records.  

• The Domino Effect (SaaS Supply Chain Attacks): Many business applications and learning tools are linked together online to share data automatically. The analysis showed that instead of attacking every school individually, hackers target the third-party platforms themselves. Once a master system or vendor like Instructure is breached, the attacker can use those pre-existing technical pathways to slide into thousands of connected downstream school and business accounts.  

Further Reading: How three techniques are behind ShinyHunters' 2026 campaigns - Push Security 

Fake Gemini and Claude Code Sites Deliver Infostealer Malware 

Summary 

Security researchers at EclecticIQ have discovered a cyber campaign targeting software developers and technical workers. Threat actors are creating highly convincing fake websites that impersonate official AI development tools—specifically Google's Gemini command-line interface (CLI) and Anthropic's Claude Code. Instead of getting helpful AI programming assistants, unsuspecting users who download from these sites are infected with a hidden virus that steals sensitive corporate data.  

How the Scams Work 

• The Search Engine Trap (SEO Poisoning): When developers search online for installation instructions for tools like Gemini CLI or Claude Code, hackers use search engine manipulation (SEO poisoning) to push their fraudulent websites (like geminicli[.]co[.]com or claudecode[.]co[.]com) to the very top of the results page, above the real sites. 

• The Visual Clone: The fake sites are exact visual clones of official Google and Anthropic documentation pages. This high level of detail tricks even tech-savvy professionals into believing they are in the right place.  

• The Copy-and-Paste Trick: The fake website presents the user with a standard-looking setup command and instructs them to copy and paste it into their computer's terminal or PowerShell window to "install" the AI tool.  

• The Silent Takeover: Once pasted and run, the command silently reaches out to an attacker-controlled server to download an "infostealer" program. The virus runs entirely in the computer's memory to avoid triggering standard security software warnings. It immediately sweeps the system to steal saved browser passwords, corporate VPN logins, security tokens, and sensitive work files.  

Further Reading: SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer 

Scammers Weaponize Official Microsoft Email System 

Summary 

Security researchers have discovered that cybercriminals are exploiting a loophole in an internal Microsoft system to send spam and phishing messages directly from an official Microsoft email address (msonlineservicesteam@microsoftonline.com). Because the emails originate from Microsoft's actual servers, they easily bypass traditional spam filters and inbox security measures, making them exceptionally dangerous to everyday users.  

How the Scams Work 

• The Trusted Address: The email address being abused is normally used by Microsoft to send important notices, such as multi-factor authentication (MFA) security codes or billing updates.  

• The "Tenant Branding" Loophole: Scammers start by creating a free, temporary Microsoft business account. They navigate to the account profile settings and change the "Organization Name" or "Tenant Name" field to a fraudulent scam message—such as a fake notice about a Bitcoin purchase or a fake financial emergency.  

• The Forced Notification: Once the scammer inputs their fake message into the name field, they trigger an automated verification email from Microsoft to be sent to the victim (for instance, by attempting to add the victim's email address to their fraudulent account).  

• The Inbox Delivery: When the official email arrives in the victim's inbox, Microsoft’s automated template places the scammer’s text right into the subject line or body text. Since the email is technically authentic, signed by Microsoft, and contains no malicious attachments, your email provider assumes it is completely safe and delivers it straight to your primary inbox.  

• The Tech Support Trap: The text pushed into the email usually includes an urgent call-to-action, such as a fraudulent customer support phone number. Victims who call the number are connected to scammers who attempt to steal their credit card details or trick them into downloading remote-control malware.  

Further Reading: Internal Microsoft account being used to send scams, phishing links 

YouTube Simplifies and Automates AI Video Labels 

Summary YouTube has updated its AI transparency systems to make it easier for viewers to spot AI-generated content. While video creators have been required to manually disclose realistic AI usage since 2024, YouTube is now moving these labels to highly visible locations and introducing automated scanners to automatically flag unlabeled AI videos. 

Key Takeaways 

• Highly Visible Labels: AI disclosures are moving to prominent locations. For standard long-form videos, the label will sit directly under the video player. For short-form YouTube Shorts, the AI tag will appear as a permanent visual overlay right on top of the video. 

• Automated AI Scanners: If a video uses photorealistic AI but the creator fails to disclose it during upload, YouTube's built-in detection systems will automatically scan the video and apply the AI label. 

• Creator Appeal System: Creators can manually remove an automated label through YouTube Studio if they believe the system made a mistake. However, labels are permanent for videos made with YouTube’s own AI tools or those carrying verifiable AI digital metadata. 

• No Revenue Penalties: Applying an AI label does not negatively impact a video's performance. It will not restrict how the video is recommended to other viewers, nor will it affect the creator's ability to earn advertising money. 

Further Reading: Improving AI labels for viewers and creators - YouTube Blog 

Hackers Hijack Thousands of Sites for ClickFix and FakeUpdate Attacks 

Summary A large-scale cyber campaign has hijacked thousands of legitimate websites to display fake system warnings. These alerts use "ClickFix" and "FakeUpdate" tactics to trick visitors into manually running commands that download data-stealing viruses onto their computers. 

Key Items 

• Mass Website Compromise: Attackers inject malicious scripts into regular websites to display full-screen overlays mimicking official Windows Updates or security checks. 

• The Pastejacking Trick: The fake screens instruct users to click a button that copies a hidden script, then guide them to paste and run it in their computer's Command Prompt or Terminal. 

• Hidden in Pictures: The malicious code is hidden inside the microscopic color pixels of normal background images, allowing the virus to bypass standard security software. 

• Silent Data Theft: Once executed, the system installs an infostealer virus that instantly sweeps the device for saved browser passwords, corporate logins, and crypto wallets. 

Further Reading: Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks 

Why Vishing Is the Ultimate Bypass for Corporate Security

This was written for as a blog post for a security awareness program. Feel free to grab and use in your own program.

We’ve spent decades training employees to look out for suspicious email attachments, broken English in phishing emails, and dodgy domain names. As a result, email security gateways are smarter than ever, and employees are getting better at spotting traditional spam.

So, how are attackers bypassing cybersecurity infrastructure?

They’re picking up the phone.

Welcome to the era of Vishing (Voice Phishing). By blending modern technology with classic psychological manipulation, voice-based social engineering has quickly become one of the most effective threat vectors targeting organizations today.

Why Firewalls Can’t Stop a Phone Call

Traditional cyber defenses are built to monitor data packets, scan emails, and block malicious IP addresses. A phone call bypasses all of it. When an attacker calls an employee, they are engaging directly with the organization’s most flexible and most vulnerable security perimeter: human behavior.

Vishing attacks are particularly dangerous because they exploit real-time conversational dynamics:

• Urgency: Attackers create high-stress scenarios (e.g., "Your account will be suspended in 5 minutes") that trigger panic and disable critical thinking.

• Authority: They impersonate IT staff, executive leadership, or external auditors to leverage employee compliance.

• Trust: A friendly, helpful tone breaks down natural suspicion far faster than a toneless email.

3 Corporate Vishing Tactics You Need to Know

1. Internal IT & Helpdesk Impersonation 

Posing as internal IT support or employees is currently the single most common enterprise vishing tactic. Attackers execute this in two ways:

• Targeting Employees: An attacker calls an employee claiming there is an urgent security patch, email migration, or compromised account. They persuade the employee to reveal login credentials by going to a URL they control and then input or  read back a One-Time Password (OTP).

• Targeting the Helpdesk: The attacker calls internal IT support posing as a real employee (using details scraped from LinkedIn or public profiles). They trick helpdesk agents into resetting the target’s password or registering a new device to bypass MFA entirely.

2. Telephone-Oriented Attack Delivery (TOAD / Callback Phishing)

Instead of placing cold calls, attackers send an email disguised as an urgent receipt or subscription renewal (e.g., "Your service will auto-renew for $500 in 2 hours"). The email intentionally contains no malicious links—only a support phone number. When the anxious recipient calls to cancel the charge, they are routed to a live scammer who guides them through a payment portal the control, installing remote-access software, or revealing sensitive data.

3. Executive & Direct Manager Impersonation

Using spoofed caller IDs—and increasingly, AI voice cloning built from podcasts, webinars, or social media—attackers impersonate company leadership. While traditional scams focused on C-suite executives (like the CEO or CFO) pressuring finance staff for urgent wire transfers, modern vishers frequently target everyday employees by impersonating their direct manager.

By mapping out org charts on LinkedIn, an attacker identifies who an employee reports to, calls them posing as their immediate boss, and demands an urgent task—such as sharing confidential files, approving an MFA prompt, or making quick gift card purchases. Because employees naturally want to be responsive to their direct supervisor, they are far less likely to question authority or double-check verification procedures.

The Employee Defense Playbook: 4 Rules to Stay Safe

To protect yourself against vishing attacks, incorporate these fundamental rules into your daily workflow:

1. Out-of-Band Verification is Mandatory

If anyone calls claiming to be from internal IT, executive leadership, or a critical vendor asking for sensitive actions (password resets, financial transfers, access grants), hang up. Contact them back using an official, internal communication channel (e.g., Slack, Teams, or an internal directory phone number).

2. Never Share Passwords, Multi-Factor Authentication (MFA) Codes, or Trust Unverified URLs

Passwords and Multi-Factor Authentication (MFA) codes sent via SMS or authenticator apps are strictly for your eyes only. No legitimate IT department, bank, or vendor will ever call asking you to read back an MFA code, reveal your password, or approve an unsolicited MFA push prompt over the phone.

Additionally, be extremely cautious if a caller directs you to a website to "verify your identity," reset your password, or update settings. Attackers frequently set up malicious lookalike URLs that appear to be Acadia-owned (e.g., acadia-verify-login.com or acadia-support-portal.net instead of our official domain). Always verify domain spellings carefully and navigate to official corporate portals directly rather than typing in URLs provided over the phone.

3. Beware of Unsolicited Remote Access Requests

Be extremely cautious if a caller asks you to install remote administration tools like AnyDesk, TeamViewer, or LogMeIn. Unless you opened a ticket through your company's official IT portal, never grant remote desktop access.

4. Trust Your Instincts: Ditch the Pleasantries and Verify

Healthy skepticism is your sharpest line of defense. As you speak with a caller, listen to your gut. If something feels rushed, unusual, or slightly off, pay attention to those internal alarm bells. Attackers actively exploit corporate politeness and social pressure, relying on your desire to be helpful so you won't challenge them.

When your intuition tells you a call isn't right, skip the polite small talk and drop the fear of appearing rude. Cut straight to the point and inform them firmly: "I need to verify this request through our official internal channels before we proceed," and hang up. Reaching out through a trusted, known method to confirm identity isn't being difficult—it's enforcing standard corporate security protocol. 

What to Do If You Suspect a Vishing Attempt

Act Fast: Report Immediately—No Shame, No Blame

If you receive a suspicious call—or realize after hanging up that you accidentally shared credentials, clicked a link, or provided an MFA code—do not let fear or embarrassment keep you silent. Cybercriminals are highly trained manipulators, and anyone can be caught off guard.

The worst thing you can do after a potential slip-up is freeze. The delay between when a mistake happens and when it gets reported is the exact window an attacker needs to move laterally through the system, escalate their privileges, and cause catastrophic network-wide damage or steal troves of sensitive data.

Reporting the incident right away gives your Security and IT teams the immediate head start they need to revoke active session tokens, isolate compromised endpoints, and lock the attacker out before they dig in. An immediate report turns a potentially devastating breach into a quick, minor cleanup. Your Cybersecurity and IT teams will always prefer spending minutes resetting an account today over weeks spent recovering from a full blown security incident.

What are Passkeys and Why Are They Replacing SMS Codes

I wrote this for an internal security awareness program. Feel free to copy and use within your own security awareness program. Generated by Gemini and edited by a human.

Imagine checking your inbox only to find an alert that your primary email account has been compromised. You had SMS-based two-factor authentication (MFA) turned on, so you thought you were safe. How did this happen?

The reality is that hackers have gotten incredibly good at intercepting text messages. Cybercriminals routinely bypass SMS codes through tactics like "SIM-swapping" (where they trick your mobile carrier into assigning your phone number to their SIM card) or using clever phishing sites that steal both your password and your security code in real-time.

Tech giants have taken notice. In a major shift for consumer security, Microsoft announced that it is officially phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts. According to Microsoft, SMS-based authentication has become a leading source of fraud and account takeover vectors.

So, if text message codes are going away, what are we supposed to use instead?

The answer is Passkeys.

What is a Passkey?

A passkey is a modern, passwordless alternative to logging in. Instead of creating, memorizing, and typing a complex string of characters, a passkey allows you to sign into websites and apps using the same biometric features or PIN you already use to unlock your phone, tablet, or computer.

If you use Face ID, Touch ID, Google Fingerprint, or a Windows Hello PIN to unlock your device, you already know how to use a passkey.

How Do Passkeys Work? (Without the Tech Jargon)

When you use a traditional password, both you and the website have to "know" the secret. If a hacker breaches the website’s database, they steal your secret.

Passkeys work on a public-private key pair system:

1. The Public Key: When you create an account, your device generates a public key and sends it to the website (like Microsoft, Google, or Amazon). This key is completely useless to a hacker; it’s just one half of a digital lock.

2. The Private Key: Your device creates a matching private key. This key never leaves your device. It is securely locked away in your phone or computer's hardware.

When you try to log in, the website sends a "challenge" to your device. Your device uses your face, fingerprint, or PIN to verify that you are physically holding the device. Once verified, the private key signs the challenge and unlocks the account.

Why Passkeys Are The Way Forward

Passkeys aren’t just a minor upgrade from passwords; they are an entirely new class of defense:

• They Are Phishing-Resistant: This is their superpower. Traditional phishing works because a hacker can trick you into typing your password and SMS code into a fake website that looks identical to the real one. Passkeys cannot be phished. Because the passkey is tied to the actual domain name of the website, your device will refuse to share its private key with a fake or spoofed URL. If you land on a malicious clone of a login page, the passkey simply won't trigger.

• No More Credential Stuffing: Since there are no passwords to steal, a data breach at a website you use won’t result in hackers exposing a password that is used on multiple accounts.

• Seamless Convenience: You don't have to open an authenticator app; wait for a text message to arrive; or struggle to remember if your password requires an exclamation mark or an uppercase letter. Logging in takes a fraction of a second.

What Happens If I Lose My Device?

One of the most common concerns about passkeys is: "If my passkey is saved to my phone, what happens if I drop my phone in a lake?"

Thankfully, you won't be locked out of your digital life. Companies like Apple, Google, and Microsoft automatically sync your passkeys to your cloud account (e.g., iCloud Keychain, Google Password Manager, or Microsoft Credential Provider). If you get a new phone, logging into your cloud account securely restores your passkeys.

Furthermore, as companies like Microsoft phase out SMS, they are prompting users to establish verified backup emails alongside their passkeys to ensure robust account recovery options are always available.

How to Get Started with Passkeys Today

Transitioning to passkeys is incredibly simple, and you don’t have to switch all your accounts over at once. You can activate them entirely at your own pace.

Here is how you can get started right now:

1. Enable Device Security: First, ensure that your smartphone, tablet, or computer has a secure unlock method turned on—such as Apple Face ID/Touch ID, Android Fingerprint/PIN, or Windows Hello.

2. Check Your Account Settings: Log into a service that supports the technology (such as Microsoft, Google, Apple, Amazon, or PayPal). Navigate to your Account Settings or Security/Sign-in menu.

3. Look for the Passkey Option: Look for a button that says "Create a Passkey," "Set up a Passkey," or "Go Passwordless."

4. Verify Your Biometrics: Your browser or device will prompt a pop-up asking if you want to save a passkey for that site. Confirm using your fingerprint, face, or device PIN.

Pro-Tip: If you prefer not to rely on Apple or Google's default cloud ecosystems to sync your passkeys, popular third-party password managers like 1Password, Bitwarden, and Dashlane fully support storing and syncing passkeys across different operating systems (e.g., using a passkey created on an iPhone to log into a Windows PC).

The Shift Is Happening Now

The era of the password and SMS MFA is drawing to a close. Microsoft's decision to drop SMS codes is a definitive signal that the industry is moving toward an inherently safer, passwordless standard.

The next time a website or app asks you if you’d like to "Sign in faster" or "Create a passkey," don't skip it. Take the 10 seconds to set it up. It is the easiest step you can take today to protect your digital identity from modern cyber threats.

March 2026 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Fake Dropbox Emails Used to Steal Login Details 

Attackers are circulating phishing emails that impersonate Dropbox and attempt to trick recipients into handing over their account credentials. The messages often look like routine business communications and include a PDF attachment. When opened, the document directs the user to a fake Dropbox login page designed to capture usernames and passwords. 

Key Points 

• Phishing emails are crafted to look like legitimate Dropbox notifications or file-sharing messages. 

• PDF attachments are used to make the email appear business-related and trustworthy. 

• Links inside the document lead to counterfeit login pages. 

• Entered credentials are captured by attackers and can be reused to access other accounts. 

• The technique relies on familiar brands and file formats to lower suspicion. 

Further Reading: CybersecurityNews 

DKIM Replay Attacks Abuse Trusted Email for Invoice and Support Scams 

Threat researchers are tracking a rise in DKIM replay attacks, where adversaries reuse legitimate, cryptographically signed emails from trusted services such as Apple and PayPal. Because these messages retain valid authentication, they can bypass email security controls and appear legitimate to recipients, even when used to deliver fraudulent invoices or support scams. 

Key Insights 

• DKIM replay attacks involve capturing a genuine, signed email and redistributing it without breaking authentication checks. 

• Since DKIM and DMARC validation still passes, many email defenses treat the replayed message as trusted. 

• Attackers commonly abuse invoice or notification workflows that allow user-controlled fields to inject scam content. 

• Messages often include urgent payment requests or fake support numbers designed to trigger rapid victim response. 

• DKIM verifies message integrity but does not restrict message reuse, making replay a persistent risk. 

Further Reading: Kaseya 

CrashFix: New ClickFix Variant Deploys Python Remote Access Trojan 

Threat researchers have identified a new evolution of the ClickFix social engineering campaign known as CrashFix. This variant intentionally crashes a victim’s browser and presents a deceptive recovery prompt that convinces users to manually execute commands on their own systems. The interaction ultimately leads to the installation of a Python-based remote access trojan, giving attackers persistent access to compromised devices. 

Key Insights 

• CrashFix commonly begins with users being prompted to install a malicious browser extension disguised as a legitimate utility, such as an ad blocker. 

• The extension later forces the browser into a crash state, creating urgency and the illusion of a technical failure. 

• Victims are shown fake troubleshooting instructions that direct them to run system commands, unknowingly initiating the infection chain. 

• The attack leverages built-in Windows tools and scripting to deploy a Python-based remote access trojan that enables surveillance and long-term access. 

• The campaign appears designed to prioritize enterprise environments, including systems connected to corporate domains. 

Further Reading: Microsoft Security Blog 

Why Even Smart People Fall for Phishing Attacks 

Phishing doesn’t succeed because people are careless — it works because attackers understand how human decision-making works under pressure. Researchers found that phishing messages are deliberately designed to exploit emotions, habits, and cognitive shortcuts people rely on during busy workdays. When distracted or rushed, even experienced professionals can make quick decisions that feel reasonable in the moment but lead to compromise. 

Key Insights 

• Phishing messages are often built around a simple pattern: grab attention, create emotional pressure, and prompt immediate action. 

• Common tactics rely on urgency, fear, authority, or trust to override careful thinking. 

• People tend to overestimate their ability to spot scams, which can make them more vulnerable. 

• Multitasking and information overload reduce the ability to notice subtle warning signs. 

• Familiar branding and realistic language can create a false sense of safety, even when the message is malicious. 

Further Reading: Unit 42 – The Psychology of Phishing 

SaaS Abuse at Scale: Phone-Based Scam Campaign Leveraging Trusted Platforms 

Threat researchers have identified a large-scale scam campaign in which attackers abuse legitimate SaaS platform features to deliver phone-based fraud lures. Rather than relying on malicious links or spoofed domains, the campaign misuses native notification and messaging workflows from trusted services, causing emails to appear authentic and pass standard security checks. Victims are directed to call attacker-controlled phone numbers, shifting the final stage of the scam to voice-based social engineering. 

Key Insights 

• Attackers exploit built-in notification systems within SaaS platforms to generate messages that inherit trust from legitimate services. 

• The campaign operated at significant scale, impacting tens of thousands of organizations worldwide. 

• Emails frequently avoid malicious links and instead instruct recipients to call fake support phone numbers. 

• Multiple abuse techniques were observed, including misuse of general SaaS messaging and business invitation workflows. 

• The activity reflects a broader shift toward abusing trusted platforms rather than deploying traditional phishing infrastructure. 

Further Reading: Check Point Research 

Discord Rolls Out “Teen-by-Default” Safety Settings Worldwide 

Discord has announced a global rollout of “teen-by-default” safety settings beginning in early March 2026. Under this change, all new and existing users will initially experience a teen-appropriate version of the platform unless they verify their age as an adult. The update is part of Discord’s broader push to strengthen age-appropriate safeguards and align with evolving global safety expectations. 

Key Points 

• All accounts will default to a teen-appropriate mode with stricter content and communication controls. 

• Users must complete age verification to access adult-restricted spaces and features. 

• Sensitive content may be blurred, and messaging from unfamiliar accounts can be limited under default settings. 

• Age verification methods include options such as on-device facial age estimation or ID verification. 

• The rollout builds on previous regional safety updates and expands protections globally. 

Further Reading: Discord 

Exposed OpenClaw AI Instances Raise Security Concerns 

Recent research highlights growing security risks tied to exposed OpenClaw AI agent instances. OpenClaw is a self-hosted AI assistant platform that users can deploy to automate messaging, data access, and system tasks. However, many deployments are being misconfigured and left accessible on the public internet, creating opportunities for unauthorized access and potential compromise. 

Key Points 

• Thousands of OpenClaw instances were found exposed online due to insecure configuration settings. 

• Some instances lacked strong authentication controls, allowing external parties to interact with the AI agent. 

• Because OpenClaw integrates with messaging platforms, cloud tools, and local systems, an exposed setup could provide indirect access to connected accounts and sensitive data. 

• Researchers observed scanning activity shortly after instances became publicly accessible, demonstrating how quickly exposed services attract attention. 

• The ease of deployment may contribute to widespread adoption, but also increases the likelihood of insecure configurations. 

Further Reading: Bitsight 

QR Codes Used as an Attack Vector in Phishing and Malware Campaigns 

Threat researchers have documented an increase in malicious use of QR codes by attackers. QR codes — once primarily a convenience tool for quickly linking users to URLs — are now being embedded in phishing campaigns, physical media, and social engineering lures. Because many people instinctively trust QR codes and may not check the underlying link before scanning, attackers can use them to direct victims to sites hosting credential-harvesting pages, malware downloads, or other harmful content. This trend shows how even familiar convenience features can be abused when users aren’t aware of the risks. 

Key Insights 

• QR codes are being inserted into phishing emails, SMS messages, posters, and social media posts to silently redirect users to malicious destinations. 

• Scanning a QR code can open links that lead to credential-harvesting pages that mimic legitimate services, increasing the chance of compromise. 

• QR codes can also deliver links to files or installers, which victims may download unknowingly. 

• Because QR codes obscure the actual URL, they make it harder for users to assess safety before interacting. 

• Awareness of this technique is critical, as attackers blend convenience with malicious intent in everyday workflows. 

Further Reading: Unit 42 

Infostealer Malware Targets OpenClaw AI Agent Secrets 

Security researchers have identified infostealer malware expanding its focus to include OpenClaw AI assistant environments. Traditionally known for stealing browser credentials and system data, these threats are now targeting AI agent configuration files that may contain API keys, authentication tokens, and other sensitive secrets. 

Key Points 

• Infostealer malware is harvesting configuration files associated with OpenClaw AI assistants. 

• Stolen data may include API keys, authentication tokens, and other credentials used to access connected services. 

• This marks a shift from browser-only credential theft to targeting locally stored AI agent secrets. 

• Because configuration files are often stored in user directories, traditional infostealers can easily locate and exfiltrate them. 

• AI agent credentials should be treated with the same level of protection as passwords and other sensitive secrets. 

Further Reading: BleepingComputer – Infostealer Malware Found Stealing OpenClaw Secrets for First Time 

Romance Scam Victims Often Feel Shame and Financial Loss 

A recent survey of more than 2,000 U.S. adults found that many people who fall for romance scams struggle with embarrassment and underreporting, making it harder for others to learn from these crimes. These scams occur when someone posing as a romantic interest tricks victims into sending money or sharing sensitive details, often through fake profiles on social media or dating apps. Such experiences can cause both emotional distress and significant financial harm. 

Key Points 

• Around half of survey respondents found it harder to admit falling for a romance scam than other types of fraud, which can discourage reporting and awareness. 

• Many people who use digital platforms to meet others notice fraudulent or fake profiles on dating sites and social media. 

• A notable portion of people reported losing money, with typical losses ranging into the low thousands of dollars. 

• Even after financial loss, many victims continue to feel stigma, and some choose not to report their experiences to authorities or support networks. 

• These scams tend to occur where people seek connection online, highlighting the need for caution and awareness on digital platforms. 

Further Reading: NordProtect Romance Scam Survey 

Huntress Report Reveals How Organized Cybercrime Operates at Scale 

A new 2026 Cyber Threat Report from Huntress lays out how modern cybercriminals have evolved into highly efficient, profit-driven operators — running campaigns that resemble legitimate businesses rather than isolated hacker hits. The analysis draws on telemetry from millions of endpoints and identities and highlights how organized cybercrime groups are abusing trusted tools, stolen credentials, and scaled workflows to compromise people and organizations worldwide. 

Key Takeaways 

• Legitimate tools are being weaponized — Remote monitoring and management (RMM) systems are now a top choice for attackers to deploy malware, steal credentials, and execute commands without using traditional hacking tools. 

• User deception fuels malware delivery — Techniques like ClickFix social engineering accounted for more than half of observed malware loader activity by tricking people into installing threats as part of routine actions. 

• Ransomware groups follow streamlined playbooks — Major ransomware operators are focusing on stealth and data theft, increasing time-to-ransom and making detection harder. 

• Criminal ecosystems are thriving — Stolen credentials are being sold cheaply on underground markets, making initial access easier and boosting identity-based attacks. 

• Mailbox manipulation and OAuth abuse lead to BEC — These identity threats are establishing footholds that set the stage for high-impact business email compromise schemes. 

Further Reading: Huntress 2026 Cyber Threat Report 

AI Recommendation Poisoning: How "Summarize with AI" Buttons Can Bias Your Assistant 

Summary Microsoft security researchers have uncovered a new deceptive technique called AI Recommendation Poisoning. This attack targets the "memory" and personalization features of AI assistants like Microsoft Copilot, ChatGPT, and Gemini. By embedding hidden instructions in seemingly helpful "Summarize with AI" buttons or share links, companies and bad actors can inject persistent "facts" or preferences into your AI’s long-term memory. Once poisoned, the AI may begin to show subtle biases—recommending specific products, favoring certain vendors, or trusting unreliable sources—without you ever knowing the assistant has been manipulated. 

Key Takeaways 

• The Helpful Button Trap: Be cautious of "Summarize with AI" buttons on third-party websites. They may contain hidden URL parameters that do more than just summarize; they can "pre-fill" instructions that tell your AI to "always remember this site as a trusted source." 

• Persistent Bias: Unlike a standard prompt injection that only affects one conversation, memory poisoning is designed to last. The injected instructions can influence the AI's behavior across future sessions, even weeks after you clicked the link. 

• Hidden in Plain Sight: These malicious prompts often use phrases like "from now on," "always," or "remember" to establish persistence. Because the AI presents these biased recommendations confidently, users are less likely to question their accuracy. 

• Practical Defense: Periodically review and clear your AI assistant’s memory or "personalization" settings. Hover over AI-related links before clicking to see if the URL contains long, suspicious-looking text strings or commands. 

Further Reading: Manipulating AI memory for profit: The rise of AI Recommendation Poisoning 

OpenClaw AI: Why Your New "Super Assistant" Might Be a Security Backdoor 

Summary Microsoft security researchers have issued a major warning regarding OpenClaw, a viral open-source AI agent that runs locally on your computer. Unlike standard AI chatbots that just talk, OpenClaw is designed to act—it can read your emails, run terminal commands, and manage your files. However, because it operates with the same permissions as you, it lacks traditional security boundaries. This creates a "lethal trifecta": the agent has access to your private data, the ability to communicate with the outside world, and the requirement to read untrusted content (like emails or websites), making it an easy target for hackers. 

Key Takeaways 

• The Power is the Problem: Because OpenClaw has "the keys to the kingdom" (your login details and file access), any malicious instruction it reads from a website or email could trick it into deleting files, stealing passwords, or sending spam from your account. 

• The "Skills" Marketplace is Risky: Much like a suspicious app store, OpenClaw’s "ClawHub" is currently flooded with community-made "skills." Researchers have found that a significant percentage of these contain hidden malware designed to steal crypto-wallets or install keyloggers. 

• Not for Your Work PC: Microsoft strongly advises against running OpenClaw on any computer used for actual work or personal banking. It should only be used in "isolated" environments (like a dedicated Virtual Machine) where it cannot access your sensitive identities. 

• Treat it as Untrusted Code: If you are testing OpenClaw, never give it access to your primary email or password manager. Assume that anything the agent "sees" or "remembers" could potentially be exfiltrated if the agent is manipulated by an external prompt. 

Further Reading: Running OpenClaw safely: identity, isolation, and runtime risk 

Hook, Line, and Vault: How the 1Phish Tool Steals Your Corporate Identity 

Summary Security researchers have detailed a powerful new open-source phishing tool called 1Phish, designed specifically to target corporate employees. This tool goes beyond stealing passwords; it focuses on harvesting session cookies and tokens from high-value services like Okta, Microsoft, and Google. By tricking users into logging into a fake corporate portal, 1Phish allows attackers to "clone" an active login session. Once this happens, the attacker can bypass Multi-Factor Authentication (MFA) entirely and access the victim's work apps as if they were the legitimate employee. 

Key Takeaways 

• The "One-Click" Danger: 1Phish is designed for speed. Once a victim clicks a link and enters their credentials, the attacker has nearly instant access to their corporate account before the victim even realizes something is wrong. 

• MFA is Not a Total Shield: This tool specializes in "session hijacking." Because it captures the "authorization token" generated after you successfully complete an MFA prompt, the attacker doesn't need to know your MFA code to stay logged in. 

• Mimicking Corporate Portals: 1Phish makes it very easy for attackers to clone your company's specific login page, including custom branding and logos, making the fake site look exactly like the "Single Sign-On" (SSO) page you use every day. 

• Stay Alert on Redirects: Be wary of any login page that feels "glitchy" or redirects you multiple times. If you are prompted to log in to a service you are already signed into, close the tab and navigate to the site directly through a trusted bookmark. 

Further Reading: Hook, Line, and Vault: A Deep Dive into 1Phish 

February 2026 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Sophisticated ClickFix Campaign Targeting the Hospitality Sector 

A recent phishing campaign has been observed targeting the hospitality industry with a refined version of the ClickFix social-engineering technique. In this variant, victims are presented with what appears to be a routine human-verification prompt or CAPTCHA, but the displayed “fix” instructions lead them to execute commands on their systems. Once executed, these commands deploy remote-access malware that gives attackers control over endpoints, enabling credential theft, data exfiltration, or further malicious activity. Because the campaign leverages familiar prompts and trusted branding, users may be more likely to follow the steps without suspecting foul play. 

Key Insights 

• Attackers are tailoring ClickFix lures to the hospitality sector’s workflows and terminology. 

• The campaign uses fake verification prompts that instruct victims to run benign-looking commands. 

• Executing these commands installs remote-access malware that compromises devices. 

• Social engineering remains a powerful vector when paired with familiar user interactions. 

Further Reading: SecurityWeek 

Analyzing PhaltBlyx: Fake BSODs and Trusted Build Tools Used to Construct a Malware Infection 

Researchers have dissected a malware campaign involving PhaltBlyx, a deceptive infection method that combines social engineering with abuse of trusted development tools and fake system prompts. In this technique, victims encounter what appears to be a Blue Screen of Death (BSOD) or other alarming system error. Instead of indicating a real crash, the fake BSOD is used to convince the user to run repair or diagnostic tools — including legitimate build tools — that have been co-opted to execute malicious scripts. Once launched, these components pull additional payloads and establish persistence, often evading traditional security defenses because they’re routed through trusted binaries. 

Key Insights 

• Fake system errors like bogus BSODs are used to create urgency and lower user skepticism. 

• Attackers abuse trusted development/build tools to execute malicious scripts, making detection harder. 

• Once executed, these scripts fetch and deploy additional malware components. 

• Using legitimate tools helps the infection evade security controls that trust known binaries. 

Further Reading: Securonix 

The Truman Show Scam: Trapped in an AI-Generated Reality 

Researchers describe a mobile-focused scam dubbed The Truman Show Scam in which attackers use AI-generated audio and video to create highly convincing fake scenarios that manipulate victims. The scam leverages generative media to simulate trusted individuals or realistic situations — for example, mimicking a friend, coworker, or service agent — in order to extract sensitive information, push fraudulent transactions, or coerce victims into risky actions. The use of AI increases the believability of the bait, making traditional skepticism and simple heuristics less effective. 

Key Insights 

• Attackers leverage AI-generated audio/video to simulate real people or situations with high fidelity. 

• The convincing nature of generative media reduces user suspicion and increases interaction rates. 

• Scams may involve spoofed identities of friends, colleagues, or service representatives. 

• AI media can be used to pressure victims into disclosing credentials, payment details, or other sensitive data. 

Further Reading: Check Point Mobile Security Blog 

Cyber Criminal Ecosystem Analysis 

Researchers have mapped the modern cyber criminal ecosystem, revealing how threat actors operate with increasing organization and specialization. Instead of lone attackers working in isolation, today’s underground economy functions more like a service industry — with distinct roles and marketplaces for phishing kits, malware, access brokers, and human-based attack services. This division of labor allows even low-skilled attackers to launch sophisticated campaigns by purchasing tools, infrastructure, or privileged access from others. Understanding this ecosystem helps defenders anticipate how capabilities and services evolve and how attacks scale. 

Key Insights 

• The cyber criminal ecosystem now resembles a service economy with specialized roles and offerings. 

• Tool-and-infrastructure marketplaces lower the barrier to entry for new attackers. 

• Access brokers sell privileged access and footholds, enabling rapid exploitation. 

• Services like phishing-as-a-service and malware distribution are commoditized. 

• Human-based services (e.g., social-engineering or insider collaboration) are part of the overall attack chain. 

Further Reading: Push Security 

CrashFix Browser Extension Campaign Delivers ModeloRAT 

Researchers identified a campaign linked to the threat actor KongTuke that uses a malicious browser extension to compromise systems. The extension poses as a legitimate utility, such as an ad blocker, but is designed to intentionally destabilize the browser. Victims are then presented with fake error messages that guide them into executing attacker-controlled commands, ultimately leading to the installation of a remote-access Trojan. 

Key Insights 

• The attack relies on a malicious browser extension disguised as a legitimate tool. 

• The extension deliberately crashes the browser to prompt user interaction. 

• Victims are socially engineered into running commands that install additional malware. 

• Corporate, domain-joined systems are targeted with more advanced payloads. 

• The technique combines social engineering with browser abuse rather than traditional phishing links. 

Further Reading: Huntress 

Microsoft Remains the Most Imitated Brand in Phishing Attacks in Q4 2025 (Check Point Research) 

Check Point Research reports that Microsoft continued to be the most frequently impersonated brand in phishing attacks during Q4 2025. Attackers consistently leverage trusted, widely used brands to increase the likelihood of user interaction and credential compromise, particularly for access to email, cloud services, and productivity platforms. Technology companies remain the most attractive targets due to the value of associated identities and accounts. 

Key Insights 

• Microsoft accounted for the largest share of brand-based phishing attempts in Q4 2025. 

• Technology brands dominate phishing campaigns due to their broad user bases and access value. 

• Other commonly impersonated brands included Google, Amazon, Apple, and Meta. 

• Phishing lures often rely on realistic branding and subtle impersonation techniques to appear legitimate. 

Further Reading: Check Point Research 

Hackers Use LinkedIn Messages to Spread Malware via Job Scams 

Attackers are leveraging LinkedIn messaging to distribute malware through seemingly legitimate job opportunities and recruitment outreach. The campaign involves sending direct messages that appear to come from real LinkedIn contacts or credible recruiters, offering job details and enticing users to download attachments or click links that lead to malware. Because the messages originate from within LinkedIn — a trusted professional network — users may be more likely to engage, making this a potent vector for social engineering and malware distribution. 

Key Insights 

• LinkedIn is being abused as a delivery channel for malware via direct messages tied to job offers or recruitment. 

• Messages mimic legitimate recruiters or contacts, increasing the chances that recipients will engage. 

• Malicious attachments or links in the message lead to malware downloads. 

• Trust in professional networking platforms lowers skepticism and can bypass some security filters. 

Further Reading: The Hacker News 

Phishing Emails Impersonating LastPass 

A new phishing campaign is targeting LastPass users with emails that appear to come from the company. The messages claim that LastPass is performing maintenance and urge recipients to take urgent action, such as creating a backup of their password vault. These emails are designed to trick people into visiting fake websites where attackers attempt to steal login information. 

Key Points 

• The emails falsely warn about upcoming account or system changes to create a sense of urgency. 

• Recipients are directed to click links that lead to look-alike websites pretending to be LastPass. 

• The fake sites are used to capture master passwords, which could expose all stored accounts. 

• The messages use familiar branding and language to appear legitimate. 

• Password manager users are being singled out because access to one account can unlock many others. 

Further Reading: LastPass 

Spam Emails Sent From Hijacked Support Systems 

A large wave of spam emails has been sent after attackers abused customer support systems that rely on automated responses. By submitting fake support tickets, the attackers triggered confirmation messages to be sent to large numbers of people. Because these emails came from real company support systems, many appeared legitimate and were delivered successfully. 

Key Points 

• Fake support tickets were submitted to trigger automatic email responses. 

• The resulting emails were sent from real company support addresses, making them look trustworthy. 

• Subject lines were often strange or alarming, causing confusion for recipients. 

• The spam affected many organizations at the same time, not just one company. 

• The issue highlights how automated systems can be misused at scale. 

Further Reading: BleepingComputer 

Fake CAPTCHA Pop-Ups Used to Trick Website Visitors 

A campaign known as ClearFake is using compromised websites to display fake verification pop-ups that look like routine security checks. These prompts guide visitors through simple steps that appear harmless but actually trigger hidden commands on their computers. Because the scam appears on real, trusted websites, it can be difficult for everyday users to recognize what’s happening. 

Key Points 

• Legitimate websites are being altered to display fake verification messages. 

• The pop-ups instruct users to perform basic actions that quietly run harmful commands. 

• Familiar technology and services are used to make the activity seem normal. 

• Once the commands run, additional unwanted software can be installed without clear warning. 

• The use of trusted websites and common prompts increases the likelihood of user interaction. 

Further Reading: Expel 

Disinformation Campaigns Exploit European Online Conversations 

Misleading stories linked to Russian sources are spreading across websites and social media by tapping into real concerns and debates within European countries. These narratives often take familiar topics—such as politics, the economy, or public safety—and reshape them in ways that blur facts and fiction. By blending false claims with real issues people already care about, the content is more likely to be shared and believed. 

Key Points 

• False or misleading stories are tailored to specific European audiences rather than using one-size-fits-all messaging. 

• Real events or concerns are often used as a starting point, then distorted to push a misleading narrative. 

• The origin and intent of the content can be difficult to identify, making it harder to judge credibility. 

• Social media and lesser-known websites play a major role in spreading these narratives. 

• The mix of truth and falsehood can make misleading information feel more convincing to everyday readers. 

Further Reading: NewsGuard Reality Check 

2026 Threat Forecast: Top Cyberattacks Set to Increase Enterprise Exposure 

Email remains the primary entry point for attackers, and emerging campaigns are increasingly focused on exploiting trust, identity, and routine workflows to bypass defenses. Threat actors are layering social engineering techniques with technical evasion methods to increase success rates and reduce detection, signaling a continued shift toward human-centric attack vectors. 

Key Insights 

• Attackers are refining multi-stage phishing workflows (e.g., QR codes and vendor impersonation) to condition targets and evade security controls. 

• Social engineering remains central, with threat actors embedding themselves in legitimate communication threads to increase credibility. 

• Look-alike domains, branding mimicry, and personalized phishing pages are becoming more common to improve credential theft success. 

• Email continues to be the most reliable initial access vector due to its ubiquity and reliance on human interaction. 

Further Reading: Abnormal AI 

Phishing Messages Masquerade as Collaboration Platform Invites 

A phishing campaign is abusing trusted collaboration platform notifications to deliver scam messages that look like legitimate invitations. By using real platform features, the messages appear routine and familiar, increasing the chances that recipients engage without questioning them. Instead of pushing malicious links, the messages often steer people toward fake support interactions. 

Key Points 

• Legitimate collaboration platform features are being used to send deceptive invitations. 

• Messages are designed to look like normal work notifications, such as billing or subscription alerts. 

• Some scams avoid links entirely and instead prompt users to contact fraudulent support numbers. 

• The volume of messages is high, affecting users across many organizations. 

• Familiar workplace tools are being leveraged to make scams feel routine and trustworthy. 

Further Reading: Check Point 

Phishing Kits Now Work Hand-in-Hand With Phone Scams 

Attackers are using specialized phishing tools designed to support phone-based scams. During these calls, the scammer can control what the victim sees in their browser in real time, matching on-screen prompts to the caller’s script. This coordination makes fake login pages and security checks appear more believable, increasing the chances that victims unknowingly hand over account access. 

Key Points 

• Phishing tools are being built to support live phone scams, not just fake emails or websites. 

• Scammers can change what appears on a victim’s screen while talking to them. 

• Real-time control helps attackers react immediately to login or verification steps. 

• The combination of phone calls and on-screen prompts makes scams feel more legitimate. 

• Common security checks can be misused when attackers guide victims step by step. 

Further Reading: Okta 

Password Manager Adds Pop-Up Warnings for Fake Websites 

1Password has introduced a new safety feature designed to stop people from accidentally entering their login details on fake websites. When someone tries to paste saved credentials into a site that doesn’t match the correct web address, a warning pop-up appears. This pause is meant to help users notice suspicious sites before sensitive information is shared. 

Key Points 

• A warning appears when login details are pasted into a site that doesn’t match the saved address. 

• The feature helps catch look-alike websites that imitate real brands and services. 

• It adds an extra pause moment before sensitive information is entered. 

• Existing protections that block automatic filling on suspicious sites are reinforced. 

• Many users will receive this protection automatically through their password manager. 

Further Reading: BleepingComputer 

Fake CAPTCHA Prompts Used to Trick Users Into Installing Malware 

Researchers have identified a scam that uses fake “CAPTCHA” verification screens to deceive users into installing malicious software. Instead of a simple checkbox, these prompts instruct people to copy and run a command on their own device, which secretly launches malware designed to steal sensitive information. Because the steps look like a normal verification process, many users don’t realize anything is wrong until after their system is compromised. 

Key Points 

• Fake CAPTCHA pages instruct users to manually run commands as part of a supposed verification step. 

• Following these instructions can silently install malware on the device. 

• The malware is designed to collect sensitive data such as saved passwords and browser information. 

• Trusted system tools are abused to make the activity look legitimate. 

• The attack relies heavily on user interaction, making it harder to spot at first glance. 

Further Reading: Blackpoint Cyber 

Scam Emails Abuse a Real Microsoft Address 

Scammers are sending fraudulent emails that appear to come from a legitimate Microsoft notification address, making the messages look trustworthy at first glance. Because these emails originate from a real Microsoft service that some organizations allow by default, they can slip past spam filters and land directly in inboxes. The messages often claim an urgent issue, such as an unexpected charge, and push recipients to take immediate action. 

Key Points 

• Scam messages are being sent from a real Microsoft notification address. 

• The emails are designed to look authentic and bypass some email filters. 

• Messages often create urgency by claiming billing or account problems. 

• Recipients may be directed to call a phone number controlled by scammers. 

• Trusted services can be abused to make scams more convincing. 

Further Reading: Ars Technica 

Exposed AI Bot Gateways Leak Chats and Sensitive Data 

Security researchers found that numerous publicly accessible control panels tied to an AI bot framework known as Clawdbot (also called OpenClaw or Moltbot) were left exposed online without proper protection. These misconfigured gateways made it possible for outsiders to view private chat histories and sensitive technical details, raising concerns about how easily personal or organizational data can be leaked through poorly secured tools. 

Key Points 

• Many AI bot gateways were publicly accessible with no authentication required. 

• Exposed interfaces allowed access to private chat logs and conversation history. 

• Sensitive information such as API keys and access tokens was also visible. 

• The bots integrate with messaging platforms, increasing the potential impact of exposure. 

• The issue highlights risks tied to insecure configurations and default settings. 

Further Reading: CybersecurityNews 

Fake Dropbox Emails Used to Steal Login Details 

Attackers are circulating phishing emails that impersonate Dropbox and attempt to trick recipients into handing over their account credentials. The messages often look like routine business communications and include a PDF attachment. When opened, the document directs the user to a fake Dropbox login page designed to capture usernames and passwords. 

Key Points 

• Phishing emails are crafted to look like legitimate Dropbox notifications or file-sharing messages. 

• PDF attachments are used to make the email appear business-related and trustworthy. 

• Links inside the document lead to counterfeit login pages. 

• Entered credentials are captured by attackers and can be reused to access other accounts. 

• The technique relies on familiar brands and file formats to lower suspicion. 

Further Reading: CybersecurityNews 

January 2026 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Fake “Calendly” Invites Used to Spoof Major Brands and Hijack Ad Manager Accounts 

A phishing campaign is impersonating well-known brands by sending fake Calendly-style meeting invites designed to harvest credentials. The invites lead users to a fraudulent scheduling page, followed by a CAPTCHA and a spoofed login prompt. Attackers target users with access to Google Workspace, Facebook Business, and other advertising platforms, aiming to steal credentials or session tokens and take over ad-manager accounts. 

Key Insights 

• Attackers are weaponizing familiar scheduling tools and trusted brand names to increase credibility. 

• Fake meeting invites tied to business outreach or job opportunities are being used as lures. 

• CAPTCHA steps and attacker-in-the-middle techniques help bypass two-factor authentication. 

• Compromised ad accounts can be abused for unauthorized spending, malvertising, or resale. 

Further Reading: BleepingComputer 

Cybercrime Goes SaaS: Renting Tools, Access, and Infrastructure 

Cybercriminals are increasingly operating like SaaS providers, offering subscription-based access to phishing kits, info-stealer data, malware loaders, OTP bots, and even compromised network access. This model lowers the technical barrier for newcomers, enabling less skilled attackers to run large-scale campaigns using ready-made tools and infrastructure. 

Key Insights 

• Phishing-as-a-service operations provide complete kits and delivery mechanisms for recurring fees. 

• Marketplaces now sell ongoing access to stolen credentials and session tokens as if they were data feeds. 

• Initial-access brokers rent out compromised systems or credentials, giving threat actors an immediate foothold. 

• Malware, RATs, and exploit kits can be purchased through short-term subscriptions for quick deployment. 

Further Reading: BleepingComputer 

California’s New Browser Privacy Requirement Could Have Nationwide Effects 

California’s upcoming “Opt Me Out” requirement will mandate that web browsers include a built-in setting allowing users to automatically signal that their data should not be sold or shared. While designed for California residents, browser makers are expected to roll this out broadly, which could result in nationwide changes to how websites handle data privacy and tracking. 

Key Insights 

• Browsers will be required to include a simple, user-accessible opt-out preference toggle. 

• Once enabled, the browser will automatically send a data-privacy opt-out signal to every site visited. 

• Industry experts anticipate browsers will implement this globally to avoid patchwork configurations. 

• Websites and advertisers will need to honor these opt-out signals, affecting tracking and targeted advertising models. 

Further Reading: The Record 

Storm-0900 Uses Fake Parking Tickets to Deliver Malware 

A recent campaign by Storm-0900 sent fake parking-ticket notices and fabricated medical-alert messages to lure people into interacting with a malicious site. The attackers used a bogus CAPTCHA page as the trigger for delivering XWorm, a remote-access malware designed for credential theft, surveillance, and persistent access. 

Key Insights 

• Attackers used urgent, familiar themes (parking violations, medical alerts) to increase engagement. 

• The malicious flow relied on a fake CAPTCHA page that initiated the malware delivery. 

• XWorm provides remote-access capabilities that enable data theft and long-term compromise. 

• The campaign shows continued use of real-world pretexts tied to everyday tasks to improve success rates. 

Further Reading: Cybersecurity News 

Threat Actors Exploit Foxit PDF Reader to Deliver Malware 

A recent campaign is targeting job-seekers with fake recruitment documents packaged in ZIP or RAR archives. The files impersonate a legitimate Foxit PDF Reader executable, but launching them triggers a multi-stage malware chain that ultimately installs ValleyRAT, enabling remote access and data theft. 

Key Insights 

• Attackers disguise a malicious executable as a trusted PDF reader to increase the likelihood of execution. 

• The infection sequence uses DLL side-loading and hidden Python components to download and run ValleyRAT. 

• ValleyRAT provides attackers with credential theft, surveillance, and persistent remote-access capabilities. 

• The campaign relies heavily on social engineering, using job-themed lures to target individuals likely to open unfamiliar files. 

Further Reading: Cybersecurity News 

Phishing Attack Leveraging Microsoft Teams Notifications 

A recent campaign abuses Microsoft Teams by adding users to fake Teams groups with names referencing invoices, payments, or account issues. The groups generate legitimate-looking Teams notification emails that prompt users to call a fraudulent support number. Because the messages originate from trusted Teams infrastructure, they are more likely to pass filtering and appear credible. 

Key Insights 

• Attackers exploit trust in collaboration platforms by using Teams notifications instead of traditional phishing emails. 

• Notification emails appear legitimate, increasing the chances they bypass security filters. 

• The campaign uses callback phishing, directing victims to call a phone number where attackers extract sensitive information. 

• The technique shows how platform misuse and social engineering can blend to create effective phishing without malicious links or files. 

Further Reading: Cybersecurity News 

PowerShell 5.1 Now Warns Before Executing Scripts from Web Content 

Microsoft has updated Windows PowerShell 5.1 so that running Invoke-WebRequest (including the curl alias) against a webpage now triggers a security confirmation prompt. The prompt warns that embedded scripts in the retrieved content could run if processed using the legacy HTML parser. Users must choose to proceed or cancel, and declining halts the action. Using the -UseBasicParsing parameter avoids script execution entirely and prevents the prompt, making it the safer option for automation. 

Key Insights 

• A new confirmation prompt appears when fetching web content that might contain executable scripts. 

• The -UseBasicParsing parameter avoids script execution and prevents the prompt from interrupting automated workflows. 

• Legacy HTML parsing now requires explicit user approval when running interactively. 

• The update reduces the chance of unintentionally executing malicious code embedded in fetched web content. 

Further Reading: Microsoft Support 

ConsentFix: Browser-Native OAuth Consent Hijacking 

A newly identified phishing technique called ConsentFix combines ClickFix-style interaction tricks with OAuth consent abuse. Attackers direct victims to compromised, high-reputation sites where fake verification prompts are shown. Victims are manipulated into completing a legitimate OAuth authorization flow and then pasting the resulting authorization code into the attacker-controlled page. This grants persistent account access without stealing passwords or bypassing MFA, because the attacker leverages legitimate OAuth mechanisms used by trusted applications such as Azure CLI. 

Key Insights 

• ConsentFix operates entirely within the browser, preventing endpoint security tools from detecting the takeover step. 

• Victims can be compromised even while already signed in, with no credential or MFA submission required. 

• The technique abuses inherently trusted OAuth flows from first-party applications. 

• Delivery via search-engine results and compromised sites bypasses email-focused phishing defenses. 

• Conditional loading and other evasion tactics make detection significantly harder. 

Further Reading: Push Security 

Is Your Android TV Streaming Box Part of a Botnet?  

An investigation has uncovered that many low-cost Android TV streaming boxes are being shipped with hidden malware that quietly enrolls devices into botnets. These compromised devices can be used for large-scale ad fraud, proxy abuse, credential stuffing, and other criminal activity — often without any visible signs to the owner. The issue largely affects off-brand devices sold online that run modified versions of Android and receive little to no security updates. 

Key Insights 

• Some Android TV boxes arrive pre-infected, meaning users are compromised immediately after setup. 

• Infected devices are commonly abused as residential proxies or for ad fraud operations. 

• The malware is deeply embedded, making removal difficult or impossible without replacing the device. 

• Affected devices often lack proper update mechanisms or certification, increasing long-term risk. 

Further Reading: Krebs on Security 

Uncovering a Calendly-Themed Phishing Campaign 

A recent phishing campaign uses fake Calendly-style scheduling pages to trick users into surrendering their credentials. Instead of a legitimate meeting invite, victims are shown a cloned scheduling interface that prompts them to log in with their corporate credentials. Behind the scenes, the attacker captures those credentials — and often MFA tokens or session cookies — enabling full account takeover or further abuse. 

Key Insights 

• The phishing lure mimics familiar scheduling tools to lower users’ skepticism and increase the likelihood of interaction. 

• Attackers often pair fake scheduling pages with urgent or compelling text (e.g., job interviews, client meetings) to induce hasty responses. 

• The cloned interfaces capture credentials and may also harvest session data or MFA tokens for deeper access. 

• Because the page appears legitimate — complete with branding and typical UI elements — it can evade cursory inspection by users. 

Further Reading: Push Security 

Access Granted: Phishing Abuse of Device Code Authorization 

A new phishing trend is exploiting Device Code Authorization flows — a common method many services use to let users sign in on shared or secondary devices (like TVs) by entering a code shown elsewhere. Attackers are crafting phishing lures that direct victims to fake “authorization” pages where they’re prompted to enter a device code. Once entered, the code links the attacker’s session to the victim’s account, giving the attacker instant access without the victim ever entering credentials or MFA codes. 

Key Insights 

• Attackers misuse legitimate device-code sign-in flows to take over accounts without stealing passwords. 

• Victims can inadvertently grant access simply by entering a displayed code on a malicious page. 

• Because no credentials are entered, many defenses (including MFA) don’t block this technique. 

• This method highlights the importance of educating users about out-of-band authentication flows and confirming unexpected prompts before entering codes. 

Further Reading: Proofpoint 

SMS Phishers Pivot to Points, Taxes, and Fake Retailers  

A surge in SMS phishing (smishing) campaigns is using new lures — including rewards-points alerts, tax refund notices, and “order issues” from well-known retailers — to trick recipients into clicking malicious links. These texts are crafted to look like legitimate communications from brands or government agencies, and they direct users to spoofed login pages or fake offers designed to capture credentials or financial information. The shift shows how attackers are evolving beyond traditional banking scams to exploit trends and behaviors that feel more routine or beneficial to users. 

Key Insights 

• Smishing campaigns now leverage enticing themes such as reward-points expirations and tax refund notifications to increase engagement. 

• Fake retail order alerts capitalize on widespread online shopping habits. 

• Malicious links often lead to spoofed web pages that harvest credentials or sensitive personal data. 

• Users are more likely to click when the message appears tied to a known brand or potential benefit. 

Further Reading: Krebs on Security 

Android Expands Pilot for In-Call Scam Protection for Financial Apps 

Google is expanding its Android in-call scam protection pilot specifically for interactions involving financial applications. This feature aims to intercept and block scam calls that impersonate banks, payment services, or other financial institutions before they reach users. By analyzing call metadata and patterns, the protection can warn users or automatically prevent known scam call types — reducing the likelihood that someone answers a phone-based phishing or social-engineering attempt targeting financial credentials or sensitive data. 

Key Insights 

• The expanded pilot focuses on identifying and blocking scam calls tied to financial apps and services. 

• By analyzing characteristics of known scam call patterns, Android can warn users before an interaction begins. 

• Preventing scam calls before they connect reduces the success of phone-based social engineering and credential harvesting. 

• This feature builds on broader Android protections that aim to reduce unwanted and malicious communications. 

Further Reading: Google Security Blog 

Cybercriminals Exploiting .onmicrosoft.com Domains to Launch TOAD Scam Attacks 

Cybercriminals are abusing legitimate Microsoft tenant domains that end in “.onmicrosoft.com” to deliver TOAD (Telephone-Oriented Attack Delivery) scams. By sending messages from these trusted-looking domains, attackers can bypass security filters and convince recipients that the communication is associated with Microsoft. Victims are then prompted to call fraudulent support numbers, where they are manipulated into disclosing credentials or other sensitive information. 

Key Insights 

• Default “.onmicrosoft.com” tenant domains are being used to make scam messages appear legitimate. 

• The trusted reputation of these domains helps attackers evade email and messaging security controls. 

• Victims are often directed to call fake support numbers rather than click links. 

• The activity demonstrates how legitimate cloud infrastructure can be repurposed to support social-engineering campaigns. 

Further Reading: Cybersecurity News 

Calendar-Invite Phishing Campaigns Use Meeting Invites as Lures 

Attackers are increasingly using fake calendar invitations as a phishing vector. These malicious invites may arrive by email or through synced calendar apps, often appearing to come from familiar contacts or trusted services. When a recipient interacts with the invite — for example, by clicking a link to join a “meeting” — they can be led to spoofed login pages designed to harvest credentials or other sensitive information. This technique leverages the trust people place in calendar events and routine scheduling workflows to bypass skepticism. 

Key Insights 

• Malicious invites look like legitimate meeting requests: Attackers spoof sender names and use familiar branding to increase credibility. 

• Links in calendar events can lead to credential-harvesting sites: Clicking “Join” or related links may redirect users to phishing pages. 

• Attackers abuse calendar sync and notification features: Because events often appear automatically on connected devices, users may interact without verifying the source. 

• This technique blends social engineering with platform abuse: It takes advantage of the routine nature of scheduling to reduce suspicion. 

Further Reading: HoxHunt 

Google Malvertising Attack Uses Search Ads to Deliver Phishing and Malware 

A recently analyzed campaign showed how attackers are abusing Google Search Ads to distribute malicious redirects and phishing lures. Instead of relying on compromised websites or email alone, the adversary purchased search ad placements that appeared for high-traffic queries. When users clicked these ads, they were taken through a chain of redirects and deceptive pages that ultimately led to credential-harvesting forms or malware delivery. Because the initial entry point came from legitimate ads, many victims didn’t suspect the content was malicious — and traditional web-filtering tools often trust paid search results by default. 

Key Insights 

• Malicious actors are buying legitimate search ad placements for popular queries to maximize reach. 

• Clicking the ad triggers redirects and cloaked landing pages that conceal the malicious intent until the final stage. 

• Credential harvesting and malware downloads are delivered through deceptive page flows that mimic real services. 

• Because the initial interaction comes from an ad, users may trust the link more than typical phishing emails or unknown sites. 

Further Reading: Push Security 

Top Phishing Trends for 2025 

Security researchers have identified several key phishing trends that defined 2025 — highlighting how attackers continue to evolve both their techniques and delivery mechanisms. These trends emphasize that phishing is no longer confined to simple email links, but increasingly combines social engineering with platform abuse, deceptive flows, and legitimate-looking vectors to bypass defenses and capture credentials, session tokens, and MFA responses. 

Key Insights 

• Browser-in-the-Browser (BITB) attacks remain prevalent, using fake pop-ups that mimic legitimate login dialogs to harvest credentials and active sessions. 

• Consent-based abuse techniques are growing, where attackers trick users into granting OAuth consent or other permissions that grant access without passwords. 

• Search-engine and ad-based delivery shows attackers buying and manipulating legitimate channels to increase reach and bypass filters. 

• Fake verification flows (CAPTCHAs, device codes, and human-verification prompts) continue to be effective in tricking users into executing commands or authorizing access. 

• AiTM and proxy-style phishing remains a persistent threat, capturing session tokens even when MFA is present. 

Further Reading: Push Security 

Most Parked Domains Now Serving Malicious Content  

Security researchers report that a majority of parked domains — web addresses registered but not actively used for legitimate content — are now repurposed to serve malicious material. Cybercriminals are leveraging these unused or abandoned domains to host deceptive content that can deliver malware, phishing pages, or exploit kits. Because these domains often lack reputation and oversight, they present a growing risk to users who accidentally visit them through typos, shady links, or bundled ad networks. 

Key Insights 

• A significant portion of parked domains are now used to host malicious content rather than benign placeholders. 

• These domains often serve phishing pages, malware downloads, or exploit kits designed to compromise visitors. 

• Users may encounter these threats through typosquatting, low-quality ads, or obscure links. 

• Because parked domains typically lack established reputation, traditional filtering and reputation systems can struggle to detect and block them effectively. 

Further Reading: Krebs on Security 

The Kimwolf Botnet Is Stalking Local Networks  

The Kimwolf botnet highlights how modern botnets are expanding beyond traditional IoT targets to compromise consumer-grade devices such as Android TV boxes, set-top boxes, and other smart devices. Once infected, these systems are folded into a large distributed botnet and can be abused for activities like DDoS attacks and proxying traffic into private networks, weakening the assumption that home and small-office networks are naturally isolated. 

Key Insights 

• Consumer devices are being mass-compromised and used as nodes in a large botnet. 

• Infected devices can act as residential proxies, allowing attackers to route traffic into local networks. 

• Weak default configurations, such as exposed debugging services, contribute to large-scale compromise. 

• The botnet demonstrates resilience through adaptable infrastructure and recovery after disruption. 

Further Reading: Krebs on Security 

Making Security Stick: Lessons from Cybersecurity Awareness Month

This blog post was created based on episode 253 of the Exploring Information Security podcast. Gemini created the first draft and a human edited it for publication.

Every October, the cybersecurity community rallies for Cybersecurity Awareness Month—a concentrated effort to bring security behaviors to the forefront of the corporate mind. But as any practitioner knows, getting thousands of employees to care about passwords and phishing is as much an art as it is a science.

In a recent episode of the Exploring Information Security podcast, I sat down with security awareness experts Maeve Mueller to discuss the logistics, the experiments, and the "human risk" of modern awareness programs. While Cybersecurity Awareness Month has already based it’s never too early to start thinking about next year.

Beyond the PowerPoint: Creative Engagement

The consensus is clear: "death by PowerPoint" is the fastest way to lose an audience. Instead, practitioners should turn to gamification and high-impact demonstrations to make lessons stick.

• Mythbusters & Live Cracking: Mueller’s team found success with a "Cybersecurity Mythbusters" presentation, where they disproved common misconceptions and used live password-cracking demonstrations to show how quickly a weak password can be compromised in a real data breach.

• "Pitch a Phish" Contests: Rather than just being the targets, employees at Mueller's organization were invited to create their own phishing emails to dupe a fictional persona named "Mimi Click". This role reversal turned the tables and encouraged participation by letting teammates "phish" the security team.

• Watch and Win: De Block experimented with a marathon-style "Watch and Win" contest, offering prizes to anyone who completed over nine hours of popular security training modules. Despite the length, over 500 employees finished the entire series.

The Logistics of "Food and Swag"

While digital events are scalable, in-person events remain a priority for leadership. However, these come with significant "hidden" time costs in planning and cleanup.

Mueller utilized booths in office lobbies, handing out swag like screen cleaning cloths and info cards. To draw the crowd, they used the ultimate motivator: food. While in another country for a security awareness event, she used candy from the US with clever puns, like "Smarties" (because smart people are cyber-secure).

Food is the best way to fill a room. The challenge, however, is the registration gamble—knowing exactly how much food to buy without running out and leaving attendees without food.

The Shift to "Human Risk Management"

The industry is currently seeing a shift in terminology from "security awareness" toward Human Risk Management (HRM).

HRM seeks to use data science and telemetry to look at the "full person"—analyzing how they respond to training, phishing simulations, and real-world incidents to build a more accurate risk profile. While the term is "HR-adjacent," it reflects a deeper need to manage behaviors rather than just providing information.

Final Thoughts: Awareness is a Year-Round Mission

The ultimate goal of October isn't to be a one-off event, but a "launching pad" for year-round security habits. As Mueller pointed out, "October is just one time to bring it to the forefront of your mind, but this is important every single month".

For those with limited resources, the experts recommend starting small. You don't need a daily blog post or a full-blown event schedule to make an impact. Even reaching just one or two teammates and helping them secure their personal lives—which inevitably bleeds into their professional behavior—is a win for the security team.

Stop the Steal: Your Guide to Spotting and Dodging Holiday Scams

This is a blog post I put together for a security awareness program. Feel free to grab for your own internal program.

The holiday season is a time for giving, celebration, and searching for the perfect deal. Unfortunately, it's also Scam Season—a time when cybercriminals ramp up their attacks, using urgency, emotional pressure, and tempting offers to steal your money and your identity.

 From fake gift card surveys to cloned travel sites, staying aware is the best gift you can give your financial security. Here is your essential guide to recognizing the biggest threats and protecting yourself.

The Lure of the 'Free' Gift Card (The Survey Scam)

You've probably seen the message: a bright, urgent notification claiming you've been selected to receive a massive $750 or $1,000 gift card from a major retailer like Walmart. All you have to do is answer a quick survey.

What's Really Happening? This is rarely about a prize. These are sophisticated lead-generation and data-harvesting scams disguised as promotions.

1. Data Harvesting: As you move through the "survey," you are asked for valuable details: your name, email, phone number, address, and even personal interests.

2. The Hidden Cost: The promised gift card never materializes. Instead, your personal information is sold to advertisers, data brokers, and other malicious parties. This fuels targeted spam, phishing emails, and more convincing scams down the line, as criminals can now personalize their attack using real information about you.

3. The Hook: These scams rely on powerful psychological triggers—the sense of luck, the promise of low effort, and the false credibility lent by using official branding.

The Urgency of Fake Deals and Cloned Websites

During high-shopping seasons, scammers leverage our desire for a bargain and a great getaway.

Fake Retail Ads

 Scammers run professional-looking advertisements, promoting "limited-time sales" or offering extreme discounts.

• The Trap: You are taken to a website that is a near-perfect clone of a real retailer to steal your payment information. The item you paid for will never arrive.

• Red Flag: Always check the URL. Scammers often use slightly altered web addresses. If the price seems too good to be true, it is.

Phony Holiday Rentals

A great last-minute travel deal can be a front for identity theft.

• The Trap: Scammers clone real rental listings and pressure you to communicate and pay outside of the trusted rental platform, often demanding sensitive documents like photos of your ID or credit card upfront.

• Red Flag: Legitimate platforms want you to stay within their system for security. Never send copies of personal documents via private email or text.

The Gift Card Trap (The Emergency Text/Call)

One of the most devastating scams uses your love and concern for family to drain your bank account.

• The Scenario: You receive an unexpected text or call—sometimes even using an AI-faked voice—from someone claiming to be a friend or family member who is in an "emergency" (e.g., wallet stolen, car trouble).

• The Ask: They claim that because they can't use their bank or credit cards, they urgently need you to buy a specific type of gift card and send them the numbers and PIN codes.

• The Reality: Gift cards are untraceable currency for criminals. Once the code is shared, the money is gone. Scammers often use emotional pressure and timing to cloud your judgment.

The Impersonated Authority Figure

This scam targets your professionalism or loyalty by having the criminal impersonate a boss, CEO, pastor, or group leader.

• The Scenario: You receive a text message (often using the person's real name and sometimes even a real profile photo) saying they are busy in a meeting or traveling and need you to handle an urgent task: purchasing a large number of gift cards (like Apple or Amazon) to give to staff, clients, or group members immediately.

• The Ask: They promise to reimburse you later and ask you to text the photos of the card codes to them immediately.

• The Red Flag: No legitimate organization, especially during business hours, will ask an employee to use personal funds to buy untraceable gift cards for a professional or organizational expense. This is a classic scam designed to exploit your willingness to help a superior.

The "Unexpected Prize" or "Account Issue" Text

These texts are designed to get you to click on a link.

• The Setup: A text says, "Congratulations! You've won a $100 [Major Retailer Name] Gift Card! Click here to claim it," or claims there's an issue with a recent gift card purchase you need to verify.

• The Steal: The link takes you to a fake website that steals your personal data (name, address) or your financial details under the pretense of "claiming the prize."

Always Remember: If a text promises a prize or demands urgent action regarding a gift card you didn't purchase, it is a scam. Never click on a link in an unsolicited text message.

The Golden Rule: Gift Cards are for Presents, Not Payments

No legitimate business, government agency, or reputable person will ever demand payment or request verification information in the form of a gift card for an emergency, a debt, or a prize.

Your 5-Step Security Checklist

Recognizing these scams is the best defense. Follow this checklist to stay safe:

1. Verify Unexpected Requests: If a friend, family member, or especially a superior/authority figure texts with an urgent financial request, always verify it independently. Call them back using a known, trusted number, or email them via their official work email address. Do not reply to the suspicious text message.

2. Inspect the URL: Before entering personal or payment information on any site, check the website address (URL) in the browser bar. Look for misspellings or domains that don't match the company's official name.

3. Be Wary of "Free": Be highly suspicious of unsolicited messages promising huge, easy rewards for low effort. Never click on links in unexpected text messages or emails claiming you've won a prize.

4. Use Official Channels: Only communicate and pay through the official, verified channels of banks, retailers, and booking platforms.

5. Listen to Your Gut: Scammers use urgency to cloud your judgment. If an offer, deal, or emergency scenario causes anxiety or forces you to act immediately, take a deep breath and step away. When in doubt, close the tab.

Stay aware and enjoy a secure, scam-free holiday season!

Sources and Further Reading

• Malwarebytes: Watch Out for Walmart Gift Card Scams

• Chase Security Center: How to Spot Scams (Card & Holiday Scams)

August 2025 - ExploreSec Cybersecurity Security Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Task Scams: Why You Should Never Pay to Get Paid 

ESET warns of a growing wave of “task scams” where victims are enticed by offers of quick money for simple online tasks, such as liking content or clicking buttons. While early steps appear legitimate and even show fake earnings, the scheme ultimately demands an upfront payment to “unlock” these earnings—after which victims receive nothing. Reports of task scams have quadrupled, with millions lost to this tactic. 

Key Insights: 

• Scams typically begin through unsolicited messages on WhatsApp, Telegram, or social media. 

• Fake earnings dashboards give victims a false sense of progress and legitimacy. 

• Victims are often pressured to pay a fee in cryptocurrency to claim their supposed rewards. 

• Scammers may use cloned websites and group chats filled with fake success stories to boost credibility. 

• Other forms of employment fraud include fake job ads, phishing through CV submissions, and impersonated recruiters. 

Further Reading: WeLiveSecurity 

Jasper Sleet: North Korean Remote IT Workers Use AI to Infiltrate Organizations 

Microsoft Threat Intelligence has identified a surge in activity from the North Korea-linked threat actor Jasper Sleet, formerly tracked as Storm‑0287. These operatives are exploiting remote work arrangements to embed themselves within organizations worldwide. Using AI tools to enhance fake identities, they are securing employment, gaining access to sensitive systems, and exfiltrating data to support North Korea’s strategic and financial objectives. 

Key Insights: 

• Jasper Sleet operatives use AI for facial and voice modification to impersonate real job seekers. 

• Fake identities are supported by fabricated credentials, doctored online profiles, and complicit facilitators. 

• The campaign targets a wide range of industries across North America, Europe, and Asia. 

• Over 3,000 accounts have been suspended due to links to this operation. 

• Common tactics include the use of residential IPs, remote access software, and resume laundering. 

Further Reading: Microsoft Security Blog 

AI Hiring Bot Breach: McDonald’s Chatbot Exposes Data of Millions 

Security researchers Ian Carroll and Sam Curry discovered a critical vulnerability in Olivia, the AI hiring assistant via Paradox.ai's McHire platform, used by McDonald’s. With just the default password 123456, the duo accessed an admin account and discovered a critical API flaw. In under an hour, they viewed personal details—including names, emails, phone numbers, and chat logs—for approximately 64 million job applicants spanning years of data. 

Key Insights: 

• A dormant admin panel was secured by default credentials, lacking any multifactor authentication. 

• An insecure direct object reference (IDOR) allowed researchers to enumerate applicant records by simply changing numeric IDs. 

• Data exposed included conversation content and personal identifiers—though not financial or sensitive health info. 

• McDonald’s and Paradox.ai responded swiftly, disabling the account and patching the API within a day. 

• Despite the quick fix, the breach underscores the risks of weak third-party oversight and insecure AI-driven recruitment tools. 

Further Reading: Wired 

Gemini Email Summary Phishing: Invisible Prompt Injection Risk 

A newly discovered vulnerability in Google’s Gemini for Workspace demonstrates how attackers can embed hidden instructions in emails—styled with invisible text—so that clicking “Summarize this email” invokes the malicious prompt. This can result in fake security alerts, phishing links, or fraudulent phone numbers appearing in AI-generated summaries. 

Key Insights: 

• Attackers hide directives using invisible HTML/CSS that Gemini parses but users can’t see. 

• Summarized messages may falsely warn of compromised accounts and urge recipients to click links or call numbers. 

• Because there are no obvious phishing signals (like attachments or visible links), these emails bypass typical threat detection. 

• Security teams should flag summaries containing urgent calls to action and train users to verify full email content. 

Further Reading: Bleeping Computer 

Deepfake It ‘til You Make It: The New AI Criminal Toolset 

Cybercriminals are increasingly exploiting deepfake technology to conduct fraud, extortion, and manipulation campaigns. Originally built for creative or entertainment purposes, AI-driven tools for generating fake audio, video, and images are now widely available and being misused to impersonate individuals and mislead organizations. 

Key Insights: 

• Democratized Deepfake Creation: Tools for generating synthetic media are now easy to use, enabling low-skilled actors to produce realistic forgeries. 

• CEO Fraud & Recruitment Exploits: Deepfake audio and video are being used to impersonate executives during meetings or to create fake candidate profiles in hiring scams. 

• KYC & Identity Fraud Risks: Attackers use deepfakes to bypass identity verification processes at banks and fintech platforms, facilitating account fraud. 

• Plug-and-Play Underground: Criminal communities are sharing deepfake tools, tutorials, and services, lowering the barrier to entry for would-be attackers. 

Further Reading: Trend Micro 

FileFix: A Social Engineering Evolution of ClickFix 

Check Point Research has uncovered FileFix, a new social engineering attack that refines the ClickFix method to trick users into executing malicious commands. Delivered through compromised or typo-squatted websites, FileFix prompts victims with a fake download link or “Fix” button—copying harmful PowerShell scripts to the clipboard. When users paste and run these snippets, the attacker gains system access through a stealthy, multi-stage infection chain. 

Key Insights: 

• FileFix uses clipboard hijacking to push malicious payloads via user-initiated paste actions. 

• Fake prompts mimic legitimate "fix" or software update buttons to build trust. 

• Infection unfolds in stages—from initial PowerShell downloaders to final payloads like AsyncRAT or remote access trojans. 

• This variation simplifies and accelerates command execution compared to previous ClickFix variants. 

• Detection requires user awareness and endpoint policies that block shell execution from clipboard content. 

Further Reading: Check Point Research 

FBI Warns of Youth-Driven Cybercrime and Violence Networks 

The FBI has issued a series of alerts warning about “The Com,” a decentralized network of youth-led cybercriminal groups responsible for a surge in digital fraud, harassment, and real-world violence. Subgroups like Hacker Com focus on cryptocurrency theft, SIM swapping, and ransomware, while IRL Com offers violence-for-hire services such as swatting, assault, and kidnapping. These groups exploit gaming platforms and social media to recruit minors, using threats, doxing, and financial incentives to escalate involvement. 

Key Insights: 

• Youth-focused groups are driving cybercrime and monetizing their skills via extortion, malware, and fraud. 

• Cryptocurrency enables both virtual and physical attacks, including pay-for-assault services. 

• Recruitment often starts on gaming and social platforms, escalating into serious criminal activity. 

• Swatting and doxing are common intimidation tactics tied to digital theft or status-building. 

Further Reading: IC3.gov PSA 1   | ICS3.gov PSA 2 | ICS3.gov PSA 3 

North Korean IT Worker Schemes: Emerging Threat to U.S. Businesses 

The FBI has issued a critical alert (PSA>I‑072325‑4) highlighting how North Korean IT workers and their domestic facilitators are infiltrating U.S. businesses. These workers use deceptive employment setups—often via U.S.-based intermediaries—to bypass sanctions and gain unauthorized access to sensitive systems, generating illicit revenue to support the DPRK regime. 

Key Insights: 

• These schemes rely on unwitting or complicit U.S. individuals who receive, configure, and then forward company assets (like laptops and accounts) to operatives in North Korea. 

• Facilitators may manage shipping, remote access setup, account creation on job platforms, and even handle proceeds in shared financial accounts. 

• Tactics exploit front companies and virtual interviews to mask identities and evade detection, with remote desktop tools like TeamViewer used covertly. 

• There are significant risks of sanction violations, data theft, and unauthorized system control when businesses hire third-party or international IT contractors. 

• The FBI recommends organizations conduct in-person or video identity verifications, validate employment credentials, monitor shipping/payment methods, and restrict unauthorized remote-access tools. 

Further Reading: IC3.gov PSA I‑072325‑4 

Targeted Social Engineering Drives Ransom Payments Skyward in Q2 2025 

Coveware’s Q2 2025 ransomware spotlight reveals a dramatic shift in attack economics: the average ransom payment jumped to $1,130,070—a staggering 104% increase from Q1—while the median payment doubled to $400,000, indicating high-value extortion is on the rise. 

Key Insights: 

• Ransomware actors are shifting from broad targeting to highly targeted social-engineering campaigns, exploiting trusted communications and tailored deception to pressure specific high-profile victims. 

• While the payment amounts surged, the overall ransom payment rate remained low at ~26%, suggesting many organizations continue to successfully resist paying demands. 

• Mid-sized and larger enterprises are now disproportionately affected, as attackers focus on fewer but more lucrative targets rather than bulk low-value victims. 

Further Reading: Coveware Blog 

Privacy Alert: Tea App Data Breach Exposes Millions of Sensitive Chats 

The women-focused “Tea” app, designed for anonymous reviews and dating safety, has suffered a catastrophic data breach impacting users prior to February 2024. Initial reports of exposed selfies and ID documents (around 72,000 images) have now escalated: researchers uncovered a second compromised database containing 1.1 million private messages on deeply personal topics—spanning infidelity, abortion, and abuse. 

Key Insights: 

• Legacy storage misconfiguration in Firebase led to unauthorized data exposure, including chat logs and user IDs. 

• Messaging functionality has been disabled while Tea investigates and coordinates with cybersecurity experts and the FBI. 

• Victims face potential risks of identity theft, harassment, and blackmail through leaked information involving personal phone numbers and real‑world identifiers. 

Further Reading: WebProNews  

Scattered Spider Alert: FBI & CISA Update on Tactics & Threats 

Critical infrastructure and commercial entities are urged to review CISA's updated joint advisory AA23‑320A (last revised July 29, 2025), detailing evolving tactics used by the Scattered Spider cybercriminal group. Known for preying on IT and help desk personnel, this financially motivated threat actor now combines social engineering, ransomware, and data extortion with sophisticated new techniques. 

Key Insights: 

• Scattered Spider continues targeting IT support channels using voice phishing (vishing), SMS phishing (smishing), and MFA fatigue attacks alongside SIM swapping to obtain access credentials. 

• Once inside, attackers repurpose legitimate remote-access and tunneling tools (e.g. TeamViewer, AnyDesk, Ngrok) instead of relying on malware, enabling stealthy and persistent access. 

• New variants like DragonForce ransomware are now being deployed as part of combined extortion operations (data theft + encryption). 

• In recent operations, actors have refined social engineering methods while rotating TTPs to evade detection and extend dwell time. 

• Updated mitigations emphasize phishing-resistant MFA, verifying helpdesk contacts out-of-band, limiting remote access tool use, and continuous validation of security controls against evolving attack behaviors. 

Further Reading: CISA Advisory AA23‑320A (Scattered Spider) 

Scam Alert: Gaming Sites Flooded with Fake Platforms and Phishing Traps 

Threat actors have launched a large-scale social engineering campaign using polished, fraudulent gaming and wagering websites—promoted via Discord and social media ads. These platforms lure users with claims of partnerships with influencers like “Mr. Beast,” and offer fake promo codes for in-game credits. Once victims deposit funds or connect crypto wallets, the sites disappear—often taking user data and assets with them. 

Key Insights: 

• Hundreds of scam sites—often over 1,200 domains—are promoted via sponsored ads and influencer tie-ins to appear legitimate. 

• These platforms impersonate giveaways or wagering systems, incentivizing sign-ups with fake bonus credits and “verified” endorsements. 

• After registration or payment, users often lose access to funds and face account theft or credential compromise. 

• Scams are heavily directed toward younger users on Discord and gaming communities, exploiting trust in influencer culture. 

• In addition to phishing domains, attackers distribute malware via fake mods or “game cheats,” particularly targeting titles like Minecraft and Roblox. 

Further Reading: KrebsOnSecurity 

Phishing Trends Q2 2025: Microsoft at the Helm, Spotify Rejoins the Spotlight 

Check Point Research’s latest Brand Phishing report reveals that in the second quarter of 2025, cybercriminals continued to impersonate high-trust brands to trick users into revealing credentials or financial data. Microsoft remained the most spoofed brand—used in 25% of phishing attempts—followed by Google (11%), Apple (9%), and Spotify (6%), marking Spotify’s first reappearance in the charts since late 2019. 

Key Insights: 

• Microsoft led phishing campaigns, accounting for a quarter of all spoofed brands. 

• Spotify saw a surprising resurgence in impersonation attempts after a long absence, used in campaigns involving fake credential and payment pages. 

• Booking.com–themed domains surged by over 700 in Q2, many embedding personal user data to deceive targets convincingly. 

• Tech remained the top spoofed sector, with social networks, travel, and retail brands also seeing elevated impersonation activity. 

• Seasonal alignment played a key role: the rise in travel scams coincided with summer holiday planning, amplifying phishing success. 

Further Reading: Check Point Research 

Microsoft OAuth Phishing Campaign: MFA Bypass via App Impersonation 

Proofpoint has exposed a sophisticated phishing campaign where attackers used malicious Microsoft OAuth applications—disguised as trusted brands like Adobe, DocuSign, and SharePoint—to trick users into granting access to their Microsoft 365 accounts. These apps operated within legitimate authorization flows, enabling attackers to bypass multi-factor authentication (MFA) with minimal-risk consent requests. 

Key Insights: 

• The fake OAuth apps mimicked trusted publishers to obtain permissions for profile, email, and openid scopes—enough to capture credentials and session tokens without raising suspicion. 

• Once approved, users were redirected to phishing pages that intercepted login credentials and session tokens using AiTM (attacker-in-the-middle) kits like Tycoon or EvilProxy. 

• Attackers were able to maintain access via stolen tokens even after password resets, remaining linked to accounts until consent was manually revoked. 

• The campaign compromised multiple sectors—including finance, healthcare, and retail—targeting executives and high-privilege users. 

• Standard security controls such as DMARC or domain reputation were largely ineffective since the phishing originated from within Microsoft's system. 

• Microsoft is rolling out updated defaults that require administrative approval for third-party app permissions, aiming to limit similar attacks going forward. 

Further Reading: Proofpoint Threat Insight 

FBI Alert: QR Code Packages Used in Emerging Fraud Scheme 

The FBI has issued a Public Service Announcement (PSA I‑073125) warning about a new twist on the classic "brushing scam": unsolicited packages sent to recipients containing QR codes that, when scanned, prompt the victim to share personal or financial information or inadvertently download malware. These packages often arrive without sender details, making recipients more likely to investigate the code out of curiosity. 

Key Insights: 

• Mail includes no sender information, tempting recipients to scan QR codes in order to identify the sender. 

• Scanning the code can lead to phishing forms requesting sensitive data or installation of smartphone malware. 

• The tactic is a modification of brushing scams, repurposed for fraud by exploiting user curiosity and trust. 

• Fraudsters may ask victims to grant permissions or download apps that compromise device security. 

Protective Measures: 

• Don’t scan QR codes from unexpected or unknown packages. 

• Avoid granting app or account access triggered via unsolicited QR links. 

• If suspicious, report the package to your local authorities or the FBI’s Internet Crime Complaint Center (IC3). 

Further Reading: IC3.gov PSA I‑073125 

Too Good to Be True? Text-Based Job Scam are Spiking

Feel free to take this blog post and use it for your own internal security awareness program.

Have you ever received a text message offering a part-time job with incredibly high pay and flexible hours? It might sound like the perfect opportunity—until you look a little closer. Over the weekend I received the text below.

At first glance, it seems like a dream gig: no experience needed, immediate pay, and high earnings. But this is a classic job scam designed to lure you in and exploit your trust. Scammers are aware of the current state of the U.S. economy and they are looking to exploit it for their own financial gain.

How These Scams Work:

• Initial Hook: They send a message with flattery and a compelling offer.

• Urgency or Exclusivity: They claim they found your profile and that it’s a unique opportunity.

• Off-Platform Contact: You’re asked to message them on WhatsApp or Telegram—a red flag.

• Fake Training or Tasks: You may be asked to complete “trial” work or even pay a fee up front.

• Financial Risk: Scammers might ask for personal sensitive information, send fake checks, or trick you into forwarding money.

Red Flags to Watch For:

• Vague company info (DSL? TEMU merchants?).

• Unrealistic pay for minimal effort.

• Requests to communicate on encrypted apps like WhatsApp.

• Spelling and grammar issues or overly generic language.

• No official email or website.

What You Can Do:

• Don’t respond to the message.

• Don’t click any links or share personal info.

• Report the message to your mobile provider (forward to 7726).

• Block the number and delete the message.

Stay alert. If a job offer seems too good to be true—it probably is.

Tax Fraud: How to Avoid Criminals Filing Fraudulent Returns

This is a post I put together for my own internal security awareness program. Feel free to grab and use within your own organization. Created with help from ChatGPT. 

Tax season is a time when individuals and businesses focus on filing their returns and securing their refunds. However, it is also a prime opportunity for fraudsters looking to exploit the system. One particularly alarming form of fraud is when criminals file tax returns on behalf of individuals without their knowledge, stealing valuable refunds in the process. This type of fraud, known as tax-related identity theft, can have serious financial consequences for the victim. In this post, we'll dive into how this scheme works, its impact, and the steps you can take to protect yourself.

How the Scheme Operates

1. Data Acquisition Criminals obtain personal information through a variety of methods, such as data breaches, phishing attacks, or purchasing stolen data from underground markets. This personal information—such as your Social Security number and other identifying details—becomes their key to committing fraud.

2. Filing False Returns Once they have the necessary information, criminals file tax returns on behalf of individuals without their consent, typically early in the tax season to get ahead of the legitimate filer.

3. Refund Diversion The fraudsters request that the refund be deposited into bank accounts they control, bypassing the rightful taxpayer entirely. By the time the legitimate taxpayer files their return, the criminals have already claimed the refund.

Consequences for Victims

• Delayed Refunds The IRS will flag the duplicate filings, resulting in significant delays for the legitimate taxpayer's refund. This can cause frustration and financial strain, especially if the refund was anticipated to cover expenses.

• Tax Liabilities Victims may find themselves liable for taxes owed on fraudulent returns filed by the criminals. This unexpected liability can lead to a tax debt that wasn’t part of the original financial planning.

• Identity Theft Beyond the immediate tax consequences, the stolen personal information can be used in other fraudulent activities, such as opening new credit accounts or applying for loans in the victim’s name.

How to Protect Yourself

• File Early One of the best ways to prevent criminals from filing fraudulent returns is to file your taxes early. The sooner your return is filed, the less likely criminals are to file a fake return using your information. Early filing reduces the opportunity for fraudsters to get to your refund first.

• Use a Reputable Tax Service Ensure that the tax preparer you use is legitimate and has a good reputation. If you're using a tax professional, verify their credentials, such as their IRS Preparer Tax Identification Number (PTIN). Check online reviews or ask for referrals from trusted sources to avoid working with fraudulent tax preparers who might exploit your information.

• Consider an Identity Protection PIN (IP PIN) The IRS offers an Identity Protection PIN program, which provides an added layer of security for taxpayers. This PIN is used when filing taxes and helps prevent unauthorized returns from being filed in your name.

Conclusion

Tax fraud in the form of criminals filing fraudulent returns can cause significant stress and financial loss. By understanding how the scheme works and taking proactive measures, you can better protect yourself from becoming a victim. Filing early, using a reputable tax service, monitoring your personal information, and using additional security measures like an IP PIN are all critical steps in preventing and mitigating the effects of tax-related identity theft. 

Further Reading

For more tips on protecting yourself from tax fraud, visit the IRS website and read about common scams and how to avoid them.

January 2025 - Security Awareness Newsletter

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

FBI Shares Strategies to Combat AI-Driven Fraud Schemes 

The Federal Bureau of Investigation (FBI) has issued a public service announcement highlighting the increasing use of generative artificial intelligence (AI) by cybercriminals to enhance the sophistication and believability of fraud schemes. These AI-powered tactics are being employed across various fraudulent activities, including romance scams, investment fraud, and job recruitment cons.  

Internet Crime Complaint Center 

Key Insights: 

• Enhanced Deception: Generative AI enables criminals to produce highly convincing text, images, audio, and video content, making fraudulent communications appear legitimate and more persuasive. 

• Voice Cloning: Advanced AI techniques allow for the cloning of voices, which can be used in schemes such as impersonating family members in distress to solicit money or sensitive information.  

Synthetic Identities: AI-generated images and profiles are utilized to create fake identities on social media platforms, facilitating social engineering attacks and spear-phishing campaigns. 

Recommendations: 

• Verify Communications: Be cautious of unsolicited messages, especially those requesting personal information or financial transactions. Confirm the authenticity of such communications through direct and reliable channels. 

• Establish Verification Protocols: Develop secret codes or phrases with family members and trusted contacts to authenticate identities during unexpected or urgent requests. 

• Limit Personal Information Sharing: Be mindful of the personal data shared on social media and other public platforms, as it can be exploited to craft personalized and convincing scams. 

Staying informed about the evolving tactics of AI-driven fraud is crucial in safeguarding personal and financial information. 

Further Reading: BleepingComputer Article 

Black Basta Ransomware Adopts Advanced Social Engineering Tactics 

The Black Basta ransomware group has recently enhanced its attack strategies by incorporating sophisticated social engineering techniques, including email bombing, QR code phishing, and the deployment of custom malware payloads. 

Key Developments: 

• Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications. 

• Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools. 

• QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware. 

Further Reading: The Hacker News 

Phishing Attacks Target Employee Payroll Accounts 

Cybercriminals are increasingly launching phishing attacks aimed at hijacking employee payroll accounts. These schemes often involve fraudulent emails that appear to originate from Human Resources or payroll departments, requesting employees to update or verify their direct deposit information. Unsuspecting employees who comply may inadvertently provide attackers with access to their payroll accounts, leading to unauthorized changes and financial theft. 

Key Insights: 

• Impersonation of Internal Departments: Attackers craft emails that convincingly mimic internal communications from HR or payroll, exploiting employees' trust in these departments. 

• Urgency and Deception: Messages often convey a sense of urgency, such as impending payroll issues, to prompt quick action without thorough scrutiny. 

• Credential Harvesting: Links within these emails direct employees to counterfeit login pages designed to capture their credentials, granting attackers unauthorized access. 

Further Reading: KnowBe4 Blog 

Surge in 'ClickFix' Social Engineering Attacks 

Cybersecurity researchers have identified a significant increase in the use of a social engineering tactic known as "ClickFix." This method deceives users into copying and pasting malicious commands into their systems, leading to malware infections. 

Key Developments: 

• Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues. 

• Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT. 

• Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates. 

Further Reading: Proofpoint Blog 

AI-Driven Investment Scams Proliferate via Social Media 

Cybercriminals are increasingly leveraging artificial intelligence (AI) and social media platforms to perpetrate sophisticated investment scams, leading to significant financial and data losses among victims worldwide. 

Key Insights: 

• AI-Generated Deception: Scammers utilize AI to create convincing video testimonials featuring fabricated endorsements from celebrities and financial experts, enhancing the credibility of fraudulent investment schemes. 

• Social Media Malvertising: Fraudulent advertisements are disseminated through social media channels, often mimicking legitimate company posts or news outlets, to lure potential investors into the scam. 

• Phishing Tactics: Victims are directed to counterfeit websites designed to harvest personal information under the guise of investment opportunities, leading to identity theft and unauthorized financial transactions. 

Recommendations: 

• Verify Authenticity: Scrutinize investment opportunities, especially those encountered through social media, by researching the offering entity and seeking independent financial advice. 

• Be Skeptical of High Returns: Exercise caution with schemes promising unusually high or guaranteed returns, as these are common indicators of fraudulent activity. 

• Protect Personal Information: Avoid sharing sensitive data through unsolicited links or forms; ensure websites are legitimate and secure before providing any personal details. 

Staying informed and exercising due diligence are crucial in safeguarding against these evolving AI-driven investment scams. 

Further Reading: The Hacker News 

Security Alert: Fake Brand Collaboration Scams Targeting YouTube Creators 

Cybercriminals are increasingly targeting YouTube content creators by impersonating reputable brands and offering fraudulent collaboration opportunities. These sophisticated phishing campaigns aim to distribute malware, leading to the theft of sensitive information and unauthorized access to creators' systems. 

Key Insights: 

• Impersonation of Trusted Brands: Attackers craft convincing emails that appear to originate from well-known companies, proposing enticing partnership deals to lure creators into their scheme. 

• Malware Delivery via Documents: The fraudulent offers include attachments, such as contracts or promotional materials, often delivered through password-protected files hosted on platforms like OneDrive to evade detection. 

• Theft of Sensitive Information: Once the malware is installed, it can steal login credentials, financial data, and grant attackers remote access to the victim's system, compromising both personal and channel security. 

Further Reading: CloudSEK Blog 

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees 

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware. 

Key Developments: 

• Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information. 

• Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update. 

• SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions. 

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware. 

Further Reading: Malwarebytes Blog 

Threat Actors Exploit LinkedIn to Target Job Seekers 

Cybercriminals are increasingly leveraging LinkedIn to deceive job seekers through sophisticated employment scams. By creating fake recruiter profiles, often enhanced with AI-generated images, these threat actors craft personalized messages that appear to offer legitimate job opportunities. The objective is to lure victims into clicking on malicious links that lead to phishing sites designed to harvest personal information or deploy malware. 

Key Insights: 

• Personalized Deception: Scammers tailor messages based on the victim's professional background, making the fraudulent offers appear credible and enticing. 

• Advanced Phishing Techniques: The use of AI-generated recruiter profiles and convincing communication strategies increases the likelihood of victims engaging with malicious content. 

• Exploitation of LinkedIn Features: By abusing LinkedIn's InMail feature, attackers can reach users outside their immediate network, broadening the scope of potential targets. 

Further Reading: KnowBe4 Blog 

Cybercriminals Impersonate KnowBe4 in Phishing Attacks 

Cybercriminals are impersonating KnowBe4 by sending fraudulent emails that closely mimic legitimate "Please Complete Assigned Training" notifications. These deceptive emails aim to trick recipients into clicking malicious links or downloading harmful attachments, potentially compromising personal and organizational security. 

Key Insights: 

• Sophisticated Mimicry: The phishing emails are designed to closely resemble authentic KnowBe4 training notifications, making it challenging for recipients to distinguish between legitimate and fraudulent communications. 

• Malicious Intent: Interacting with the links or attachments in these emails can lead to malware infections, unauthorized access to sensitive information, or other security breaches. 

• Targeted Deception: By exploiting the trust associated with KnowBe4's brand, attackers increase the likelihood of recipients falling victim to the scam. 

Further Reading: KnowBe4 Blog 

Malicious Advertisements Pose Growing Threat to Internet Users 

Cybercriminals are increasingly utilizing malicious advertisements, or "malvertising," to distribute malware and conduct phishing attacks. These deceptive ads often appear as legitimate sponsored content on search engine results pages, making it challenging for users to distinguish between safe and harmful links. 

Key Insights: 

• Prevalence of Malvertising: Malicious actors pay search engines to display their harmful URLs as sponsored ads, which are prominently positioned above legitimate search results. This tactic increases the likelihood of user engagement with malicious content. 

• Deceptive Appearances: These ads are crafted to closely mimic legitimate websites or services, often using familiar branding and language to deceive users into clicking on them. 

• Potential Consequences: Interacting with malvertising can lead to malware infections, unauthorized access to personal information, and financial loss. 

Further Reading: KnowBe4 Blog 

Mobile Phishing Campaign Targets Job Seekers 

Cybercriminals are impersonating recruiters to target job seekers with phony employment offers. Researchers at Zimperium warn that a phishing campaign is targeting Android phones to deliver the Antidot banking trojan.  

Key Insights: 

• Sophisticated Social Engineering: Attackers masquerade as job recruiters or HR representatives from well-known organizations, sending well-crafted phishing emails that purport to come from real companies, informing recipients that they’ve been selected to advance in the hiring process. 

• Malware Delivery: Victims are enticed to download a malicious application, leading to the installation of the Antidot banking trojan on their Android devices. 

• Credential Theft: Once installed, the malware enables a broad set of malicious actions, including credential theft of banking, cryptocurrency, and other critical applications. 

Further Reading: KnowBe4 Blog 

Phishing Scam Mimics Employment Termination Notices 

Cybercriminals are deploying phishing attacks that impersonate employment termination notices to exploit individuals' fear of job loss. These deceptive emails appear to be official communications from human resources departments, complete with authentic-looking logos and case numbers, urging immediate action to avoid "serious legal consequences." 

Key Insights: 

• Deceptive Emails: The phishing emails are designed to closely resemble legitimate employment termination notices, making it challenging for recipients to distinguish between authentic and fraudulent communications. 

• Malware Distribution: Clicking on the provided link directs victims to a fake Microsoft webpage that prompts the download of malicious software. This malware can steal sensitive information, including banking credentials, leading to significant financial and personal repercussions. 

• Exploiting Emotional Triggers: By preying on the fear of job loss, attackers increase the likelihood of recipients reacting hastily and clicking on malicious links without proper scrutiny. 

Further Reading: KnowBe4 Blog 

Malicious Google Ads Exploit Printer Troubleshooting Searches 

Cybercriminals are exploiting Google Ads to target users seeking solutions for printer issues, particularly those involving HP and Canon devices. 

Key Insights: 

• Deceptive Advertisements: Scammers purchase Google Ads that appear as legitimate tech support for printer drivers, luring users into clicking on malicious links. 

• Fake Installation Processes: Upon visiting these fraudulent sites, users encounter a simulated driver installation that culminates in a fabricated error message, warning that further attempts may damage the printer and void its warranty. 

• Phony Tech Support: The error message prompts users to initiate a live chat, connecting them with scammers posing as tech support representatives, who may then attempt to extract personal information or payments. 

Further Reading: KnowBe4 Blog 

Phishing Attack Exploits Google Calendar to Bypass Spam Filters 

Cybercriminals are leveraging Google Calendar invites to conduct phishing attacks that evade spam filters. By sending fraudulent meeting invitations, they prompt recipients to click on malicious links embedded within the event details. 

Key Insights: 

• Exploitation of Trusted Services: Attackers utilize legitimate Google services, such as Calendar and Forms, to enhance the credibility of their phishing attempts, making detection more challenging. 

• Evasion of Security Measures: By originating from trusted platforms, these phishing messages can bypass traditional email security filters, increasing the likelihood of reaching potential victims. 

• Deceptive Tactics: The fraudulent invitations often include links disguised as legitimate actions, such as viewing event details or confirming attendance, which redirect to malicious sites designed to harvest user credentials. 

Further Reading: BleepingComputer 

Smart Devices in Homes Pose Privacy and Security Risks 

Recent analyses have highlighted the potential privacy and security vulnerabilities associated with the increasing presence of smart devices in households. These devices, while offering convenience, can be exploited by malicious actors to compromise personal information and security.  

Checkpoint Blog 

Key Insights: 

• Unauthorized Access: Smart devices, such as cameras and voice assistants, can be manipulated to monitor activities within homes without the owner's consent. 

• Data Exploitation: Information collected by these devices may be accessed or intercepted by unauthorized parties, leading to potential misuse of personal data. 

• Regulatory Challenges: The rapid adoption of smart technology has outpaced the development of comprehensive regulations, leaving consumers vulnerable to emerging threats. 

Further Reading: Check Point Blog 

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware 

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems. 

Key Developments: 

• Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare. 

• Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt. 

• Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems. 

Further Reading: ReliaQuest Blog 

Data Breach at American Addiction Centers Affects Over 422,000 Individuals 

American Addiction Centers (AAC), a leading provider of substance abuse treatment services, has reported a data breach impacting more than 422,000 individuals. 

Key Details: 

• Incident Timeline: The breach was detected on September 26, 2024, with unauthorized access occurring several days prior. 

• Compromised Information: Exfiltrated data includes names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance details, and medical record identifiers. Notably, treatment information and payment card data were not affected. 

• Threat Actor Involvement: The Rhysida ransomware group has claimed responsibility, alleging the theft of approximately 2.8 terabytes of data. 

• Notification and Support: AAC has begun notifying affected individuals and is offering 12 months of free credit monitoring services. 

Further Reading: SecurityWeek 

Sophisticated Phishing Scams Lead to Significant Cryptocurrency Losses 

Recent incidents have highlighted advanced phishing attacks where cybercriminals impersonate legitimate services to gain unauthorized access to individuals' cryptocurrency wallets, resulting in substantial financial losses. 

Key Insights: 

Impersonation of Trusted Entities: Attackers pose as representatives from reputable organizations, such as Google or cryptocurrency platforms, to deceive victims into believing their accounts are compromised. 

Manipulation of Security Features: Victims receive seemingly legitimate security alerts and prompts, which are actually orchestrated by the attackers to facilitate unauthorized account access. 

Exploitation of Stored Sensitive Information: Once access is obtained, cybercriminals search for stored sensitive data, such as cryptocurrency wallet seed phrases, enabling them to transfer funds without detection. 

Further Reading: Krebs on Security 

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures 

Recent analyses have identified a novel social engineering tactic targeting mobile banking users. Attackers are leveraging Progressive Web Apps (PWAs) and WebAPKs to distribute phishing websites disguised as legitimate applications, effectively bypassing traditional security warnings and app store vetting processes. 

Key Insights: 

• Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging. 

• Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts. 

• Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them. 

Further Reading: KnowBe4 Blog 

'James Bond-Style' Scams Lead to Significant Financial Losses 

Recent reports have highlighted a surge in sophisticated scams where fraudsters impersonate trusted entities, such as law enforcement or intelligence agencies, to deceive victims into believing they are involved in international criminal activities. 

Key Insights: 

• Deceptive Communication: Scammers contact individuals, claiming to be from reputable organizations like Amazon, the U.S. Post Office, or law enforcement agencies, alleging the victim's involvement in global criminal schemes. 

• Manipulative Tactics: Victims are coerced into withdrawing large sums of money from personal accounts under the guise of protecting their funds from criminal misuse. They are instructed to hand over cash to individuals posing as law enforcement agents, who then abscond with the money. 

• Significant Financial Impact: These scams have led to substantial financial losses for victims, with little to no chance of recovery once the funds are handed over. 

Further Reading: KnowBe4 Blog 

What is Smishing and How You Can Protect Yourself

This is an article I’ve put together for my internal Security Awareness program. Feel free to grab and use in your own program. Created with help from ChatGPT.

In today's digital age, cybersecurity threats are evolving rapidly, and one of the rising threats is "smishing." Smishing, a blend of "SMS" (short message services) and "phishing," is a form of phishing that involves sending fraudulent SMS messages designed to deceive recipients into revealing personal information or installing malware. 

Understanding Smishing 

Smishing attacks typically involve a text message that appears to come from a legitimate source, such as a bank, a well-known retailer, or even government agencies. These messages may claim that there's an urgent issue requiring your immediate attention, such as a problem with your bank account, a missed delivery, or a tax refund opportunity. The message will usually include a link that you are urged to click to resolve the issue. 

How Smishing Works 

The goal of smishing is to trick the recipient into providing sensitive information, such as login credentials, credit card details, or personal identification numbers. Alternatively, the link may download malware onto the recipient’s phone, which can lead to data theft or loss, financial loss, and sometimes even identity theft. 

Examples of Smishing Attacks 

• Financial Frauds: "Notice from Bank XYZ: Unusual activity detected on your account. Please verify your identity immediately to prevent closure. Click here [link]." 

• Fake Contests: "Congratulations! You’ve won a $500 gift card from [Popular Brand]. Claim your prize now [link]." 

• Impersonation of Authorities: "Urgent COVID-19 alert in your area. Click here for safety measures to follow [link]." 

• CEO Fraud: “Hi [employee], are you available? I have an urgent need.” 

Tips to Protect Yourself from Smishing 

• Be Skeptical of Unsolicited Messages: Always be wary of text messages that ask for personal information, especially if they convey a sense of urgency. 

• Verify the Source: If a message claims to be from an organization you do business with, verify its authenticity by contacting the organization directly using a phone number or email address from their official website—not the contact details provided in the message. 

• Avoid Clicking on Suspicious Links: Do not click on links in unsolicited texts or emails. Instead, go directly to the website by typing the URL into your browser. 

• Educate Yourself and Others: Awareness is your best defense. Learn about the latest smishing tactics and educate your family and friends on how to protect themselves. 

Conclusion 

Smishing is a significant and growing threat in the realm of cyber scams. By staying informed and cautious, you can protect yourself from falling victim to these malicious attacks. Always remember that when it comes to protecting your personal information, vigilance is key. If you suspect you’re being targeted by a smishing attack please contact [INTERNAL SECURITY TEAM INBOX]. 

The Art of Secure Passwords: Safeguarding Your Digital Life

This is a blog post I plan to submit to my companies intranet site as part of security awareness program. I wanted to post this here in case others would like to use it for their own internal programs. This was largely generated with ChatGPT. I have gone through and made my own edits and adjustments.

In today’s interconnected world, passwords are the gatekeepers to our digital existence. Whether it’s accessing your email, online banking, or social media accounts, a strong password is your first line of defense against cyber threats. In this blog post, we’ll explore essential practices for creating and managing secure passwords. 

The Key to Your Account: Guard Your Passwords 

Your passwords are like the keys to your virtual kingdom. Treat them with utmost care and never share them with anyone. Remember, a password shared is a vulnerability exposed. Whether it’s your Netflix account or your corporate email, keep those keys close and confidential. 

Password managers are great for both storing and creating passwords. Password managers generate and store complex, unique passwords for each of your accounts. Instead of remembering dozens (or even hundreds) of passwords, you only need to remember one master password. Password managers can auto-fill your login information on websites and apps, streamlining the login process. Below are some recommended password managers for personal use: 

LastPass 

Features: LastPass offers a user-friendly interface, secure password storage, and strong password generation. It's accessible across various devices and browsers, making it convenient for users who need to manage their passwords on the go. LastPass also features secure sharing options, allowing users to safely share login information with trusted individuals. 

1Password 

Features: 1Password is known for its strong security measures, including a unique security key for encryption, making it nearly impossible for unauthorized users to access your vault. It also offers a Travel Mode, which temporarily removes sensitive data from your devices when crossing borders. 1Password's user interface is clean and intuitive, with excellent organization features for managing passwords and documents. 

Dashlane 

Features: Dashlane provides a robust set of features, including password management, a secure digital wallet, and a VPN for safe browsing. Its password changer feature can automatically update passwords on various sites, enhancing security with minimal user effort. Dashlane is suitable for individuals and businesses looking for a comprehensive security solution. 

Bitwarden 

Features: Bitwarden stands out for being open-source, offering transparency in its security practices. It provides a secure vault for passwords and sensitive information, with options for self-hosting for users who prefer complete control over their data storage. Bitwarden's free version is feature-rich, making it an excellent choice for budget-conscious users seeking reliable security. 

Keeper 

Features: Keeper is noted for its high-level security features, including biometric logins and a secure messaging vault. It offers flexible storage options for passwords, files, and private client data, making it a suitable option for both personal and professional use. Keeper also includes breach monitoring to alert users of potential security threats. 

Browsers 

Browsers can be a good place to store passwords for users seeking convenience and simplicity, offering several features that facilitate better password practices. However, for those who require more robust security features, flexibility, and functionality, a dedicated password manager might be a more suitable option. As with any security tool, the best choice depends on your specific needs, habits, and the level of risk you're comfortable with. 

Crafting Strong and Memorable Passwords 

Creating strong and memorable passwords is essential, especially for securing critical accounts like those for work, email, and finances. Here's how to craft passwords that are both robust and easy to remember: 

Ensure Uniqueness for Each Account 

Distinguish your work and personal passwords to safeguard against potential breaches. Each account should have a unique password to prevent a security issue in one from affecting others. Websites like Have I Been Pwned offer valuable insights by letting you check if your email has been involved in any breaches, underscoring the importance of uniqueness. 

My personal email shows up in the LinkedIn breach

Opt for Passphrases with Special Characters 

Early in my career, I learned the effectiveness of using multi-word passphrases with special characters interspersed. This strategy not only makes passwords more difficult for attackers to guess or crack but also helps in keeping them memorable. Despite witnessing 22-character passwords being compromised, it's clear that security isn't solely about length. Crafting your password—a mix of length, complexity, and unpredictability—is key. 

Avoid common or popular phrases. Instead, draw inspiration from less obvious sources, like obscure quotes or unique phrases from your favorite media. This approach significantly lowers the risk of your password being easily cracked while ensuring it remains memorable to you. 

By focusing on creating unique, complex passphrases that are personal and meaningful, you can significantly enhance the security of your online accounts while maintaining ease of recall. 

Conclusion 

By adopting recommended practices—treating passwords as keys to our digital domains, leveraging password managers for enhanced security, and crafting strong, memorable passwords—we fortify our digital presence against unauthorized access. 

Password managers like LastPass, 1Password, Dashlane, Bitwarden, and Keeper offer robust protection. For added simplicity, browser-stored passwords can also serve as a basic defense. Utilizing unique passphrases enriched with special characters further strengthens our security posture, as echoed by services like Have I Been Pwned, which emphasize the importance of password uniqueness. 

In conclusion, secure password practices are not just about technical security; they're about empowering ourselves to navigate the digital space confidently and securely. Let's prioritize our digital safety by embracing these practices, ensuring our online presence is shielded from potential threats.