Advertisement
Tycoon Phishers Adopt Device Code Attacks to Bypass 2FA
Tycoon 2FA Phishers are now leveraging device code phishing to bypass multi-factor authentication, granting them unauthorized account access.
Business Impersonation Fraud: Analyzing Identity Gaps in 2024
Analysis of how attackers exploit identity verification gaps to execute financial fraud and brand impersonation, from shell companies to AI-driven scams.
Sapphire Sleet's ClickFix: North Korea Targets macOS Users
North Korea-backed Sapphire Sleet is deploying ClickFix malware via fake job offers and phony Zoom updates to steal macOS user credentials and data.
Google Deploys Gemini AI to Combat Malvertising and Brand Fraud
Google expands the use of Gemini LLMs to detect sophisticated ad scams, blocking 5.5 billion ads and countering AI-generated brand impersonation tactics.
Abused n8n Webhooks Facilitate Automated Malware Delivery Since 2025
Threat actors are weaponizing n8n AI workflow automation webhooks to bypass email filters and distribute malware in persistent phishing campaigns.
AI Diffusion in Cybercrime: How Hackers Exploit LLM Tools
An analysis of how cybercriminals discuss and adopt AI tools, highlighting the diffusion of LLM exploitation techniques in underground forums.
Advertisement
Booking.com Data Breach: Unauthorized Access to Customer Information
Booking.com confirms unauthorized access to customer booking data. Analyze the breach impact, TTPs used against travel platforms, and mitigation strategies.
FBI and Indonesia Dismantle W3LL Phishing Infrastructure
Law enforcement dismantles the W3LL phishing toolkit infrastructure responsible for $20M in fraud attempts and thousands of credential thefts globally.
Storm-2755 Targets Canadian Employees in Payroll Pirate Campaigns
Microsoft warns of Storm-2755, a financially motivated threat actor hijacking employee accounts to redirect salary payments via sophisticated phishing.
Detect Obfuscated JavaScript Phishing Delivered via RAR Archives
Security researchers identify a new phishing campaign using heavily obfuscated JavaScript within RAR archives to bypass traditional endpoint detection.
FBI Reports $21 Billion Cybercrime Loss in US: Key Attack Vectors
The FBI's IC3 report reveals Americans lost a record $21 billion to cybercrime, primarily due to investment scams, BEC, tech support fraud, and data breaches.
Analyzing the Frequency of Open Redirects in Phishing Campaigns
Examine the technical drivers behind the use of open redirects in phishing delivery and learn strategies for detection and vulnerability remediation.
OAuth 2.0 Device Code Phishing Surge: Protecting M365 and Google
Device code phishing attacks have surged 37x this year. Learn how adversaries abuse the OAuth 2.0 Device Authorization Grant to bypass MFA and hijack accounts.
Casbaneiro Banking Trojan: Evasion and Lateral Movement in Latin America
Analyzing Casbaneiro, a sophisticated banking Trojan employing advanced evasion, process injection, and network worming to target financial institutions and users in…
EvilTokens Fuels Microsoft Device Code Phishing & BEC
New EvilTokens service automates Microsoft device code phishing, enabling account takeover and sophisticated business email compromise (BEC) attacks. Learn how to defend.
UAC-0255 Impersonates CERT-UA to Distribute AGEWHEEZE Malware
UAC-0255 targeted 1 million emails with a phishing campaign impersonating CERT-UA to deploy the AGEWHEEZE RAT. Learn about the TTPs and mitigation steps.
GitHub Malware Campaign: Fake VS Code Alerts Target Developers
Attackers exploit GitHub Discussions to push malware via fake VS Code security alerts. Learn the TTPs used to target developers and how to mitigate risk.
Palo Alto Networks Recruiter Scam and Quantum Security Outlook
Threat actors are impersonating Palo Alto Networks recruiters to target security professionals, while Google sets a 2029 deadline for quantum computing.
AitM Phishing Campaign Targets TikTok Business via Turnstile Evasion
Security researchers have identified a sophisticated AitM phishing campaign using Cloudflare Turnstile to hijack TikTok for Business accounts for malvertising.
Dutch Police Phishing Breach Exposes Internal Contact Data
The Dutch National Police (Politie) confirms a security breach after a phishing attack exposed work contact details for 65,000 police department employees.
TikTok for Business Phishing Campaign Evades Security Bots
A new TikTok for Business phishing campaign uses sophisticated bot-evasion techniques to steal corporate credentials and hijack advertising assets.
Bubble Platform Abuse: Credential Phishing Targets Microsoft Accounts
Threat actors are abusing the Bubble no-code platform to host sophisticated phishing campaigns, bypassing traditional detection and targeting Microsoft account…
_Panther_Media_GmbH_Alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale)
Palo Alto Networks Recruitment Fraud: Analysis of Phishing Tactics
Phishing campaigns posing as Palo Alto Networks recruiters leverage LinkedIn data and psychological tactics to defraud job seekers in the security industry.
Silnikau Sentenced: BitPaymer Ransomware Botnet Operator Receives 2 Years
Russian national Maksim Silnikau sentenced for managing a botnet used in BitPaymer ransomware attacks targeting 72 U.S. companies and demanding $100 million.