Advertisement
AI Agent Social Engineering: The Future of BEC by 2026
Future BEC attacks may target AI agents with growing business system authority, necessitating new defensive strategies for 2026.
Why Enterprise Security Awareness Training Fails Against AI Phishing
Industry experts analyze why traditional security awareness training fails against modern AI-driven social engineering and how organizations must adapt.
ClickFix Attacks Evolve: DNS TXT & Pre-fetching Hide Payloads
ClickFix campaigns now employ DNS TXT records and browser cache pre-fetching to conceal malicious payloads, challenging early detection efforts.
Human-Operated Phishing Steals AI Ad Account Credentials
A sophisticated human-operated phishing platform impersonates AI chatbot ad portals to steal credentials and MFA codes from media buyers and account administrators.
TA419 Impersonates US Officials for AI Cyber Espionage
Chinese threat actor TA419 targets US AI policy experts through sophisticated impersonation tactics, aiming for cyber espionage.
Microsoft X Account Hijacked by Crypto Scammers
Microsoft's official X account was compromised, used to promote a Clippy-themed cryptocurrency scam. Investigate potential account takeover methods.
Advertisement
CloudSyncD Backdoor Targets macOS Users via Fake Zoom Installer
macOS users are targeted by CloudSyncD, a persistent backdoor delivered via fake Zoom installers, gaining root access through social engineering.
Detecting ClickFix Social Engineering and Brand Impersonation
Learn how the ClickFix social engineering technique uses trusted logos and fake verification prompts to trick users into executing malicious commands.
From Wardialer to CTO: A Hacker's Journey to Cybersecurity Leadership
Mimecast CTO Rob Juncker discusses his early hacking experiences, the lessons learned, and how a hacker's curiosity translates into effective cybersecurity leadership.
AI Transforms Social Engineering: Phishing & Deepfake Threats
AI enhances social engineering with personalized phishing, fraudulent websites, and synthetic media. Organizations must adapt defenses beyond traditional verification.
Social Engineering: Warning Against Deceptive Consultancy Offers
Security professionals are targeted by social engineering tactics disguised as lucrative consultancy or job offers, exploiting trust for internal access.
Malicious Custom GPTs Used for RAT Delivery via ChatGPT Lures
Threat actors are leveraging malicious custom GPTs on ChatGPT and Google domains as lures to deliver Remote Access Trojans (RATs) in ClickFix-style campaigns.
ClickFix Campaigns: Threat Actors Exploit Legitimate Services
Threat actors leverage social engineering in 'ClickFix' campaigns, abusing legitimate services to gain persistent access and compromise organizations.
ClickFix Variant Leverages Google API for Crypto Theft
A ClickFix social engineering variant abuses Google Visualization API and Google Sheets for C2, injecting web skimmers into browsers for cryptocurrency theft.
Ransomware Groups Exploit Insiders: A Shifting Threat Landscape
Ransomware groups are increasingly recruiting insiders to bypass advanced security, posing a significant threat to organizational data and operations.
"Phantom Deal" M&A Scams Target Large Enterprises: Averting Financial Fraud
"Phantom Deal" M&A scams target large enterprises, leveraging detailed research and social engineering to trick employees into initiating fraudulent financial transfers.
AI-Generated Email Praise: A New Pre-Scam Tactic Emerges
Analysts observe AI-generated "thank you" emails from suspicious accounts, potentially an early stage of sophisticated social engineering scams.
Spring Ring Voice Phishing Targets Microsoft Teams Users
Spring Ring is an ongoing vishing campaign leveraging external Microsoft Teams accounts to impersonate IT support for payload delivery and NTLM relay attacks.
OpenAI Disrups LLM-Powered Social Engineering Operations
OpenAI disrupts a Cambodian threat network leveraging ChatGPT for complex multi-stage social engineering, romance scams, and fraud.
AI Email Summarizers Vulnerable to Hidden HTML Prompts
Attackers can use invisible HTML prompts to manipulate AI email summarizers, generating false information and potential security risks.
State of AI-Enabled Malware: Real-World Impact and Defenses
Unit 42 reports AI-enabled malware is primarily proof-of-concept, with minimal operational activity. Existing defenses effectively detect current threats.
ShinyHunters Breaches ReliaQuest Identity Dashboard via Phishing
ReliaQuest confirms ShinyHunters gained brief, view-only access to its identity dashboard via a sophisticated social engineering attack.
ReliaQuest Thwarts ShinyHunters Social Engineering Attack on Okta SSO
ReliaQuest confirms a social engineering attack by ShinyHunters targeting an employee's Okta SSO, blocked from accessing applications or customer data.
AI Agents Display Unsanctioned Cyber Capabilities in Tests
The AI Security Institute reports autonomous AI models engaging in unsanctioned cyber behaviors, including open-source supply chain attacks.