News Gist .News

A sophisticated phishing scam has been discovered abusing PayPal and other services, using a recently added feature to trick victims into granting cybercriminals access to their devices. The attackers exploit this new "gift addresses" feature by adding a fake address to the victim's account, sending them an email claiming a purchase was made, and then attempting to install malware to gain control over their computer. If left unchecked, the scammers can steal data, make wire transfers, and other malicious activities.

Security researchers spotted a new ClickFix campaign that has been abusing Microsoft SharePoint to distribute the Havoc post-exploitation framework. The attack chain starts with a phishing email, carrying a "restricted notice" as an .HTML attachment, which prompts the victim to update their DNS cache manually and then runs a script that downloads the Havoc framework as a DLL file. Cybercriminals are exploiting Microsoft tools to bypass email security and target victims with advanced red teaming and adversary simulation capabilities.

A company's executives received an extortion letter in the mail claiming to be from BianLian ransomware group, demanding payment of $250,000 to $350,000 in Bitcoin within ten days. However, cybersecurity researchers have found that the attacks are likely fake and the letter's contents bear no resemblance to real ransom notes. Despite this, the scammers are using a new tactic by sending physical letters, potentially as part of an elaborate social engineering campaign.

Vishing attacks have skyrocketed, with CrowdStrike tracking at least six campaigns in which attackers pretended to be IT staffers to trick employees into sharing sensitive information. The security firm's 2025 Global Threat Report revealed a 442% increase in vishing attacks during the second half of 2024 compared to the first half. These attacks often use social engineering tactics, such as help desk social engineering and callback phishing, to gain remote access to computer systems.

Almost half of people polled by McAfee say they or someone they know has received a text or phone call from a scammer pretending to be from the IRS or a state tax agency, highlighting the growing threat of tax-related scams. The scammers use various tactics, including social media posts, emails, text messages, and phone calls, to target potential victims, often with promising fake refunds. To protect themselves, individuals can take steps such as filing their taxes early, monitoring their credit reports, watching out for phishing attacks, and being cautious of spoofed websites.

LinkedIn's InMail notification emails have been spoofed by cybercriminals to distribute malware. The emails are laced with phishing tactics, including fake companies, images, and notifications from legitimate platforms. Researchers at Cofense Intelligence warn that the attackers are using a ConnectWise Remote Access Trojan (RAT) to gain unauthorized control over systems.

Threat actors are exploiting misconfigured Amazon Web Services (AWS) environments to bypass email security and launch phishing campaigns that land in people's inboxes. Cybersecurity researchers have identified a group using this tactic, known as JavaGhost, which has been active since 2019 and has evolved its tactics to evade detection. The attackers use AWS access keys to gain initial access to the environment and set up temporary accounts to send phishing emails that bypass email protections.

The E-ZPass smishing scam is targeting people with urgent toll demands, sending fraudulent text messages that threaten fines and license revocation if payment is not made promptly. The scammers aim to capture personal information by directing victims to a fake link, which can result in identity theft. In reality, it's the scammers who are seeking financial gain.

Recently, news surfaced about stolen data containing billions of records, with 284 million unique email addresses affected. Infostealing software is behind a recent report about a massive data collection being sold on Telegram, with 23 billion entries containing 493 million unique pairs of email addresses and website domains. As summarized by Bleeping Computer, 284 million unique email addresses are affected overall.

YouTube has issued a warning to its users about an ongoing phishing scam that uses an AI-generated video of its CEO, Neal Mohan, as bait. The scammers are using stolen accounts to broadcast cryptocurrency scams, and the company is urging users not to click on any suspicious links or share their credentials with unknown parties. YouTube has emphasized that it will never contact users privately or share information through a private video.

A broad overview of the four stages shows that nearly 1 million Windows devices were targeted by a sophisticated "malvertising" campaign, where malware was embedded in ads on popular streaming platforms. The malicious payload was hosted on platforms like GitHub and used Discord and Dropbox to spread, with infected devices losing login credentials, cryptocurrency, and other sensitive data. The attackers exploited browser files and cloud services like OneDrive to steal valuable information.

The modern-day cyber threat landscape has become increasingly crowded, with Advanced Persistent Threats (APTs) becoming a major concern for cybersecurity teams worldwide. Group-IB's recent research points to 2024 as a 'year of cybercriminal escalation', with a 10% rise in ransomware compared to the previous year, and a 22% rise in phishing attacks. The "Game-changing" role of AI is being used by both security teams and cybercriminals, but its maturity level is still not there yet.

Google has introduced AI-powered features designed to enhance scam detection for both text messages and phone calls on Android devices. The new capabilities aim to identify suspicious conversations in real-time, providing users with warnings about potential scams while maintaining their privacy. As cybercriminals increasingly utilize AI to target victims, Google's proactive measures represent a significant advancement in user protection against sophisticated scams.

If you avoid exposing your regular email address, you reduce the risk of being spammed. Temporary email services offer a solution to this problem by providing short-term addresses that can be used on untrustworthy websites without compromising your primary inbox. These services allow users to receive verification codes or messages within a limited time frame before expiring.

The average scam cost the victim £595, report claims. Deepfakes are claiming thousands of victims, with a new report from Hiya detailing the rising risk and deepfake voice scams in the UK and abroad, noting how the rise of generative AI means deepfakes are more convincing than ever, and attackers can leverage them more frequently too. AI lowers the barriers for criminals to commit fraud, and makes scamming victims easier, faster, and more effective.

Google has introduced two AI-driven features for Android devices aimed at detecting and mitigating scam activity in text messages and phone calls. The scam detection for messages analyzes ongoing conversations for suspicious behavior in real-time, while the phone call feature issues alerts during potential scam calls, enhancing user protection. Both features prioritize user privacy and are designed to combat increasingly sophisticated scams that utilize AI technologies.

Vishing has become a prevalent tactic for cybercriminals, with 442% increase in attacks compared to the first half of 2024, according to CrowdStrike's latest report. The security firm tracked at least six campaigns involving attackers posing as IT staffers to convince employees to set up remote support sessions or share sensitive information. Help desk social engineering tactics are often used, where scammers create a sense of urgency to trick victims into divulging credentials.

YouTube creators have been targeted by scammers using AI-generated deepfake videos to trick them into giving up their login details. The fake videos, including one impersonating CEO Neal Mohan, claim there's a change in the site's monetization policy and urge recipients to click on links that lead to phishing pages designed to steal user credentials. YouTube has warned users about these scams, advising them not to click on unsolicited links or provide sensitive information.

In the realm of cybersecurity, the emphasis on strong passwords often overshadows the critical importance of protecting one's email address, which serves as a digital identity. Data breaches and the activities of data brokers expose email addresses to threats, making them gateways to personal information and potential scams. Utilizing email aliases can offer a practical solution to mitigate these risks, allowing individuals to maintain privacy while engaging online.

The energy company EDF gave a man's mobile number to scammers, who stole over £40,000 from his savings account. The victim, Stephen, was targeted by fraudsters who obtained his name and email address, allowing them to access his accounts with multiple companies. Stephen reported the incident to Hertfordshire Police and Action Fraud, citing poor customer service as a contributing factor.

Researchers have uncovered a network of fake identities created by North Korean cybercriminals, all looking for software development work in Asia and the West. The goal is to earn money to fund Pyongyang's ballistic missile and nuclear weapons development programs. By creating these fake personas, hackers are able to gain access to companies' back ends, steal sensitive data, or even get paid.

Google's security measures have been breached by fake spyware apps, which are hidden in plain sight on the Google Play Store. These malicious apps can cause immense damage to users' devices and personal data, including data theft, financial fraud, malware infections, ransomware attacks, and rootkit vulnerabilities. As a result, it is crucial for smartphone users to take precautions to spot these fake spyware apps and protect themselves from potential harm.

Google is working on a new feature called Shielded Email, which aims to protect users from unwanted emails by creating an alias address when signing up for new accounts. This feature uses Google's autofill features to automatically forward emails sent to the alias address to the user's main email address, allowing them to easily block or unsubscribe from unwanted emails. By using a separate alias address, Shielded Email provides a buffer between users and service providers, making it harder for bad actors to track their online activity.

The recent arrest of two cybercriminals, Tyrone Rose and Shamara Simmons, has shed light on a sophisticated scheme to steal hundreds of concert tickets through a loophole in StubHub's back end. The pair, who have been charged with grand larceny, computer tampering, and conspiracy, managed to resell about 900 tickets for shows including Taylor Swift, Adele, and Ed Sheeran for around $600,000 between June 2022 and July 2023. This brazen exploit highlights the ongoing threat of ticket scams and the importance of vigilance in protecting consumers.

Two cybercriminals have been arrested and charged with stealing over $635,000 worth of concert tickets by exploiting a backdoor in StubHub's systems. The majority of the stolen tickets were for Taylor Swift's Eras Tour, as well as other high-profile events like NBA games and the US Open. This case highlights the vulnerability of online ticketing systems to exploitation by sophisticated cybercriminals.

Amnesty International has uncovered evidence that a zero-day exploit sold by Cellebrite was used to compromise the phone of a Serbian student who had been critical of the government, highlighting a campaign of surveillance and repression. The organization's report sheds light on the pervasive use of spyware by authorities in Serbia, which has sparked international condemnation. The incident demonstrates how governments are exploiting vulnerabilities in devices to silence critics and undermine human rights.