News Gist .News

Mishing is emerging as a major threat to business operations, with cybercriminals adapting their methods to exploit the growing reliance on mobile devices for key operations. The term, coined by Zimperium, covers various mobile-first phishing techniques, including SMS/text-based phishing, QR code phishing, voice phishing, and Wi-Fi-based phishing. As a result, businesses urgently need to adopt mobile-specific security measures to protect themselves from these increasingly sophisticated attacks.

Vishing has become a prevalent tactic for cybercriminals, with 442% increase in attacks compared to the first half of 2024, according to CrowdStrike's latest report. The security firm tracked at least six campaigns involving attackers posing as IT staffers to convince employees to set up remote support sessions or share sensitive information. Help desk social engineering tactics are often used, where scammers create a sense of urgency to trick victims into divulging credentials.

Vishing attacks have skyrocketed, with CrowdStrike tracking at least six campaigns in which attackers pretended to be IT staffers to trick employees into sharing sensitive information. The security firm's 2025 Global Threat Report revealed a 442% increase in vishing attacks during the second half of 2024 compared to the first half. These attacks often use social engineering tactics, such as help desk social engineering and callback phishing, to gain remote access to computer systems.

The modern-day cyber threat landscape has become increasingly crowded, with Advanced Persistent Threats (APTs) becoming a major concern for cybersecurity teams worldwide. Group-IB's recent research points to 2024 as a 'year of cybercriminal escalation', with a 10% rise in ransomware compared to the previous year, and a 22% rise in phishing attacks. The "Game-changing" role of AI is being used by both security teams and cybercriminals, but its maturity level is still not there yet.

The E-ZPass smishing scam is targeting people with urgent toll demands, sending fraudulent text messages that threaten fines and license revocation if payment is not made promptly. The scammers aim to capture personal information by directing victims to a fake link, which can result in identity theft. In reality, it's the scammers who are seeking financial gain.

Microsoft's Threat Intelligence has identified a new tactic from Chinese threat actor Silk Typhoon towards targeting "common IT solutions" such as cloud applications and remote management tools in order to gain access to victim systems. The group has been observed attacking a wide range of sectors, including IT services and infrastructure, healthcare, legal services, defense, government agencies, and many more. By exploiting zero-day vulnerabilities in edge devices, Silk Typhoon has established itself as one of the Chinese threat actors with the "largest targeting footprints".

A broad overview of the four stages shows that nearly 1 million Windows devices were targeted by a sophisticated "malvertising" campaign, where malware was embedded in ads on popular streaming platforms. The malicious payload was hosted on platforms like GitHub and used Discord and Dropbox to spread, with infected devices losing login credentials, cryptocurrency, and other sensitive data. The attackers exploited browser files and cloud services like OneDrive to steal valuable information.

Threat actors are exploiting misconfigured Amazon Web Services (AWS) environments to bypass email security and launch phishing campaigns that land in people's inboxes. Cybersecurity researchers have identified a group using this tactic, known as JavaGhost, which has been active since 2019 and has evolved its tactics to evade detection. The attackers use AWS access keys to gain initial access to the environment and set up temporary accounts to send phishing emails that bypass email protections.

Sophisticated, advanced threats have been found lurking in the depths of the internet, compromising Cisco, ASUS, QNAP, and Synology devices. A previously-undocumented botnet, named PolarEdge, has been expanding around the world for more than a year, targeting a range of network devices. The botnet's goal is unknown at this time, but experts have warned that it poses a significant threat to global internet security.

Security researchers spotted a new ClickFix campaign that has been abusing Microsoft SharePoint to distribute the Havoc post-exploitation framework. The attack chain starts with a phishing email, carrying a "restricted notice" as an .HTML attachment, which prompts the victim to update their DNS cache manually and then runs a script that downloads the Havoc framework as a DLL file. Cybercriminals are exploiting Microsoft tools to bypass email security and target victims with advanced red teaming and adversary simulation capabilities.

Google has introduced two AI-driven features for Android devices aimed at detecting and mitigating scam activity in text messages and phone calls. The scam detection for messages analyzes ongoing conversations for suspicious behavior in real-time, while the phone call feature issues alerts during potential scam calls, enhancing user protection. Both features prioritize user privacy and are designed to combat increasingly sophisticated scams that utilize AI technologies.

Google Messages is rolling out an AI feature designed to assist Android users in identifying and managing text message scams effectively. This new scam detection tool evaluates SMS, MMS, and RCS messages in real time, issuing alerts for suspicious patterns while preserving user privacy by processing data on-device. Additionally, the update includes features like live location sharing and enhancements for Pixel devices, aiming to improve overall user safety and functionality.

2024 has been marked as a record-breaking year for ransomware attacks, with a 65% increase in detected groups and 44 new malware variants contributing to almost a third of undisclosed attacks. The healthcare, government, and education sectors were disproportionately affected, while emerging groups like LockBit and RansomHub accounted for a significant number of incidents, highlighting the growing sophistication of cybercriminals. As organizations face escalating financial and reputational risks, the need for proactive cybersecurity measures has never been more urgent.

Almost half of people polled by McAfee say they or someone they know has received a text or phone call from a scammer pretending to be from the IRS or a state tax agency, highlighting the growing threat of tax-related scams. The scammers use various tactics, including social media posts, emails, text messages, and phone calls, to target potential victims, often with promising fake refunds. To protect themselves, individuals can take steps such as filing their taxes early, monitoring their credit reports, watching out for phishing attacks, and being cautious of spoofed websites.

A company's executives received an extortion letter in the mail claiming to be from BianLian ransomware group, demanding payment of $250,000 to $350,000 in Bitcoin within ten days. However, cybersecurity researchers have found that the attacks are likely fake and the letter's contents bear no resemblance to real ransom notes. Despite this, the scammers are using a new tactic by sending physical letters, potentially as part of an elaborate social engineering campaign.

Google has introduced AI-powered features designed to enhance scam detection for both text messages and phone calls on Android devices. The new capabilities aim to identify suspicious conversations in real-time, providing users with warnings about potential scams while maintaining their privacy. As cybercriminals increasingly utilize AI to target victims, Google's proactive measures represent a significant advancement in user protection against sophisticated scams.

A "hidden feature" was found in a Chinese-made Bluetooth chip that allows malicious actors to run arbitrary commands, unlock additional functionalities, and extract sensitive information from millions of Internet of Things (IoT) devices worldwide. The ESP32 chip's affordability and widespread use have made it a prime target for cyber threats, putting the personal data of billions of users at risk. Cybersecurity researchers Tarlogic discovered the vulnerability, which they claim could be used to obtain confidential information, spy on citizens and companies, and execute more sophisticated attacks.

The energy company EDF gave a man's mobile number to scammers, who stole over £40,000 from his savings account. The victim, Stephen, was targeted by fraudsters who obtained his name and email address, allowing them to access his accounts with multiple companies. Stephen reported the incident to Hertfordshire Police and Action Fraud, citing poor customer service as a contributing factor.

Aviation firms in the United Arab Emirates (UAE) were recently targeted by a highly sophisticated business email compromise (BEC) attack looking to deploy advanced malware. The attackers used a compromised email account to share polyglot files with their victims, which deployed a hidden backdoor against aviation firms. Cybersecurity researchers Proofpoint observed that these attacks started in late 2024 and target organizations with a distinct interest in aviation and satellite communications.

Worried about your child’s screen time? HMD wants to help. A recent study by Nokia phone maker found that over half of teens surveyed are worried about their addiction to smartphones and 52% have been approached by strangers online. HMD's new smartphone, the Fusion X1, aims to address these issues with parental control features, AI-powered content detection, and a detox mode.

Cybersecurity experts have successfully disrupted the BadBox 2.0 botnet, which had compromised over 500,000 low-cost Android devices by removing numerous malicious apps from the Play Store and sinkholing multiple communication domains. This malware, primarily affecting off-brand devices manufactured in mainland China, has been linked to various forms of cybercrime, including ad fraud and credential stuffing. Despite the disruption, the infected devices remain compromised, raising concerns about the broader implications for consumers using uncertified technology.

US lawmakers have raised national security concerns in letters to top Chinese telecom companies, China Mobile, China Telecom, and China Unicom, citing the potential for these firms to exploit access to American data through their U.S. cloud and internet businesses. The lawmakers are seeking details on any links between the companies and the Chinese military and government by March 31, amid concerns about unauthorized data access, espionage, or sabotage. National security experts have warned that China Telecom's operations in the US could pose a significant risk to American telecommunications networks.

Amnesty International said that Google fixed previously unknown flaws in Android that allowed authorities to unlock phones using forensic tools. On Friday, Amnesty International published a report detailing a chain of three zero-day vulnerabilities developed by phone-unlocking company Cellebrite, which its researchers found after investigating the hack of a student protester’s phone in Serbia. The flaws were found in the core Linux USB kernel, meaning “the vulnerability is not limited to a particular device or vendor and could impact over a billion Android devices,” according to the report.

Amnesty International has uncovered evidence that a zero-day exploit sold by Cellebrite was used to compromise the phone of a Serbian student who had been critical of the government, highlighting a campaign of surveillance and repression. The organization's report sheds light on the pervasive use of spyware by authorities in Serbia, which has sparked international condemnation. The incident demonstrates how governments are exploiting vulnerabilities in devices to silence critics and undermine human rights.

Commonwealth Bank is introducing a new layer of security to its internet banking, requiring millions of customers to approve each login attempt via the app. The bank claims this will make it harder for fraudsters to access customer accounts. However, critics argue that the added complexity may push some users away from mobile banking altogether.

A recently discovered trio of vulnerabilities in VMware's virtual machine products can grant hackers unprecedented access to sensitive environments, putting entire networks at risk. If exploited, these vulnerabilities could allow a threat actor to escape the confines of one compromised virtual machine and access multiple customers' isolated environments, effectively breaking all security boundaries. The severity of this attack is compounded by the fact that VMware warned it has evidence suggesting the vulnerabilities are already being actively exploited in the wild.