News Gist .News

In the realm of cybersecurity, the emphasis on strong passwords often overshadows the critical importance of protecting one's email address, which serves as a digital identity. Data breaches and the activities of data brokers expose email addresses to threats, making them gateways to personal information and potential scams. Utilizing email aliases can offer a practical solution to mitigate these risks, allowing individuals to maintain privacy while engaging online.

Google is working on a new feature called Shielded Email, which aims to protect users from unwanted emails by creating an alias address when signing up for new accounts. This feature uses Google's autofill features to automatically forward emails sent to the alias address to the user's main email address, allowing them to easily block or unsubscribe from unwanted emails. By using a separate alias address, Shielded Email provides a buffer between users and service providers, making it harder for bad actors to track their online activity.

If you avoid exposing your regular email address, you reduce the risk of being spammed. Temporary email services offer a solution to this problem by providing short-term addresses that can be used on untrustworthy websites without compromising your primary inbox. These services allow users to receive verification codes or messages within a limited time frame before expiring.

Modern web browsers offer several built-in settings that can significantly enhance data security and privacy while online. Key adjustments, such as enabling two-factor authentication, disabling the saving of sensitive data, and using encrypted DNS requests, can help users safeguard their personal information from potential threats. Additionally, leveraging the Tor network with specific configurations can further anonymize web browsing, although it may come with performance trade-offs.

Spam emails are an inevitable part of our online experience, but instead of deleting them, we should consider marking them. This teaches the spam filter to better recognize and catch unwanted emails, reducing the amount of junk mail in our inboxes. By doing so, we also help prevent scammers from mistakenly believing their messages have been reported, thereby protecting ourselves and others from potential harm. The benefits of this approach are clear, but it requires a change in behavior from simply deleting spam emails to taking an active role in training the filters to improve.

Recently, news surfaced about stolen data containing billions of records, with 284 million unique email addresses affected. Infostealing software is behind a recent report about a massive data collection being sold on Telegram, with 23 billion entries containing 493 million unique pairs of email addresses and website domains. As summarized by Bleeping Computer, 284 million unique email addresses are affected overall.

1Password has introduced a feature allowing users to add location data to individual login items, enabling the password manager to automatically display relevant passwords based on their current location. This update addresses the challenge of managing numerous unique passwords for various accounts, making it easier to access the correct login credentials when needed. Users can now leverage their mobile phone's location data to automatically show logins tied to a specific geographic area.

Almost half of people polled by McAfee say they or someone they know has received a text or phone call from a scammer pretending to be from the IRS or a state tax agency, highlighting the growing threat of tax-related scams. The scammers use various tactics, including social media posts, emails, text messages, and phone calls, to target potential victims, often with promising fake refunds. To protect themselves, individuals can take steps such as filing their taxes early, monitoring their credit reports, watching out for phishing attacks, and being cautious of spoofed websites.

Vishing attacks have skyrocketed, with CrowdStrike tracking at least six campaigns in which attackers pretended to be IT staffers to trick employees into sharing sensitive information. The security firm's 2025 Global Threat Report revealed a 442% increase in vishing attacks during the second half of 2024 compared to the first half. These attacks often use social engineering tactics, such as help desk social engineering and callback phishing, to gain remote access to computer systems.

LinkedIn's InMail notification emails have been spoofed by cybercriminals to distribute malware. The emails are laced with phishing tactics, including fake companies, images, and notifications from legitimate platforms. Researchers at Cofense Intelligence warn that the attackers are using a ConnectWise Remote Access Trojan (RAT) to gain unauthorized control over systems.

Using virtual cards can significantly enhance online shopping security by allowing consumers to manage their spending and limit exposure to fraud. Services like Privacy.com enable users to create virtual card numbers with specific spending limits, making it easier to handle subscriptions and free trials without the risk of unexpected charges. This method not only protects personal financial information but also offers peace of mind when dealing with unfamiliar vendors.

A cyber-attack like the one in Zero Day is improbable. The average Netflix viewer isn’t familiar with the technical details of how cyberattacks are carried out, but they’re acutely aware of their growing frequency and severity. Millions of Americans have had their data exposed in attacks, and while they may not fully understand what ransomware is, they know it isn’t good. While the critical reception of Zero Day remains to be seen, one thing is certain: viewers will debate the plausibility of the events unfolding on their screens.

Commonwealth Bank is introducing a new layer of security to its internet banking, requiring millions of customers to approve each login attempt via the app. The bank claims this will make it harder for fraudsters to access customer accounts. However, critics argue that the added complexity may push some users away from mobile banking altogether.

Security researchers spotted a new ClickFix campaign that has been abusing Microsoft SharePoint to distribute the Havoc post-exploitation framework. The attack chain starts with a phishing email, carrying a "restricted notice" as an .HTML attachment, which prompts the victim to update their DNS cache manually and then runs a script that downloads the Havoc framework as a DLL file. Cybercriminals are exploiting Microsoft tools to bypass email security and target victims with advanced red teaming and adversary simulation capabilities.

Zapier, a popular automation tool, has suffered a cyberattack that resulted in the loss of sensitive customer information. The company's Head of Security sent a breach notification letter to affected customers, stating that an unnamed threat actor accessed some customer data "inadvertently copied to the repositories" for debugging purposes. Zapier assures that the incident was isolated and did not affect any databases, infrastructure, or production systems.

The E-ZPass smishing scam is targeting people with urgent toll demands, sending fraudulent text messages that threaten fines and license revocation if payment is not made promptly. The scammers aim to capture personal information by directing victims to a fake link, which can result in identity theft. In reality, it's the scammers who are seeking financial gain.

Misconfigured Access Management Systems (AMS) connected to the internet pose a significant security risk to organizations worldwide. Vulnerabilities in these systems could allow unauthorized access to physical resources, sensitive employee data, and potentially even compromise critical infrastructure. The lack of response from affected organizations raises concerns about their readiness to mitigate potential risks.

Email marketing continues to be a cornerstone for businesses aiming to engage with their audience effectively. Global email marketing revenue was projected to surpass $9.5 billion in 2024, highlighting its robust growth and sustained relevance. Consumer engagement with email remains high, with 96% of consumers checking their email daily, making it a vital touchpoint for marketers.

A software engineer for the Disney Company unwittingly downloaded malware on his computer that turned his life upside down. The malware gave outside attackers full access to his 1Password database and session cookies, allowing them to compromise his online accounts, including his employer's Slack channel. As a result, he lost his job after Disney's forensic examination reportedly showed that he had accessed pornographic material on his work laptop in violation of company policy.

Hackers are exploiting Microsoft Teams and other legitimate Windows tools to launch sophisticated attacks on corporate networks, employing social engineering tactics to gain access to remote desktop solutions. Once inside, they sideload flawed .DLL files that enable the installation of BackConnect, a remote access tool that allows persistent control over compromised devices. This emerging threat highlights the urgent need for businesses to enhance their cybersecurity measures, particularly through employee education and the implementation of multi-factor authentication.

Researchers have uncovered a network of fake identities created by North Korean cybercriminals, all looking for software development work in Asia and the West. The goal is to earn money to fund Pyongyang's ballistic missile and nuclear weapons development programs. By creating these fake personas, hackers are able to gain access to companies' back ends, steal sensitive data, or even get paid.

In 2003, Skype pioneered end-to-end encryption in the internet phone-calling app space, offering users unprecedented privacy. The company's early emphasis on secure communication helped to fuel global adoption and sparked anger among law enforcement agencies worldwide. Today, the legacy of Skype's encryption can be seen in the widespread use of similar technologies by popular messaging apps like iMessage, Signal, and WhatsApp.

A simple and effective method allows Gmail users to archive their emails and media while freeing up storage without losing important data. By utilizing Google Takeout for backups and creating a new Gmail account for archiving, users can declutter their inbox and optimize storage capacity without the hassle of manual deletions. This strategy not only preserves essential emails but also ensures a fresh start with the original account.

The modern-day cyber threat landscape has become increasingly crowded, with Advanced Persistent Threats (APTs) becoming a major concern for cybersecurity teams worldwide. Group-IB's recent research points to 2024 as a 'year of cybercriminal escalation', with a 10% rise in ransomware compared to the previous year, and a 22% rise in phishing attacks. The "Game-changing" role of AI is being used by both security teams and cybercriminals, but its maturity level is still not there yet.

A company's executives received an extortion letter in the mail claiming to be from BianLian ransomware group, demanding payment of $250,000 to $350,000 in Bitcoin within ten days. However, cybersecurity researchers have found that the attacks are likely fake and the letter's contents bear no resemblance to real ransom notes. Despite this, the scammers are using a new tactic by sending physical letters, potentially as part of an elaborate social engineering campaign.