Real-world phishing, vishing, and social engineering attacks, continuously collected from security reporting and broken down with an original video explainer, key findings, and the red flags your team should watch for. How we produce these.
A financially motivated campaign in India used fake bank calls and WhatsApp links to persuade recent credit-card recipients to install malicious Android apps. The apps stole banking details and text messages, including…
A real ClickFix campaign used compromised websites to display fake Cloudflare “Verify you are human” pages. The pages instructed Windows and macOS visitors to…
The MR ROBOT malware service rents customized fake Android banking apps to criminals targeting Indian bank customers. Victims are lured through fake Play…
MS-ISAC tracked attackers who used a phished K-12 staff account to send phishing messages to that employee’s contacts, including staff at other school…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
A consumer survey found that scam victims often face shame, financial loss, and difficulty getting help after an attack. The report also describes recovery scams, in which third parties charge victims while promising to recover stolen money, repair credit, or catch the scammer.
ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…
U.S. authorities sanctioned people supporting a real North Korean scheme that placed workers in legitimate U.S. businesses using false identities and fabricated job applications. The workers reportedly used AI to tailor resumes and cover letters, create profile photos, and even conceal their…
Attackers sent personalized fake federal court notices to more than 100,000 companies, impersonating the US District Court for the Southern District of Florida. The emails directed recipients to a counterfeit court website and offered a password-protected case file that ultimately installed…
A real attack attempt used a malicious AGENTS.md file placed in a developer’s Downloads folder and disguised as normal engineering notes. When an AI coding assistant opened the folder, the file instructed the agent to install malware; related compromised GitHub repositories used hidden AI-assistant…
Rhode Island alleges that Meta profited from scam advertising that used targeted delivery to reach vulnerable users, including older adults. Reported lures included fake Alzheimer’s and diabetes cures, misleading health products, and investment scams using deepfaked public figures such as Elon…
Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…
A real phishing campaign targeted Colombian organizations with Spanish-language messages posing as administrative or judicial correspondence. The emails used script attachments disguised as documents and pressured recipients to open them, ultimately delivering XWorm malware through hidden…
The article describes real malware-delivery operations that use fake open-source download sites, advertising redirects, and device profiling to decide who receives malicious content. Attackers hide the final payload behind ordinary-looking pages and scripts, while sending researchers, bots, and…
Attackers targeted Colombian organizations with Spanish-language emails posing as urgent court notices. The messages use legal-looking JavaScript or VBScript attachments, sometimes inside ZIP files, to install XWorm and give criminals remote control of the victim’s computer. Employees should…
Attackers used fake ChatGPT, Claude, and Cursor AI application listings to trick Windows users into downloading malware. The downloads appeared trustworthy because they were hosted through GitHub and included real, digitally signed OpenAI or Anthropic executables, but malicious files alongside them…
The Skyw4lker campaign targets U.S. manufacturing, technology, and healthcare organizations with password-protected documents disguised as contracts or service proposals. Victims are sent through a Google-hosted page into a legitimate Microsoft authentication process, where completing an…
North Korea-linked Lazarus targeted South Korean organizations with tailored phishing links leading to fake résumé and portfolio websites. The links started a malware infection chain by abusing widely used South Korean financial security software, showing how a convincing job-related lure can lead…
Cisco Talos found roughly 1,400 scam emails sent through legitimate Staples and Dell order-notification systems. Attackers placed fake helpline numbers and support prompts into order fields, causing trusted retailers to email recipients about purchases they did not make. The scam then pressures…
U.S. prosecutors indicted six people over a Madagascar-based scam operation that allegedly stole more than $516,000 from U.S. victims. The group reportedly used dating sites, posed as attractive women, and persuaded victims to connect cryptocurrency wallets to fraudulent NFT websites, then…
South Korean police say a suspected hacker breached 60 organizations and stole personal and business data, then used the threat of public disclosure to demand payment. The group reportedly sent extortion emails and escalated to calls and text messages to executives and employees when organizations…
A Sirius backdoor campaign used Korean-language emails that impersonated FedEx billing notices and demanded payment of a fraudulent tax invoice. The email directed recipients to a ZIP file containing a weaponized PDF, which required the recipient to approve a PDF-reader security prompt before it…
This article describes real election-themed scams that use fake voter-support messages, political donation appeals, survey prizes, official-looking penalty notices, and bogus campaign merchandise. The scams pressure voters to click fraudulent links, share personal or payment information, download…
A commercial Android spyware kit called uCreator hides inside modified versions of legitimate messaging apps, including Telegram X. Victims who sideload these lookalike apps may expose Telegram two-step verification passwords or have WeChat account data copied, even while the altered app continues…
Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making…
