Nach einem Angriff auf einen Buchungsdienstleister für Tourismusbetriebe wurden Gästedaten zahlreicher Unterkünfte gestohlen. Die Täter nutzen Namen, Kontaktdaten und Buchungsnummern, um Urlauber mit glaubwürdigen Phishing-Nachrichten zur Herausgabe ihrer Kreditkartendaten zu verleiten.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Eine Nachricht zu deiner Hotelbuchung nennt sogar deine Buchungsnummer. Echt? Nicht unbedingt. Bei einer Supply-Chain-Attacke auf einen Buchungsdienstleister wurden Namen, Kontaktdaten und Buchungsnummern gestohlen – auch von Gästen in Mecklenburg-Vorpommern und norddeutschen Motel-One-Hotels. Die Phishing-Nachricht nutzt genau diese Daten: „Buchung 48271 – Kreditkarte bestätigen.“ Der Aha-Moment: Die Buchungsnummer kann stimmen, während der Zahlungslink falsch ist. Klick den Link nicht an. Öffne die bekannte offizielle Website deiner Unterkunft selbst und prüfe dort deine Buchung.
INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
GhostAction attackers sent a fake GitHub security alert to an open-source maintainer, claiming a login from Moscow and directing the victim to secure their account. The fake site stole the victim’s password and two-factor code, then silently approved a powerful GitHub OAuth connection that let the…
Researchers reported a real developer-targeting campaign linked to DPRK actors where attackers pose as legitimate recruiters or Web3 companies and trick targets into running code or pulling poisoned dependencies. The operation has now expanded to include malicious Terraform providers hosted in the…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
