INTERPOL’s Operation Jackal IV (Nov 2025–Jun 2026) targeted the money-laundering backbone behind global online scams, leading to 58 arrests and 263 suspects linked to West African organized crime groups. Cases included romance/investment scams targeting retirees, a fake-investment call center tied…
Interpol said an eight-month operation across 22 countries led to 58 arrests tied to cyber-enabled financial fraud, including romance scams, cryptocurrency/investment scams, and business email compromise. Authorities described how scammers build trust with victims (including minors) on social and…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
Researchers described a real phishing campaign using a platform called “ZeroTokens” that lets a live operator watch what a victim types and change the next phishing prompts in real time. The lure used “W-8BEN tax-documentation reviews” and spoofed financial institutions’ multi-step verification…
Interpol said Operation Jackal IV arrested dozens and disrupted West Africa–linked criminal networks tied to scams and money laundering, including Black Axe. The cases described include a call-center “investment” scam, romance/investment scams targeting retirees, and sextortion of teenagers on…
Researchers found a campaign of malicious Firefox add-ons that look like legitimate crypto wallets, VPNs, or utilities but are designed to trick people into entering wallet recovery phrases or exposing credentials. The add-ons can switch from harmless decoys (like a notepad or sports scores) to a…
Apollo Global Management disclosed a breach after attackers used social engineering to access some of its cloud platforms over several days in July. The company says personal data may have been exposed, including names, contact details, and Social Security numbers. Reporting links the incident to…
Researchers documented a real phishing method where attackers push fake bank sites up in search results, then show different content depending on how a person arrived. If someone clicks from a poisoned search result, the site shows a realistic bank login page to steal credentials; if security teams…
The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing…
Researchers observed phishing sites that appear “dead” to security scanners but turn into convincing fake bank login pages when a victim arrives from poisoned Google/Bing search results. The goal is to steal banking credentials while keeping the malicious pages online for days or weeks by showing…
Zimperium reports ToxicPanda 2.0 is a mobile banking trojan that targets 349 financial apps across 16 countries by impersonating legitimate screens and prompts to trick users into granting permissions. After installation, it uses Android Accessibility and Wireless Debugging to gain deeper control…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
This article explains how business email compromise (BEC) scams work when attackers impersonate executives or suppliers to request urgent wire transfers, bank-detail changes, or credentials, often without malware or links. It cites real, high-loss cases (including Google/Facebook and aerospace…
Researchers observed a real business email compromise (BEC) lure targeting finance teams, where attackers spoofed a legitimate bank and sent a forwarded-looking email thread to pressure recipients to open an attachment and reply. Opening the attached script would install Agent Tesla v4, an…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
Researchers found more than 800 “phantom” online banking sites built from a cheap, reused website template and designed to look like legitimate financial institutions. These portals appear to support scams where a fraudster (e.g., a “broker” or “loan agent”) directs victims to log in, register, and…
Researchers report a real Android malware operation (“Manic”) active since at least February 2026 that blends banking fraud with spyware-style surveillance. It can trick users into revealing their device PIN/pattern via a fake lock prompt and silently capture banking PIN taps, then exfiltrate…
A real campaign of voice-phishing (vishing) calls targeted major hedge funds and private equity firms by impersonating internal IT/help desk staff. Victims were pressured into completing “routine” security steps and were sent to fake login pages that captured usernames, passwords, and MFA codes in…
A new Android malware family called “Manic” is being used in real campaigns targeting banking, government identity, and messaging apps, especially in Ukraine and parts of Europe. It spreads through phishing sites and “dropper” apps disguised as legitimate utilities (including a booking-app lure),…
Researchers report two Android banking malware families (ToxicPanda 2.0 and GoldDigger) that rely on tricking people into installing malicious apps and granting powerful permissions. GoldDigger campaigns impersonate airlines and shopping retailers and then abuse Android Accessibility to take over…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
