Criminals abused an unnamed spend-management platform’s open-banking connection feature to test stolen bank logins and identify accounts with available funds. They also used the platform’s legitimate notification system to send fake Poshmark sale alerts, directing victims to counterfeit pages that…
BioCatch reports that social engineering scams are rising in Spain, where criminals manipulate legitimate bank customers into giving attackers access to their screens or devices. The report also links increased malware activity to job and investment scams that persuade victims to install fake work…
A scammer used a hacked Facebook Marketplace account to pose as a seller and direct a buyer to send $1,000 to a Cash App account supposedly belonging to the seller’s wife. The payment account had been opened using another person’s stolen identity, illustrating how account impersonation and identity…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
Attackers abused legitimate Staples and Dell order-notification systems to send convincing emails about expensive purchases the recipient never made. Instead of using a suspicious link, the messages inserted attacker-controlled “helpline” numbers into trusted transaction fields, aiming to move…
A UK survey found that many people targeted by scams do not report them, especially when they have not lost money. It also identifies a common phone scam: callers impersonate banks, police, or government bodies and pressure people to move money into a supposedly safe account.
Lazarus targeted South Korean organizations with spear-phishing emails that linked to fake, tailored résumé, portfolio, and interior-design websites. Visiting the sites likely triggered an infection through commonly required financial-security software, allowing the attackers to install malware…
Socure research describes how people are using generative AI to create fake hardship letters, income statements, and bank statements to support fraudulent claims using their own identities. The report also observed large-scale account and promotion abuse during the 2026 World Cup, where fraudsters…
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…
Scammers reportedly cloned Osceola County Sheriff Steve Moser’s voice and used his photo in a voicemail to make a fake arrest-warrant call appear legitimate. Similar police-impersonation scams involving alleged missed jury duty or outstanding warrants have been reported in several states, using…
This weekly recap describes a task scam in which victims were paid to create fake sales and reviews, then told they had a “negative balance” and needed to deposit their own money to receive payment. One fraudster reportedly lost more than $4.8 million after proceeds from this scam were placed into…
An Arup employee transferred $25 million to fraudulent accounts after joining a video call featuring deepfake impersonations of company executives. The case shows how realistic-looking executive impersonation can pressure employees into approving high-value payments, even when the request appears…
Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…
A Hong Kong employee at engineering firm Arup transferred about $25.6 million after joining a video conference where every other participant was a deepfake. The incident shows how convincing fake video identities can be used to pressure employees into approving high-value payments, and why…
Researchers disclosed SearchLeak, a Microsoft 365 Copilot Enterprise vulnerability chain that reportedly let a single crafted-link click turn a user’s AI assistant into a tool for collecting and sending out sensitive data. The attack abused prompt injection and trusted Microsoft infrastructure,…
Attackers hijacked two official Irish police X/Twitter accounts and used the trusted accounts to promote a fake cryptocurrency airdrop. The posts directed followers to a link that could trick them into giving up cryptocurrency-wallet keys, allowing criminals to drain their funds.
A reported case involved a Virginia woman receiving hundreds of automated sign-up emails in a day. The flood was used to hide a legitimate bank alert about a fraudulent laptop purchase, showing how inbox overload can conceal account fraud or unauthorized transactions.
Scammers are exploiting fear from a recent Ledger-related spyware incident by sending emails that push a fake “firmware update.” The email urges recipients to connect their hardware wallet and click through to a realistic-looking “Genuine check” page with an “Update Now” button, risking theft if…
A real-world business email compromise-style fraud hit Italian bank Fideuram after criminals impersonated executives using WhatsApp and an AI-cloned voice on a follow-up call. Staff were persuaded to transfer funds to foreign accounts before the scam was discovered, showing how AI makes familiar…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
