Cisco Talos investigated a VYPR ransomware incident in which an attacker used a voice-phishing call to trick a user into starting a Microsoft Quick Assist remote-support session. Talos also observed IT help desk impersonation in several other incidents, showing that a seemingly routine support call…
The Town of Whitsett, North Carolina, found unauthorized access to its Microsoft 365 account on October 22, 2026. An unknown party used an official town email account to send a phishing email titled "Ref: Approved Payment Report from Whitsett, NC" and included attachments recipients were told not…
The FBI warns that scammers are impersonating political candidates and campaigns to solicit donations and steal personal information ahead of the midterms. Attackers use candidates’ names, logos, and AI-generated voices or messages, while weak email authentication can allow fraudulent messages to…
A financially motivated campaign in India used fake bank calls and WhatsApp links to persuade recent credit-card recipients to install malicious Android apps. The apps stole banking details and text messages, including one-time passwords, allowing criminals to support fraudulent transactions.
The MR ROBOT malware service rents customized fake Android banking apps to criminals targeting Indian bank customers. Victims are lured through fake Play Store-style pages and links in messaging apps, then tricked into installing apps that can steal banking details, intercept one-time passwords,…
A consumer survey found that scam victims often face shame, financial loss, and difficulty getting help after an attack. The report also describes recovery scams, in which third parties charge victims while promising to recover stolen money, repair credit, or catch the scammer.
Rhode Island alleges that Meta profited from scam advertising that used targeted delivery to reach vulnerable users, including older adults. Reported lures included fake Alzheimer’s and diabetes cures, misleading health products, and investment scams using deepfaked public figures such as Elon…
A real phishing campaign targeted Colombian organizations with Spanish-language messages posing as administrative or judicial correspondence. The emails used script attachments disguised as documents and pressured recipients to open them, ultimately delivering XWorm malware through hidden…
Attackers targeted Colombian organizations with Spanish-language emails posing as urgent court notices. The messages use legal-looking JavaScript or VBScript attachments, sometimes inside ZIP files, to install XWorm and give criminals remote control of the victim’s computer. Employees should…
This article describes real election-themed scams that use fake voter-support messages, political donation appeals, survey prizes, official-looking penalty notices, and bogus campaign merchandise. The scams pressure voters to click fraudulent links, share personal or payment information, download…
Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making…
North Korea-linked Lazarus targeted South Korean organizations with tailored phishing emails that directed recipients to fake portfolio and résumé websites. The sites, including GitHub Pages hosting a purported senior network-appliance developer résumé, abused vulnerable financial-security software…
The article recounts the real ILOVEYOU worm outbreak, which used a romantic email subject line and a supposed love-letter attachment to trick millions of recipients into infecting their computers. Once opened, the attachment spread the same message to everyone in the victim's address book, showing…
A Russia-linked operation used a spear-phishing email with a malicious attachment to gain access to a Ukrainian logistics company. UAC-0099 established access and later handed the victim environment to Sandworm, which carried out a destructive data-wiping attack more than two months later.
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
This weekly roundup describes several real social-engineering campaigns, including fake government-payment posts that compromised thousands of Bluesky accounts and mobile scams disguised as community activities. It also documents AI-generated bank-helpdesk calls that persuaded victims to install an…
Russia-linked APT28 hackers successfully entered a NATO-member shipbuilder’s network after an employee opened an infected Microsoft Word document. The attackers used the foothold to communicate with the compromised machine, collect information, and map the company network as part of a wider…
A UK survey found that many people targeted by scams do not report them, especially when they have not lost money. It also identifies a common phone scam: callers impersonate banks, police, or government bodies and pressure people to move money into a supposedly safe account.
Court records allege that CBP officers used a false claim about searching for child sexual abuse material to pressure activist Samuel Tunick during an airport device search. The records indicate the real stated purpose in an internal alert was an investigation into suspected terrorist activity,…
Scammers reportedly cloned Osceola County Sheriff Steve Moser’s voice and used his photo in a voicemail to make a fake arrest-warrant call appear legitimate. Similar police-impersonation scams involving alleged missed jury duty or outstanding warrants have been reported in several states, using…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
