Recent Retail Cyber Attacks

Attackers compromised Arara Message, a Japanese email delivery platform, potentially exposing about 77 million email addresses across roughly 380 client companies. They then used the trusted service to send up to 7.13 million suspicious emails that impersonated credit card companies and asked…

Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…

Researchers found that criminals are stealing cloud and AI access, then reselling it through illicit AI services while victims receive enormous cloud bills. In one documented case, a group used a fake portal for LLM users to trick visitors into submitting information containing active access…

Mandiant investigated real 2026 incidents in which criminals stole or abused cloud and LLM access to run up massive unauthorized charges. In one case, UNC6993 used a fake application portal to persuade LLM users to paste active access-token data, allowing the attackers to bypass password and MFA…

Google’s threat researchers investigated real attacks in which criminals stole cloud and AI-service access, then ran up charges exceeding $100,000 in a day and, in one case, nearly $1 million. One group used a fake LLM user sign-up portal to trick visitors into providing active access tokens, while…

A viral social-media misinformation campaign used a limited pesticide test result to falsely claim that Driscoll’s strawberries cause cancer and contain hundreds of pesticides. The campaign shows how emotionally charged consumer-safety claims can spread quickly on Facebook and TikTok before factual…

Akamai documented scam operations that use large numbers of look-alike shopping and ticketing websites to steal payment and identity information. The operators can quickly replace a removed site with another domain connected to the same payment-data collection system. Other campaigns used…

A threat actor impersonated about 32 AI bots, including ones claiming to represent OpenAI, Anthropic, Meta, and Perplexity, to probe enterprise web servers for exposed credentials and private keys. The scanner relied on easily forged bot identity labels and rapidly requested common secret-file…

The FBI warns that scammers are impersonating political candidates and campaigns to solicit donations and steal personal information ahead of the midterms. Attackers use candidates’ names, logos, and AI-generated voices or messages, while weak email authentication can allow fraudulent messages to…

Rhode Island alleges that Meta profited from scam advertising that used targeted delivery to reach vulnerable users, including older adults. Reported lures included fake Alzheimer’s and diabetes cures, misleading health products, and investment scams using deepfaked public figures such as Elon…

Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…

Cisco Talos found roughly 1,400 scam emails sent through legitimate Staples and Dell order-notification systems. Attackers placed fake helpline numbers and support prompts into order fields, causing trusted retailers to email recipients about purchases they did not make. The scam then pressures…

This article describes real election-themed scams that use fake voter-support messages, political donation appeals, survey prizes, official-looking penalty notices, and bogus campaign merchandise. The scams pressure voters to click fraudulent links, share personal or payment information, download…

Researchers found criminals using World Cup-themed Instagram advertisements, compromised websites, and abandoned analytics tags to expose iPhone users to Coruna and DarkSword spyware kits. The attacks can begin when malicious advertising or web content loads, with little or no action beyond…

Keystone confirmed that an attacker accessed customer shipping and order information, and a customer reported a social-engineering phone call using those details. The exposed information can make fake support messages and calls about refunds, replacement devices, or order fixes sound credible.…

Dutch police arrested two suspects accused of using AI-generated bank fraud calls to steal more than €380,000 from 170 victims. The callers falsely warned of suspicious account activity, then posed as bank employees and persuaded victims to download an app and tap their debit card to their phone,…

TransUnion reports that criminals are using trusted brands and compromised customer information to trick people into sharing details, one-time passcodes, or access to their accounts. The scams exploit normal-looking security requests and can lead to account takeovers, redirected payments, and…

Scammers are persuading victims in Norway to buy gold, claiming they will safeguard it, then arranging a handoff that never happens. After building trust, sometimes through a fake romance, the scammers tell victims to leave the gold in a forest or public park, where it can be collected anonymously.

Interpol's Serengeti III operation led to 1,462 arrests across Africa and the recovery of more than $105 million linked to cybercrime. In Uganda, fraud rings used call-center scripts, fake trading platforms, and fraudulent websites to persuade pensioners in Asia to invest in fictional…

Attackers are abusing legitimate services such as Dell and Staples to send real, authenticated emails containing fraudulent support phone numbers. The emails pass normal authentication checks because the trusted platform sends them, but the attacker controls fields displayed in the message and uses…