Recent Retail Cyber Attacks

Attackers are abusing legitimate services such as Dell and Staples to send real, authenticated emails containing fraudulent support phone numbers. The emails pass normal authentication checks because the trusted platform sends them, but the attacker controls fields displayed in the message and uses…

A scammer used a hacked Facebook Marketplace account to pose as a seller and direct a buyer to send $1,000 to a Cash App account supposedly belonging to the seller’s wife. The payment account had been opened using another person’s stolen identity, illustrating how account impersonation and identity…

Attackers abused legitimate Staples and Dell order-notification systems to send convincing emails about expensive purchases the recipient never made. Instead of using a suspicious link, the messages inserted attacker-controlled “helpline” numbers into trusted transaction fields, aiming to move…

The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…

Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…

This weekly recap describes a task scam in which victims were paid to create fake sales and reviews, then told they had a “negative balance” and needed to deposit their own money to receive payment. One fraudster reportedly lost more than $4.8 million after proceeds from this scam were placed into…

Nach einem Sicherheitsvorfall beim Schweizer Online-Marktplatz Ricardo könnten Angreifer Namen, Adressen und Telefonnummern von rund 890.000 Konten für überzeugende Betrugsversuche nutzen. Parallel wurden WhatsApp-Nachrichten beobachtet, die sich als Ricardo-Kundendienst ausgaben und Nutzer auf…

Scammers are exploiting fear from a recent Ledger-related spyware incident by sending emails that push a fake “firmware update.” The email urges recipients to connect their hardware wallet and click through to a realistic-looking “Genuine check” page with an “Update Now” button, risking theft if…

An Australian Shopify store was advised to stay closed after a third‑party app/theme extension injected malicious code that redirected shoppers to a fake checkout page. Two app vendors (Logbase and HulkApps) reported unauthorized access or configuration changes that inserted scripts designed to…

Security researchers showed that “decision models” like TypeSafe AI’s Jev can still be manipulated by indirect prompt injection, even if they don’t produce free-form text. In a shopping checkout test, a fake on-page ad persuaded an AI browser agent to click an attacker-controlled button instead of…

Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…

Researchers uncovered a commercial phishing-kit-as-a-service called “Iron Man System” that lets criminals quickly deploy fake brand pages (postal/courier, toll fines, tax, banks, telecoms, loyalty programs) to steal victim data. The operation appears active and professionally maintained, with…

US authorities say North Korean operatives used stolen and fake identities to get hired into remote roles at more than 70 US companies, then operated company laptops from inside the US using “laptop farms.” Americans allegedly helped by receiving employer-issued laptops, keeping them online, and…

Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax…

US authorities arrested two Americans accused of helping North Korean “fake IT workers” get hired remotely at US companies and route company laptops into US-based “laptop farms.” The scheme used stolen or fake identities and location-masking tools so overseas workers could appear to be working from…

Researchers described two cybercrime operations. While one campaign focused on breaking into websites and infrastructure, a second operation (“Operation Master”) ran an automated invoice-fraud system that sent millions of messages with personalized invoice links designed to trick victims into…

Researchers demonstrated how attackers can register lookalike web domains using two specific Unicode characters that Chromium-based browsers may display as trustworthy, normal-looking URLs. This can make phishing and typosquatting sites appear legitimate to employees, increasing the chance they…

Attackers used social engineering to access an ASOS employee account connected to Snowflake, then used ASOS’s own app notification system to broadcast an extortion message directly to customers. The incident also involved suspected large-scale customer data theft, which increases the risk of highly…

A ransomware crew that compromised retailer Asos used the company’s own mobile app push notifications to send an extortion message directly to customers. The message claimed the attackers had fully compromised Asos’s Snowflake environment and threatened to leak data if the company didn’t engage.…

Attackers abused ASOS’s own mobile app messaging to send customers a threatening push notification claiming ASOS’s Snowflake environment was compromised and demanding engagement to avoid a data leak. ASOS confirmed the notification was unauthorized and warned customers to watch for follow-on…