Attacks on carriers and telecom providers, including SIM swap operations and the smishing campaigns that abuse their networks. Each entry is broken down with an original video explainer, key findings, and the red flags your team should watch for. How we produce these.
A Ukrainian corruption investigation uncovered a network accused of paying officials to protect fraudulent call centers. The centers allegedly targeted victims in Ukraine and abroad by posing as bank employees, law enforcement officers, or financial advisers, and by directing people to fake…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
Cisco Talos investigated a VYPR ransomware incident in which an attacker used a voice-phishing call to trick a user into starting a Microsoft Quick Assist remote-support session. Talos also observed IT help desk impersonation in several other incidents, showing that a seemingly routine support call…
A threat actor impersonated about 32 AI bots, including ones claiming to represent OpenAI, Anthropic, Meta, and Perplexity, to probe enterprise web servers for exposed credentials and private keys. The scanner relied on easily forged bot identity labels and rapidly requested common secret-file…
The MR ROBOT malware service rents customized fake Android banking apps to criminals targeting Indian bank customers. Victims are lured through fake Play Store-style pages and links in messaging apps, then tricked into installing apps that can steal banking details, intercept one-time passwords,…
North Korea-linked Lazarus targeted South Korean organizations with tailored phishing links leading to fake résumé and portfolio websites. The links started a malware infection chain by abusing widely used South Korean financial security software, showing how a convincing job-related lure can lead…
North Korea-linked Lazarus targeted South Korean organizations with tailored phishing emails that directed recipients to fake portfolio and résumé websites. The sites, including GitHub Pages hosting a purported senior network-appliance developer résumé, abused vulnerable financial-security software…
TransUnion reports that criminals are using trusted brands and compromised customer information to trick people into sharing details, one-time passcodes, or access to their accounts. The scams exploit normal-looking security requests and can lead to account takeovers, redirected payments, and…
Socure research describes how people are using generative AI to create fake hardship letters, income statements, and bank statements to support fraudulent claims using their own identities. The report also observed large-scale account and promotion abuse during the 2026 World Cup, where fraudsters…
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
Researchers uncovered a commercial phishing-kit-as-a-service called “Iron Man System” that lets criminals quickly deploy fake brand pages (postal/courier, toll fines, tax, banks, telecoms, loyalty programs) to steal victim data. The operation appears active and professionally maintained, with…
Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…
Researchers reported an Iranian state-aligned actor impersonating the Dubai Airports IT department to lure a targeted Iraqi individual into installing a fake “careers portal” and then opening a weaponized coding test. The workflow looked like a real recruitment process (HR questions, then a…
After a Free Mobile customer data breach, scammers sent convincing emails that mimic Free Mobile’s real branding and templates. The emails claim a €9.99 unpaid invoice and threaten service suspension, pushing victims to a fake payment page that collects credit card details via redirect links.
A future security executive describes how, as a young teenager, he used deception to get a phone company to install a second phone line at his home. He posed as his father using a forged letter and a believable technical-sounding request (“dedicated low-noise line for a modem”), successfully…
Dutch police are investigating ShinyHunters after a phone-based social engineering incident helped attackers break into Odido, the Netherlands’ largest mobile provider. Investigators say the caller persuaded an employee to log into a spoofed website, which was then used to steal data on more than…
A U.S. Army soldier ("Kiberphant0m") tied to major telecom data thefts was sentenced to 70 months in prison. Prosecutors say that while jailed, he used other inmates’ email accounts to get someone on the outside to ask commercial AI tools for vulnerability details and even “real world working”…
Researchers found a malicious npm package that pretended to be an “authorized” Twilio bug-bounty security probe to trick developers into running it. When executed in a Twilio developer environment, it collected system details and (in some versions) attempted to steal Twilio credentials like Account…
A large phishing (smishing) campaign is sending messages that claim a T-Mobile customer’s rewards points are about to expire. The texts use urgency, made-up point balances, and lookalike “t-mobile.*.top” links to push people into clicking and entering sensitive information. Malwarebytes observed…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
