A UK survey found that many people targeted by scams do not report them, especially when they have not lost money. It also identifies a common phone scam: callers impersonate banks, police, or government bodies and pressure people to move money into a supposedly safe account.
Lazarus targeted South Korean organizations with spear-phishing emails that linked to fake, tailored résumé, portfolio, and interior-design websites. Visiting the sites likely triggered an infection through commonly required financial-security software, allowing the attackers to install malware…
Socure research describes how people are using generative AI to create fake hardship letters, income statements, and bank statements to support fraudulent claims using their own identities. The report also observed large-scale account and promotion abuse during the 2026 World Cup, where fraudsters…
Google is updating Chrome Enhanced Protection to warn people when scam websites try to trick them into copying and running harmful commands. These ClickFix scams use fake computer problems, such as bogus browser or antivirus alerts, to move victims from the browser into a terminal where security…
Court records allege that CBP officers used a false claim about searching for child sexual abuse material to pressure activist Samuel Tunick during an airport device search. The records indicate the real stated purpose in an internal alert was an investigation into suspected terrorist activity,…
Cofense analyzed real phishing emails disguised as bidding invitations. The emails send recipients to fake, branded login and device-enrollment pages, then trick them into entering a device code in a genuine Microsoft prompt. Doing so can authorize an attacker’s session without giving them the…
The report documents how criminals use antidetect browsers to make stolen sessions and phishing logins appear to come from legitimate, local devices. A commercially available Browser-in-the-Middle workflow can relay a victim’s login details to real services such as Google, Microsoft, Facebook, and…
Attackers are using fake calendar invitations to bypass normal email defenses and lure people into credential theft or malware downloads. The invites may appear in a user’s calendar even when the related phishing email is quarantined, making unexpected meeting entries a new route for account and…
Attackers are using a fake or trojanized Siemens Software Center installer to trick people into manually pasting malicious commands into Windows. The campaign abuses a familiar “I am not a robot” style prompt and a trusted, signed Siemens program to make the attack appear legitimate.
Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…
Attackers are using a fake “I am not a robot” style ClickFix prompt to persuade Siemens Software Center users to paste attacker-provided commands into Windows. If users comply, the attackers can exploit a DLL side-loading flaw to run malware alongside a genuine, signed Siemens application.
A Brazilian bricklayer traveled 2,000 km after an AI-generated social-media persona offered him a serious relationship, a place to live, and payment for his trip. The case shows how public videos that simulate personal conversations can create a convincing romance-style lure, even when there is no…
Attackers sent large volumes of fake Microsoft 365 calendar invitations designed to steal employee credentials. The messages use familiar meeting requests, including apparent Microsoft Teams invitations and calendar files, to direct users to phishing pages. Some invitations can remain on an…
Attackers abused a trusted, signed Siemens Software Center program to run malicious code and install a remote access trojan. Victims were directed to a fake web address containing a ClickFix lure, where copying and running the displayed content launched PowerShell and an installer that exploited…
Researchers found ROMULUS, a malware-delivery platform that uses fake web pages and ClickFix-style prompts to persuade people to run harmful commands themselves. The platform can deliver Legion Loader and other malware through a PowerShell script, showing how a seemingly routine verification or fix…
Attackers exploited a Siemens Software Center flaw as part of the Romulus ClickFix campaign. Victims were lured to fake CAPTCHA-style prompts that told them to paste and run malicious commands, while attackers used a legitimate signed Siemens program and malicious helper files to load malware.
Scammers reportedly cloned Osceola County Sheriff Steve Moser’s voice and used his photo in a voicemail to make a fake arrest-warrant call appear legitimate. Similar police-impersonation scams involving alleged missed jury duty or outstanding warrants have been reported in several states, using…
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
This weekly recap describes a task scam in which victims were paid to create fake sales and reviews, then told they had a “negative balance” and needed to deposit their own money to receive payment. One fraudster reportedly lost more than $4.8 million after proceeds from this scam were placed into…
Federal investigators are examining alleged links between ShinyHunters and ransomware negotiation executives. The article also documents a real Dharma ransomware exchange in which the attacker steered a victim toward an alleged Canadian IT intermediary, using a reassuring “guarantees” offer to keep…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
