Threat Watcher

A Register podcast transcript describes real-world activity linked to the ShinyHunters cyber extortion crew, including an FBI-related breach and subsequent arrests. It also notes the group’s reliance on social engineering phone calls where attackers impersonate locked-out contractors or employees…

Researchers described phishing emails that contain hidden “prompt injection” instructions aimed at AI assistants that summarize inboxes. The goal is to make the AI present the scam as legitimate or urgent, potentially pushing a user to take risky actions like changing vendor payment details. The…

Researchers described two cybercrime operations. While one campaign focused on breaking into websites and infrastructure, a second operation (“Operation Master”) ran an automated invoice-fraud system that sent millions of messages with personalized invoice links designed to trick victims into…

U.S. and international agencies warned that China-linked actors, enabled by a China-based company (Integrity Technology Group), are breaking into organizations including U.S. critical infrastructure. A key technique described is altering legitimate webpages to show fake login prompts that steal…

Scammers are targeting YouTube creators by posing as brands offering sponsorships and sending personalized emails that reference the creator’s videos. Victims are directed to a convincing fake collaboration platform and then prompted to sign in with Google, putting their accounts at risk.

Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…

Silent Ransom Group allegedly extorted law firms by using phone calls and social engineering to trick employees into giving access or uploading sensitive files, without encrypting data. Leaked internal chats suggest 27 law firms paid roughly $207M in a six‑month span, with individual payments…

Researchers demonstrated how attackers can register lookalike web domains using two specific Unicode characters that Chromium-based browsers may display as trustworthy, normal-looking URLs. This can make phishing and typosquatting sites appear legitimate to employees, increasing the chance they…

Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…

Researchers described how an external user with only chat access to an Amazon Bedrock AgentCore agent could prompt it to fetch a cloud credential endpoint and inadvertently reveal temporary AWS credentials. Those credentials could then be used to enumerate other agents, access container images,…

Attackers used social engineering to access an ASOS employee account connected to Snowflake, then used ASOS’s own app notification system to broadcast an extortion message directly to customers. The incident also involved suspected large-scale customer data theft, which increases the risk of highly…

A ransomware crew that compromised retailer Asos used the company’s own mobile app push notifications to send an extortion message directly to customers. The message claimed the attackers had fully compromised Asos’s Snowflake environment and threatened to leak data if the company didn’t engage.…

Attackers abused ASOS’s own mobile app messaging to send customers a threatening push notification claiming ASOS’s Snowflake environment was compromised and demanding engagement to avoid a data leak. ASOS confirmed the notification was unauthorized and warned customers to watch for follow-on…

ASOS confirmed attackers got into customer-data systems after tricking an employee into handing over login credentials. Stolen data reportedly included not only names and contact details, but also customers’ shopping searches, which could enable highly convincing follow-on scams and phishing.…

ESET reports that Russia-aligned group UAC-0099 is using spearphishing emails with malicious links to deliver a downloader called MATCHBOIL. The attack relies on tricking a person into manually running a downloaded VBScript, which then fetches and installs further malware and sets up persistence…

U.S. prosecutors say the owner of MonsterCloud told ransomware victims he could recover data with proprietary tools and avoid paying criminals, but instead allegedly paid the ransom and charged clients far more. The scheme reportedly used a paid “analysis” step where clients shared the ransom note…

A weekly threat roundup includes multiple real-world social engineering campaigns, including a phishing operation that abuses legitimate Power BI domains to look trustworthy and trick users into downloading a remote-access tool installer. It also describes a WhatsApp-delivered lure that tricks…

Russia-aligned actor UAC-0099 targeted Ukrainian government personnel using malware (ASHVEIN) that steals credentials and enables remote control. A key lure described is a malicious .NET file that shows a decoy Microsoft Word document pretending to be an official response from Ukraine’s National…

Leaked chat logs linked to the Silent Ransom Group describe efforts to pressure U.S. law firms through extortion and, unusually, by sending in-person “agents” to physically enter offices and copy data. The FBI previously warned that people tied to the group were posing as IT staff to gain access,…

ASOS says an attacker got into an employee account by impersonating a trusted contact to steal login credentials. Those credentials were then used to access third-party platforms and send a legitimate-looking push notification to customers claiming a Snowflake hack and directing them to a Telegram…