Do Son Kimsuky's AppleSeed campaign targets Korean Facebook, email, and Telegram users with evolved social engineering and stealthy malware.
social engineering
Beware 'imad213,' a fake Instagram booster stealing credentials via social engineering and bot services. Learn how to protect your account.
UNC6040 is using sophisticated vishing to breach Salesforce, tricking employees into granting access, exfiltrating data, and then pivoting to other cloud platforms.
A new AMOS macOS stealer variant is using typo-squatted Spectrum domains in a clever cross-platform social engineering campaign. Stay vigilant!
Coinbase suffered a data breach impacting 69,000 customers, linked to a third-party contractor. Personal info was leaked, raising security concerns.
BitMEX security team infiltrates Lazarus Group's infrastructure after a phishing attempt, exposing their tactics and even a hacker's real location.
Haozi, a Chinese Phishing-as-a-Service platform, is back, offering no-code phishing kits and full support. Learn how this service enables easy cybercrime.
A stealthy spear-phishing campaign uses fake Rothschild job offers to trick finance execs into installing NetBird RAT, gaining remote access.
A new global malware campaign delivers PureHVNC RAT via fake job offers and complex, multi-stage obfuscation, making detection extremely difficult.
A new campaign by UNC6032 uses fake AI video generator sites and social media ads to distribute a malware cocktail including STARKVEIL.
A fake Google Meet page on compromised WordPress sites tricks users into manually running PowerShell commands, delivering remote access malware.
The "ClickFix" campaign tricks users with fake CAPTCHAs, leading them to paste malicious commands into the Windows Run dialog, delivering infostealers.
AI-generated TikTok videos are instructing users to run PowerShell commands, leading to the delivery of Vidar and StealC infostealer malware.
Coinbase confirms a social engineering attack led to the theft of 69,461 users' data, including IDs and transaction history, via bribed service reps.
Beware! Cybercriminals are using fake CAPTCHA pages to trick you into running commands that install the dangerous Lumma Stealer malware.
Unit 42 uncovers Iranian cyber espionage using a fake modeling agency website to selectively target victims with sophisticated techniques.
A sophisticated phishing campaign, possibly by APT36, spoofs Indian government sites and uses ClickFix tactics to target Windows and Linux users.
UNC3944 resurfaces as Scattered Spider, linked to DragonForce and RansomHub in new retail attacks. Mandiant warns of social engineering escalation.
California Man to Plead Guilty in Hack of Disney Employee, Theft of 1.1TB of Confidential Slack Data
California Man to Plead Guilty in Hack of Disney Employee, Theft of 1.1TB of Confidential Slack Data
Ryan Mitchell Kramer pleaded guilty to hacking Disney after using a fake AI art tool to steal 1.1TB of data. The attack involved malware and social engineering.
EclecticIQ report details Luna Moth's callback phishing attacks using legitimate RMM tools to breach US legal, financial firms for multi-million dollar ransoms.
Silent Push uncovers Lazarus Group's campaign using fake crypto job offers to spread malware (BeaverTail, InvisibleFerret, OtterCookie), targeting job seekers.
Volexity uncovers Russian threat actors abusing Microsoft 365 OAuth flows via phishing, impersonation, and device registration to access email accounts.