Phishing threats

The “I Paid Twice” scam targets users of Booking.com and other booking platforms by leveraging phishing techniques to deliver the PureRAT malware through a malicious tool called ClickFix. Victims are deceived into believing they have been charged twice for bookings, prompting them to interact with fraudulent links or downloads. This interaction results in the installation of PureRAT, a remote access trojan capable of stealing sensitive data and enabling persistent unauthorized access. The scam exploits user trust in popular travel booking sites and uses social engineering to bypass technical defenses. While no known exploits are currently widespread, the potential for data theft and account compromise is significant. European organizations and individuals using these platforms are at risk, especially given the high volume of travel-related transactions. Mitigation requires user education, enhanced email and web filtering, and monitoring for unusual account activity. Countries with high tourism activity and frequent use of Booking.com, such as Germany, France, and the UK, are most likely to be targeted.

Phishing#infosecnews#redditGermany+5

What to do and how to react if you receive a threatening email.

PhishingGermanyFrance+8

Community score +1

A recently reported security flaw in Microsoft Teams allows attackers to impersonate users by faking identities and rewriting chat messages. This vulnerability could enable phishing attacks and manipulation of communication within organizations. Although no known exploits are currently in the wild, the flaw poses a medium risk due to its potential impact on trust and information integrity. The attack does not require user interaction beyond receiving messages, and authentication bypass techniques may be involved. European organizations using Microsoft Teams for internal and external communication could face risks of misinformation, social engineering, and reputational damage. Mitigation requires close monitoring of Microsoft updates and applying patches promptly once available. Additional controls such as enhanced message verification, user training on phishing, and anomaly detection in chat behavior are recommended. Countries with high Microsoft Teams adoption and significant corporate or governmental use, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the medium severity rating, organizations should prioritize awareness and readiness to respond to potential exploitation attempts.

Phishing#infosecnews#redditGermany+6

This threat involves phishing attacks exploiting the OAuth device code authorization flow, comparing techniques targeting Microsoft Azure and Google accounts. Attackers trick users into authorizing malicious applications by presenting fake device code prompts, leading to credential compromise or unauthorized access. The phishing leverages the OAuth device code flow, which is designed for devices with limited input capabilities, making it a novel vector for social engineering. Although no known exploits are currently widespread, the technique poses a medium risk due to its potential to bypass traditional phishing defenses. European organizations using Azure or Google identity services are at risk, especially those with remote or hybrid workforces relying on OAuth device code authentication. Mitigation requires user education on recognizing legitimate device code prompts, implementing conditional access policies, and monitoring OAuth consent grants for anomalies. Countries with high adoption of Microsoft and Google cloud services, such as the UK, Germany, France, and the Netherlands, are most likely to be affected. The suggested severity is medium, given the moderate impact on confidentiality and the social engineering nature of the attack, which requires user interaction but no prior authentication. Defenders should focus on awareness, monitoring, and restricting OAuth app consent to reduce risk.

Phishing#infosecnews#redditGermany+5

North Korean threat actors have been observed using AI-generated video filters to impersonate individuals during fake job interviews as part of phishing campaigns. This technique leverages deepfake or AI video manipulation technology to deceive victims into believing they are interacting with legitimate recruiters or interviewers. The goal is to extract sensitive personal or corporate information or to deliver malware payloads. Although no known exploits or widespread campaigns have been reported yet, this emerging tactic represents an evolution in social engineering attacks. European organizations, especially those involved in recruitment or human resources, may be targeted due to the reliance on virtual interviews. The threat requires vigilance around verifying identities in remote communications and enhancing phishing detection capabilities. Mitigation involves implementing multi-factor authentication, training staff to recognize AI-generated media, and validating interview processes through trusted channels. Countries with high technology adoption and significant recruitment activities, such as the UK, Germany, and France, are more likely to be affected. Given the medium severity rating, the threat poses moderate risk but could escalate as AI tools become more accessible. Defenders should prioritize awareness and verification controls to reduce exposure.

Phishing#infosecnews#redditGermany+4

A threat actor group dubbed the 'YouTube Ghost Network' is distributing an infostealer malware campaign via approximately 3,000 fake YouTube videos. These videos serve as a vector for phishing attacks, aiming to trick users into downloading malicious payloads that steal sensitive information. The campaign leverages YouTube’s platform to reach a wide audience, exploiting user trust in the platform. While no known exploits or CVEs are associated, the infostealer can compromise confidentiality by exfiltrating credentials and personal data. The threat is assessed as medium severity due to the scale and social engineering involved, though exploitation requires user interaction. European organizations are at risk, especially those with employees who frequently use YouTube and may be targeted by phishing. Mitigation requires enhanced user awareness, strict email and web filtering, and monitoring for suspicious downloads. Countries with high internet penetration and significant YouTube usage, such as Germany, France, and the UK, are likely most affected. Given the ease of distribution and potential data loss, the threat severity is suggested as medium.

Phishing#infosecnews#redditGermany+5

EDR-Redir V2 is a technique that redirects system folders like "Program Files" to a fake location that excludes antivirus and EDR folders, effectively isolating endpoint detection and response tools from the rest of the system. This allows other software to operate normally while EDR solutions are blocked or bypassed, potentially enabling attackers to evade detection. The threat is categorized as phishing-related but primarily involves filesystem redirection to blind security tools. There are no known exploits in the wild, and technical details are limited to a Reddit NetSec post with minimal discussion. The medium severity rating reflects the potential for stealthy evasion but also the complexity and limited current exploitation. European organizations relying heavily on EDR solutions for endpoint security could be impacted, especially those with widespread use of Windows systems. Mitigation requires advanced monitoring of filesystem integrity, strict application whitelisting, and enhanced behavioral analytics to detect anomalies in EDR operation. Countries with large enterprise sectors using Windows and advanced EDR solutions, such as Germany, France, and the UK, are most likely to be affected. The suggested severity is medium due to the moderate impact on detection capabilities, the complexity of exploitation, and the lack of current active exploitation. Defenders should focus on monitoring for unusual folder redirections and ensuring EDR components are protected from tampering.

Phishing#netsec#redditGermany+5

Witnesses on the Thai side of the border reported hearing explosions and seeing smoke coming from the center over the past several nights starting on Friday. The post Stragglers From Myanmar Scam Center Raided by Army Cross Into Thailand as Buildings are Blown Up appeared first on SecurityWeek .

PhishingGermanyFrance+4

The BiDi Swap phishing technique exploits the bidirectional text rendering feature in Unicode to craft URLs that visually appear legitimate but actually direct users to malicious sites. By inserting special Unicode control characters, attackers can reverse portions of the URL text, making fake domains look real to users and evade detection. This trick is particularly dangerous in phishing attacks where users rely on visual inspection of URLs to verify authenticity. European organizations are at risk due to widespread use of browsers and email clients that support bidirectional text rendering. The threat can lead to credential theft, malware infection, and data breaches. Mitigation requires user awareness, URL parsing improvements in security tools, and disabling or flagging suspicious bidirectional characters in URLs. Countries with high internet usage, significant financial sectors, and advanced digital infrastructure, such as Germany, the UK, France, and the Netherlands, are more likely to be targeted. Given the ease of exploitation and potential for significant impact on confidentiality and integrity without user authentication, this threat is assessed as high severity. Defenders should prioritize detection of BiDi characters in URLs and educate users about this phishing technique.

Phishing#infosecnews#redditGermany+6

While reviewing malicious messages that were delivered to our handler inbox over the past few days, I noticed that the “subject” of one phishing e-mail looked quite strange when displayed in the Outlook message list…

PhishingGermanyFrance+8

The malicious Smishing Triad domains were used to collect sensitive information, including Social Security numbers. The post Massive China-Linked Smishing Campaign Leveraged 194,000 Domains appeared first on SecurityWeek .

PhishingGermanyFrance+8

CoPHish is a novel phishing technique that leverages Microsoft Copilot Studio chatbots to craft highly convincing OAuth-based credential theft campaigns. Attackers abuse the chatbot’s capabilities to generate realistic phishing content that tricks users into granting OAuth permissions, thereby compromising their accounts. This technique does not require exploiting software vulnerabilities but relies on social engineering and the abuse of legitimate OAuth flows. The threat is categorized as medium severity due to its potential impact on user credentials and organizational security, though it requires user interaction and targeted phishing attempts. European organizations using Microsoft 365 and related cloud services are at risk, especially those with extensive OAuth integrations. Mitigation involves user education on OAuth consent phishing, strict monitoring of OAuth app permissions, and enhanced email filtering. Countries with high Microsoft cloud adoption and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the ease of exploitation through social engineering and the broad scope of affected users, the suggested severity is medium.

Phishing#netsec#redditGermany+5

A global phishing campaign known as the 'Smishing Triad' has been linked to the creation and use of approximately 194,000 malicious domains. This operation leverages smishing (SMS phishing) techniques to deceive victims into divulging sensitive information or installing malware. The campaign is widespread and targets users globally, posing a significant threat to organizations and individuals alike. European organizations are at risk due to the high volume of malicious domains and the common use of mobile communications in business and personal contexts. The threat is categorized as high severity due to its scale, potential impact on confidentiality and integrity, and the ease of exploitation without requiring user authentication. Defenders should focus on enhancing mobile security awareness, deploying advanced domain filtering, and monitoring for suspicious SMS activity. Countries with high mobile penetration and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are particularly vulnerable. Immediate mitigation steps include user education, domain reputation services, and collaboration with telecom providers to detect and block smishing attempts.

Phishing#infosecnews#redditGermany+6

A recent phishing campaign exploits fake death claims related to LastPass to trick users into divulging credentials and breaching password vaults. Attackers impersonate LastPass or related entities, leveraging emotional manipulation to increase success rates. This social engineering tactic targets users of LastPass password managers, aiming to gain unauthorized access to their stored credentials. The campaign is high severity due to the sensitive nature of compromised data and potential for widespread credential theft. No known exploits in the wild have been reported yet, but the threat is credible given the trusted brand impersonation and phishing vector. European organizations using LastPass are at risk, particularly those with employees susceptible to social engineering. Mitigation requires targeted user awareness training, multi-factor authentication enforcement, and vigilant email filtering. Countries with high LastPass adoption and significant digital infrastructure, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. The threat is assessed as high severity due to the potential impact on confidentiality and ease of exploitation via phishing without technical vulnerabilities. Defenders should prioritize detection of phishing attempts referencing LastPass death claims and reinforce secure password management practices.

Phishing#infosecnews#redditGermany+6

Over the past two months, my outlook account has been receiving phishing email regarding cloud storage payments, mostly in French and some English with the usual warning such as the account is about to be locked, space is full, loss of data, refused payment, expired payment method, etc.

PhishingFranceBelgium+3

A high-severity phishing campaign targets Ukraine aid groups using fake Zoom meeting invitations and weaponized PDF files. Attackers impersonate trusted contacts to lure victims into opening malicious PDFs that may deliver malware or steal credentials. This threat exploits the reliance on virtual meetings and document sharing in humanitarian operations. European organizations supporting Ukraine or involved in aid efforts are at risk of data breaches, operational disruption, and espionage. The campaign requires user interaction but does not require prior authentication, increasing its attack surface. No known exploits in the wild have been reported yet, but the threat remains credible due to its targeted nature. Defenders should focus on verifying meeting invitations, scanning attachments, and educating users on phishing tactics. Countries with strong ties to Ukraine and active humanitarian sectors are most likely to be affected. The suggested severity is high due to the potential impact on confidentiality and operational integrity combined with ease of exploitation through social engineering.

Phishing#infosecnews#redditPoland+7

A fake Nethereum NuGet package was published using homoglyph characters to impersonate the legitimate package, aiming to steal cryptocurrency wallet keys from developers who inadvertently install it. This supply chain attack leverages the similarity of characters in package names to deceive users into downloading malicious code. The threat is categorized as phishing due to the deceptive nature of the package naming and distribution. Although no known exploits in the wild have been reported yet, the potential for significant financial loss is high given the theft of crypto wallet keys. European organizations involved in blockchain development or using Nethereum libraries are at risk, especially those in countries with active crypto markets and development communities. Mitigation requires vigilance in verifying package authenticity, use of package signing, and dependency monitoring tools. Countries like Germany, the UK, France, and the Netherlands are likely most affected due to their strong blockchain ecosystems and developer presence. The threat severity is assessed as high due to the direct impact on confidentiality and financial assets, ease of exploitation via developer error, and the broad scope of affected systems using the NuGet ecosystem. Defenders should prioritize supply chain security and developer education to prevent such attacks.

Phishing#infosecnews#redditGermany+5

A new phishing campaign is impersonating top firms by sending fake job offer emails to steal Facebook login credentials. The emails lure victims with employment opportunities, prompting them to enter their Facebook credentials on fraudulent websites. This threat targets individuals rather than specific software vulnerabilities and relies on social engineering. The campaign has been recently reported but lacks evidence of widespread exploitation or advanced technical sophistication. European organizations could face reputational risks if their employees fall victim, potentially leading to compromised personal or corporate Facebook accounts. Mitigation requires user awareness training focused on phishing recognition, verification of job offers through official channels, and enforcing multi-factor authentication on social media accounts. Countries with high social media usage and significant employment in multinational firms are more likely to be targeted. Given the medium severity rating, the threat poses moderate risk primarily through credential theft and potential subsequent misuse. Defenders should prioritize phishing detection and response capabilities to reduce impact.

Phishing#infosecnews#redditGermany+6

South Korea faces public calls to take stronger action to protect its nationals from being forced into overseas online scam centers. The post South Korea Seeks to Arrest Dozens of Online Scam Suspects Repatriated From Cambodia appeared first on SecurityWeek .

Phishing#rceGermany+4

A new tech support scam is leveraging the Microsoft logo to create a fake browser lock screen, tricking users into believing their system is compromised. This phishing attack aims to steal sensitive data by convincing victims to contact fraudulent support services. The scam does not exploit software vulnerabilities but relies on social engineering and visual deception. It has been recently reported on Reddit and covered by hackread.com, indicating emerging awareness but minimal current discussion or exploitation. European organizations and users are at risk due to the widespread use of Microsoft products and browsers. The scam's impact includes potential data theft, financial loss, and reputational damage. Mitigation requires user education, browser security enhancements, and blocking known scam domains. Countries with high Microsoft product adoption and significant digital infrastructure are most likely to be targeted. Given the ease of exploitation and potential data compromise without technical exploitation, the threat severity is assessed as medium.

Phishing#infosecnews#redditGermany+8