Business Email Compromise (BEC) is a sophisticated phishing threat involving coordinated operations that use compromised email accounts, financial research, and cash-out networks to defraud organizations. This threat is not a simple scam but a complex attack chain revealed through underground forums. The analysis highlights how attackers plan and execute BEC campaigns, emphasizing the need for targeted defensive measures. No specific software versions are affected, and no direct exploits or patches are associated with this threat.
How scammers play on your emotions and what social engineering really means: we break down the mind games cybercriminals play and how to spot them before it’s too late.
Business email compromise attacks increasingly rely on convincing impersonation rather than malware, making them harder for employees and traditional email defenses to detect. This webinar explores how behavioral AI can help identify sophisticated email threats and automate response workflows. [...]
Threat actors are selling investment scam templates created using the legitimate DCloud Uni-App toolkit. The post Chinese Framework Powers 200,000 Scam Sites appeared first on SecurityWeek .
The FBI and CISA are warning that a phishing campaign targeting Signal users tied to Russian intelligence services has evolved to steal Signal Backup Recovery Keys, allowing attackers to access victims' historical messages. [...]
Mirage2FA is a phishing kit that uses HTML smuggling and obfuscated JavaScript to deliver fake Microsoft 365 login pages. It targets users with business-themed lures and mimics the Microsoft 365 sign-in process, including MFA prompts. The goal is to steal Microsoft 365 credentials and potentially take over accounts. The phishing campaign uses short-lived domains and sophisticated code obfuscation to evade detection.
Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software. [...]
The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past week and by adding browser-in-the-middle capabilities for improved data theft. [...]
Service desk social engineering attacks exploit human trust and procedural weaknesses to gain unauthorized access to corporate systems. Attackers impersonate employees or contractors to trick help desk agents into resetting passwords, disabling MFA, or creating privileged accounts. These attacks bypass technical defenses by manipulating service desk staff, often using spoofed caller IDs and internal jargon to appear legitimate. High-profile incidents, such as those involving the Scattered Spider group, demonstrate the effectiveness and persistence of these tactics. Defenses include strict identity verification, limiting help desk privileges, and targeted staff training.
This threat involves a phishing campaign leveraging a kit targeting FACEIT and Steam users. The campaign expanded from initially using 3 domains to 75 domains, indicating a significant scaling of the phishing infrastructure. The information is sourced from a Reddit post linking to an external blog analysis. No specific affected software versions or exploits in the wild are reported. The campaign is categorized as medium severity based on available details.
An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. [...]
Maine's official data breach notification portal allowed anyone to submit breach disclosures without verification, leading to fake breach reports being publicly posted. Notably, fraudulent notices impersonating Discord and VRChat were submitted, causing these companies to publicly deny the incidents. The portal has been taken offline while the Maine Attorney General's office reviews the situation. This lack of authentication in the submission process risks misinformation, reputational damage, and public panic.
A sophisticated, modular phishing infrastructure has been identified targeting at least 12 Mexican financial institutions over a three-year period. The operation leverages GitHub Pages for hosting and SheetBest API for credential exfiltration, eliminating the need for dedicated backend infrastructure. Attackers employ obfuscated JavaScript, randomized paths, and dynamic brand selection panels to impersonate legitimate banking portals. Over 100 associated domains were identified, each hosting multiple phishing pages across different paths. Credentials are collected through multi-stage forms mimicking authentic banking authentication flows and exfiltrated in real-time to attacker-controlled Google Sheets. An alternative exfiltration method via Telegram bot was also observed. The campaign demonstrates operational persistence with multiple operator accounts maintaining the infrastructure through continuous commits and updates.
This threat involves autonomous AI agentic phishing, where standard phishing techniques are effective against autonomous AI personal assistants without requiring prompt injection or adversarial content. The information is sourced from a recent Reddit cybersecurity discussion linking to a Varonis blog post. There is no indication of known exploits in the wild or specific affected software versions. The threat is assessed as medium severity based on the potential for phishing attacks to manipulate AI agents.
Account takeovers are rising as attackers bypass traditional defenses through phishing, session hijacking, and MFA fatigue. Specops Software explores how device trust and continuous verification help reduce account takeover risk. [...]
BlueKit operates as a mature commercial Phishing-as-a-Service platform offering 87 ready-made phishing kits targeting banks, cloud services, cryptocurrency exchanges, and global brands. The platform features subscription-based access, automated account takeover capabilities, peer-to-peer infrastructure for stealth, and integrated anti-detection tooling. BlueKit supports credential harvesting, session hijacking, and automated post-compromise workflows including password resets and passkey enrollment. The platform includes bulk SMS phishing capabilities, Telegram notifications, hardware wallet seed phrase harvesting, and integration with anti-detect browsers. Operating through Tor and clearnet domains with cryptocurrency payments, BlueKit employs a reseller model enabling white-label redistribution. The platform significantly lowers technical barriers for cybercriminals while providing enterprise-grade phishing infrastructure, posing critical threats to financial institutions, cloud environments, and cryptoc...
The U.S. Federal Trade Commission (FTC) warned that Americans lost $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020. [...]
The U.S. Federal Bureau of Investigation (FBI) warned that criminals are using couriers to collect money from victims of cryptocurrency investment scams, also known as pig butchering or romance baiting. [...]
