This content describes an upcoming webinar discussing how behavioral AI can help detect and mitigate modern phishing, business email compromise (BEC), and account takeover (ATO) attacks that bypass traditional email defenses. The webinar focuses on automating detection, investigation, and remediation to reduce alert fatigue and improve response times. It highlights challenges such as attackers abusing legitimate authentication flows and the operational strain on security teams. No specific vulnerability or exploit is detailed.
The platform used more than 9,000 phishing sites, stealing nearly 4 million credit cards and causing roughly $1.9 billion in losses. The post FBI, Google Dismantle ‘Outsider Enterprise’ Phishing Service appeared first on SecurityWeek .
In a coordinated effort, the FBI, working with Google and Black Lotus Labs, has dismantled a massive Chinese phishing-as-a-service operation called Outsider Enterprise with thousands of phishing websites used to steal credit card data and passwords. [...]
A security researcher accidentally gained access to a phishing website controlled by a threat actor. The incident revealed operational mistakes by the threat actor, including exposure of backend panels and infrastructure details. This access provides valuable insight into phishing infrastructure and potential pivot points for threat intelligence investigations. The event was shared on Reddit's r/netsec community with a link to a detailed write-up. No specific software versions or patches are involved. The severity is assessed as medium based on the nature of the exposure and potential intelligence value.
The UNC1151/Ghostwriter group is conducting high-intensity phishing campaigns targeting Gmail accounts of Polish citizens since March 2026. The campaigns primarily target individuals in political and public life, prominent positions, researchers, journalists, public administration and law enforcement employees, and their associates. Attackers use fraudulent emails impersonating Gmail administrators, claiming suspicious activity or policy violations to pressure victims into verifying their accounts. The phishing infrastructure captures login credentials and two-factor authentication codes through fake login panels. The group utilizes dedicated domains, Netlify subdomains, and compromised websites to host phishing pages. Campaigns run primarily on weekdays with new domains appearing almost daily, demonstrating persistent operational tempo against Polish targets.
Attackers are abusing legitimate Microsoft notification emails by injecting malicious content into dynamic fields that are rendered in real, authenticated messages. This technique leverages trusted senders and legitimate notification triggers, allowing phishing lures to pass SPF/DKIM/DMARC checks. The abuse extends beyond Microsoft to other SaaS platforms and services that render customer-controlled text in notifications, such as PayPal, DocuSign, and Azure Monitor. The threat requires defenders to scrutinize notification context rather than relying solely on sender authentication.
This entry is a request on Reddit for current phishing email samples targeting IONOS customers, intended for a technical blog analysis focusing on email headers and artifacts. It does not describe a specific vulnerability or active exploit but rather seeks raw phishing email data for research purposes.
Attackers are increasingly bypassing weak authentication through phishing, MFA fatigue, and service desk social engineering. Specops Software breaks down five best practices for stronger identity verification and access security. [...]
As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomware and other cybercrime operations. The post Infostealers Turn Millions of Devices Into Credential Theft Machines appeared first on SecurityWeek .
Phishing simulation on an OpenClaw email agent with various configuration profiles showed that it was susceptible to tactics commonly used to compromise human users. [...]
WhatsApp successfully identified and disrupted spear phishing attempts linked to NSO Group, a spyware firm blacklisted by the US government. The company is requesting the court to hold NSO in contempt for violating a permanent injunction that prohibited them from targeting WhatsApp and its users. The attacks involved social engineering attempts to trick users into clicking malicious links, as well as creating test accounts and groups on the platform. WhatsApp emphasizes that spyware represents a national security threat and is supporting the Spyware Accountability Initiative through significant contributions. The company continues to protect users through end-to-end encryption and encourages reporting suspicious activity while maintaining updated applications and devices.
WhatsApp has detected and stopped spear-phishing campaigns allegedly conducted by the NSO Group after investigating user reports of social engineering attacks. [...]
As threat actors operationalize AI to accelerate attacks, they are also leveraging the wider global interest around AI itself as a social engineering lure. The post AI brands as bait: How threat actors are using the AI hype in social engineering appeared first on Microsoft Security Blog .
Phishing, shadow AI, malicious extensions, and credential theft increasingly happen inside the browser. Keep Aware explains what the 2026 Verizon DBIR reveals about browser-layer security gaps and modern attacks. [...]
Relying on social engineering, the hacking group engages in credential phishing, malware distribution, and fraud activities. The post Chinese Cybercrime Group in Spotlight for Record Campaign Pace appeared first on SecurityWeek .
A malvertising campaign is leveraging ChatGPT and OpenAI branding to deceive users into downloading malware. The campaign was reported via a Reddit post linking to an external analysis by Evalian. There are no specific affected software versions or technical exploit details provided. The campaign is categorized as phishing and malware distribution. No known exploits in the wild or patch information is available. The threat appears to be recent but has minimal discussion and no direct indicators shared.
Google is introducing a new Android security feature that will detect and flag phone calls in which scammers use artificial intelligence to impersonate a user's personal contacts. [...]
This analysis covers emerging security risks related to AI-powered attacks and uncontrolled AI adoption occurring within browser sessions. Attackers leverage AI to rapidly create and evolve phishing kits and multi-channel campaigns that evade traditional detection methods relying on blocklists and IoCs. Simultaneously, employees adopt AI tools and browser extensions without adequate governance, leading to data exfiltration and OAuth permission abuses. The browser is identified as the critical layer where both attack delivery and AI governance converge, requiring deep visibility into browser activity to detect threats and control AI usage effectively. Traditional endpoint and network defenses lack the necessary insight into browser-native attack techniques and shadow AI adoption. The threat is ongoing and evolving, with no specific software vulnerability or patch available. The severity is assessed as critical due to the combination of advanced attacker capabilities and widespread uncontrolled AI use in enterprise environments.
For a few days, my SANS ISC mailbox is flooded with emails that delivers SVG files. An SVG ("Scalable Vector Graphic") is a web-friendly vector file format used for graphics and icons. No URL in the body, just “an image”, that's the perfect way to deliver some malicious content. This isn't the first time that we see this technique used by threat actors[1].
Kaspersky experts are studying the full end-to-end reality of messaging-based scams to understand the extent of the losses, how quickly harm occurs, how they impact trust, and what remains after an interaction ends. They also shared statistics and advice on how to avoid falling victim to scam schemes.
