This threat involves the use of a large language model (LLM) platform, Venice.ai, which offers uncensored AI capabilities that could be leveraged to create phishing tools. The information originates from a Reddit cybersecurity discussion where a user inquires about uncensored LLMs suitable for phishing tool creation. There is no evidence of active exploitation or specific vulnerabilities in Venice.ai itself. The platform emphasizes privacy and uncensored AI access but does not inherently constitute a vulnerability. No patches or fixes are applicable as this is a misuse scenario rather than a software flaw.
A small business website is being repeatedly and falsely flagged as phishing or malicious by multiple security vendors, causing access issues for users of certain ISPs. The site owner has verified proper DNS and SSL configurations and suspects possible malicious reporting by competitors. The website is hosted on SquareSpace and built on Shopify, with no unsafe content. There is no evidence of actual compromise or exploitation. The issue appears to stem from false positive detections by security vendors rather than a technical vulnerability.
The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environments. This report details the attack chain, detection opportunities, and mitigation guidance to help organizations identify and disrupt related activity. The post Typosquatted npm packages used to steal cloud and CI/CD secrets appeared first on Microsoft Security Blog .
A new phishing campaign targets Japanese online banking users by impersonating a legitimate bank with a typographical error in the brand name, using 'PayPoy' instead of the correct name. The phishing emails demand verification within 24 hours but contain a conspicuous branding typo that has reduced the campaign's perceived credibility, turning it into a viral meme in the local tech community rather than causing widespread alarm. The campaign was reported on Reddit cybersecurity forums with minimal discussion and no confirmed exploits in the wild. No patch or official remediation is applicable as this is a phishing campaign rather than a software vulnerability.
Kali365 is a phishing-as-a-service (PhaaS) platform that has recently seen a surge in activity involving device code phishing attacks. These attacks exploit legitimate Microsoft device authentication flows by tricking victims into entering a user code on a real Microsoft authentication page, enabling attackers to capture OAuth access tokens rather than passwords. This method reduces traditional phishing indicators, making detection and triage more difficult. The phishing kit includes templates for Microsoft services such as OneDrive, SharePoint, Teams, Outlook, and Voicemail, as well as Google device-code authentication flows. The activity was observed through over 100 analysis sessions in 24 hours on ANYRUN, indicating rapid scaling. No known exploits in the wild or patches are applicable as this is a phishing campaign rather than a software vulnerability.
Threat actors are exploiting legitimate Google AppSheet addresses for phishing campaigns, sending emails on behalf of major companies to steal user credentials.
As AI accelerates phishing, session hijacking, and credential abuse, security teams are racing to close the gap between attacker speed and defensive response. The post The Credential Crisis: How Stolen Credentials Defeat Modern Security appeared first on SecurityWeek .
The FBI has issued an alert about the Silent Ransom Group (SRG) targeting law firms primarily in the US by impersonating IT support to gain access to systems. The attackers use social engineering, including phishing and phone calls, to convince employees to grant remote access or, if unsuccessful, send operatives in person to insert USB drives or external devices into victim computers. After gaining access, SRG escalates privileges and exfiltrates data using legitimate tools like WinSCP or Rclone, often avoiding ransomware deployment. The group then extorts victims by threatening to publish or sell stolen data. Traditional antivirus solutions are unlikely to detect these intrusions due to the use of legitimate system tools. The FBI recommends verifying credentials, limiting access, employee training, and disabling remote access and external drive permissions to prevent such attacks.
The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multi-factor authentication (MFA). [...]
This report discusses the concept of indirect prompt injection as a trivial method of social engineering AI systems, likening AI to a toddler being manipulated with world knowledge. The information is sourced from a Reddit cybersecurity discussion and does not provide technical details, affected versions, or evidence of active exploitation. The threat is categorized under phishing but lacks concrete indicators or exploit data.
Two former executives of a call-tracking and analytics company pleaded guilty to concealing a years-long tech support fraud scheme that victimized individuals worldwide. [...]
This report discusses tracking a Phishing-as-a-Service (PhaaS) operator, detailing a case from an initial phishing email to activity linked to Lagos, Nigeria. The information is sourced from a Reddit cybersecurity post referencing an external blog. There are no technical details, affected software versions, or known exploits provided. The threat is categorized as phishing with medium severity based on the available data.
This threat describes a widespread fake engagement problem on GitHub where bot accounts artificially inflate star counts on repositories, primarily targeting low-quality AI tools and executor software. A detection tool named phantomstars identifies these campaigns by analyzing account creation dates, activity patterns, and coordinated timing of star events. The fake engagement distorts the credibility signals developers rely on to evaluate and recommend software. No direct exploitation or vulnerability is described, but the manipulation impacts trust and decision-making in the open source ecosystem.
Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments. The malware executes during npm install and targets credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password platforms. The post Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft appeared first on Microsoft Security Blog .
This content is a blog post discussing the evolving cybersecurity challenges and opportunities for growing businesses in an AI-powered world. It highlights how AI is increasing the sophistication and frequency of cyberattacks, particularly AI-automated phishing, which is significantly more effective than traditional methods. The post emphasizes the importance of integrating simple, built-in security solutions to protect business operations, customer trust, and growth. It does not describe a specific vulnerability or exploit but rather provides best practices and strategic guidance for cybersecurity in the context of AI advancements.
How can family subscriptions turn into a cyberthreat? What kind of phishing emails are scammers sending to subscribers? And most importantly, how do you use these services safely? We cover all this and more in this post.
Security researchers gained direct access to Doko's Panel, a real-time phishing platform used in criminal campaigns by ShinyHunters and BlackFile groups. The investigation revealed four distinct infrastructure clusters operating independently customized variants of the tooling. Attacks combine voice phishing with adversary-in-the-middle techniques targeting enterprise identity providers like Okta, Microsoft, and Google, as well as cryptocurrency exchanges. Operators call victims impersonating IT helpdesk staff, directing them to combosquatted domains where credentials and MFA tokens are manually relayed in real-time. Confirmed breaches include SoundCloud (30M records), Match Group (10M records), Betterment (20M records), and Crunchbase. Over 400 domains have been identified linked to these operations. Evidence shows extensive use of AI language models in developing phishing infrastructure, with operators leveraging legitimate services to rapidly deploy and rotate attack infrastructure.
Operation HookedWing is a prolonged phishing campaign active for over four years, targeting more than 500 organizations across multiple critical sectors including aviation, energy, logistics, and public administration. The campaign uses phishing emails impersonating trusted sources and leverages GitHub and compromised servers to host phishing infrastructure. Victims are lured to fake Microsoft Outlook login pages that personalize content to increase credibility and steal credentials along with geolocation data. The threat actor focuses on high-value targets with access to sensitive information and high-privilege credentials. The campaign has evolved over time, expanding its infrastructure, languages, and phishing themes to maintain effectiveness.
A sophisticated credential theft campaign targeting over 35,000 users across 13,000 organizations was observed between April 14-16, 2026. The operation primarily impacted the United States, particularly healthcare and financial services sectors. Attackers used code of conduct themed phishing emails masquerading as internal compliance communications, sent through legitimate email delivery services from attacker-controlled domains. Victims received polished HTML emails with PDF attachments containing fake disciplinary logs and CAPTCHA gates to evade automated analysis. The multi-stage attack chain ultimately directed users to counterfeit Microsoft authentication pages operating as adversary-in-the-middle infrastructure, enabling real-time interception of credentials and session tokens while bypassing multi-factor authentication defenses.
