A vulnerability in ChatGPT's Lockdown Mode allows attackers to bypass its protections and perform silent exfiltration of chat data, phishing, and malware delivery. The flaw exploits the HTML page preview feature in ChatGPT code blocks, enabling attackers to open pop-up windows outside the sandbox, exfiltrate entire chat histories without user interaction, and display phishing content. This bypass undermines Lockdown Mode's restrictions on outbound network requests and content loading. The attack surface includes data theft, social engineering via interface manipulation, and malware distribution within the trusted ChatGPT interface.
A phishing campaign uses over 300 fake domains impersonating mostly US financial institutions to target business banking and treasury logins. The phishing sites serve legitimate-looking login pages to first-time visitors but show fake 'account suspended' pages to returning visitors to evade takedown efforts. The campaign leverages Cloudflare to hide hosting details and uses IP tracking to differentiate visitors. This tactic complicates detection and takedown since security teams see only the fake suspended page on repeat visits. The campaign also targets victims in the UK, Australia, and New Zealand.
Ahead of the Grand Theft Auto VI release on November 19, 2026, threat actors are exploiting consumer excitement through phishing campaigns and fraudulent schemes. These campaigns use fake downloads, false early access offers, nonexistent mobile versions, and free game promises to lure victims. Malicious sites distribute trojans, request cryptocurrency payments, use content lockers requiring survey completion, and harvest personal information. Tactics include fake storefronts impersonating Rockstar Games, fraudulent APK files with unsafe permissions, and giveaway scams with urgency counters. Post-launch threats are expected to include in-game currency fraud, credential phishing for Rockstar and gaming platform accounts, and malware through fake cheats and modifications.
A phishing campaign impersonates OpenAI by sending fake ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fraudulent payment pages hosted on compromised WordPress sites under Nexcess's nxcli.io infrastructure. Attackers monitor submitted credit card details in real time and dynamically request one-time passwords (OTPs) to complete fraudulent transactions. The campaign uses multiple redirect domains and identical client-side code across instances to steal credit card information and OTPs.
Cybercriminals exploit the popularity of ebooks by distributing malware disguised as ebook files, using search result manipulation, phishing scams, and fake pirate library sites. These attacks can lead to malware infections such as cryptocurrency miners and infostealers, data leaks including personal and financial information, and fraudulent charges via fake bookstore sites. E-readers themselves are less commonly targeted, but vulnerabilities exist in advanced models. Users' reading histories and personal data can also be exposed through data leaks or account compromises. Safe practices include using official bookstores, keeping devices and apps updated, and avoiding unofficial firmware.
Threat actors are abusing legitimate mobile device management (MDM) platforms such as Hexnode and Rippling by using social engineering techniques to trick users into enrolling devices or installing management agents. Once enrolled, attackers deploy unauthorized remote monitoring and management (RMM) tools like ScreenConnect, connecting to attacker-controlled relays to gain remote access. The MDM platforms themselves are not compromised but are misused through deception, making it difficult to distinguish legitimate from malicious activity.
Check Point Research identified a malware campaign named Yoba that abuses the popularity of AI tools like ChatGPT and Claude by creating fake GitHub projects impersonating AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers containing a dropper and loader that fetch and execute malware. The campaign uses DLL sideloading with legitimate signed binaries to evade detection and employs strong operational security by avoiding traditional command-and-control infrastructure, instead using Telegram, Tor, Catbox, and DNS over HTTPS. The threat actor shows indicators of Russian origin and operates primarily in the UTC-4 timezone. The malicious releases are hosted on GitHub without password protection, leveraging SEO poisoning to appear in top Google search results and lure victims.
Three VBScript-based malware campaigns target victims primarily in Brazil and Portugal via phishing emails using fake legal and financial documents. These campaigns deliver Overlord RAT, Lampion trojan, and an unknown RAT through multi-stage execution chains involving obfuscated VBScript, batch files, and DLL side-loading with legitimate Windows components. The malware establishes persistence via scheduled tasks and registry modifications, evades detection by adding exclusions to Windows Defender and checking for virtual environments, and uses cloud services for payload delivery. Command and control infrastructure is based in Brazil.
Microsoft Teams will introduce an AI-powered, context-aware phishing detection feature starting in early November 2026. This feature aims to identify phishing, social engineering, impersonation attempts, and deceptive intent by analyzing conversation context, particularly focusing on external first-contact chats. The system does not retain message content for AI training or other secondary uses and requires no action from IT administrators to enable. This enhancement is part of a broader set of security improvements in Teams designed to reduce phishing and fraud risks.
This content describes a technology used by Kaspersky to detect and block email spam domains generated by domain generation algorithms (DGAs). Spammers use DGAs to create many similar domain names automatically, making it difficult to block spam by individual domain names. Kaspersky's solution clusters similar domains and creates rules to block entire batches of these generated domains, improving spam filtering efficiency. The technology is part of Kaspersky's corporate email security solutions and helps reduce spam, phishing, and malware emails.
This is a medium-severity phishing campaign observed in late 2026 targeting organizations during year-end and fiscal close periods. Attackers exploit increased legitimate administrative communications in finance, HR, and IT by impersonating compensation adjustments, Q4 financial documents, access reviews, invoice follow-ups, and benefits statements. The campaign uses themes from SharePoint, Docusign, and Microsoft 365 to deliver credential harvesting pages disguised as document-sharing portals. It affects multiple sectors including aviation, telecommunications, manufacturing, real estate, technology, and financial services, with a concentration in the Middle East. The phishing lures are generic and require minimal customization, making them effective during busy periods when employees expect increased document requests.
This analysis covers rapid credential theft and data exfiltration attacks that occur within minutes of initial compromise, often outpacing traditional security detection and response. Attackers exploit stolen GitHub tokens, malicious AI tool installers, and MFA phishing to quickly access and exfiltrate sensitive data. Detection requires anomaly and behavior-based monitoring, while effective containment demands automated or autonomous response to minimize attacker dwell time. Manual response delays enable significant data loss. The threat highlights gaps in current identity provider detections and the need for integrated, fast-acting defense mechanisms.
Tenable developed a multilingual AI security detection model that natively supports 10 languages, overcoming limitations of English-only threat detectors. Previously, their approach translated non-English inputs into English before detection, which introduced latency, cost, operational complexity, and loss of semantic accuracy. To address this, Tenable created an agentic translation pipeline that generates high-fidelity, label-preserving multilingual training and benchmark data, ensuring the security-relevant meaning is maintained. This approach avoids reliance on costly and slow translation models in production, resulting in detection speeds 20-800 times faster and significantly reduced costs. The solution improves detection of AI threats, harmful content, and policy risks across multiple languages without degrading accuracy.
Attackers are abusing legitimate infrastructure, such as transactional email pipelines from trusted retailers like Staples and Dell, to deliver malicious content. Instead of forging sender identities, attackers embed fraudulent information within legitimate order notification fields to create urgency and prompt victims to call attacker-controlled phone numbers. This technique leverages the inherent trust in authenticated messages, bypassing traditional sender authentication checks. The abuse extends beyond commerce pipelines to various SaaS platforms, exploiting insufficient input validation to reflect attacker-controlled content in automated notifications. This evolving attack vector highlights a systemic vulnerability where trusted platforms inadvertently become delivery mechanisms for malicious intent.
Antidetect browsers such as Kameleo, AdsPower, and MultiLogin enable threat actors to conceal their digital identities and manage thousands of isolated accounts across multiple social media and financial platforms without detection. These tools facilitate account takeovers, financial fraud, phishing, malware distribution, and coordinated influence operations by evading platform detection systems that rely on behavioral and device identity signals. The integration of AI enhances these browsers' capabilities, automating persona management and content generation at scale, reducing the need for large technical teams. These commercially available browsers have legitimate uses but are actively abused in underground criminal ecosystems. The threat is significant because accounts created or taken over via antidetect browsers can pass KYC verification and appear legitimate, making fraud detection difficult until after damage occurs.
This content discusses cybersecurity challenges faced by small and medium-sized businesses (SMBs), focusing on vulnerabilities in people, processes, and technology that can lead to cyberattacks. It highlights how attackers exploit gaps such as unpatched software, insufficient employee training, and inadequate protection of cloud infrastructure. A real-world case study describes an ERP system breach during cloud migration, where attackers used phishing and exploited unpatched vulnerabilities to gain administrator access and steal confidential data. The article emphasizes the importance of targeted employee training, structured patch management, and appropriate technological defenses to mitigate risks.
Unit 42's report for September 2026 outlines the top five initial access vectors used by adversaries to breach organizations. The primary vector is exploitation of public-facing applications, followed by credential abuse, phishing, supply chain compromise, and drive-by compromises. These vectors highlight a mix of technical exploits and social engineering targeting public sector, critical infrastructure, and enterprise environments. The report emphasizes the systemic risks posed by supply chain attacks and automated drive-by compromises. No specific vulnerabilities or exploits are detailed, but the trends indicate persistent threats leveraging exposed infrastructure and stolen credentials.
This analysis discusses the security and privacy risks associated with using AI chatbots and language models for resume writing and job applications. It highlights the potential for personal data leakage through AI training, bugs, or indexing of shared conversations. The post advises users to remove sensitive information before submitting resumes to AI tools and to prefer local AI models for sensitive data. It also warns about malicious actors exploiting personal data from AI interactions for targeted phishing and scams. The article provides guidance on safely using AI to improve resumes without oversharing and explains how applicant tracking systems (ATS) and AI are used in recruitment.
CikaBika Bot is a Rust-based Remote Access Trojan (RAT) distributed via phishing emails containing malicious document-themed lures. It uses Discord channels for command-and-control (C&C) communications and provides attackers with capabilities including system reconnaissance, remote command execution, process management, file upload/download, and surveillance functions such as screenshots and camera streaming. The malware employs a multi-stage infection chain involving a decoy document, PowerShell scripts, and DLL sideloading to evade detection and bypass User Account Control (UAC). Data exfiltration is facilitated through Ngrok tunnels. The malware leverages legitimate services like Discord and Ngrok to mask its operations.
A phishing campaign uses fake Calendly booking pages impersonating Meta Careers to steal Facebook and Google login credentials. Victims are tricked into selecting interview times, submitting personal data, and completing fake CAPTCHAs before being prompted to log into their accounts. The phishing kit captures credentials and bypasses two-factor authentication by relaying authentication codes in real-time. The fake pages include convincing replicas of legitimate login screens with fake address bars showing authentic URLs. Eleven domains with recruiting-related names are involved, and the infrastructure operates via Amazon API Gateway in Singapore. Code comments in Vietnamese suggest possible origins of the operation.
