Phishing & Scams
Fake login pages, fake support calls and fake apps: how the scams work and what to tell your staff.
Moldova Cyberattack: State Actor Suspected After Citizen Data Was Taken From Government Systems, What Is Confirmed and What to Check
Moldova says hackers accessed the personal data of about 450,000 citizens through government digital services. The prime minister suspects a state actor but has named none. Here is what is confirmed and what businesses should check.
Does MFA Stop Stolen Passwords? What 19,252 Unauthorized Brokerage Access Cases in Japan Show About Phone Codes and Passkeys
Japan's regulator counted 19,252 unauthorized access cases at online brokerages in 21 months. Phone MFA blocks a leaked password on its own, but typed codes can still be stolen on fake sites. Here is what to change this week.
Fake Software Installers: Microsoft Says Cracked Downloads Hijack Windows PC Bandwidth and Computing Power, and How to Check Yours
Microsoft says fake downloads for cracked software, free games and unofficial tools route outside traffic through Windows PCs and enroll them in distributed computing. Here is what is confirmed and what to check this week.
Mirax Android RAT: Thousands of Banking Customers' Phones Infected, Streaming App Ads Suspected, and How to Lock Down Work Phones
Group-IB says Mirax Android malware infected thousands of retail banking customers' phones in the Middle East, Turkey and Africa. Here is what is confirmed, what is not, and what to check on work phones.
Fake Gift Card Scams: 1,000+ Incidents Use Walmart, Sephora and MrBeast Branding to Push Surveys and Phone Subscriptions, and What to Do This Week
CTM360 tied fake gift card giveaways to more than 1,000 incidents. No card was delivered in any flow it tested. Here is how the scam works, what Trap 10 is, and what businesses should do this week.
Holiday Rental Phishing: Fake Booking Sites Use Copied Listings and Live Chat to Steal Passwords and Card Numbers, What Is Confirmed and What to Tell Traveling Staff
Fortra researchers found fake holiday rental sites that copy real listings and reviews, then use a live chat agent to talk travelers into entering passwords and card numbers. Here is what is confirmed and what to tell staff who book work travel.
Dangling DNS Records: Typos in SPF, MX and DMARC Records Leave 43 US Government Domains Open to Email Spoofing, and How to Check Your Own Domain
Researchers found 43 US government domains whose SPF, MX, DMARC or NS records trust misspelled or expired domains. What is confirmed, what is not, and how to check your own DNS this week.
AI CEO Fraud: Three Charged With Using Deepfake Voices of CEOs and Lawyers to Take $129 Million, What Is Confirmed and the Wire Checks to Add This Week
Federal prosecutors in New York say three people used AI to copy the voices of CEOs and law firm attorneys, then talked accounting staff into wiring about $129 million. Here is what is confirmed and how finance teams should check wire requests.
Fake Event Invitation Phishing: Fake OpenAI, SpaceX and Anthropic Invites Target Microsoft and Google Work Accounts, What Is Confirmed and What to Check
Fake OpenAI, SpaceX and Anthropic event invites ask employees to register with their work Microsoft or Google account. The tools behind them can get past MFA codes. Here is what is confirmed and what to check this week.
