Phishing
Abusing DNS record management controls, the threat actor hides the location of malicious content via Cloudflare.
Hi, what are you looking for?
SecurityWeek
Cybercrime
The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.
Phishing
Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks.
Data Breaches
Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.
Phishing
Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or...
Phishing
The attackers are sending out fake alerts claiming unauthorized access or master password changes.
Cybercrime
Domains set up by the threat actor suggest attacks aimed at Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
Malware & Threats
Priced $2,000 - $6,000 on a cybercrime forum, the MaaS toolkit promises publication on the Chrome Web Store.
Phishing
Threat actors are leveraging the file-sharing service for payload delivery in AitM phishing and BEC attacks.
Cybercrime
Threat actors may have wanted to take advantage of the holiday weekend in the United States to increase their chances of success.
Email Security
Threat actors spoof legitimate domains to make their phishing emails appear to have been sent internally.
Cybercrime
The cybercriminals attempted to steal $28 million from compromised bank accounts through phishing.
Identity & Access
AI has given cybercriminals the ability to operate like Fortune‑500‑scale marketing departments—except their product is account takeover, data theft, and identity fraud.
Phishing
The cybercriminals informed customers that their cloud server was shut down due to complaints.
Phishing
Google is targeting the threat group known as Smishing Triad, which used over 194,000 malicious domains in a campaign.
Phishing
The malicious Smishing Triad domains were used to collect sensitive information, including Social Security numbers.
Phishing
The video game software development company says the incident impacted users of its SpeedTree website.
Phishing
Threat actors used automation to create over 175 malicious NPM packages targeting more than 135 organizations.
Phishing
Threat actors impersonating PyPI ask users to verify their email for security purposes, directing them to fake websites.
Cybercrime
Microsoft and Cloudflare have teamed up to take down the infrastructure used by RaccoonO365.
Artificial Intelligence
AI-powered phishing attacks leverage ConnectWise ScreenConnect for remote access, underscoring their sophistication.
Cybercrime
Investigators from HMRC joined more than 100 Romanian police officers to arrest the 13 Romanian suspects in the counties of Ilfov, Giurgiu and Calarasi.
Email Security
Hackers are abusing the Microsoft 365 Direct Send feature to deliver phishing emails that bypass email security controls.
Data Breaches
Microsoft flags a new Kremlin hacking team buying stolen usernames and passwords from infostealer markets for use in cyberespionage attacks.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.
(Nadir Izrael)
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today.
(Sravish Sridhar)
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default.
(Matt Honea)
Security teams must treat autonomous agents as highly privileged identities.
(Etay Maor)
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)