Data Breaches
A mandatory filing to the Maine Attorney General says 69,461 customers nationwide were affected and dates the breach back to last December.
Hi, what are you looking for?
SecurityWeek
Cybercrime
The cybercrime platform leveraged AI at every step of the attack chain, including writing social engineering messages and deciding targets.
Phishing
Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks.
Data Breaches
Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.
Phishing
Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or...
Artificial Intelligence
Combined with AI, polymorphic phishing emails have become highly sophisticated, creating more personalized and evasive messages that result in higher attack success rates.
Email Security
A sophisticated phishing campaign abuses weakness in Google Sites to spoof Google no-reply addresses and bypass protections.
Artificial Intelligence
Agentic AI has improved spear phishing effectiveness by 55% since 2023, research shows.
Email Security
‘PoisonSeed’ phishing campaign targets CRM and bulk email providers to distribute “crypto seed phrase” messages.
Phishing
A threat actor tracked as Morphing Meerkat abuses DNS mail exchange (MX) records to deliver spoofed login pages.
Phishing
A long-running campaign phishing for credentials through scareware recently switched to targeting macOS users.
Phishing
Threat actors are abusing Microsoft 365 infrastructure in a BEC campaign, and target its users in two brand impersonation campaigns.
Phishing
A cybercrime group named Storm-1865 has targeted hospitality organizations via fake Booking.com emails and the use of social engineering.
Phishing
Researchers see dozens of fake DeepSeek websites used for credential phishing, cryptocurrency theft, and scams.
Cybercrime
Business resilience must be the ultimate purpose of all the security controls and processes we employ, because we will never conclusively defeat or protect...
Phishing
Noteworthy stories that might have slipped under the radar: several multi-million dollar settlements, CrowdStrike-themed phishing emails, and MITRE launches D3FEND 1.0.
Phishing
Fortinet warns of a phishing campaign that uses legitimate links to take over the victims’ PayPal accounts.
Phishing
General Dynamics says several benefits accounts were hacked after threat actors targeted employees in a phishing campaign.
Phishing
Okta has warned customers that it has seen an increase in phishing attacks impersonating its support team.
Cybercrime
Belgian and Dutch authorities arrested eight individuals for their alleged involvement in phishing, online scams, and money laundering operations.
Cybercrime
Microsoft has seized 240 phishing-related websites and has disrupted the ONNX service, which the company says is run by an Egyptian man.
Cybercrime
GoIssue is a new tool for cybercriminals that allows attackers to extract email addresses from GitHub profiles and send bulk emails to users.
Cybercrime
Kolade Akinwale Ojelade was sentenced to 26 years in prison in the US for compromising email accounts through phishing and stealing millions.
Email Security
Barracuda has observed a large-scale OpenAI impersonation campaign whose goal is to phish for ChatGPT credentials.
Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.
(Nadir Izrael)
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today.
(Sravish Sridhar)
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default.
(Matt Honea)
Security teams must treat autonomous agents as highly privileged identities.
(Etay Maor)
For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality.
(Danelle Au)