Phishing
Victims span across the aviation, critical infrastructure, energy, logistics, public administration, and technology sectors.
Hi, what are you looking for?
SecurityWeek
Phishing
The attackers call victims to direct them to phishing websites mirroring Microsoft Entra ID login pages.
Cybercrime
The decentralized prediction market said hackers targeted some of its users through a compromise of a third-party vendor.
Phishing
The platform used more than 9,000 phishing sites, stealing nearly 4 million credit cards and causing roughly $1.9 billion in losses.
Phishing
MokN's platform deploys realistic decoy access points to lure attackers into revealing compromised credentials, enabling organizations to respond before abuse occurs.
Phishing
The malicious emails claim to contain a conduct report and lure victims to a Microsoft phishing website that leverages AitM.
Phishing
Still under development, Bluekit provides users with automated domain registration and an AI Assistant.
Phishing
Legitimate-looking emails coming from Robinhood systems lured recipients to phishing websites.
Email Security
New analysis from Abnormal AI reveals how attackers have abandoned technical exploits to weaponize routine workflows and internal trust.
Phishing
Threat actors are reusing Tycoon 2FA tools across other phishing kits following the platform’s disruption.
Phishing
Attack volumes are back to pre-disruption levels, and the adversary tactics have remained unchanged.
Malware & Threats
Insufficient sanitization of CSS content within HTML emails leads to inline script execution when the message is opened in a browser.
Phishing
The attackers used a DKIM-signed phishing email, trusted redirect infrastructure, compromised servers, and Cloudflare-protected phishing pages, but the attack was unsuccessful.
Data Breaches
Starbucks said the incident involved phishing attacks targeting an employee portal, affecting hundreds.
Phishing
Abusing DNS record management controls, the threat actor hides the location of malicious content via Cloudflare.
Phishing
The attackers are sending out fake alerts claiming unauthorized access or master password changes.
Cybercrime
Domains set up by the threat actor suggest attacks aimed at Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
Malware & Threats
Priced $2,000 - $6,000 on a cybercrime forum, the MaaS toolkit promises publication on the Chrome Web Store.
Phishing
Threat actors are leveraging the file-sharing service for payload delivery in AitM phishing and BEC attacks.
Cybercrime
Threat actors may have wanted to take advantage of the holiday weekend in the United States to increase their chances of success.
Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)
Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts.
(Tod Beardsley)
Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences.
(Steve Durbin)
As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production.
(Matias Madou)