Stories tagged “Phishing.”
30 stories
Trezor said nearly 14,000 customers had personal data exposed after its fulfillment partner ShipMonk suffered an unauthorized access to its systems, though its own infrastructure and wallets remain secure.
The White House has signed a national security presidential memorandum that enables private security companies to apply for approval to hack foreign cybercrime organizations. The program will be overseen by executive directors designated by the Justice and Homeland Securi…
The best antivirus software to protect your computer in 2026
ZDNET experts put every product through rigorous testing and research to curate the best options for you. Our favorite antivirus software protects your PC, laptop, and mobile devices from malware without costing a fortune.
The Singapore police issued a warning about a scam involving compromised Telegram accounts. Victims receive a message with a fake public transport voucher link, which leads to a phishing page asking for personal details. The scammers then seize control of the victim's Tel…
Scammers are sending iMessages pretending to be the Singapore police or courts, claiming unpaid fines and asking victims to click links or reply with codes. The police advise verifying notices on official websites, using iMessage spam filters, installing ScamShield, and e…
New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party …
Cybersecurity researchers have called attention to an active phishing campaign that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email.
Google's security researchers have identified groups of hackers targeting financial and investment firms in the US, using phone calls to trick employees into entering their credentials and extorting them with the threat of publishing stolen data.
A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software.
AI-powered phishing has made blocklists functionally useless by generating phishing pages from screenshots in minutes, spinning up and tearing down infrastructure faster than any blocklist can track, and iterating on tooling at a cadence that makes indicator-based detecti…
The Greatness phishing-as-a-service platform is now abusing RingCentral's trusted sender reputation to bypass email filters and harvest Microsoft 365 credentials via adversary-in-the-middle and device-code attacks.
Greatness PhaaS, a commercial phishing-as-a-service toolkit, has added support for device code phishing, a rapidly growing cyber threat that bypasses Multi-Factor Authentication (MFA) and steals user tokens.
Hardware wallet manufacturers Trezor and Foundation have warned of a surge in phishing attempts targeting users of their devices, following the disclosure of a Coldcard firmware exploit. Scammers are chasing users' recovery phrases and pushing malicious downloads.
A Chinese threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. The kit targets iOS versions 18.4 through 18.7 and has been observed to employ watering holes as a starting point …
The Police National Legal Database (PNLD) has confirmed that police, government, and customer contact information was compromised and published on the dark web. The data included names, organisations, and work email addresses belonging to police officers, police staff, cr…
A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report.
Device code phishing, the abuse of the OAuth 2.0 device authorization grant to steal access tokens, has evolved from a niche red-team technique to an industrial-scale threat in under six months. It defeats every form of MFA, including passkeys, and is now a standard featu…
The New SIM Card Scam That Can Steal Your Banking Data During Vacations
A new scam is targeting people during their vacations by creating fake websites that imitate official telecom operators' portals. These websites ask for phone numbers and account credentials, which are then used to steal personal and banking information.
Russia's Federal Security Service (FSB) has charged Telegram founder Pavel Durov with allegedly facilitating terrorist activities and failing to remove prohibited information in violation of Russian law.
Kaspersky attributes a fresh wave of attacks across the Middle East, Africa, and South Asia to Iranian group Nimbus Manticore, which deployed a new Windows backdoor called NightLedger alongside custom WebSocket tunnelers BridgeHead and ArcBridge to covertly relay traffic …
Assume AI cybersecurity attacks are the future: 43% of companies have already experienced it
A new CDW research report reveals that 43% of organizations have experienced AI-enhanced phishing attacks, and 37% have encountered AI-augmented malware. Many companies are considering investing in AI threat detection, training, and controls to combat the new face of mode…
Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs 'secure document' lures to deliver legitimate remote monitoring and management (RMM) tools. The campaign, codenamed Operation BlueDash, has been active since at least February 2…
A China-linked cybercrime group has been observed using a sophisticated crypter service called Cruciferra to deliver a wide array of remote access trojans (RATs) and information stealer malware.
Binance, the largest crypto exchange, runs simulated phishing attacks on its employees to test their security hygiene. The company's red team poses as job recruiters or offers fake conference invites to trick employees into revealing personal information.
Phishing campaigns targeting financial institutions have evolved, with attackers now synchronizing their activity with victims in real-time, authenticating against legitimate insurance portals as victims unknowingly complete the login process.
A critical vulnerability in OpenAI's ChatGPT Workspace Agents could have allowed a single phishing link to deploy a rogue AI agent inside a victim's organization. The issue has been addressed by OpenAI as of June 8, 2026.
A Russia-aligned threat group, UAC-0099, is using a malicious Notepad++ plugin to compromise Windows systems, delivering the MATCHBOIL.V2 malware via sophisticated phishing campaigns.
AegisAI, a startup founded by former Google security executives, has raised $36 million to stop AI-driven spear phishing attacks. The company's AI agents can analyze each message as a human would, paying attention to small anomalies that traditional email security systems…
Russian hackers, part of the Laundry Bear group, are exploiting a zero-click flaw in Zimbra email servers to steal user data. The flaw, patched in November 2025, allows attackers to steal emails, passwords, and 2FA tokens without requiring user interaction.
German and US law enforcement, with Indonesian authorities, dismantled the Kratos phishing kit's infrastructure and arrested its alleged developer, which was used to steal Microsoft 365 credentials and bypass MFA.