ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “security update”

27 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 183Advisory 178Vulnerability 156Industry 65Malware 61Threat actor 53AI safety & security 43Tools 39Data breach 34Phishing & fraud 29Research 25AI industry 24Policy & legal 24Model release 7
SeverityAllcritical 81high 348medium 231low 53info 222

Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

Ukraine's top prosecutor Ruslan Kravchenko resigned after NABU arrested a deputy for taking bribes protecting scam call centers running fake investment platforms.

Ukraine's anti-corruption bureau NABU arrested Serhiy Kropyva, Deputy Head of International Cooperation at the Prosecutor General's Office, alleging officials took monthly protection fees from a network of 100-500 scam call centers luring victims into fake investment platforms, with bribes reportedly growing from $700,000 to $3.5 million per month. Prosecutor General Ruslan Kravchenko resigned on Monday, calling it a political decision, while Kropyva was fired with bail set at 120 million hryvnias ($2.7 million) and over 100 call centers shut down in the past month. The newsletter also briefly covers a cyberattack crippling more than 80 Luxembourg medical practices via payment vendor BMS Engineering, ShinyHunters' claimed theft of 200,000 Florida DMV driver records, a cyberattack on the American Meteor Society, and school closures in Springfield, Massachusetts.

Risky Business News · 8d agoPhishing & fraud

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News · 10d agoPhishing & fraud in the wild1

Five Venezuelan Nationals Plead Guilty in Kansas ATM Jackpotting Attempt

Five Venezuelan nationals pleaded guilty to failed ATM jackpotting attempts in Kansas as the FBI reports 700+ US incidents in 2025.

The five defendants traveled from Indiana to Kansas in December 2025 and tried to install malware on ATMs in Wamego and Manhattan, planning to remotely trigger the machines to dispense cash. Both attempts failed — one triggered an alarm — and the men were arrested days later after surveillance captured the thefts. All five pleaded guilty to conspiracy to commit bank larceny; one has received a nine-month prison sentence. The FBI counted more than 700 jackpotting incidents in 2025 with over $20 million in losses, part of 1,900 incidents since 2020.

Security Affairs · 16d agoPhishing & fraud

Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs

Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.

Microsoft Threat Intelligence observed attackers abusing Microsoft Teams external collaboration to impersonate IT/helpdesk staff, persuading employees to grant screen control via Quick Assist or RMM tools. Operators deploy malicious MSI packages via silent msiexec, run encrypted JavaScript implants through portable Node.js, and persist via EdgeUpdate Run keys or Startup folder entries. The Node.js backdoor uses HTTPS long-polling C2, captures screenshots, enumerates Active Directory, and moves laterally over WinRM (TCP 5985) to domain controllers and certificate authorities. Initial access maps to MITRE ATT&CK T1566.003 (Spearphishing via Service); no Teams vulnerability is exploited.

GBHackers · 9d agoPhishing & fraud in the wild1

Most Fraudulent Hires Receive Credentials Before Detection

HYPR report finds 42% of fraudulent hires pass screening and receive corporate credentials, averaging 5.73 days of unmonitored network access before detection.

A HYPR study of 500 US HR executives found 42% of fraudulent candidates pass pre-hire screening and get hired, with only 3% detected on their hire day and 20% remaining undetected up to three weeks. This gives fraudulent hires an average of 5.73 days of unmonitored corporate network access, and 98% of surveyed executives said they had experienced candidate fraud firsthand. The report follows a September 9 CISA update to its Insider Threat Mitigation Guide warning that malicious actors use AI tools to obtain remote IT jobs, a tactic long used by North Korean actors for data theft and extortion.

Infosecurity Magazine · 1d agoPhishing & fraud

Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.

Microsoft Threat Intelligence observed a growing set of campaigns that abuse trust in popular AI brands: a ChatGPT-themed phishing campaign sent up to 100,000 emails in one day to steal payment card data, and a Claude-themed campaign used adversary-in-the-middle techniques to harvest credentials and access tokens. Other campaigns included malvertising for a fake AI Windows plugin delivering the Vidar stealer and fraudulent DeepSeek installers distributed via GitHub. Initial access broker Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, and Microsoft notes the AI services themselves were not compromised. Microsoft also details Defender protections such as Safe Links, Safe Attachments, and attack disruption against these multi-stage lures.

Microsoft Security Blog · 6d agoPhishing & fraud in the wild1

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security News · 1d agoPhishing & fraud in the wild 2 sources

Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes

SOCRadar details AnonyMousKIT, a phishing-as-a-service platform using AI voice agents posing as Apple Support to steal passcodes and 2FA codes.

SOCRadar's Threat Research Unit documented AnonyMousKIT, a credit-metered phishing-as-a-service platform that strips Activation Lock from stolen Apple devices across email, SMS, WhatsApp, recorded calls and AI voice agents. The 'Alice from Apple Support' personas request the device passcode, Apple ID credentials and a live 2FA code, with lures citing the handset's model identifier and live Find My status. Of 200 recovered AI calls made between August 31, 2025 and May 30, 2026, 179 targeted Brazil, and the calls cost $19.24 total via voice platform Vapi. Exposed log paths revealed 30 kit installations on 42 domains and 6,092 send attempts family-wide between March and July 2026.

The Hacker News · 22d agoPhishing & fraud

ClickFix attacks infecting PCs and Macs are going viral

ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.

BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.

Ars Technica · Security · 6d agoPhishing & fraud in the wild1

Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.

Microsoft Security Research has tracked the campaign since May 2026: callers posing as IT helpdesk staff tell employees to urgently update passkeys, MFA, or SSO settings via domains such as add-passkey[.]com and contoso[.]add-passkey[.]com. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that yield credentials, session tokens, or OAuth tokens, after which attackers enroll their own MFA methods for persistence and run Microsoft Graph reconnaissance. They then collect SharePoint, OneDrive, and sometimes Exchange Online data at deliberately low rates (often under 1,000 files or messages per hour), with python-httpx seen in high-volume file access. Microsoft attributes initial access tradecraft to Storm-3121 and Storm-3032, linked respectively to ShinyHunters/Falcon and BlackFile/Helix extortion operations.

GBHackers · 7d agoPhishing & fraud in the wild2

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

Barracuda details a phishing campaign that renders pages in-browser via blob URLs, routed through Microsoft Teams and cdn.bloom[.]io to evade detection.

Barracuda researchers analyzed a phishing campaign that generates a blob URL to render the phishing page entirely inside the victim's browser, leaving no static page for scanners to inspect. The chain begins with a Docusign-themed email containing a calendar invite, followed by a crafted redirect through Microsoft Teams to a resource on cdn.bloom[.]io that the browser converts into the blob URL. Service workers, iframes, and a hidden command-and-control configuration indicate the page is part of a centrally managed phishing platform that can be updated and steered across victims. Researchers recommend inspecting blob URL activity, monitoring OAuth authorization flows, and analyzing the full click path in email security controls.

SecurityWeek · 8d agoPhishing & fraud in the wild

Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters

VBSpam Q3 2026 test shows phishers abusing DKIM-aligned domains, Amazon SES, and multi-stage URL cloaking to defeat email filters.

Virus Bulletin's Q3 2026 VBSpam test (AMTSO-LS1-TP207) found phishing campaigns moving payloads past the email itself via browser-fingerprinting gates, redirect chains, and hidden POST requests. Examples include a Dutch McAfee/TotalAV scareware renewal scam, a German overdue-payment Web3 fraud delivered via Amazon SES from DKIM-aligned moolaah.com, and Romanian BCR PSD2 credential phishing embedding IPv6-mapped URLs resolving to 103.193.179.223. Net at Work NoSpamProxy ranked first with a 99.995 score while open-source Rspamd caught only 62.55% of phishing mail.

GBHackers · 2d agoPhishing & fraud in the wild 2 sources

New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners

Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.

Barracuda researchers report a credential-harvesting phishing campaign that starts with a DocuSign-themed email containing a calendar invitation and routes victims through legitimate Microsoft OAuth endpoints and Microsoft Teams. A crafted redirect parameter leads Teams to load external content from cdn.bloom[.]io, which the browser renders as a blob URL — a session-only address held in local memory with no persistent public URL to crawl, categorize, or blocklist. The locally generated page registers a service worker, runs inside a sandboxed iframe, and is dynamically steered by backend infrastructure, indicating a centrally managed phishing platform. Barracuda recommends phishing-resistant MFA such as FIDO2 keys and passkeys, monitoring OAuth flows and redirect chains, and Teams malicious URL protection.

GBHackers · 7d agoPhishing & fraud in the wild

Safe word: What is it and why do you need one?

ESET recommends pre-agreed family safe words to counter AI voice-clone scams such as virtual kidnapping, as one-in-four Americans report receiving deepfake calls.

ESET outlines how scammers use just seconds of audio scraped from social media or work content to create convincing voice clones, with a Hiya report finding one-in-four Americans received a deepfake voice call in the past 12 months. Common schemes include virtual kidnapping calls mixing cloned voices with sobbing and background noise. A pre-agreed, non-OSINT-discoverable safe word, plus callback verification via known numbers and 2FA, reduces success rates of these frauds.

ESET WeLiveSecurity · 8d agoPhishing & fraud in the wild

HBO Max Reddit account compromised to serve ClickFix attacks

Attackers hijacked HBO Max's verified Reddit account to run 108 ClickFix malvertising ads delivering infostealers, loaders, and crypto clippers to Windows and macOS users.

Attackers compromised the verified HBO Max Reddit account (u/hbomax) to push 108 malicious ads in a 48-hour malvertising blitz named PasteSwitch, analyzed by Hudson Rock and ADAMnetworks. The ClickFix lures directed victims to fake landing pages instructing them to paste commands into Terminal, delivering OS-targeted infostealers, malware loaders, and cryptocurrency clippers. Lures included 46 HBO Max ads, 36 fake OpenAI Codex ads, 15 fake macOS disk utilities, and 11 developer-tool ads. The AnimateClipper and ZigClipper payloads use Binance Smart Chain contracts as resilient C2 fallback, with 36 mainnet changes observed between March and July 2026; Reddit paused the ads three days after discovery and is investigating.

The Register · Securityupdated · 2d agofirst · 2d agoPhishing & fraud in the wild 7 sources

Attackers call employees’ personal phones to break into Microsoft 365 accounts

Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.

Microsoft Security Research has tracked a campaign since May 2026 in which attackers call or text employees' personal phones posing as IT staff, using passkey/MFA/SSO lures to run adversary-in-the-middle phishing or device-code authentication flows. Attackers register their own MFA methods for durable persistence, abuse Microsoft Graph for tenant discovery, and download SharePoint, OneDrive, and Exchange data below 1,000 files or emails per hour to avoid detection. Microsoft attributes initial access to actors including Storm-3121, which feeds ShinyHunters and Falcon extortion operations, and Storm-3032, the Helix extortion operation descended from BlackFile.

Help Net Security · 7d agoPhishing & fraud in the wild 2 sources3

Cybercriminals are building phishing pages that exist only inside victims’ browsers

Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.

Barracuda researchers describe a phishing campaign that starts with DocuSign-themed emails carrying calendar invites pointing to genuine Microsoft OAuth endpoints, then routes victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The login page is assembled entirely inside the victim's browser from a blob URL, registers a service worker, and runs inside a sandboxed iframe that receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and redirect chains, and behavior-based identity controls rather than URL blocklisting.

Help Net Security · 7d agoPhishing & fraud in the wild

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.

Huntress SOC investigated two August incidents where phishing links led to fake CAPTCHA checks and Adobe PDF Reader lures rendered as browser-in-the-browser (BiTB) pages spoofing legitimate domains like get.adobe.com. Victims downloaded what they believed was Acrobat Reader but actually installed ScreenConnect.ClientSetup.exe from attacker infrastructure, yielding two rogue ScreenConnect clients with service-based persistence. The attacker used cmd.exe and curl to stage a second client connecting to 144.172.115.59, leveraged a ScreenConnect Trial Relay domain for stealth, and ran HideCursor.exe as a defense-evasion binary. Incident 2 arrived via AT&T Office@Hand (RingCentral), with both chains stopped before broader impact.

Huntress · 8d agoPhishing & fraud in the wild

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft details two campaigns: million-email CEO impersonation ACH fraud and passkey-themed vishing that hijacks Microsoft cloud accounts for data theft and extortion.

Microsoft disclosed a campaign that sent over one million CEO-impersonation scam emails between August 3-5, 2026, targeting U.S. accounts payable departments with fake ServiceNow subscription invoices to induce ACH transfers, using generative AI to tailor templates. A second campaign detected since May 2026 uses passkey/MFA-themed voice phishing posing as the IT help desk, redirecting victims via SMS to counterfeit Microsoft sign-in pages and adversary-in-the-middle or device-code flows to hijack accounts. Post-compromise activity includes adding attacker-controlled authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection via REST APIs. Microsoft attributes initial access to Storm-3121 (linked to ShinyHunters and Falcon extortion) and Storm-3032 (UNC6671, a BlackFile splinter operating the Helix extortion brand).

The Hacker News · 4d agoPhishing & fraud in the wild2

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog · 6d agoPhishing & fraud

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.

Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.

Cisco Talos · 9d agoPhishing & fraud in the wild

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputer · 5d agoPhishing & fraud in the wild 4 sources3

T-Mobile rewards points expiry texts are a phishing scam

Malwarebytes tracks an SMS phishing campaign, active since May 2026, impersonating T-Mobile rewards expiry with 1,000+ templates and 81 rotating domains to lure victims.

Malwarebytes Labs has monitored a large smishing campaign since early May 2026 that falsely claims recipients' T-Mobile Rewards points are expiring, using invented balances like 18,400 points and imminent deadlines to create urgency. Researchers identified more than 1,000 semantically similar message templates (199 scoring at least 0.95 similarity) that vary only in salutation, headline, expiry date, and point balance. The links resolve to rotating domains such as t-mobile.biktpw[.]top, with at least 81 short-lived domains observed over four months, pushing victims to fake redemption pages where they may enter credentials or payment details. Activity peaked in two large spikes and has since declined, though messages are still circulating.

Malwarebytes Labs · 3h agoPhishing & fraud in the wild

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes Labs · 2d agoPhishing & fraud

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.

Bitdefender reports threat actors are abusing Google Play's Early Access program, which blocks public reviews and ratings, to distribute thousands of deceptive casino, reward, and utility apps. A GTA imitator, 'Vice Streets: Open World,' surpassed 1 million downloads before disappearing, with apps promoted via AI celebrity deepfake ads on TikTok and Facebook and monetized through endless ad serving and payouts that never arrive. The report coincides with disclosures on Android malware families Hagaseca, Mantax Otax, StreamRat, and GoldFactory's Gigabud banking trojan with its Vwork companion app used for cloned-app financial fraud.

The Hacker Newsupdated · 6d agofirst · 6d agoPhishing & fraud in the wild 8 sources

I Hijacked a Real Artist's Spotify with AI Music. It Was Disturbingly Easynew

A journalist used DistroKid's loophole to publish an Udio-generated song on Lathe of Heaven's verified Spotify page, exposing a widespread AI music royalty scam.

A 404 Media reporter generated a punk song with Udio and, via a $3.75-per-month DistroKid account, released it under the name of Brooklyn punk band Lathe of Heaven without any identity verification by the distributor or streaming platforms. The AI-generated track appeared a day later on the band's Spotify, Apple Music, Tidal, Amazon Music and Deezer pages, with royalties flowing to the uploader. Similar abuse has hit deceased musicians such as Blaze Foley, and Spotify says artist profiles that are not actively managed are especially vulnerable.

404 Media · 18m agoPhishing & fraud in the wild

The sexy AI-powered dating app scams are here

Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.

Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.

The Verge · AI · 23h agoPhishing & fraud in the wild