Search: “visualization”

11 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI research 77 AI industry 30 Model release 22 AI safety & security 11 Phishing & fraud 11 Research 9 Vulnerability 8 Malware 8 Exploit / PoC 7 AI tools & infra 7 Advisory 7 Tools 7 Threat actor 6 Industry 6

SeverityAll critical 2 high 23 medium 26 low 1 info 171

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.

Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.

Cisco TalosSep 8, 10:00 UTC · 9d agoPhishing & fraud in the wild

ClickFix Moves into the Browser to Steal Cryptocurrency

Cisco Talos details a ClickFix campaign injecting browser JavaScript via Google Sheets to skim crypto deposits, stealing at least ~0.159 BTC since October 2025

Cisco Talos reported a months-long ClickFix campaign that shifted from OS command execution to injecting JavaScript through Chrome's address bar or the Tampermonkey extension into sessions on two cryptocurrency trading sites. Since March 2026 the operators fetch obfuscated payloads via the Google Visualization API from public Google Sheets, replacing displayed deposit addresses and amounts and overriding the fetch API, and the campaign survived two disruption attempts. Talos observed 49 Bitcoin addresses with 24 receiving at least 0.159 BTC (~$10,000) by early August, with proceeds routed through roughly 30 wallets and more than 3,000 addresses in apparent mixing. Lures posed as leaked vulnerability reports describing non-existent API flaws at crypto swap services, promising payouts up to 38% higher.

Infosecurity MagazineSep 9, 13:45 UTC · 7d agoPhishing & fraud in the wild

Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks

Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.

Cisco Talos tracks a ClickFix-style campaign that tricks cryptocurrency traders into pasting JavaScript into Chrome's address bar or a Tampermonkey extension, promising fake bonuses on SwapZone and SimpleSwap. The loader pulls obfuscated JavaScript from cells in a public Google Sheet via the Visualization API, then behaves like a web skimmer, rewriting deposit addresses on screen, in web responses, and in the clipboard. Researchers counted 49 attacker-controlled Bitcoin addresses, with 24 receiving a combined 0.159 BTC, roughly $10,000, by early August 2026. A Tampermonkey variant re-injects the payload on every return visit, giving the attackers persistence despite takedown efforts.

Cyber Security NewsSep 9, 10:57 UTC · 8d agoPhishing & fraud in the wild

Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.

Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.

GBHackersSep 9, 06:22 UTC · 8d agoPhishing & fraud in the wild

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes LabsSep 15, 08:40 UTC · 2d agoPhishing & fraud

Hundreds of fake government websites target users in Central Asia

F6 uncovered 360+ fake government and news websites scamming Central Asians with bogus state payouts that harvest personal data and install mobile malware.

F6 researchers identified more than 360 fraudulent domains impersonating government portals and regional news outlets in Uzbekistan, Belarus and Tajikistan. Sites promise weekly payments such as 15 million Uzbek sums (about $1,300) to lure victims into submitting names and phone numbers. Scammers then call posing as personal managers, demanding fees, requesting passport scans, or directing victims to install a malicious mobile app that grants device control. The group behind the campaign is unidentified and victim counts are unknown.

The RecordSep 14, 16:02 UTC · 2d agoPhishing & fraud

Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments

A BEC campaign sent over one million fake CEO invoice emails, mostly to US firms, urging ~$50,000 ACH transfers to attacker accounts.

Microsoft analysts tracked a business email compromise campaign that sent more than one million messages between August 3 and 5, with 87.7% targeting US recipients. Emails impersonated CEOs, CFOs, and presidents and carried fake ServiceNow-branded subscription invoices directing accounts-payable staff to make ACH transfers of nearly $50,000 to attacker-controlled accounts. No malicious attachments or malware were used, and researchers observed signs consistent with AI-assisted template development. Lookalike domains such as service-nowinc[.]com and third-party delivery accounts were used, while named firms like ServiceNow showed no evidence of compromise.

Cyber Security NewsSep 11, 13:38 UTC · 5d agoPhishing & fraud 2 sources1

Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft tracked a campaign of over one million AI-crafted CEO-impersonation emails seeking ~$50,000 ACH payments with fabricated ServiceNow invoices.

Between August 3 and 5, Microsoft detected a campaign of more than one million fraud emails, 87.7% of them targeting US enterprise users, sent through multiple third-party email delivery service accounts. The actor impersonated CEOs, CFOs, and presidents of targeted companies, urging accounts payable staff to process an ACH payment of nearly $50,000. Lures layered executive impersonation, lookalike domains, a fabricated ServiceNow 'Annual Subscription' invoice personalized to the recipient, and forged forwarded email threads; Microsoft found no evidence ServiceNow or the referenced executives were compromised. Microsoft observed indicators consistent with generative AI-assisted template creation, while leftover inconsistencies such as missing forwarding headers and mismatched display names gave defenders detection cues.

Microsoft Security BlogSep 10, 17:23 UTC · 6d agoPhishing & fraud1

BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA

CloudSEK uncovered BigBear 2.0, a PhaaS operation that captured 4,148 Microsoft 365 session cookies, hijacking authenticated sessions after MFA via AiTM proxy.

CloudSEK infiltrated the BigBear 2.0 phishing-as-a-service panel in June, finding 5,137 credential records tied to 461 organizations in over 40 countries, including 4,148 captured session cookies and 474 completed post-MFA logins. The operation, built on Evilginx2, uses an attacker-controlled reverse proxy to steal authenticated session cookies and residential proxies to defeat location-based Conditional Access checks, while custom code disables FIDO2/WebAuthn on phishing pages. At least five affiliates operated 42 VPS nodes, with IT services and managed service providers the most targeted sector.

CSO OnlineSep 8, 10:48 UTC · 9d agoPhishing & fraud in the wild1

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business NewsSep 7, 03:42 UTC · 10d agoPhishing & fraud in the wild1

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.

Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.

Microsoft Security BlogSep 3, 16:00 UTC · 13d agoPhishing & fraud in the wild1