Source: TechCrunch · Security

2 stories in the last 30d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Data breach 7 Policy & legal 6 Industry 4 AI safety & security 4 Threat actor 2 Phishing & fraud 2 Malware 1 AI industry 1 AI policy 1 Ransomware 1 Exploit / PoC 1

SeverityAll critical 2 high 8 medium 8 low 0 info 12 source: TechCrunch · Security ✕

ClickFix attacks are tricking Mac and Windows users into hacking themselves

ClickFix campaigns trick users into pasting terminal commands via fake CAPTCHAs; latest wave abused HBO Max's hacked Reddit account to push infostealer ads.

ClickFix attacks use fake CAPTCHA or anti-bot prompts on hacked or counterfeit websites to convince victims to copy a command into Windows Command Prompt or macOS Terminal, instantly installing infostealers that steal passwords, logged-in sessions, and crypto wallets. The latest campaign compromised HBO Max's official Reddit account to post hundreds of fake ads linking to a spoofed HBO Max page carrying the lure, per researchers at Hudson Rock. It is unclear how many users were compromised. Because execution happens in the terminal, many attacks evade antivirus tools; enterprises can block terminals domain-wide and Mac users can deploy BlockBlock.

TechCrunch · SecuritySep 14, 18:08 UTC · 1d agoPhishing & fraud in the wild1

X says attackers are targeting user accounts after the launch of X Money

X is investigating a wave of unsolicited password reset emails targeting users after the X Money payments launch, with no confirmed breaches yet.

Numerous X users reported unsolicited password reset emails following the launch of X Money, the platform's new payments service with accounts held at FDIC-insured Cross River Bank. Product engineer Mridul Singhai said the company found no evidence of successful breaches or mass account takeovers, while the Grok chatbot confirmed attackers are mass-triggering resets using public usernames. Users are being advised to enable two-factor authentication and Password Reset Protect while the investigation continues.

TechCrunch · SecuritySep 1, 20:48 UTC · 14d agoPhishing & fraud in the wild