Source: The Register · Security

3 stories in the last 30d

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 13 Policy & legal 12 AI safety & security 12 Data breach 9 Industry 9 Threat actor 5 Ransomware 3 Phishing & fraud 3 Malware 3 Vulnerability 2 AI policy 2 Research 1 AI tools & infra 1 AI industry 1

SeverityAll critical 6 high 22 medium 19 low 3 info 26 source: The Register · Security ✕

HBO Max Reddit account compromised to serve ClickFix attacks

Attackers hijacked HBO Max's verified Reddit account to run 108 ClickFix malvertising ads delivering infostealers, loaders, and crypto clippers to Windows and macOS users.

Attackers compromised the verified HBO Max Reddit account (u/hbomax) to push 108 malicious ads in a 48-hour malvertising blitz named PasteSwitch, analyzed by Hudson Rock and ADAMnetworks. The ClickFix lures directed victims to fake landing pages instructing them to paste commands into Terminal, delivering OS-targeted infostealers, malware loaders, and cryptocurrency clippers. Lures included 46 HBO Max ads, 36 fake OpenAI Codex ads, 15 fake macOS disk utilities, and 11 developer-tool ads. The AnimateClipper and ZigClipper payloads use Binance Smart Chain contracts as resilient C2 fallback, with 36 mainnet changes observed between March and July 2026; Reddit paused the ads three days after discovery and is investigating.

The Register · Securityupdated 11:51 UTC · 11h agofirst Sep 14, 22:43 UTC · 1d agoPhishing & fraud in the wild 7 sources

BigBear phishing crew nets thousands of Microsoft 365 credentials

CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.

CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.

The Register · SecuritySep 8, 13:26 UTC · 7d agoPhishing & fraud in the wild1

ASCII smuggling isn't just an AI security risk

Microsoft tracked a phishing campaign peaking at 2.37 million daily messages that hid financial-lure keywords with invisible Unicode tag characters to evade filters.

Microsoft researchers uncovered a large phishing campaign that inserted invisible Unicode tag characters (e.g., U+E0020) inside common financial keywords like 'funding', splitting words so keyword, signature, and regex matches fail. The campaign peaked at more than 2.37 million messages in late February 2026, ran from about 150 finance-themed sender domains on a strict weekday-only schedule, and gradually declined to under 20% of peak weekday volume by late March, with residual spikes through mid-June. The technique repurposes ASCII smuggling, normally used for indirect prompt injection against AI assistants, for traditional email phishing evasion. Microsoft advises defenders to strip or fold invisible Unicode code points before content matching and to watch for bulk weekday spikes from churning finance-themed domains.

The Register · SecuritySep 4, 19:23 UTC · 11d agoPhishing & fraud in the wild1