60
60
60
ClickFix attacks infecting PCs and Macs are going viral
ClickFix social engineering attacks are spreading widely, delivering malware to Windows and macOS users by tricking them into running malicious terminal commands that bypass Gatekeeper.
BlueVoyant reports the Lorem Ipsum malware operation pivoted to ClickFix in late May 2026, dropping code-signing infrastructure and broadening its victim pool from Microsoft Teams searchers to anyone browsing a compromised website. Jamf and independent researchers documented macOS ClickFix variants that bypass Gatekeeper protections. Cisco Talos observed attackers abusing published Google Sheets for control traffic, while Netskope counted 5,400 sites beaconing to one campaign; Sandworm has separately hosted control infrastructure in blockchain smart contracts.
62
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.
Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.
70
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.
Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.
72
60
⚡ Weekly Recap: NFC Fraud, Curly COMrades, N
60
60
60
60
60
60
60