30
30
30
30
30
30
30
30
New Pluralsight Course: Adapting to the New Normal: Embracing a Security Culture of Continual Change
30
The sexy AI-powered dating app scams are here
Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.
Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.
60
30
30
30
30
30
35
30
30
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.
Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.
70
30
30
35
30
30
30
30
30
30
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
30
30
30
30
30
30
30
30
30
30
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.
Huntress SOC investigated two August incidents where phishing links led to fake CAPTCHA checks and Adobe PDF Reader lures rendered as browser-in-the-browser (BiTB) pages spoofing legitimate domains like get.adobe.com. Victims downloaded what they believed was Acrobat Reader but actually installed ScreenConnect.ClientSetup.exe from attacker infrastructure, yielding two rogue ScreenConnect clients with service-based persistence. The attacker used cmd.exe and curl to stage a second client connecting to 144.172.115.59, leveraged a ScreenConnect Trial Relay domain for stealth, and ran HideCursor.exe as a defense-evasion binary. Incident 2 arrived via AT&T Office@Hand (RingCentral), with both chains stopped before broader impact.
52
ASCII smuggling isn't just an AI security risk
Microsoft tracked a phishing campaign peaking at 2.37 million daily messages that hid financial-lure keywords with invisible Unicode tag characters to evade filters.
Microsoft researchers uncovered a large phishing campaign that inserted invisible Unicode tag characters (e.g., U+E0020) inside common financial keywords like 'funding', splitting words so keyword, signature, and regex matches fail. The campaign peaked at more than 2.37 million messages in late February 2026, ran from about 150 finance-themed sender domains on a strict weekday-only schedule, and gradually declined to under 20% of peak weekday volume by late March, with residual spikes through mid-June. The technique repurposes ASCII smuggling, normally used for indirect prompt injection against AI assistants, for traditional email phishing evasion. Microsoft advises defenders to strip or fold invisible Unicode code points before content matching and to watch for bulk weekday spikes from churning finance-themed domains.
62