30
30
30
30
30
42
42
60
30
30
30
30
30
30
60
55
55
30
55
30
30
30
30
55
30
30
30
42
30
Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023
FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.
FinCEN analyzed more than 33,000 cyber fraud incident reports filed by roughly 1,300 financial institutions between September 2023 and December 2025, finding about $12.7 billion in losses to cryptocurrency investment scams across all 50 states. Traditional banks reported about $6.4 billion in suspected scam activity and crypto firms about $5.5 billion. Scam activity is growing, with monthly reports rising nearly 11% as centers expand beyond Myanmar, Cambodia, and Laos. The US later sanctioned Xinbi Guarantee, a Telegram-based marketplace used to launder over $36 billion.
66
Researching Employment Scams
Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.
The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.
30
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.
Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.
72
30
30
30
30
30
30
55
30