ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “scam kit”

14 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllPhishing & fraud 14Exploit / PoC 11Ransomware 11Malware 7Vulnerability 6Data breach 6Threat actor 3AI safety & security 2Industry 1
SeverityAllcritical 48high 5medium 6low 1info 1

The Smishing Deluge: China-Based Campaign Flooding Global Text Messages

Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.

Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security News · 1d agoPhishing & fraud in the wild 2 sources

Bogus recruiters go after high-value corporate credentials on mobile

Zimperium details browser-in-the-browser recruitment scams stealing corporate credentials on mobile, impersonating Amazon, Apple, Boeing, and Deloitte.

Zimperium reports scammers posing as HR staff use browser-in-the-browser (BitB) phishing via fake interview scheduling flows to steal corporate credentials. The kit pre-qualifies victims by rejecting personal email addresses, then captures credentials that grant OAuth tokens, internal communications, and cloud access enabling lateral movement. Domains impersonating Amazon, Louis Vuitton, Apple, FIFA, Boeing, Deloitte and others were tracked for a year, mostly hosted on AWS and SEDO, with 46 previously unpublished IOCs released.

Help Net Security · 22d agoPhishing & fraud in the wild

The sexy AI-powered dating app scams are here

Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.

Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.

The Verge · AI · 23h agoPhishing & fraud in the wild