30
30
30
North Korean remote workers are broadening their job hunt beyond IT
Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.
Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.
58
30
30
30
30
30
30
The sexy AI-powered dating app scams are here
Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.
Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.
60
Red Flags That Expose Fake North Korean IT Workers
Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.
Dark Reading describes indicators that help organizations identify North Korean operatives working undercover as IT workers. Researchers say these operatives are improving their tactics, but detection methods still exist. Catching them early helps employers avoid infiltration, data theft, and damage.
50
30
30
30
30
30
30
30
30
30
30
Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers
Barracuda details a phishing campaign using Microsoft Teams OAuth redirects and browser blob URLs to render local fake DocuSign login pages for credential theft.
Barracuda researchers identified an active phishing campaign that routes DocuSign-themed emails with calendar invites through a Microsoft OAuth endpoint and crafted redirects into Microsoft Teams, then renders a fake sign-in page via a browser-generated blob URL. Because the page is assembled locally in memory and can register service workers and run in a sandboxed iframe, URL-reputation checks largely see legitimate Microsoft domains. The goal is credential theft and account takeover, not a flaw in Teams itself.
48
New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners
Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.
Barracuda researchers report a credential-harvesting phishing campaign that starts with a DocuSign-themed email containing a calendar invitation and routes victims through legitimate Microsoft OAuth endpoints and Microsoft Teams. A crafted redirect parameter leads Teams to load external content from cdn.bloom[.]io, which the browser renders as a blob URL — a session-only address held in local memory with no persistent public URL to crawl, categorize, or blocklist. The locally generated page registers a service worker, runs inside a sandboxed iframe, and is dynamically steered by backend infrastructure, indicating a centrally managed phishing platform. Barracuda recommends phishing-resistant MFA such as FIDO2 keys and passkeys, monitoring OAuth flows and redirect chains, and Teams malicious URL protection.
48
Researching Employment Scams
Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.
The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.
30
30
30
30
30
30
30
30
30
30
Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.
58
Cybercriminals are building phishing pages that exist only inside victims’ browsers
Barracuda details a DocuSign-themed phishing campaign that renders login pages locally via blob URLs, abusing genuine Microsoft OAuth and Teams infrastructure.
Barracuda researchers describe a phishing campaign that starts with DocuSign-themed emails carrying calendar invites pointing to genuine Microsoft OAuth endpoints, then routes victims through Microsoft Teams to a resource hosted on cdn.bloom[.]io. The login page is assembled entirely inside the victim's browser from a blob URL, registers a service worker, and runs inside a sandboxed iframe that receives live instructions from the attacker's backend. Hidden command-and-control configuration indicates the page is part of a centrally managed phishing platform that can be updated and steered across many victims. Barracuda recommends phishing-resistant MFA such as FIDO2 keys or passkeys, monitoring of OAuth flows and redirect chains, and behavior-based identity controls rather than URL blocklisting.
55
30
30
30
30