Search: “Nigerian scammer”

21 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Phishing & fraud 81 Malware 35 Vulnerability 9 Ransomware 9 Policy & legal 4 Threat actor 4 Data breach 3 Exploit / PoC 3 Advisory 2

SeverityAll critical 29 high 53 medium 45 low 22 info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

How Cyber Sleuths Tracked a Nigerian Scammer to His Doorstep

Cyber fraud fighters Erin West and Paul Raffile traveled to Nigeria to identify a scammer, uncovering more than just his identity.

404 Media reports that fraud investigators Erin West and Paul Raffile traveled to Nigeria to track down an online scammer. The on-the-ground investigation revealed more than the scammer's identity, offering a rare look at how scam operations run. The piece is an investigative narrative with no immediate technical risk to defenders.

404 MediaAug 31, 12:21 UTC · 16d agoPhishing & fraud

Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider

Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.

Trezor confirmed that a breach at Brevo, its marketing email provider, exposed customer contact data and let hackers send roughly 347,000 phishing emails claiming a fake 'STM32 Entropy Vulnerability' and asking victims for their wallet backup password. Brevo said attackers accessed 138 accounts by abusing overly broad, improperly scoped access privileges. Trezor was also hit weeks earlier by a breach at shipping partner ShipMonk that exposed names, phone numbers, email addresses, and postal addresses of at least 81,000 wallet buyers. Trezor stated its own products, wallets, and account systems were unaffected and warned customers to expect further phishing attempts.

TechCrunch · Securityupdated Sep 11, 15:01 UTC · 5d agofirst Sep 11, 13:32 UTC · 5d agoData breach in the wild 5 sources1

What’s the Scam?

Bruce Schneier reports AI-generated fake thank-you replies to his newsletter confirmations from throwaway Gmail accounts; the scam's goal is unclear.

Bruce Schneier describes receiving a burst of AI-generated, one-line praise emails replying to Crypto-Gram newsletter confirmation messages, sent from random-character Gmail addresses. None of the senders actually subscribed, and they did not respond when he replied, weakening a pig-butchering theory. The campaign appears automated, but its objective has not been identified.

Schneier on SecuritySep 1, 17:36 UTC · 15d agoPhishing & fraud

Scammers are getting smarter about where they target you

Malwarebytes data shows scammers tailor fraud by platform: 90% of toll scams arrive via email/SMS and MrBeast is now the most impersonated person.

Malwarebytes threat research analyzed global scam data from April 15 to July 14, 2026, across more than 20 scam types, finding each type favors a specific channel such as email, SMS, phone, or social media. Roughly nine in ten toll scams arrive by email or text, about half of IRS scams come by phone, and MrBeast is impersonated in about 30% of impersonation scams. The most impersonated brands are Google, Microsoft, Apple, Roblox, and Amazon, and Malwarebytes blocks around 500,000 phishing websites daily. Gaming scams on Roblox, Steam, Discord, and Minecraft increasingly carry losses of $1,000 or more, with 15-19% activity spikes in mid-2026.

Malwarebytes LabsSep 2, 12:45 UTC · 14d agoPhishing & fraud

Scammers have figured out the best time to text you

Malwarebytes threat data shows scammers tailor platforms per scam, with the web as top channel, Friday midday peaks, and MrBeast the most impersonated person.

Malwarebytes analyzed its threat data from April 15 to July 14, 2026 across more than 20 scam categories, finding scammers match platforms to scam types: job scams via email, romance scams via social media, and tech support scams via phone. The web is the top delivery channel ahead of email and SMS, and Malwarebytes says it blocks about 500,000 phishing sites a day. Scam texts peak at 12:00 pm ET, roughly 874% above the quietest hour, with volume peaking on Fridays about 50% higher than the start of the week. MrBeast (Jimmy Donaldson) appears in about 30% of impersonation scams, and the most impersonated brands are Google, Microsoft, Apple, Roblox and Amazon.

Help Net SecuritySep 4, 00:00 UTC · 13d agoPhishing & fraud in the wild

Fake Law Firms Scam Victims Crypto

Fraudsters posed as fake law firms to scam victims into paying fees in cryptocurrency.

Scammers impersonated law firms to persuade victims to pay bogus legal fees, likely in cryptocurrency. Crypto-based legal-fee scams typically pressure targets with urgent payment demands, and cryptocurrency transfers are hard to reverse once sent. Victim counts and loss amounts are not stated in the headline.

Infosecurity MagazineAug 16, 00:00 UTC · Aug 16, 2026Phishing & fraud

Ready-made $500 kit puts a crypto scam within anyone's reach

A $500 ready-made scam kit sold on a cybercrime forum builds fake Tesla $TSLA presale pages that harvest wallet recovery phrases and cryptocurrency deposits.

Malwarebytes found a $500 scam-in-a-box kit by seller xrep on a cybercrime forum, bundling a fake Tesla-style $TSLA presale site, a victim-tracking admin panel, and controls to inflate fake balances. The kit harvests 12-word wallet recovery phrases via wallet-connection prompts or accepts direct transfers in Bitcoin, Ethereum, USDT, or Dogecoin. The admin panel lets operators check stolen wallets' value before draining them, raise displayed balances to encourage further deposits, and send follow-up messages demanding fake network fees.

Help Net SecurityAug 12, 00:00 UTC · Aug 12, 2026Phishing & fraud

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on SecuritySep 3, 11:18 UTC · 13d agoPhishing & fraud

Bogus recruiters go after high-value corporate credentials on mobile

Zimperium details browser-in-the-browser recruitment scams stealing corporate credentials on mobile, impersonating Amazon, Apple, Boeing, and Deloitte.

Zimperium reports scammers posing as HR staff use browser-in-the-browser (BitB) phishing via fake interview scheduling flows to steal corporate credentials. The kit pre-qualifies victims by rejecting personal email addresses, then captures credentials that grant OAuth tokens, internal communications, and cloud access enabling lateral movement. Domains impersonating Amazon, Louis Vuitton, Apple, FIFA, Boeing, Deloitte and others were tracked for a year, mostly hosted on AWS and SEDO, with 46 previously unpublished IOCs released.

Help Net SecurityAug 26, 00:00 UTC · 22d agoPhishing & fraud in the wild

Fake Refund Scam Hits Shopify Shop App Users

A fake refund scam has targeted Shopify Shop app users for several months, with fraudsters impersonating refunds directly inside the app.

Huntress reports an ongoing fake refund scam aimed at users of Shopify's Shop app. The fraudsters operate directly within the app rather than via email, making the scam harder to spot. The activity has been observed over the past few months, and users should verify refund requests before acting.

HuntressAug 13, 13:00 UTC · Aug 13, 2026Phishing & fraud

Wzmacniamy w Polsce ochronę przed oszustwami

Meta announces expanded anti-scam protections in Poland, citing rising fraud across dating apps, crypto platforms, online games and SMS messaging.

Meta says it is investing in new technologies and partnerships to better detect and fight scam content across its platforms in Poland. The company notes scam activity spans social platforms, dating apps, online games, cryptocurrency services and SMS messages. It also claims a recent campaign is distorting the picture of Meta's actions and motivations.

Meta NewsroomAug 28, 09:00 UTC · 19d agoPhishing & fraud

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.

Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Recovered prompts, shell history, and project files show the operator relied on AI coding assistants to package Electron applications, obfuscate code, troubleshoot builds, and modify phishing infrastructure.

Rapid7 BlogAug 17, 11:29 UTC · Aug 17, 2026Phishing & fraud

Fake Recruiter Scams Target Corporate Credentials on Mobile

RecruitTrap phishing campaigns use mobile-optimized fake recruiter pages to steal corporate credentials from enterprise targets.

RecruitTrap campaigns impersonate recruiters and direct victims to phishing pages optimized for mobile devices. The goal is harvesting corporate credentials from enterprise targets. The mobile-focused design suggests deliberate targeting of smartphone users, where phishing cues are harder to scrutinize.

Infosecurity MagazineAug 25, 13:00 UTC · 22d agoPhishing & fraud

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business NewsSep 7, 03:42 UTC · 10d agoPhishing & fraud in the wild1

Party’s over for scammers who went on spending spree after $240M bitcoin theft

AP report on scammers' spending spree after a $240 million bitcoin social engineering theft, as ringleader Malone Lam nears a plea agreement.

DataBreaches.net syndicates AP reporting on the $240 million bitcoin theft from a Washington, D.C. resident via social engineering calls impersonating Google and Gemini. Alleged ringleader Malone Lam, 22, faces a plea hearing; the scam network spent stolen funds on cars, jets, and mansions before FBI arrests. Crypto investment fraud complaints to the FBI rose nearly 50% in 2025.

DataBreaches.netSep 8, 11:32 UTC · 8d agoPolicy & legal

Russian suspect in bank account takeovers is extradited to US

Russian web developer Sergei Filimonov was extradited from Georgia to the US to face charges in a multimillion-dollar bank account takeover fraud.

Sergei Anatolyevich Filimonov, 36, appeared in an Atlanta federal court on September 4 and pleaded not guilty to bank fraud, wire fraud, access device fraud, and aggravated identity theft charges. Prosecutors say that from November 2023 to October 2025 his group bought sponsored search-engine links that diverted online banking customers to spoofed login pages, stole their credentials, and initiated unauthorized wire transfers. The FBI linked the scheme to the December 2025 seizure of the domain web3adspanels.org, identifying at least 19 victims, roughly $14.6 million in confirmed losses, and about $28 million in attempted losses.

The RecordSep 8, 19:37 UTC · 8d agoPolicy & legal

Microsoft Teams Has Become a Haven for Scammers in China

Scammers in China are exploiting Microsoft Teams and Webex to trick Chinese victims into transferring large sums of money.

WIRED reports that fraudsters are abusing enterprise chat platforms including Microsoft Teams and Cisco Webex to run scams against victims in China. Victims are socially engineered into transferring large sums of money. The campaign has generated a wave of complaints, highlighting how scam groups abuse legitimate business communication tools.

WIRED · SecurityAug 28, 18:23 UTC · 19d agoPhishing & fraud in the wild

Fake Gemini installer delivers Vidar infostealer via Google Colab lure

Attackers used a fake Google Gemini installer hosted on Google Colab to deliver a Go-compiled Vidar infostealer that stole browser credentials from an EMEA company.

Darktrace investigated an EMEA company infection where the top search result for a Gemini-related filename pointed to a Google Colab page that redirected to a fake 'Windows Software Hub' hosting a malicious executable. The ZIP contained a README instructing victims to run the file as administrator and add it to antivirus exceptions, delivering a newer Go-compiled Vidar variant that used dtm[.]kijangturbo88[.]top over Telegram-based infrastructure. The malware stole browser credentials and other sensitive data; Darktrace's Autonomous Response blocked the C2 and quarantined the device.

Help Net SecurityAug 20, 00:00 UTC · 28d agoMalware in the wild1

Revolut handed customer data to fraudsters using government email account

Revolut handed sensitive KYC data of high-net-worth crypto customers to fraudsters submitting fake emergency data requests from a compromised government email domain.

Revolut confirmed it disclosed sensitive customer data—including passport and driver's license copies, verification selfies, bank statements, IBANs, and Bitcoin transaction histories—to attackers who submitted fraudulent emergency data requests from a legitimate government agency email account, apparently an Italian domain. Targets were high-net-worth individuals involved in crypto, including Marc Karpelès and entrepreneur Marc Zeller. A Telegram account claiming responsibility posted stolen data as proof and demanded an extortion payment; the account has since been suspended. Revolut says only a limited number of customers were affected and has alerted the relevant government agency, law enforcement, and regulators. The technique mirrors 2021-2022 Lapsus$-linked fraudulent emergency data request scams against Apple, Meta, and Discord.

The RecordSep 14, 12:00 UTC · 2d agoData breach

LLM-Based Social Engineering Scams

OpenAI disrupted a Cambodia-based ChatGPT-powered scam network running romance, crypto-investment, gambling, and fake law-enforcement fraud campaigns.

OpenAI disrupted a social engineering network operating from Cambodia that used ChatGPT to run multiple scam types simultaneously. Operators built trust with fake dating personas before pitching fraudulent cryptocurrency and spot gold investments, posed as gambling platforms offering fake bonuses, or impersonated law enforcement agencies demanding fine payments. The network also generated images of forged documents including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.

Schneier on SecurityAug 27, 09:57 UTC · 20d agoAI safety & security in the wild

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes LabsSep 15, 08:40 UTC · 1d agoPhishing & fraud