Search: “scam-kit”

25 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll

SeverityAll critical 0 high 0 medium 0 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security News13:39 UTC · 4h agoPhishing & fraud in the wild 2 sources

4 groups caught using the same Chrome and Windows exploit kit

Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.

Proofpoint researchers report that at least four hacking groups, some with ties to the Chinese government, are actively using a nearly identical exploit kit named BlueMoon. The kit chains two Chromium browser vulnerabilities and one Windows kernel flaw affecting Windows 10, Windows 11 initial release, and a later Windows version to install malware of the attacker's choice. All three vulnerabilities received patches within the past 24 hours. Proofpoint attributes the kit's rapid, widely shared deployment to a Chromium patch-gap window and AI agents accelerating exploit development against publicly accessible upstream patches.

Ars Technica · Securityupdated Sep 10, 15:49 UTC · 6d agofirst Sep 9, 20:55 UTC · 6d agoExploit / PoC in the wild 3 sources3

Ready-made $500 kit puts a crypto scam within anyone's reach

A $500 ready-made scam kit sold on a cybercrime forum builds fake Tesla $TSLA presale pages that harvest wallet recovery phrases and cryptocurrency deposits.

Malwarebytes found a $500 scam-in-a-box kit by seller xrep on a cybercrime forum, bundling a fake Tesla-style $TSLA presale site, a victim-tracking admin panel, and controls to inflate fake balances. The kit harvests 12-word wallet recovery phrases via wallet-connection prompts or accepts direct transfers in Bitcoin, Ethereum, USDT, or Dogecoin. The admin panel lets operators check stolen wallets' value before draining them, raise displayed balances to encourage further deposits, and send follow-up messages demanding fake network fees.

Help Net SecurityAug 12, 00:00 UTC · Aug 12, 2026Phishing & fraud

What’s the Scam?

Bruce Schneier reports AI-generated fake thank-you replies to his newsletter confirmations from throwaway Gmail accounts; the scam's goal is unclear.

Bruce Schneier describes receiving a burst of AI-generated, one-line praise emails replying to Crypto-Gram newsletter confirmation messages, sent from random-character Gmail addresses. None of the senders actually subscribed, and they did not respond when he replied, weakening a pig-butchering theory. The campaign appears automated, but its objective has not been identified.

Schneier on SecuritySep 1, 17:36 UTC · 15d agoPhishing & fraud

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

HuntressSep 2, 13:00 UTC · 14d agoPhishing & fraud in the wild1

LLM-Based Social Engineering Scams

OpenAI disrupted a Cambodia-based ChatGPT-powered scam network running romance, crypto-investment, gambling, and fake law-enforcement fraud campaigns.

OpenAI disrupted a social engineering network operating from Cambodia that used ChatGPT to run multiple scam types simultaneously. Operators built trust with fake dating personas before pitching fraudulent cryptocurrency and spot gold investments, posed as gambling platforms offering fake bonuses, or impersonated law enforcement agencies demanding fine payments. The network also generated images of forged documents including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.

Schneier on SecurityAug 27, 09:57 UTC · 20d agoAI safety & security in the wild

Scammers are getting smarter about where they target you

Malwarebytes data shows scammers tailor fraud by platform: 90% of toll scams arrive via email/SMS and MrBeast is now the most impersonated person.

Malwarebytes threat research analyzed global scam data from April 15 to July 14, 2026, across more than 20 scam types, finding each type favors a specific channel such as email, SMS, phone, or social media. Roughly nine in ten toll scams arrive by email or text, about half of IRS scams come by phone, and MrBeast is impersonated in about 30% of impersonation scams. The most impersonated brands are Google, Microsoft, Apple, Roblox, and Amazon, and Malwarebytes blocks around 500,000 phishing websites daily. Gaming scams on Roblox, Steam, Discord, and Minecraft increasingly carry losses of $1,000 or more, with 15-19% activity spikes in mid-2026.

Malwarebytes LabsSep 2, 12:45 UTC · 14d agoPhishing & fraud

Fake Law Firms Scam Victims Crypto

Fraudsters posed as fake law firms to scam victims into paying fees in cryptocurrency.

Scammers impersonated law firms to persuade victims to pay bogus legal fees, likely in cryptocurrency. Crypto-based legal-fee scams typically pressure targets with urgent payment demands, and cryptocurrency transfers are hard to reverse once sent. Victim counts and loss amounts are not stated in the headline.

Infosecurity MagazineAug 16, 00:00 UTC · Aug 16, 2026Phishing & fraud

GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds

eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.

eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.

Cyber Security News14:54 UTC · 3h agoPhishing & fraud in the wild 9 sources

Scammers have figured out the best time to text you

Malwarebytes threat data shows scammers tailor platforms per scam, with the web as top channel, Friday midday peaks, and MrBeast the most impersonated person.

Malwarebytes analyzed its threat data from April 15 to July 14, 2026 across more than 20 scam categories, finding scammers match platforms to scam types: job scams via email, romance scams via social media, and tech support scams via phone. The web is the top delivery channel ahead of email and SMS, and Malwarebytes says it blocks about 500,000 phishing sites a day. Scam texts peak at 12:00 pm ET, roughly 874% above the quietest hour, with volume peaking on Fridays about 50% higher than the start of the week. MrBeast (Jimmy Donaldson) appears in about 30% of impersonation scams, and the most impersonated brands are Google, Microsoft, Apple, Roblox and Amazon.

Help Net SecuritySep 4, 00:00 UTC · 12d agoPhishing & fraud in the wild

Product showcase: ScamNet looks for warning signs in suspicious calls and shady links

Synaptrex's ScamNet app filters scam calls, messages and websites on Apple devices using on-device AI and reputation checks.

ScamNet: Anti-Scam Suite from Synaptrex Technologies is a free consumer app (with ScamNet+ subscription) for iPhone, iPad and Mac that blocks robocalls and spam via iOS Call Blocking & Identification, filters unknown senders with an offline detection engine, and provides a Safari extension that analyzes and blocks suspicious websites. A Check/Report tool accepts phone numbers, websites, crypto addresses, text, images and audio, and a Device Shield verifies passcode, OS updates and screen-recording status.

Help Net SecurityAug 17, 00:00 UTC · Aug 17, 2026Tools

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.

Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.

The Hacker NewsSep 10, 17:47 UTC · 6d agoIndustry in the wild

Outsider Phishing Kit Survives Takedown With 700 New Pages

Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.

Group-IB linked the Outsider Phishing Kit, operated by a threat actor known as ChenLun, to more than 100,000 phishing pages across 54+ countries between December 2025 and May 2026. After the FBI, Google, and Lumen's Black Lotus Labs seized core admin servers, a Shopify storefront, about $100,000, and thousands of domains under Operation Ghost Hook in June, over 700 new phishing domains appeared within a month. The kit offered 267 templates, adversary-in-the-middle MFA interception, WebSocket-based live operator communication, and SMS delivery via a Telegram affiliate ecosystem with more than 5,000 subscribers.

Infosecurity MagazineSep 3, 14:00 UTC · 13d agoPhishing & fraud in the wild1

AI helps scammers build convincing antivirus renewal pages

Malwarebytes found scammers using AI to build polished fake antivirus renewal pages impersonating Avast, harvesting names, emails and phone numbers for follow-up fraud calls.

Malwarebytes analyzed a fake Avast renewal site targeting Belgian users in French, claiming a €129.99 Avast Premium Security renewal and collecting name, email address and Belgian mobile number through a cancellation form. Leftover code comments written in polite French and other stylistic clues suggest the page was generated with AI assistance, and the form was never connected to send data anywhere. The scam typically progresses to phone calls pressuring victims to install remote access software, and AI substantially lowers the barrier for producing polished, localized scam pages at scale.

Malwarebytes Labs08:41 UTC · 9h agoPhishing & fraud

AnonyMousKIT phishing-as-a-service uses AI voice calls to steal iPhone passcodes

SOCRadar details AnonyMousKIT, an active phishing-as-a-service platform using AI voice agents across 506 domains to steal Apple ID credentials from stolen iPhone owners.

SOCRadar analyzed AnonyMousKIT, a pay-per-action phishing-as-a-service platform built to harvest Apple ID credentials needed to remove Activation Lock from stolen iPhones. A bare-relative-paths flaw exposed a reseller supply chain of 506 domains and 168 storefront brands active since early 2024, plus 200 call logs and 55 transcripts, with 179 of 200 calls going to Brazil at a total cost of $19.24. Voice-agent personas like 'Alice Dias, Apple Support' convince victims to dictate their four- or six-digit passcode and enter an unlock code from a security link, allowing thieves to remove Activation Lock and resell devices. The platform ran five personas in English, Spanish, and Brazilian Portuguese and remained active at the end of the investigation.

Help Net SecurityAug 26, 00:00 UTC · 21d agoPhishing & fraud

Tech support scams look different now. Here’s what to watch for

Malwarebytes warns tech support scammers now abuse sponsored search results, fake listings, calendar invites, and Apple Pay notifications, and shares red flags for impersonation scams.

Malwarebytes describes how tech support scams have expanded beyond browser locks and fake virus warnings to sponsored search results, hijacked on-site searches, fake platform listings, renewal scams, fake calendar invites, and Apple Pay notifications. Scammers impersonate trusted security companies including Malwarebytes, seeking payment, personal information, or remote access to victims' computers. Malwarebytes notes it does not outsource support, never makes unsolicited calls, and works with the FTC and the Global Anti-Scam Alliance to combat these scams.

Malwarebytes LabsSep 2, 15:49 UTC · 14d agoPhishing & fraud1

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on SecuritySep 3, 11:18 UTC · 13d agoPhishing & fraud

Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits

Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.

Proofpoint identified a new exploit kit, BlueMoon, first observed on August 28 and used by TA412 (APT31/Violet Typhoon) against US NGOs, mining firms, and commodity trading companies. The kit chains a V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows Advanced Local Procedure Call privilege escalation (CVE-2026-85880), both patched flaws having been exploited in the wild. At least four espionage groups, most with suspected China nexus including UNK_LateNight, adopted the kit within days, targeting US aerospace firms with defense-sector lures. Fewer than 20 organizations were observed targeted, and researchers believe AI-assisted exploit development against upstream Chromium patches enabled the kit's rapid creation and sharing.

The Register · Securityupdated 17:13 UTC · 1h agofirst Sep 9, 22:28 UTC · 6d agoExploit / PoC in the wild 19 sources CVE-2026-85046 CVE-2026-858801

Bogus recruiters go after high-value corporate credentials on mobile

Zimperium details browser-in-the-browser recruitment scams stealing corporate credentials on mobile, impersonating Amazon, Apple, Boeing, and Deloitte.

Zimperium reports scammers posing as HR staff use browser-in-the-browser (BitB) phishing via fake interview scheduling flows to steal corporate credentials. The kit pre-qualifies victims by rejecting personal email addresses, then captures credentials that grant OAuth tokens, internal communications, and cloud access enabling lateral movement. Domains impersonating Amazon, Louis Vuitton, Apple, FIFA, Boeing, Deloitte and others were tracked for a year, mostly hosted on AWS and SEDO, with 46 previously unpublished IOCs released.

Help Net SecurityAug 26, 00:00 UTC · 21d agoPhishing & fraud in the wild

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.

Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Recovered prompts, shell history, and project files show the operator relied on AI coding assistants to package Electron applications, obfuscate code, troubleshoot builds, and modify phishing infrastructure.

Rapid7 BlogAug 17, 11:29 UTC · Aug 17, 2026Phishing & fraud

The Money Mule Solution: What Every Scam Has in Common

CYBERA's money mule intelligence, now in Recorded Future's Payment Fraud Intelligence, targets the shared exit point of $450B-$1T annual scam losses.

Scams, especially authorized push payment fraud, do not require a breach; Global Anti-Scam Alliance estimated ~$450B in 2025 losses while CYBERA co-founder Claudio Staub puts the real figure near $1 trillion when underreporting is counted. Every scam needs a mule account to receive funds, so CYBERA uses agentic personas to engage active scammers and extract verified mule account details before payments occur, now available as an add-on to Recorded Future's Payment Fraud Intelligence. CYBERA collected over 16,000 confirmed mule accounts across 72 countries in H2 2025, finding 28% remained active 30 days or more after identification, including one account in 25 engagements. In Europe 51% of mule accounts sat at neobanks and fintechs, while outside Europe 69% were at major banks; regulatory pressure like the UK's APP reimbursement mandate is raising the stakes for institutions.

Recorded FutureAug 30, 00:00 UTC · 17d agoPhishing & fraud

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.

Abnormal Security analyzed iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for a $10,000 base price with additional capability modules sold separately. Using a browser-in-the-middle relay behind a trycloudflare.com subdomain with valid TLS, it captures Google logins and uses the authenticated session to enroll an attacker-controlled passkey within six seconds of login. Because the passkey persists after password changes and session revocation, operators regain mailbox access even after victims reset credentials. The build examined targets Google, while the seller advertises versions for Microsoft, iCloud, and LinkedIn.

Security AffairsAug 24, 07:17 UTC · 23d agoPhishing & fraud1

The Worst Spam Emails: Inside iLands' AI Agent Hustle

Autonomous AI agents from startup iLands spam freelancers with deceptive persona emails offering paid research services, prompting FTC and Amazon SES abuse reports.

AI startup iLands, founded by ex-ByteDance-affiliated entrepreneur Kaixin Tang, operates autonomous agents such as the persona "Leo Ashford" that send unsolicited emails to creators and freelancers offering research services for around $25. A Tedium writer received over a dozen of these messages in three days via the iLands.app domain, sent through Amazon SES with no unsubscribe option, using debunk-style hooks like falsely correcting a 404 error myth. The agents target professional authors and freelancers, and the author recommends reporting the campaign to the FTC and Amazon's email-abuse address.

Hacker News · AISep 12, 11:13 UTC · 4d agoAI safety & security in the wildHN 44↑ · 19 comments1

Microsoft Teams Has Become a Haven for Scammers in China

Scammers in China are exploiting Microsoft Teams and Webex to trick Chinese victims into transferring large sums of money.

WIRED reports that fraudsters are abusing enterprise chat platforms including Microsoft Teams and Cisco Webex to run scams against victims in China. Victims are socially engineered into transferring large sums of money. The campaign has generated a wave of complaints, highlighting how scam groups abuse legitimate business communication tools.

WIRED · SecurityAug 28, 18:23 UTC · 18d agoPhishing & fraud in the wild

Fake CAPTCHA Scams

Bruce Schneier examines fake CAPTCHA scams that abuse human-verification prompts as social engineering lures against users.

Bruce Schneier's blog post covers fake CAPTCHA scams, a social engineering technique in which attackers pose as CAPTCHA verification checks to manipulate users. The available page text is largely site navigation, and no specific campaign, victim, or malware family is named in the source.

Schneier on Security11:25 UTC · 6h agoPhishing & fraud