Nitori says attacker may have stolen 37.62 million customer records
Access may date to mid-October; passwords and card data were not exposed, the retailer says.
Stories per day · 30 days
21 RSS
Relatedcredential-theft21microsoft16social-engineering11data-breach8microsoft-3658japan7storm-29907yam-store7cogui6fbi6phaas6ransomware6storm-31196account-takeover5business-email-compromise5clickfix5huntress5iron-man5
424 stories, newest first · one card per story
Stories tagged #phishing
Blind Eagle phishing uses fake court notices to deliver a RAT
Zenox reports no confirmed successful infections; the in-memory payload is an AsyncRAT fork with DCRat lineage.
Model-based authoring builds consistent virtual SOC training exercises
A phishing-to-ransomware reference package with eight events passed reference validation and runs in a Virtual SOC prototype.
Iris Plaza cloud breach may expose data of 7.7 million people
About 5.8 million members and 1.9 million non-members may be affected; card data was not in the cloud store.
1
SEGA newsletter breach exposes 2.2 million email addresses
ARARA's email service leaked 77 million addresses from about 380 clients; attackers sent over 7 million impersonation emails.
Malwarebytes Claude connector checks links and numbers in chat
The connector needs no Malwarebytes account, works on free and paid Claude, and exposes six permissioned lookup tools.
Hackers log in with stolen credentials in average 8 minutes
Attackers access systems in an average of 8 minutes using stolen credentials in 27 confirmed cases, abusing AI coding tools and remote monitoring software.
1
Study maps phishing cluster aimed at German-speaking universities
Authors count 25 confirmed campus attacks from February 2022 to February 2023, affecting 5% of German universities.
ChatGPT Lockdown Mode bypass enables silent chat exfiltration
Check Point says ChatGPT Classic needs no click: a conversation can leak full history and open phishing popups.
1
Phishing sites mimic rental platforms to steal credentials
Fortra FIRE team reports phishing pages using live chat and urgency to collect traveler data.
Scammers use AI images to extort owners of missing pets
Criminals send AI-generated photos of missing pets with ransom demands and threats after finding appeals on social media.
Fake OpenAI and SpaceX events used to steal Microsoft and Google accounts
Hackers run fake registration pages for AI events that integrate Kali365 device-code phishing and VoidProxy AiTM to capture credentials and sessions.
Knicks Phishing Test Goes Out of Bounds
MSG Sports sent phishing simulation emails promising championship rings to Knicks employees, who then received training instead.
Microsoft reports 7.3 billion email phishing threats in Q3 2026
The report shows QR code phishing dropped 67% but business service spoofing hit 129 million messages with tenant exceptions weakening protections.
1
UNM Health diverts ambulances and closes clinics after cyber incident
The October 26 event hit some end-user devices, spared core servers, and care was restored the next day.
2
Bank Phishing Sites Use Fake Suspended Pages to Evade Takedowns
Kela reports over 300 look-alike domains targeting 189 US banks and other regions use IP-based switching between login pages and fake suspended notices to survive takedowns.
Scammers capitalize on GTA 6 hype to push malware and crypto cons
Scammers offer fake GTA 6 early access and mobile versions for crypto payments or malware before the November 19 launch.
Multiple phishing malware threats target US enterprises
SkyW4lker and GeorgeGinx phishing kits exploit Microsoft device code auth while WKLP infostealer targets government networks in US and France.
Hackers Use Fake Government Websites to Deliver SimpleHelp
Phishing campaign impersonates Israel Tax Authority to install SimpleHelp remote access software on Israeli targets.
1
AI scams spread across YouTube and email
Scammers are using AI to craft convincing advertisements and personalized phishing emails that exploit eroded online trust.
Fake $750 Apple Cash reward scam leads to app installs
A fake Apple Cash reward page tricks users into downloading apps through affiliate links, with no payout but risks sharing personal data.
1
SkyW4lker phishing kit abuses Microsoft 365 device-code flow for account takeovers
SkyW4lker has tracked 618 sandbox analyses since June 2026 with nearly half from the United States targeting Microsoft 365 sessions.
Google Calendar phishing campaign hijacks sessions, bypasses MFA
Phishers use live reverse proxies on Google sign-in pages to hijack sessions in real time, evading MFA and reputation checks.
1
Scammers abuse Microsoft Azure to host fake Windows alerts
Fake security warnings at 80 organizations direct users to toll-free scam calls via dynamic Azure pages.