Huntress: ClickFix chains now persist, move laterally, and steal credentials
Recent lures use malvertising, typosquats, and compromised sites, then show fake verification text while payloads run.
Stories per day · 30 days
20 RSS
Relatedclickfix11phishing11binance8microsoft-teams7cryptocurrency5north-korea5quick-assist5bec4fraud4malware4ransomware4account-takeover3ad-cs3chatgpt3claude3infostealer3lazarus3macos3
313 stories, newest first · one card per story
Stories tagged #social-engineering
Fake gift card scams impersonate trusted brands for subscriptions
Campaigns trick users with celebrity ads into fake reward portals that lead to mobile subscriptions and app installs instead of delivering cards.
Binance Heist Exposes AI Governance and Security Failures
Attackers stole $6.34 billion from Binance using malware on developer machines and an internal AI tool to pivot to additional systems.
1
Service desk account recovery can bypass stronger login controls
A Specops explainer cites Scattered Spider, deepfakes and voice phishing as reasons to drop knowledge-based checks.
1
Binance Hackers Used Fake Interviews to Steal Record-Breaking Cryptocurrency
Attackers stole 233.46 million XRP, 970,500 SOL and 44.2 million OP from Binance hot wallets using compromised engineer credentials.
1
North Korean hackers used fake job interview to breach Binance
Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.
3
Binance loses $6.3 billion in fake job interview malware attack
North Korean hackers used fake job interviews to install custom malware and steal $6.34 billion from Binance's wallet infrastructure.
1
North Korean hackers steal $6.3B from Binance
Hackers used fake recruiter contacts to trick an engineer into downloading malware, stealing $6.3 billion in crypto.
1
Binance hackers used fake job interviews and AI tools to steal $6.3B
Attackers stole $6.34 billion from Binance using fake developer tool installations and job interview lures that delivered malware into AI tools; 98% of funds replenished.
Binance reveals $6.43 billion theft via fake job interviews and AI tool abuse
A North Korea-linked campaign stole $6.43 billion from Binance using social engineering and tampered AI tools.
1
Binance says months-long campaign stole $6.3 billion in crypto
FBI blames North Korea’s TraderTraitor; Pyongyang denies it, and about $2.85 billion was frozen.
1
Dark Reading offers nine habits for current workplace cyber risks
A reader poll put phishing at 39.1% and shadow AI at 38.2% as the top awareness challenges.
Hackers use Microsoft Teams messages and calls to gain remote access
Attackers impersonate IT support via Teams to approve Quick Assist sessions and abuse AD CS for privileged account access.
1
Attackers pose as IT support on Microsoft Teams to abuse AD CS
Attackers use social engineering via Microsoft Teams and insecure AD CS to steal company data.
Research Examines Networked Synthetic Social Engineering on AI
Synthetic social engineering on AI services shows no increase in unsupported verification but publication availability leaves 40% violation reach.
Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
2
North Korean actors use AI to scale social engineering and malware
Microsoft rates Jade Sleet, Coral Sleet, and Jasper Sleet as operationalized; operations remain human-directed, not autonomous.
2
Fake Cloudflare checks push ClickFix commands to Windows and Mac users
Commands pointed to api-com.cfd and cf-id.com, but neither yielded a payload, so the malware remains unknown.
1
Fake Cloudflare checks on hacked sites push ClickFix commands
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
2
Unnamed ClickFix campaign uses fake Cloudflare checks on Windows and macOS
The researcher could not retrieve either payload: Windows returned 403 and the macOS malware domain did not resolve.
1
Talos finds 1,400 scam emails via Staples and Dell orders
Attackers put phone-support lures in order fields so authenticated retailer mail urged victims to call attacker numbers.
1
Email bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
1
Spam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
1
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
2