#social-engineering
#social-engineering

The npm incident frightened everyone, but ended up being nothing to fret about

A social-engineering compromise of an npm maintainer briefly poisoned 18 popular packages, but quick detection and response limited the supply-chain attack’s impact and damage.

fromApp Developer Magazine

8 months ago

Hackers steal cryptocurrency using fake job offers report reveals

North Korean hacking groups use fake recruiter job offers and malware-laden assessments to steal cryptocurrency from blockchain professionals and investors.

#data-breach

fromTechCrunch

Information security

VC giant Insight Partners notifies staff and limited partners after data breach | TechCrunch

Information security

1.1M Impacted by Farmers Insurance Data Breach, Security Leaders Discuss

Information security

Security Leaders Respond to Workday Cyber Incident

Information security

The Allianz Life data breach just took a huge turn for the worse

fromEntrepreneur

US news

Workday: Data Breach, Hack Exposes Personal Information | Entrepreneur

Information security

Everything we know about the Workday data breach so far

fromTechCrunch

Information security

VC giant Insight Partners notifies staff and limited partners after data breach | TechCrunch

Information security

1.1M Impacted by Farmers Insurance Data Breach, Security Leaders Discuss

Information security

Security Leaders Respond to Workday Cyber Incident

Information security

The Allianz Life data breach just took a huge turn for the worse

fromEntrepreneur

US news

Workday: Data Breach, Hack Exposes Personal Information | Entrepreneur

Information security

Everything we know about the Workday data breach so far

Information security

Account Profile Scam Targets PayPal Users

fromLifehacker

Information security

This Creative Phishing Scam Uses Netflix Job Offers to Steal Facebook Credentials

Privacy professionals

Malicious URLs overtake email attachments as the biggest malware threat

fromwww.itpro.com

Information security

New hires are your weakest link when it comes to phishing attacks here's how you can build a strong security culture that doesn't judge victims

Privacy professionals

Hackers Using PDFs to Impersonate Microsoft, DocuSign, and More in Callback Phishing Campaigns

Information security

Account Profile Scam Targets PayPal Users

fromLifehacker

Information security

This Creative Phishing Scam Uses Netflix Job Offers to Steal Facebook Credentials

Privacy professionals

Malicious URLs overtake email attachments as the biggest malware threat

fromwww.itpro.com

Information security

New hires are your weakest link when it comes to phishing attacks here's how you can build a strong security culture that doesn't judge victims

Privacy professionals

Hackers Using PDFs to Impersonate Microsoft, DocuSign, and More in Callback Phishing Campaigns

more#phishing

Artificial intelligence

fromWIRED

Psychological Tricks Can Get AI to Break the Rules

Human-style persuasion techniques can often cause some LLMs to violate system prompts and comply with objectionable requests.

Double trouble with CastleRAT malware, now in C and Python

TAG-150 created CastleRAT in Python and C, using ClickFix social engineering to trick users into pasting commands that enable remote access and payload delivery.

Cybersecurity experts issue urgent warning amid surge in Stealerium malware attacks

Stealerium infostealer has surged, exfiltrating credentials, crypto wallets, Wi‑Fi and VPN data via multiple channels and leveraging social‑engineering lures for global campaigns.

Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE

Lazarus Group used a Telegram social-engineering campaign to deliver PondRAT, ThemeForestRAT, and RemotePE, enabling credential theft and network discovery in a DeFi organization.

#cybersecurity

fromTechRadar

Information security

I am a cybersecurity expert - here's why it's time for businesses to bolster defenses, beyond just tech

Information security

Workday confirms CRM breach via social engineering

fromTechzine Global

Privacy professionals

Workday also appears to have been hit by Salesforce attack

Information security

Russian Group EncryptHub Exploits MSC EvilTwin Vulnerability to Deploy Fickle Stealer Malware

Scattered Spider's Newest Targets: Transportation and Airlines

A sophisticated cyber campaign targets retail, airline, and insurance sectors using social engineering tactics instead of traditional software exploits.

Scattered Spider Hijacks VMware ESXi to Deploy Ransomware on Critical U.S. Infrastructure

Scattered Spider targets VMware ESXi hypervisors, employing social engineering to bypass security measures and conduct precise, campaign-driven attacks.

fromTechRadar

Information security

I am a cybersecurity expert - here's why it's time for businesses to bolster defenses, beyond just tech

Information security

Workday confirms CRM breach via social engineering

fromTechzine Global

Privacy professionals

Workday also appears to have been hit by Salesforce attack

Information security

Russian Group EncryptHub Exploits MSC EvilTwin Vulnerability to Deploy Fickle Stealer Malware

Information security

Scattered Spider's Newest Targets: Transportation and Airlines

Information security

Scattered Spider Hijacks VMware ESXi to Deploy Ransomware on Critical U.S. Infrastructure

The Man Who Sold a Fake Country

Con artists exploit timeless human psychology—scarcity, forged credibility, and persuasive storytelling—to sell false opportunities across eras, from 19th-century Poyais to modern online scams.

MixShell Malware Delivered via Contact Forms Targets U.S. Supply Chain Manufacturers

Instead of sending unsolicited phishing emails, attackers initiate contact through a company's public 'Contact Us' form, tricking employees into starting the conversation. What follows are weeks of professional, credible exchanges, often sealed with fake NDAs, before delivering a weaponized ZIP file carrying MixShell, a stealthy in-memory malware.

Information security

Has password hygiene ever improved?

Passwords are fundamentally insecure and human-dependent, enabling breaches that can topple organizations; static credentials must be eliminated in favor of stronger authentication.

'Impersonation as a service' next big thing in cybercrime

Demand for English-language social engineering skills has surged, enabling impersonation-as-a-service operations that facilitate Salesforce intrusions and financially motivated attacks.

fromComputerWeekly.com

Workday hit in wave of social engineering attacks | Computer Weekly

Workday experienced a cyber attack via a third-party supplier, impacting many large organisations.

ClickFix Malware Campaign Exploits CAPTCHAs to Spread Cross-Platform Infections

"Like a real-world virus variant, this new 'ClickFix' strain quickly outpaced and ultimately wiped out the infamous fake browser update scam that plagued the web just last year."

Privacy professionals

#malware

Privacy professionals

Weekly Recap: VPN 0-Day, Encryption Backdoor, AI Malware, macOS Flaw, ATM Hack & More

Information security

Hackers Leverage Microsoft Teams to Spread Matanbuchus 3.0 Malware to Targeted Firms

Growth hacking

New EDDIESTEALER Malware Bypasses Chrome's App-Bound Encryption to Steal Browser Data

EDDIESTEALER is a Rust-based information stealer using fake CAPTCHA pages to trick users into executing malware that harvests sensitive information.

Marketing tech

Hackers Use TikTok Videos to Distribute Vidar and StealC Malware via ClickFix Technique

Latrodectus malware utilizes the ClickFix technique for stealthy and dangerous payload distribution.

Privacy professionals

Weekly Recap: VPN 0-Day, Encryption Backdoor, AI Malware, macOS Flaw, ATM Hack & More

Information security

Hackers Leverage Microsoft Teams to Spread Matanbuchus 3.0 Malware to Targeted Firms

Growth hacking

New EDDIESTEALER Malware Bypasses Chrome's App-Bound Encryption to Steal Browser Data

EDDIESTEALER is a Rust-based information stealer using fake CAPTCHA pages to trick users into executing malware that harvests sensitive information.

Marketing tech

Hackers Use TikTok Videos to Distribute Vidar and StealC Malware via ClickFix Technique

Latrodectus malware utilizes the ClickFix technique for stealthy and dangerous payload distribution.

more#malware

fromArs Technica

After BlackSuit is taken down, new ransomware group Chaos emerges

Chaos is likely a rebranding of BlackSuit ransomware or operated by former members, based on similar encryption mechanisms, ransom note structure, and tools used.

Privacy technologies

Deepfakes. Fake Recruiters. Cloned CFOs - Learn How to Stop AI-Driven Attacks in Real Time

Social engineering attacks have evolved to utilize AI and deepfake tools for sophisticated impersonation tactics.

Apple

New ZuRu Malware Variant Targeting Developers

ZuRu is a trojan malware for macOS that spreads through trojanized legitimate software and relies on social engineering tactics.

Privacy technologies

fromIT Brew

Malvertising attackers add fake numbers to real sites

Tech-support scams utilize malicious ads to lead victims to false support lines through legitimate domains.

Privacy professionals

Security Leaders Discuss Marco Rubio AI Imposter

AI-generated impersonation attempts pose serious risks to information security and can bypass human caution.

Generative AI tools have reached a level of sophistication that allows for credible impersonations.

#cybercrime

fromBusiness Matters

EU data protection

British teens arrested over 300m Marks & Spencer hacking spree

Growth hacking

Crooks posing as job hunters to malware-infect recruiters

fromWIRED

Growth hacking

How to Win Followers and Scamfluence People

fromBusiness Matters

EU data protection

British teens arrested over 300m Marks & Spencer hacking spree

Growth hacking

Crooks posing as job hunters to malware-infect recruiters

fromWIRED

Growth hacking

How to Win Followers and Scamfluence People

2024 Saw Over 4 Million Mobile Social Engineering Attacks

Mobile devices are increasingly susceptible to social engineering attacks, particularly with rising phishing interactions on iOS.

Disinformation security is a major concern for cyber teams - here's what your business can do

Being able to imitate anyone's voice with only a few seconds of audio or create a nefarious video of someone with only a few pictures found online - that's the scary part.

Information security

fromPsychology Today

4 months ago

The Psychology of Crowds

When people gather in large groups, they often act in ways that are different from how they would behave individually.

Psychology

Privacy professionals