phishing

A user warns about a phishing attempt disguised as a security tip for X/Twitter, advising users to add a secret string to their email prefix; another user clarifies it's phishing and recommends using passkeys instead.

Troy Hunt's weekly podcast episode with Scott Helme, where they launch 'Why no Passkeys?', a successor to 'Why no HTTPS?' that encourages organizations to adopt passkeys for authentication.

US authorities offer up to $10 million for information on Russian state cyber groups responsible for hacking thousands of Signal and WhatsApp accounts belonging to journalists and government employees.

LastPass is notifying users of a data breach caused by a compromise at its third-party vendor Klue, exposing customer names, email addresses, and support case data, but not password vaults.

Two key members of the Scattered Spider cybercrime group, Thalha Jubair and Owen Flowers, pleaded guilty in the UK for their roles in a 2024 cyberattack on Transport for London and other attacks involving ransomware, SIM-swapping, and phishing campaigns affecting over 130 organizations.

AI tools are making World Cup scams harder to detect, with fraudulent websites, deepfakes, and phishing campaigns targeting fans. Experts warn that over 13,000 FIFA-themed domains were registered ahead of the 2026 tournament, with 1 in 41 identified as malicious.

Storm-Breaker is an open-source social engineering tool available from GitHub, capable of remotely peeping at cameras, eavesdropping on microphones, obtaining GPS location and device information. It is mainly for learning and authorized testing, but misuse carries legal risks.

The article describes a sophisticated identity theft scam where attackers use fake job interviews and SSO login flows to steal credentials and drain accounts, warning tech-savvy professionals about new phishing techniques.

Google is suing a Chinese cybercrime network called Outsider Enterprise for using AI, including its own Gemini, to run massive phishing scams that have victimized hundreds of thousands of people and caused billions in losses.

Google has filed a lawsuit against a Chinese cybercrime network called Outsider Enterprise, alleging it used Google's Gemini AI to automate phishing scams, create fake websites, and send millions of malicious text messages to Android users.

An open source project maintainer reports that attackers abused his project's invitation system to send phishing emails to over 14,000 people, exploiting unverified signups and a verified email domain. The incident highlights how well-intentioned design can be misused for malicious purposes.

Scammers are exploiting a Microsoft internal email address typically used for account alerts to send spammy links, potentially tricking recipients. Microsoft says it is investigating and taking action.

A senior member of the cybercrime group Scattered Spider, Tyler Robert Buchanan, has pleaded guilty to wire fraud and identity theft for orchestrating SMS phishing attacks that compromised major tech companies and stole millions in cryptocurrency.