28 casos · pág. 2/2
A modular phishing campaign targets YouTube creators with personalized sponsorship offers from fake brand representatives. One variant impersonates Hollyland, a maker of wireless video transmission equipment, and also Nike and Spotify. Victims are led through a convincing fake collaboration platform to a bogus "Sign in with Google" page t…
This ESET WeLiveSecurity article explains email bombing (also called form, list or subscription bombing) and cites a September report of a Virginia woman flooded with hundreds of emails in 24 hours. The flood hid a genuine bank alert about a fraudulent laptop purchase. Attackers use bots to sign a harvested email address up to many legiti…
Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64.128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found…
Check Point Research reports that commercial antidetect browsers Kameleo, AdsPower and MultiLogin are widely referenced on Russian-language underground forums and are used for account takeover, carding, fraudulent loan applications, ad-revenue fraud and coordinated inauthentic behavior (CIB). The tools spoof browser fingerprints, manage p…
Huntress published an explainer on business email compromise (BEC), a targeted form of phishing in which attackers impersonate or take over trusted email accounts to redirect payments or steal credentials. The article cites roughly $55 billion in worldwide losses and a Huntress survey of 500+ US IT professionals, in which 36% of organizat…
Cisco Talos disclosed an APT spear-phishing and quishing campaign, tracked as UAT-11985, that targets individuals affiliated with Taiwan research organizations. First seen in mid-2026, it uses fake event invitations to lead victims to an adversary-in-the-middle (AitM) phishing framework that harvests Google account credentials and MFA cod…
F5 Labs' 2025 Advanced Persistent Bots Report analyzes more than 200 billion web and mobile API transactions from F5 Bot Defense customers between November 2023 and September 2024. It finds that 10.2% (21.22 billion) of requests were bots or automation. Of these, 4.8% were unwanted bots mitigated by F5, 3.5% were flagged automation and 2.…
This SentinelOne weekly roundup (Week 41, 2026) covers law enforcement actions, a phishing campaign and an actively exploited vulnerability. The most urgent item is CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file access flaw in Atlassian Data Center products. Exploitation attempts began about two hours after a public …
