Flashpoint's first monthly insider threat report, drawn from its Primary Source Collection (PSC), identified 9,787 insider-related posts across 1,216 channels and 1,778 authors in September 2026. Overall volume fell, but threat actors kept recruiting insiders and advertising insider access, mostly to enable fraud. Flashpoint counted 857 u…
Trend Micro published research (Unmasking Task Scams) on task scams, a fast-growing fraud model in which fake online job offers lure victims into repetitive, gamified digital tasks and then extract funds through escalating deposit demands. Operators impersonate legitimate staffing firms and digital marketing agencies and use SMS, WhatsApp…
A 40-year-old Nigerian national, Chukwuemeka Victor Amachukwu, was sentenced to eight years in prison by a US federal court for a 2019-2023 scheme that combined hacking of US tax preparation businesses, filing of fraudulent tax returns and fake investment fraud. He used identities stolen from victim organizations to file false returns wit…
The FBI warns that scammers are likely to exploit the 2026 US Midterm Election to run financial fraud schemes against victims across the United States. The PSA updates alert I-102924-PSA from 29 October 2024. Scammers use candidates' names, images, logos and slogans to solicit fake campaign contributions, sell merchandise that is never de…
Scammers are exploiting the annual Medicare Open Enrollment period (October 15 to December 7) as a pretext to impersonate insurers, agencies or Medicare itself. Contact comes by phone, SMS, email, social media and malicious Google ads that lead to spoofed, official-looking websites. Lures include plan changes, card replacement, lower prem…
This ESET WeLiveSecurity article explains email bombing (also called form, list or subscription bombing) and cites a September report of a Virginia woman flooded with hundreds of emails in 24 hours. The flood hid a genuine bank alert about a fraudulent laptop purchase. Attackers use bots to sign a harvested email address up to many legiti…
Scammers abused a legitimate spend-management platform as part of a fraud operation. They used its notification system to send phishing messages and its open-banking account linking to validate stolen banking credentials. Group-IB documented the activity in a client environment after the platform reported suspicious payment notifications …
The European Commission has opened a formal investigation under the Digital Services Act (DSA) into Booking.com, a very large online platform with more than 45 million EU users. It will examine whether the company does enough to stop fraudsters from using the platform for fake listings, impersonation fraud, phishing and smishing (theregis…
Check Point Research reports that commercial antidetect browsers, notably Kameleo, AdsPower and MultiLogin, are widely referenced on Russian-language underground forums and marketplaces. They are used for account takeover, payment card fraud (carding), fraudulent loan applications, ad-revenue fraud, bulk creation of fake accounts and coor…