138 casos · pág. 1/7
Brazilian outlet Olhar Digital describes a quishing fraud pattern in which criminals create or tamper with payment QR Codes so that victims' money goes to accounts the fraudsters control. The scheme appears in online shopping, in physical venues such as bars, restaurants, street markets and car parks, and in printed boletos. The Federação…
Episode 489 of the Smashing Security podcast covers several recent incidents, linked mainly through show-note references. The headline topic is a supply-chain attack on Ledger hardware crypto wallets, with reports of backdoored devices and funds being drained. Ledger reportedly asked sellers across Asia to halt sales and published guidanc…
A judge ordered Meta to pay $25 billion to the state of New Mexico for deceiving resident users about its data privacy practices, the largest payout in the company's history, according to The New York Times as cited by TechCrunch. A jury in a two-week trial found 43 million violations of the state's consumer protection laws, each carrying…
Proofpoint reported at its Protect 2026 conference that generative AI is removing the behavioral tells (awkward language, reused templates, repeated infrastructure) that email filters have relied on. Attackers can now produce fluent, personalized, unique messages for each recipient, which weakens behavior-only detection. The vendor cites …
The Wiz Customer Incident Response Team (CIRT) reports a rising pattern of LLMjacking in which threat actors compromise privileged Google Cloud Platform (GCP) users solely to offload the cost of large-scale LLM inference onto the victim. Attackers link external, attacker-controlled GCP projects to the victim's billing account, so all Gemi…
Hardware hacker Joe Grand found tampered Trezor Model T and Trezor One wallets sold through unauthorized third-party channels (Facebook Marketplace in Canada in 2025, and a TikTok shop in August 2026, shipped from China). The attackers replaced the microcontroller with one running malicious firmware that hands users one of about a dozen p…
Flashpoint joined the UK National Crime Agency (NCA), the DOJ, FBI, U.S. Secret Service, Homeland Security Investigations and private-sector partners in "Joint Disruption Week", held in London the week beginning October 6, 2026. The operation targeted West African scam networks running cryptocurrency investment scams, impersonation scheme…
A survey of 2,018 senior IT decision-makers in the US and UK, conducted by Censuswide for Origina and published with Thinkers50 in the report The Software Tax, finds large enterprises spend an average of 28% of software budgets on upgrades, migrations and licensing changes they would not have chosen. 95% of respondents paid for a vendor-d…
Moody's Ratings published an analysis on October 19 warning that AI-driven cyberattacks could raise financial risk for organisations with weak security, because AI tools make attacks faster, more automated and more persistent. Earlier Moody's research from March, using Bitsight data on more than 9,000 Moody's-rated organisations, found th…
On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face-swapping app with about 96,600 GitHub stars. Commit 7895c547 ("chore: update requirements.txt") rewrote 18 dependency entries and added requests @ git+https://github.com/pypls/requests.git. This points installation to a lookalike reposito…
Trend Micro disclosed its part in a multinational law enforcement operation against the LockBit ransomware group, working with the FBI and the NCA. Per the vendor, undercover infiltration helped prevent the release of the group's next malware product, LockBit-NG-Dev, and Trend customers received protection before LockBit had finished test…
Trend Micro published its Holidays, Scams, and AI survey of 6,536 consumers across the United States, United Kingdom, Australia, New Zealand, Singapore and Taiwan (2,100 in the U.S.), conducted 31 October to 10 November 2025. It shows a gap between scam-spotting confidence and actual exposure: 56% of Americans are very or extremely confid…
Trend Micro released its 2026 Consumer Security Predictions Report on December 3, 2025. It warns that scams will reach unprecedented scale as fraudsters combine automation, AI-generated personas, voice cloning and deepfake media with emotional manipulation. The report expects multi-channel scam journeys to become the dominant pattern in 2…
FortiGuard Labs describes an LLMjacking incident in which an AWS account was compromised through a leaked, long-lived IAM access key with AdministratorAccess permissions. The operator subscribed to one or more foundation models through AWS Marketplace and invoked them through Amazon Bedrock, generating inference charges against the victim…
AI voice-cloning scams are now cheap and convincing, and a Hiya report from March says one in four Americans received a deepfake voice call in the past 12 months. A further 24% say they cannot tell a cloned voice from a real one. The article describes virtual kidnapping scams, in which attackers clone a relative's voice from a few seconds…
Scammers continue to exploit Bitcoin/crypto ATMs as an irreversible payment channel in impersonation fraud. According to the FBI, 13,460 such complaints in 2025 resulted in $389 million in losses, a 23% rise in volume and 58% rise in losses over 2024. Victims over 50 lost more than $302M, and those over 60 accounted for $257.4M. The scam …
Consumer-fraud reporting describes a growing ecosystem of timeshare exit scams that target owners wanting to leave their contracts. Scammers find owners through real estate records and approach them with unsolicited calls or high-pressure dinner seminars. They then collect large upfront fees, often thousands of dollars, for services they …
Malone Lam, a 22-year-old Singaporean who used the aliases "Anne Hathaway", "$$$" and "King Greavy", has pleaded guilty to leading a group that stole more than US $245 million in cryptocurrency from victims across the United States. According to the US Department of Justice, the group operated from October 2023 to May 2025 and recruited a…
In his Weekly Update 517, Troy Hunt offers commentary on the current ransomware situation. He argues that much of what is called ransomware often involves no malware at all and is simply extortion, frequently carried out by young offenders. These actors earn large sums but struggle to spend them without being caught. He adds that breached…
On October 8, the U.K. imposed economic sanctions on Cryptomus (formerly Certa Payments and Xeltox Enterprises, rebranded as Heleket) for processing payments that benefit the Russian government and its financial institutions. The sanctions also cover the virtual payment platforms VexPay, TokenSpot and Tsunami Payments. Experts describe Cr…
