Email security

U.S. government contractors are being targeted by an ongoing phishing campaign that once used PDF files pertaining to the bidding process for Department of Labor projects but has since expanded to impersonate the Department of Commerce and the Department of Transportation, according to BleepingComputer.

Security researchers say email breach at large airline demonstrates that users are still a primary attack vector for threat actors.

Companies need to educate the staff, adapt to keep up with the bad guys, and leverage top tools to sharpen up email security.

Russia-linked hacking group Gamaredon has been targeting Ukrainian defense, government, and law enforcement agency employees in a new ongoing cyberespionage campaign leveraging an information stealing malware, reports The Hacker News.

Iranian state-sponsored threat group TA453 has been discovered to be using the novel 'multi-persona impersonation' technique in an effort to facilitate more elaborate and legitimate-looking phishing emails, according to BleepingComputer.

New phishing attacks have been using the death of Queen Elizabeth II as lures to facilitate the theft of Microsoft account credentials and multi-factor authentication codes, reports BleepingComputer.

In recent weeks, the U.S. student loan market has been in the spotlight — not just for the much-discussed loan forgiveness plan launched by the Biden administration, but also for the segment’s growing position as a target for financial fraud.

New attacks aimed at exfiltrating Steam credentials and compromising Steam account access have been leveraging the novel Browser-in-the-Browser phishing technique, which was initially reported to enable the creation of fraudulent Microsoft, Google, and Steam login forms, according to BleepingComputer.