Phishing

Spoofs from government agencies target businesses that regularly run DocuSign transactions with U.S. state, municipal and licensing authorities.

While SVG primarily enables the crafting of images using text, lines, and shapes in code rather than pixels, such files could also be utilized to show HTML and facilitate JavaScript execution in credential-stealing phishing forms.

Researchers say the Iranian threat actors impersonated the North Koreans to hide their activities.

Aside from facilitating email address extraction from public GitHub profiles, GoIssue — which also features proxy support, customizable email templates, and token management capabilities — also enables the automation of targeted phishing campaigns that could result in developer credential theft, private repository access, or malware delivery, a SlashNext report showed.

Threat actors leveraged search results for the query 'Are Bengal Cats legal in Australia?' which when clicked enabled the download of a malicious ZIP archive installing the GootKit information-stealing payload and remote access trojan, according to a Sophos report.

Slowly but surely, phishing-resistant forms of multi-factor authentication are catching on. Here's how to join the movement, and how it can lead to a fully passwordless environment.

Research underscores that many systems remain unpatched and are vulnerable to bugs that were patched several years ago.