Phishing

Attackers abused a flaw in Robinhood's onboarding process, allowing them to inject HTML into account confirmation emails.

HackRead reports that Windows systems have been subjected to a novel ClickFix attack campaign that leverages fraudulent CAPTCHA pages in the lead up to illicit command execution.

NASA had its employees and research collaborators reported by its Office of Inspector General to have been subjected to a Chinese spear-phishing campaign aimed at procuring the agency's sensitive data, The Hacker News reports.

The attack chain begins when users land on typosquatted domains mimicking telecommunications brands.

BlackFile initiates attacks through voice phishing (vishing) calls, using spoofed numbers to impersonate IT support.

The breach affected customer and prospective customer data, including names, phone numbers, and addresses.

The malicious extensions inject iframes to display phishing content and extract other data.