Phishing

Malware sandbox service Any.Run had its employees subjected to a phishing attack suspected to be part of a business email compromise campaign.

The county Department of Public Health disclosed the breach of data belonging to over 200,000 individuals.

Such a flaw was publicized by a security researcher after the disclosure was dismissed by Microsoft.

Attackers impersonated human resources departments in malicious emails purporting to be about salary updates containing PDF attachments with malicious QR codes.

Two campaigns use legitimate websites and spam emails to spread infostealers and backdoors.

Many of these "unknown" attacks are old wine in new bottles, so by focusing on familiar vectors like phishing, teams will find that these threats will decrease.

Hackread reports that organizations in the IT and technology industry were most spoofed in phishing scams between January 2020 and March 2024, followed by those in the banking and financial services sector.