Phishing

More than 16,800 illicit domains masquerading as legitimate government portals, including those from the U.S.'s Department of Motor Vehicles, were discovered by Cyble Research and Intelligence Labs researchers to have been part of the large-scale Operation TrustTrap domain spoofing campaign aimed at extensive user data exfiltration, according to The Cyber Express.

The SMS blaster operates by emitting signals that trick mobile devices into connecting to it, appearing as a stronger, legitimate cell tower.

Attackers abused a flaw in Robinhood's onboarding process, allowing them to inject HTML into account confirmation emails.

HackRead reports that Windows systems have been subjected to a novel ClickFix attack campaign that leverages fraudulent CAPTCHA pages in the lead up to illicit command execution.

NASA had its employees and research collaborators reported by its Office of Inspector General to have been subjected to a Chinese spear-phishing campaign aimed at procuring the agency's sensitive data, The Hacker News reports.

The attack chain begins when users land on typosquatted domains mimicking telecommunications brands.

BlackFile initiates attacks through voice phishing (vishing) calls, using spoofed numbers to impersonate IT support.