Phishing

Android and Google Chrome users have had their Google Discover feeds injected with deceptive news stories via search engine optimization poisoning and AI-generated content to facilitate scareware deployment and financial scams as part of the Pushpaganda ad fraud campaign, The Hacker News reports.

Vishing attacks target Okta to bypass MFA, enabling broad SSO data access.

The fraudulent app, available on Apple's App Store under the publisher name "Leva Heal Limited," tricked users into entering their seed phrases, granting attackers full control of their digital wallets.

RDP files, commonly used in enterprise environments for remote access, have been increasingly abused by threat actors, including the Russian state-sponsored APT29 group.

Suspected former Black Basta affiliates impersonate help desks to deploy RMM software.

GBHackers News reports that widely used software-as-a-service collaboration platforms GitHub and Atlassian Jira have had their alert systems exploited to deploy phishing emails without being flagged by SPF, DKIM, and DMARC checks.

North Korean state-backed threat operation APT37, also known as ScarCruft, has targeted Facebook users with the RokRAT trojan as part of a new multi-stage social engineering campaign, The Hacker News reports.