Phishing

Increasingly sophisticated voice phishing kits imitating identity providers' authentication flows to facilitate real-time tracking of illicit operations have been gaining traction among cybercriminals, according to The Register.

The updates address critical security areas including password strength, secure storage, two-factor authentication (2FA), and phishing protection.

Experts say we’ve seen similar attacks in recent Salesforce vishing campaigns tied to ShinyHunters.

The Brand Impersonation Protection feature will begin rolling out in mid-February and will be enabled by default for targeted release users.

The attackers likely initiated access using previously compromised email addresses, sending phishing emails containing a SharePoint URL disguised with subjects like "New Proposal - NDA," according to Microsoft.

Threat actors are poised to launch credential-harvesting phishing and spoofed websites, as well as harness event system software and API flaws ahead of the Milano-Cortina Winter Olympics next month, according to Infosecurity Magazine.

Afghan ministry and administrative office workers have been targeted with malware-spreading phishing emails purporting to be from the office of the country's prime minister as part of the Nomad Leopard campaign, according to The Record, a news site by cybersecurity firm Recorded Future.