Phishing

Cyber Security News reports that WordPress administrators have been targeted with fraudulent domain renewal emails to facilitate the compromise of credit card data and two-factor authentication codes as part of a new phishing campaign.

Experts say these type of combined attacks will spread globally and across industry sectors.

The UAC-0184 group, also known as Hive0156, launched a campaign against Ukraine's Verkhovna Rada, exploiting sensitive themes such as changes to military personnel files and denied compensation for fallen soldiers.

Increasingly active phishing groups and escalating cybercrime-as-a-service operations have fueled cyber extortion, with Orange Cyberdefense noting that the number of victims has risen by 45% from October 2024 to September 2025, Infosecurity Magazine reports.

Over two dozen illicit npm packages power targeted spear-phishing campaign Manufacturing, industrial automation, healthcare, and plastics organizations in the U.S. and other Allied nations have had their sales and commercial personnel's credentials targeted in a spear-phishing campaign involving 27 malicious npm packages for at least five months, according to The Hacker News.

Microsoft Outlook users have had their credentials sought to be compromised by an AI-assisted phishing kit as part of a Spanish-speaking phishing campaign that has been underway since March, Cyber Security News reports.

BleepingComputer reports that malicious emails purporting to be from U.S. online food delivery service GrubHub have been luring its users to send Bitcoin to a provided wallet address in exchange for a tenfold increase in payout as part of a supposed 'Holiday Crypto Promotion' promo since Christmas Eve.