Phishing

Expired or compromised domains could be used to push out malicious calendar files.

Harvard University has confirmed being impacted by a significant data breach following a voice phishing intrusion against its Alumni Affairs and Development systems, according to BleepingComputer.

Information-stealing payloads are being spread via bogus Windows update screens as part of a new ClickFix attack campaign that has targeted organizations in the U.S., EMEA, and Asia-Pacific and Japan regions between Sep. 29 and Oct. 30, according to The Register.

The scammers are adopting various tactics, including posing as TechCrunch staff to request introductory calls and extract proprietary details from companies.

An illicit service called Matrix Push C2 allows users to coordinate push notification attacks.

The Hacker News reports that Microsoft account credentials have been pilfered by the upgraded Sneaky 2FA phishing-as-a-service kit through the newly embedded Browser-in-the-Browser functionality, which conceals phishing URLs via pop-up login forms.

Microsoft Entra B2B tenant invitations have been exploited by threat actors to facilitate a new Telephone-Oriented Attack Delivery phishing campaign, according to Cybernews.