Phishing

Clicking on the ads including alerts on compromised passwords redirects targets to a Chrome Web Store-spoofing page, which prompts the download of the fake update in the guise of a browser extension, according to a Bitdefender report.

Spoofs from government agencies target businesses that regularly run DocuSign transactions with U.S. state, municipal and licensing authorities.

While SVG primarily enables the crafting of images using text, lines, and shapes in code rather than pixels, such files could also be utilized to show HTML and facilitate JavaScript execution in credential-stealing phishing forms.

Researchers say the Iranian threat actors impersonated the North Koreans to hide their activities.

Aside from facilitating email address extraction from public GitHub profiles, GoIssue — which also features proxy support, customizable email templates, and token management capabilities — also enables the automation of targeted phishing campaigns that could result in developer credential theft, private repository access, or malware delivery, a SlashNext report showed.

Threat actors leveraged search results for the query 'Are Bengal Cats legal in Australia?' which when clicked enabled the download of a malicious ZIP archive installing the GootKit information-stealing payload and remote access trojan, according to a Sophos report.

Slowly but surely, phishing-resistant forms of multi-factor authentication are catching on. Here's how to join the movement, and how it can lead to a fully passwordless environment.