Fraud & Scams

TerminalFix looks like ClickFix, but delivers a very different payload

The familiar ClickFix fake CAPTCHA trick has been adapted to deliver a payload that can give attackers access to the victim’s wide…

Infostealers are hijacking Claude accounts at users’ expense

Anthropic has warned that infostealers are stealing Claude session cookies to access users’ accounts and consume usage at their ex…

Attackers Abuse Enterprise Collaboration Tools to Avoid Detection

Threat actors’ abuse of enterprise collaboration tools increased fourfold over the past twelve months, according to researchers at…

McKesson confirms cyber incident after ShinyHunters claims patient-data theft

Healthcare company McKesson acknowledged a data breach. ShinyHunters claims to have stolen hundred of millions of records

FTC, States Sue Amazon Over Secret Ad Surcharge Scheme

Today, 22 states joined the Federal Trade Commission in filing suit against Amazon, alleging that the company engaged in deceptive…

Protecting Every Conversation: Introducing KnowBe4 Defend for Google Workspace

Google Workspace powers more than 3 billion active users globally. From agile mid-market firms to global enterprise operations, Gm…

A week in security (August 24 – August 30)

A list of topics we covered in the week of August 24 to August 30 of 2026

Warning: Replying to a “Wrong Number” Text Marks You as a Target for Scams

Attackers are using “wrong-number” texts to identify potential targets for scams, according to researchers at Malwarebytes. The…

The .vu Surge: How Threat Actors Are Exploiting Vanuatu's Domain Extension

Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal

Protect your WhatsApp account with new passkey and 2FA upgrades

WhatsApp has introduced three security upgrades. Here’s what to turn on to better protect your account.

New Phishing Kit Gives Threat Actors Live View Into Attacks

A new phishing platform called “JWR” gives attackers real-time control over social engineering attacks, according to researchers a…

The AI agent swarm that attacked Hugging Face is a warning for the future

An army of AI agents was responsible for the Hugging Face incident. What does it mean for the future of AI?

Voice Phishing Attacks Target Hedge Fund Employees

Google’s Threat Intelligence Group (GTIG) is tracking a voice phishing (vishing) campaign that’s targeting hedge funds and financi…

Flock wants privacy to meet surveillance halfway

Flock’s CEO wants a compromise between privacy and public safety, but the public has already compromised enough.

Fake listings can turn trusted platforms into scam springboards

A trusted name on a trusted platform does not guarantee a trustworthy listing. It could still lead to a tech support scammer.

Warning: Malicious AI Tools Are Spreading in the Criminal Underground

Criminals are now selling malicious AI tools for use in cyberattacks, according to researchers at Trellix. These tools dramaticall…

Fake Apple Pay charge brings the classic tech support scam to your phone

Built for mobile users, this tech support scam uses a fake Apple Pay alert and browser tricks to pressure victims into calling a s…

FTC Finalizes Orders with Cox Media Group, Two Other Firms Settling Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service

The Federal Trade Commission finalized orders requiring Cox Media Group (CMG) and two other firms to pay a total of $930,000 to se…

New Instagram and Facebook rules set a default two-hour limit for teens

Meta will pay up to $17 billion and introduce new protections for US teens to settle a landmark child safety case.

Update Chrome before you browse again

Chrome’s latest update fixes 327 security vulnerabilities, including some that malicious websites could exploit as soon as you vis…

Attackers Use Vishing Attacks to Distribute New Android Malware

Attackers are distributing a new Android malware called “WindRelay” via phone-based social engineering attacks, according to resea…

Popular school apps may be sharing student data with advertisers

A Utah investigation found educational apps collecting unauthorized student data and sharing information with third parties and ad…

FTC Announces 2027 Telemarketer Fees to Access the National Do Not Call Registry

The Federal Trade Commission today announced new fees for telemarketers to access phone numbers on the National Do Not Call (DNC)…

Beware of fake Indeed interview apps used to install spyware

Scammers are posing as employers on Indeed to trick job seekers into installing fake Android interview apps that deliver malware.

Report: Phishing Remains the Primary Initial Access Vector

Phishing is still the top initial access vector, accounting for more than half of cyberattacks observed during Q2 2026, according…

CyberheistNews Vol 16 #34 Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026

Encrypted instructions can fool AI assistants like Grok and Gemini

Researchers found that prompt injection attacks can hide malicious instructions in encrypted text to get them past AI guardrails.

GTA 6 leak hunt could expose data belonging to thousands of Discord users

Take-Two is demanding IP addresses, phone numbers, device IDs, and other data as it tries to identify whoever leaked GTA 6 footage…

TikTok phishing: How to spot fake login and verification pages

Scammers use fake TikTok login pages, warnings, and verification offers to trick you into handing over your account details.

Report: AI Chatbots Are More Effective at Building Trust Than Human Scammers

A study has found that AI chatbots can be more effective at social engineering than human scammers, WIRED reports. The researchers…