Fraud & Scams

Why People Remember Jaws But Forget Your Security Training

“You’re gonna need a bigger boat.”

Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026

Researchers at Microsoft warn that phishing emails are still the top initial access vector, with more than 2 billion phishing thre…

Apple fixes another image-processing flaw that could allow code execution

Apple has released updates fixing 27 vulnerabilities in iOS, iPadOS, and macOS Tahoe, including a potentially serious image-proces…

CyberheistNews Vol 16 #33 [Blind Spot] Employees Are Easier to Scam Than They Think

Be careful what you put in “anyone with the link” Google Docs

As one developer found out when his Google Doc containing company passwords showed up in Google search results.

Heights Finance data breach: What customers need to know

Leaked personal and financial data of around 750,000 US citizens, including SSNs and bank details, could put victims at risk of id…

ShieldBreak bypasses Microsoft’s patch for earlier Defender flaw

The researcher who found RoguePlanet has discovered ShieldBreak, a new way to bypass Microsoft’s fix and gain SYSTEM privileges.

Cybersecurity Challenges Facing the EMEA Travel and Tourism Industry

Like many, the travel and tourism industry has undergone a radical digital transformation over the last few years. From AI-curated…

Bill Payment Firm Doxo to Pay $2.1 Million to Settle FTC Allegations It Deceived Consumers and Charged Them Add-On Fees

Online bill payment firm Doxo will pay $2.1 million to settle Federal Trade Commission allegations that the company and two of its…

Fake TikTok rewards promise cash you’ll never get

TikTok-branded rewards pages offer cash for simple tasks and daily check-ins. But getting your hands on the money is another story…

Update your Mac: Screen Sharing vulnerability exploited in the wild

Attackers are exploiting a Mac Screen Sharing vulnerability to gain root access and install Monero cryptominers.

Why Facebook’s war on ad blockers could help scammers

One ad blocker is giving up the fight against Facebook ads. The consequences could go beyond annoying advertising.

A week in security (August 10 – August 16)

A list of topics we covered in the week of August 10 to August 16 of 2026

Warning: Compromised Hotel Routers Send Users to Phishing Sites

Attackers are using compromised hotel Wi-Fi routers to redirect users to Microsoft 365 phishing sites, according to researchers at…

Report: Scams Are Surging as Attackers Abuse Trusted Workflows

Threat actors are increasingly abusing trusted workflows to carry out attacks, according to a new report from Gen Digital.

Unmasking the Invisible: How to Identify AI Tools, Hidden Devices, and Other Unknown Assets on Your Network

You cannot protect what you do not know exists.

Apple now uses iPhone alerts for targets of mercenary spyware

Apple explains how Threat Notifications help protect iPhone users targeted by mercenary spyware.

WhatsApp is testing a new warning for scam messages

An optional new feature uses on-device AI to flag messages that look like scams.

Shadow AI: The New Frontier of Shadow IT

As a CISO advisor, I am observing a familiar pattern gaining a new, critical dimension. What we historically identified as "Shadow…

Warning: Vishing Attacks Open the Door to Ransomware Gangs

An initial access broker for ransomware gangs is targeting organizations with voice phishing (vishing) attacks through Microsoft T…

Iranian APT Launches AI-Assisted Spear Phishing Attacks

The Iran-linked threat actor APT42 is using AI-assisted phishing attacks to target U.S. organizations amidst the Iran-US war, acco…

New Android malware lets criminals use your bank card in real time

Social engineering, a Remote Access Trojan (RAT), and NFC relay malware walk up to an ATM. It's no joke. Together, they can empty…

Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits

It's the biggest legal challenge yet to addictive social media design and its impact on children.

Report: Employees Are Overconfident in Their Ability to Spot Scams

A survey from Trustmi found that most employees believe they’d be able to spot a social engineering attack, but those same employe…

The Talent Pipeline Nobody Talks About: What Young People Told Us About Cybercrime

"Someone online shows them a 'trick' that feels harmless at first. Then the community pulls them in. Everyone's doing it. It feels…

“Zoomsday” flaws could let one Zoom participant attack another

Update Zoom now to protect against critical vulnerabilities that could allow an attacker in the same meeting to run malicious code…

Patch Tuesday: Update now to fix 421 flaws, including three zero-days

Microsoft's August Patch Tuesday fixes 421 vulnerabilities, including three zero-days, 62 critical flaws, and dozens of Office rem…

Why Securing AI Agents Is More Critical Than Ever

AI agents offer unprecedented capabilities, speed, automation, deep context, and hyper-personalization, that will transform how we…

FTC Sends More than $23.8 Million to Drivers and Diners Harmed by Grubhub’s Deceptive Advertising Claims and Other Unlawful Conduct

The Federal Trade Commission is sending payments totaling more than $23.8 million to drivers harmed by Grubhub’s deceptive earning…

Fake CCleaner installs GhostDesk Chrome spyware

A convincing fake CCleaner website delivers a multi-stage malware attack that installs a spyware extension inside Chrome.