Fraud & Scams

Turn Account Takeover Into Real-Time Security Coaching

Account takeover is one of the most common ways organizations get breached and one of the hardest to train users on. Not because u…

PixelSmash flaw turns video files into attack tools

Researchers have found a critical FFmpeg flaw that could let attackers use a malicious video file to compromise vulnerable systems…

Russian Intelligence Services Continue to Target Commercial Messaging Applications

Extortion Gang Sends In-Person Attackers to Exfiltrate Data

An extortion gang tracked as “Silent Ransom Group” is targeting US law firms with voice phishing and in-person social engineering…

Watch out for renewal scams pretending to be Malwarebytes

Scammers are sending fake software renewal notices that claim you've been charged for a subscription. Some even impersonate Malwar…

Attackers aren’t loyal to any collaboration channel

Cloud email security has become pretty good. Not perfect, obviously, because the attack landscape is forever changing. But good en…

“Total access to all your devices.” Sextortion scammers strike again

They say they have videos, malware, and total control of your devices. Here's how to read a sextortion email like a security resea…

Inside the dark web: Stolen identities for 95¢, malware, and scams-for-hire

We spent 48 hours exploring the dark web and found stolen identities, malware, scams, and a thriving cybercrime economy.

CyberheistNews Vol 16 #25 [The AI Tell] How To Expose Machine-Written Phishing Fast

Meta pauses controversial employee-tracking program after security review

Meta has paused its controversial employee-tracking program. Unfortunately, employee privacy wasn't what stopped it.

Social Engineering Attacks Abuse Workplace Collaboration Tools

Threat actors are increasingly abusing workplace collaboration tools like Microsoft Teams to launch social engineering attacks, ac…

New Extortion Brand Uses IT Impersonation to Breach Organizations

A newly surfaced extortion brand called “Pink” is using voice phishing and fake IT support calls to breach organizations, the Regi…

Hackers steal passport and driver’s license data of 3 million Texans

A breach at a Texas Parks and Wildlife Department vendor exposed personal information belonging to more than three million Texans.

GTA 6 early access is nothing but a scam

No matter what a website claims, nobody is selling legitimate GTA 6 early access. And scammers are counting on fans believing othe…

APWG Report: Social Media Phishing is Surging

Phishing scams surged across social media platforms during the first quarter of 2026, according to a new report from the Anti-Phis…

Thousands of D-Link routers under control of AryStinger botnet

Thousands of outdated D-Link routers have been absorbed into the AryStinger botnet, with no future security updates available to p…

Document delivery scams: What are they and what’s their goal?

A seemingly official voicemail turned out to be a scam. Learn how document delivery scams work and what to do if you receive one.

Cybersecurity Awareness Training for AI: Key Focus Areas

As employees increasingly rely on AI tools and AI agents in daily workflows, organizations are facing a new workforce security cha…

A week in security (June 15 – June 21)

A list of topics we covered in the week of June 15 to June 21 of 2026

Nearly 15,000 infected websites cleaned in SocGholish crackdown

Thousands of everyday websites were cleaned as part of a global operation targeting the malware network behind fake browser update…

Americans Lost $900 Million to AI-Powered Scams Last Year

The US Federal Bureau of Investigation (FBI) warns that Americans lost just under $900 million to AI-powered scams in 2025, Malwar…

Apple patches Beats Studio Buds flaw that could turn earbuds into a wiretap

Apple has patched a year-old Bluetooth vulnerability that could have let nearby attackers listen through Beats Studio Buds' microp…

What AI Can’t Hide When It Writes a Phishing Email

Lead Analysts: Jeewan Singh Jalal, Prabhakaran Ravichandhiran, and Shikhar Dalela

Cyber Criminals Redirecting Users to Fraudulent Websites with Malicious Traffic Distribution Systems

Your AI Agents Are Eager to Please And Easy to Exploit

An AI-driven system at a beverage manufacturer recently churned out several hundred thousand excess cans after misreading unfamili…

Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control

Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access o…

Retro gaming fans are the new target for fake GitHub malware

Retro gaming fans should be careful with GitHub projects that claim to be tools or plugins for their consoles. We looked at one ex…

Kodak confirms breach as ShinyHunters’ leak threat reaches deadline

The photography giant confirmed a data breach after ShinyHunters claimed it stole 2.2 million records and threatened to leak them.

Roblox developers are losing entire games to malware attacks

Attackers are using fake job offers and malware to steal accounts, Robux, and Roblox games from the developers who build them.

From 1% to 26%: How AIDA Orchestration Fixes the Remedial Training Gap

As we speak, bad actors are using AI agents to do their dirty work. Our own research tells us 85.8% of phishing attacks were AI…