Fraud & Scams

FBI agents’ blood tests and doctors’ notes surface after breach

A “shellfish and banana allergy” is among the details in medical records hackers showed reporters. They claim to hold records on t…

A week in security (September 21 – September 27)

A list of topics we covered in the week of September 21 to September 27 of 2026

What Microsoft’s Latest Email Benchmark Proves About Defense-in-Depth

Let’s face it: inertia is often the most common yet most dangerous adversary when it comes to acquiring new technology, especially…

Warning: New Phishing Kit Targets Sales Teams

Threat actors are using a new phishing kit called “GhostCode” to target sales teams with phony business inquiries, according to re…

LinkedIn adds new checks for fake profiles and work histories

The platform is adding new checks as AI makes profiles easier to forge. But scammers can still invent a company to recruit for.

Kothamine malware uses Tailscale’s tailcat to evade network detection

Kothamine uses a legitimate Tailscale tool to receive attackers’ commands through an encrypted connection with no malicious domain…

Criminals turn placeholder domain into ClickFix trap

A domain used in software examples—third-party[.]com—now serves up a fake verification page that tells Windows users to run a Powe…

That shipping rebate offer may come with a monthly charge

Customers say they signed up for shipping rebates, then found recurring charges they didn’t expect.

AI-Generated Phishing Pages Are Impersonating Antivirus Services

Scammers are using AI to generate phishing pages that impersonate antivirus products, according to Malwarebytes.

Sophisticated Phishing Operation Continues to Thrive Following FBI Takedown

China-based cybercriminals are using a sophisticated phishing-as-a-service platform called the “Outsider Phishing Kit” to launch m…

OpenAI agent breached Australian government site, took months to report it

The agent was looking for public spending data. It found a way into non-public files instead. What do we need to change to stop th…

New Browser Guard features add protection before and after you click

Spot dangerous sites before you click—and check for scams once you’re there.

FTC Seeks Public Comment on Whether to Update Rule on Impersonation of Government and Businesses to Address Platforms’ Role in Promoting Impersonation Scams

The Federal Trade Commission announced today that is considering whether to update its Rule on Impersonation of Government and Bus…

Update Chrome: 108 security fixes for desktop, new release for Android

Google has released Chrome 154 for desktop and begun rolling out Chrome 155 for Android. Here’s what to check on your device.

Google’s location data privacy failures draw a €403 million fine

Turning off Location History did not necessarily stop Google from recording where users went. Ireland’s privacy regulator has now…

How device code phishing gives scammers access to your account

A scammer asks you to enter a code to open a file or join a meeting. Approving it could sign them in to your account instead.

Are Your AI Assistants the Next Attack Surface?

Lead Analysts: Shikhar Dalela, Maddhav Grandy and Jeewan Singh Jalal

Fake Claude Max giveaway hides a Google account phishing trap

A convincing offer of a free Claude Max subscription uses a fake browser window to steal Google login information.

ShinyHunters claims FBI breach was revenge for “false” report

The extortion group says it stole sensitive data on FBI agents and job applicants, and wants the bureau to retract a warning about…

Some cheap smart glasses are a security disaster

Tests found that some cheap smart glasses can be hijacked over Bluetooth, exposing their owners’ photos, videos, and personal data…

CyberheistNews Vol 16 #38 Attackers Use Passkey-Themed Phishing to Breach Cloud Environments

AI-Assisted Phishing Campaign Sent Over A Million Personalized Emails

Researchers at Microsoft are tracking an AI-assisted phishing campaign that sent over a million emails attempting to conduct payme…

Quantum Readiness Day: How to Prepare for Post-Quantum Security

Quantum Readiness Day on September 24 is a useful reminder that the security work we do today is not only about preventing breache…

Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor

A simple terminal command can hijack Muse and use its extensive permissions to spy on Mac users and control their connected accoun…

Researchers used Claude to hack OpenAI

Claude helped researchers break into OpenAI in under 72 hours, and exposed how quickly AI is lowering the bar for sophisticated ha…

Millions of Phishing Emails Use ASCII Smuggling to Bypass Security Filters

A massive phishing campaign is using invisible Unicode tag characters to evade security filters, according to researchers at Micro…

The AI plot to scan and destroy books (Lock and Code S07E19)

This week on the Lock and Code podcast, we speak with Emanuel Maiberg about Amazon's effort to scan and destroy rare books for AI…

The fake sites using a cheap toolkit to sell $2,000 AI subscriptions

More than 100 linked sites use a $249 toolkit to turn copied product names and unfamiliar AI brands into paid subscriptions.

Gemini’s breach of real companies exposes an AI guardrail problem

Gemini crossed the boundaries of a capture-the-flag test and accessed systems belonging to three real companies.

ShinyHunters hacks rival extortion gang and takes over its dark web site

Hackers hacked the hackers as a feud between two cybercrime groups escalated, leaving ShinyHunters with the upper hand over rival…