Fraud & Scams

StreamRat Android malware spreads through Meta and TikTok ads

Social media ads for a free streaming service exposed roughly 570,000 people to StreamRat, a banking Trojan that can take control…

FTC Extends Public Comment on Proposed Policy Statement Regarding Personalized Pricing

The Federal Trade Commission extended by seven days the public comment period on the proposed enforcement policy statement regardi…

Your phone or computer may soon ask how old you are

California and Colorado will require operating systems to collect users’ ages, but open-source software like Linux may be exempt.

Recruitment-Themed Phishing Campaign Targets Enterprise Users

Researchers at Zimperium are tracking widespread phishing campaigns that use Browser-in-the-Browser (BitB) attacks to trick users…

New Phishing Kit Uses AI to Fully Automate Vishing Attacks

A new phishing kit is using generative AI to fully automate voice phishing (vishing) attacks, according to researchers at Group-IB…

Tech support scams look different now. Here’s what to watch for

Tech support scams have evolved beyond fake virus warnings. Here’s how scammers reach their targets now, and how to stay safe.

Scammers are getting smarter about where they target you

New Malwarebytes research reveals how different scams are tailored to different platforms.

Two critical Chrome flaws put users at risk on malicious websites

Update Chrome now: Two critical vulnerabilities could allow a malicious website to run code on your device.

Hacking the Healers: New KnowBe4 Whitepaper Highlights Record Security Breaches in Healthcare

When an organization has a security breach, it can cause significant financial, reputational and logistical damage. But in healthc…

Dark web site puts 153 million driver’s licenses and millions more IDs up for sale

The FBI is investigating a possible breach of idscan.net linked to 153 million driver’s license scans for sale online.

Your AI chats could be used in court

What you tell an AI chatbot could come back to haunt you in court. The Washington Post found chat histories already used in 12 leg…

Fake GTA 6 leaked copy drains your crypto wallet

A fake GTA 6 leak is using wallet-draining code to steal cryptocurrency, tokens, and NFTs from eager fans.

Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing

CyberheistNews Vol 16 #35 [New Report] Phishing Is Still the No. 1 Initial Threat Access Vector

Warning: Chameleon SEO Poisoning Spreads Phishing Pages

Cloaked SEO poisoning attacks surged by 40% in the second quarter of 2026, according to researchers at Fortra. This tactic, also k…

TerminalFix looks like ClickFix, but delivers a very different payload

The familiar ClickFix fake CAPTCHA trick has been adapted to deliver a payload that can give attackers access to the victim’s wide…

Infostealers are hijacking Claude accounts at users’ expense

Anthropic has warned that infostealers are stealing Claude session cookies to access users’ accounts and consume usage at their ex…

Attackers Abuse Enterprise Collaboration Tools to Avoid Detection

Threat actors’ abuse of enterprise collaboration tools increased fourfold over the past twelve months, according to researchers at…

McKesson confirms cyber incident after ShinyHunters claims patient-data theft

Healthcare company McKesson acknowledged a data breach. ShinyHunters claims to have stolen hundred of millions of records

FTC, States Sue Amazon Over Secret Ad Surcharge Scheme

Today, 22 states joined the Federal Trade Commission in filing suit against Amazon, alleging that the company engaged in deceptive…

Protecting Every Conversation: Introducing KnowBe4 Defend for Google Workspace

Google Workspace powers more than 3 billion active users globally. From agile mid-market firms to global enterprise operations, Gm…

A week in security (August 24 – August 30)

A list of topics we covered in the week of August 24 to August 30 of 2026

Warning: Replying to a “Wrong Number” Text Marks You as a Target for Scams

Attackers are using “wrong-number” texts to identify potential targets for scams, according to researchers at Malwarebytes. The…

The .vu Surge: How Threat Actors Are Exploiting Vanuatu's Domain Extension

Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal

Protect your WhatsApp account with new passkey and 2FA upgrades

WhatsApp has introduced three security upgrades. Here’s what to turn on to better protect your account.

New Phishing Kit Gives Threat Actors Live View Into Attacks

A new phishing platform called “JWR” gives attackers real-time control over social engineering attacks, according to researchers a…

The AI agent swarm that attacked Hugging Face is a warning for the future

An army of AI agents was responsible for the Hugging Face incident. What does it mean for the future of AI?

Voice Phishing Attacks Target Hedge Fund Employees

Google’s Threat Intelligence Group (GTIG) is tracking a voice phishing (vishing) campaign that’s targeting hedge funds and financi…

Flock wants privacy to meet surveillance halfway

Flock’s CEO wants a compromise between privacy and public safety, but the public has already compromised enough.

Fake listings can turn trusted platforms into scam springboards

A trusted name on a trusted platform does not guarantee a trustworthy listing. It could still lead to a tech support scammer.