Fraud & Scams

Paidwork breach exposes data of 23 million users: Check if you’re affected

A reported breach at microtask platform Paidwork exposed personal and financial data of more than 23 million users. Here's how to…

Trust Nothing: Tips to Secure AI Tools and Agents

So, you have some AI tools or are thinking about deploying them and want to know a bit about securing them. You are not alone,…

What happens if you visit a WordPress site hacked through wp2shell?

Attackers started exploiting the critical wp2shell vulnerability chain within hours of patches being released, putting sites and t…

CyberheistNews Vol 16 #29 ClickFix Social Engineering is Now the Leading Malware Delivery Method

Beyond the Checkbox: How a Proactive Partnership Led to Turnkey Hazing Compliance

When we formed the global steering committee for our KnowBe4 Student Edition, our primary goal was to simply listen. That listenin…

Student Loan Forgiveness Scammer Permanently Banned from Debt Relief Industry and Telemarketing

Dennise Merdjanian, an operator of a student loan debt forgiveness scheme, will be permanently banned from the debt relief industr…

New ClickLock Stealer locks your Mac until you hand over your password

A new macOS infostealer tricks victims into revealing their system password and installs a persistent backdoor for future access.

Don’t trust that “FBI agent” in your DMs

The FBI is warning that fraudsters are using fake IC3 accounts and direct messages to target people who've already been scammed.

AI nudify apps spark legal scrutiny of Apple and Google’s profits

Instead of fighting over what app stores host, the San Francisco City Attorney is targeting how they make money from AI nudify app…

The Odyssey piracy scams appear within hours of the movie’s release

The release of The Odyssey has already sparked a wave of piracy scams, from fake browser errors to malware masquerading as movie f…

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Extortion groups ShinyHunters and ShadowByt3$ claim they stole vast amounts of patient data. Those allegations have not been verif…

FBI Warns of Scammers Impersonating the IC3

Founders of Celsius Network Ordered to Pay $16.5 Million to Resolve FTC Charges

Alexander Mashinsky, the former CEO of cryptocurrency platform Celsius Network Inc. (Celsius), and his business partners, Shlomi D…

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We look into how attackers are using the legitimate Ren'Py game engine to spread a malware loader that ultimately delivers Amatera…

A week in security (July 13 – July 19)

A list of topics we covered in the week of July 13 to July 19 of 2026

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

One compromised Shark robot vacuum could unlock remote access to many others.

How to use GitHub safely

Knowing how to spot a malicious GitHub repository can help you avoid downloading malware disguised as legitimate software.

The backlash against Flock cameras is spreading

Privacy concerns have dogged Flock's automated license plate recognition system for years. Now accuracy and reliability are coming…

Trust, Verify, Protect: Modernizing Email Security for the Cloud

Picture this: Your company just fell victim to a massive data breach. The culprit wasn't a sophisticated malware strain, a zero-da…

Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom

Several updates have been made available including those for Adobe, Chrome, Firefox, VMWare, and Zoom.

Samsung backs down on threat to delete health data

Samsung threatened to delete users' health data if they refused AI training. After a backlash, it quickly backed down.

Claude for Chrome flaw could let rogue extensions access your Gmail

The ClaudeBleed vulnerability still lets malicious Chrome extensions abuse Claude for Chrome's permissions.

Report: Social Engineering Remains a Central Part of AI-assisted Attacks

Threat actors continue to rely on social engineering as AI is incorporated into their attacks, according to ESET’s Threat Report f…

July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days

Microsoft's July 2026 Patch Tuesday sets yet another record, fixing 622 Microsoft CVEs—three times as many as last month.

FTC Approves Final Order Against TruHeight for Deceptive and Unsubstantiated Advertising of Supplements for Kids and Teens

The Federal Trade Commission finalized an order with Vanilla Chip LLC—which does business as TruHeight—and its two principals requ…

This fake Apple app can unlock your Mac’s password vault

Disguised as Apple's CrashReporter, CrashStealer steals passwords, browser data, crypto wallets, and other sensitive information.

ClickFix Social Engineering is Now the Leading Malware Delivery Method

The ClickFix social engineering technique is now the top malware delivery method, according to a new report from ReliaQuest. These…

CyberheistNews Vol 16 #28 Your 2026 Phishing by Industry Benchmarks: The Findings on Human Risk

Scammers Can Use AI Tools to Pinpoint Your Location Based on a Photo

Scammers can use AI tools to find your location in photos you post to social media, according to researchers at McAfee. This infor…

Warning: Scammers are using FaceTime to empty bank accounts

Cybercriminals are combining social engineering through apps like FaceTime with unpatched devices to steal credentials and drain b…