Fraud & Scams

Warning: Malicious AI Tools Are Spreading in the Criminal Underground

Criminals are now selling malicious AI tools for use in cyberattacks, according to researchers at Trellix. These tools dramaticall…

Fake Apple Pay charge brings the classic tech support scam to your phone

Built for mobile users, this tech support scam uses a fake Apple Pay alert and browser tricks to pressure victims into calling a s…

FTC Finalizes Orders with Cox Media Group, Two Other Firms Settling Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service

The Federal Trade Commission finalized orders requiring Cox Media Group (CMG) and two other firms to pay a total of $930,000 to se…

New Instagram and Facebook rules set a default two-hour limit for teens

Meta will pay up to $17 billion and introduce new protections for US teens to settle a landmark child safety case.

Update Chrome before you browse again

Chrome’s latest update fixes 327 security vulnerabilities, including some that malicious websites could exploit as soon as you vis…

Attackers Use Vishing Attacks to Distribute New Android Malware

Attackers are distributing a new Android malware called “WindRelay” via phone-based social engineering attacks, according to resea…

Popular school apps may be sharing student data with advertisers

A Utah investigation found educational apps collecting unauthorized student data and sharing information with third parties and ad…

FTC Announces 2027 Telemarketer Fees to Access the National Do Not Call Registry

The Federal Trade Commission today announced new fees for telemarketers to access phone numbers on the National Do Not Call (DNC)…

Beware of fake Indeed interview apps used to install spyware

Scammers are posing as employers on Indeed to trick job seekers into installing fake Android interview apps that deliver malware.

Report: Phishing Remains the Primary Initial Access Vector

Phishing is still the top initial access vector, accounting for more than half of cyberattacks observed during Q2 2026, according…

CyberheistNews Vol 16 #34 Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026

Encrypted instructions can fool AI assistants like Grok and Gemini

Researchers found that prompt injection attacks can hide malicious instructions in encrypted text to get them past AI guardrails.

GTA 6 leak hunt could expose data belonging to thousands of Discord users

Take-Two is demanding IP addresses, phone numbers, device IDs, and other data as it tries to identify whoever leaked GTA 6 footage…

TikTok phishing: How to spot fake login and verification pages

Scammers use fake TikTok login pages, warnings, and verification offers to trick you into handing over your account details.

Report: AI Chatbots Are More Effective at Building Trust Than Human Scammers

A study has found that AI chatbots can be more effective at social engineering than human scammers, WIRED reports. The researchers…

Fake GTA 6 Extended Look and demo sites deliver an infostealer

Bogus “Play Now” sites are exploiting the GTA 6 leak hype to spread malware that steals passwords stored in browsers.

Fake Microsoft security scans trick victims into uninstalling their antivirus

We found fake Microsoft-branded scanners that invent security problems, tell victims to uninstall AV, and then steer them into a r…

Your data doesn’t die when you do (Lock and Code S07E17)

This week on the Lock and Code podcast, we speak with Tamara Kneese about the many ways your data remains long after your die.

AliExpress caught using silent audio to fingerprint visitors’ browsers

Silent audio processing on the AliExpress website was found helping to fingerprint visitors’ browsers without relying on cookies.

ToxicPanda 2.0 can take over your Android phone and banking apps

A new version of the Android banking Trojan can seize control of infected phones and block access to Google Play and Google Play S…

Human Error Remains at the Core of AI-Enabled Social Engineering

AI is making social engineering attacks significantly more effective, according to a new report from cyber insurance firm Resilien…

Tracking PavinLoader across ClickFix and fake download campaigns

We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware.

A week in security (August 17 – August 23)

A list of topics we covered in the week of August 17 to August 23 of 2026

Report: Americans Lose an Estimated $148 Billion to Scams Each Year

Americans are now losing an estimated $148 billion each year to online scams, a 22% increase compared to 2024, according to a new…

Zombie Card: An expired Visa credit card can be used for purchases

Scientific research showed that the expiration date on some Visa credit cards can be manipulated in so-called Zombie Card attacks.

Report: Vishing and Device Code Phishing Are Surging

Social engineering remains a central part of modern cyberattacks, according to a new report from CrowdStrike. Attackers are increa…

Medical records, SSNs, and bank details exposed in CareCloud data breach

Healthcare technology provider CareCloud confirmed that 3.75 million people were affected by a March data breach.

Securing the Tip of the Spear: Guam’s Path to Human and AI Resilience

Securing the Tip of the Spear: Guam’s Path to Human and AI Resilience As the Asia-Pacific and Japan (APJ) region continues its…

Report: One-Quarter of Breaches Are Enabled by AI-Driven Attacks

A new report commissioned by IBM has found that one in four breaches is now AI-enabled, up 56% from last year.

The Rise of the 'Non-Human Insider': When AI Agents Become the Threat

For years, cybersecurity has had a familiar villain: the external attacker. The hacker breaking through the firewall, stealing cre…