Phishing

A caller claiming to be from the National Processing Center called the user and their mother, stating their names and county, and mentioned a 'servicer processer delivery' scheduled for Monday. The user questions if this is a phishing scam, as the number provided no results when searched.

A suspicious job offer involves a developer requesting help with client communication and project planning, offering high weekly compensation. The scammer claims to handle account setup on freelance platforms and development work, with the victim attending meetings and receiving 15% of project revenue. Concerns focus on phishing or more elaborate schemes.

Attackers are exploiting AI-generated fake domains by purchasing them and hosting phishing pages or malware, a tactic named 'phantom squatting' by Palo Alto Networks' Unit 42. The practice leverages domains hallucinated by large language models to direct traffic to malicious sites.

Scammers are targeting individuals with Japanese phone numbers via WhatsApp, sending phishing messages that mimic Facebook communications. The scammer's access to the victim's phone number suggests a potential data leak on WhatsApp, as they use business accounts to appear legitimate.

An Australian user on Vinted received a suspicious purchase confirmation email from a buyer, directing them to a non-Vinted website (Vinted.rethreadco.com) to enter card details. The user is concerned as the transaction isn't reflected in the app, the purchaser's name doesn't match the email, and they question if this is a scam.

A user received a suspicious Discord friend request from the Wuthering Waves Official Discord, leading to a voice call with a person claiming to be German but speaking Turkish with unnatural vocal glitches. The individual requested feedback on a Minecraft server link with a newly registered domain (May 5, 2026) and defensively dismissed concerns about its legitimacy.

A Reddit user received a direct message alleging a phishing attack and was instructed to contact Reddit's legal department on Discord. The user shared a screenshot of an email with a Reddit letterhead and later questioned if the situation was a scam after following the instructions.

A phishing email with a malicious JavaScript file disguised as a PDF installs a Chrome extension that steals session cookies and uses Chrome Native Messaging to execute PowerShell commands. The malware bypasses multi-factor authentication by hijacking active browser sessions and collects data like open tabs and system files.

A user's main Google account is being spammed with 4-5 phishing emails per minute, including auto-responses and references to 'rediffmailpro.com'. The user is seeking solutions to stop the spam and understand its purpose.

Fake subscription renewal notices impersonating Malwarebytes and other companies are being used in phishing and tech support fraud scams. These emails often include fabricated details, high charges, and fake contact information to trick recipients into divulging personal or financial information.

A user received a phishing email appearing to be from their state's DMV, containing a malicious link and an attached renewal registration PDF with their personal and vehicle information. The registration was not due for three months, raising concerns about the public availability of such data.

A user receives frequent phishing emails claiming their Cloud+ subscription payment failed, risking data deletion. They report marking emails as spam and blocking senders, but the messages persist with varying sender addresses.

INTERPOL has reported a 'dramatic increase' in cybercrime across Asia and the South Pacific, driven by digitalization, internet expansion, new technologies, organized criminal networks, and uneven cybersecurity readiness. Phishing is highlighted as the most widespread threat in the region.

A user in Australia received multiple scam calls after entering their phone number on Compare The Market, a website for comparing insurance and utility providers. They noticed discrepancies in search results, including a sponsored listing with a 'TM' symbol and a non-sponsored site with a blue icon. A follow-up email included a valid Australian Company Number registered to Compare The Market.

A user on Discord was contacted by an individual claiming to have added the wrong person, leading to a conversation where they were encouraged to download a mobile Jurassic Park game. The user suspects the game link sent by the individual may be part of a scam, questioning whether it was phishing and why the Jurassic Park game was targeted.

Cybercrime accounts for over 30% of all offenses in the Asia and South Pacific region, driven by digital infrastructure growth and organized criminal networks. Phishing, AI-enhanced scams, and deepfake technologies are key tactics, with scam centers in countries like Cambodia and the Philippines generating billions annually.

The article discusses how attackers bypass weak authentication using phishing, MFA fatigue, and service desk social engineering. Specops Software outlines five best practices to enhance identity verification and access security.

The article outlines 20 essential cybersecurity concepts, including phishing and zero-trust architecture, to help individuals protect their data and recognize online threats.

The article warns about scam invitations during events like weddings, which mimic platforms like Evite and Paperless Post to steal login credentials. The FTC advises checking sender emails, links, and avoiding entering credentials on such invitations. Victims should change passwords and enable two-factor authentication if compromised.

The 2026 Verizon DBIR report highlights that phishing, shadow AI, malicious browser extensions, and credential theft are increasingly occurring within web browsers, underscoring significant security vulnerabilities at the browser layer.

Cybersecurity threats to the 2026 midterm elections are targeting campaign systems such as email accounts, websites, and fundraising platforms rather than voting machines. Attackers are using AI to enhance phishing and password theft, with 82% of malicious attacks arriving via email and over 16,000 stolen passwords reported from ActBlue and WinRed. New election-related websites are being registered for phishing scams, and AI-generated misinformation is a growing concern.

Hackers and foreign influence operators are increasingly using misinformation campaigns to confuse voters rather than tampering with voting systems in the 2026 midterm elections, according to a Check Point Software report. The report highlights phishing, impersonation, and misinformation as primary tactics.

The Federal Trade Commission warned Americans about phishing emails that falsely claim to invite recipients to events. These scams aim to deceive individuals through unexpected party invitations sent via email.

An open source project was used for phishing activities. The article is hosted at andrej.sh and has a Hacker News thread with 30 points and 5 comments.

Dutch police dismantled a botnet comprising at least 17 million infected devices, seizing servers in the Netherlands after a tip from the NCSC-NL. The botnet, used for phishing, DDoS attacks, and fraud, targeted poorly secured consumer devices like routers and IoT hardware. Authorities also highlighted rising threats from residential proxy networks used for malicious purposes.

Cybercriminals are exploiting the popularity of Grand Theft Auto 6 by distributing phishing traps and malware, according to a warning from NordVPN. The threat actors are using the game's hype to lure victims into malicious schemes.

A sophisticated inheritance scam email is circulating that impersonates legitimate financial notices to trick recipients into clicking malicious links and surrendering personal data. The scam uses emotional triggers like urgency and the promise of unclaimed funds to bypass critical thinking, while appearing professional with proper formatting and official-sounding language.

The article examines modern crypto drainers that deceive users into approving malicious transactions rather than directly hacking wallets. It specifically analyzes the Lucifer DaaS platform, which automates wallet theft through phishing techniques and scaled attacks. The piece aims to educate readers on identifying and avoiding these threats.

Gmail users are being warned about sinister invites that can drain their bank accounts. The invites appear to be legitimate but are actually phishing scams. Users are advised to be cautious when clicking on links or providing personal information.

Gmail users are being warned about a phishing scam that steals bank details through 'friend' invites. The scam tricks users into clicking on malicious links, compromising their sensitive information. Users are advised to be cautious and not click on suspicious links.

Phishing emails can pass through security and expose businesses to risk, early detection helps teams move from uncertainty to evidence faster. Phishing attacks leave teams unsure what was exposed and how far the risk has spread. Early phishing detection is crucial to reduce business disruption.

Signal has introduced new security measures to protect against phishing and social engineering attacks. These measures include in-app confirmations and warning messages. The goal is to prevent various forms of fraud.

A Vietnamese-linked cyber operation, codenamed AccountDumpling by Guardio, used Google AppSheet as a phishing relay to steal approximately 30,000 Facebook accounts, which were then sold through an illicit storefront.

KnowBe4 reports that 86% of phishing campaigns it tracked use AI, highlighting a significant shift in cyber threats. AI-enabled phishing is described as a landscape-changing development, starting with inboxes.

Nearly half of UK businesses were breached last year due to phishing attacks, with employees often falling for fake login pages disguised as IT support emails. The article highlights human error, not AI, as the primary vulnerability.

CISA has issued a warning about a data-theft vulnerability in GrassMarlin, an operational technology (OT) networking tool developed by the National Security Agency (NSA). The flaw allows attackers to exploit sensitive information if they possess advanced phishing skills.

Cumulative crypto losses have exceeded $17 billion across 518 incidents since 2016, with private key compromises causing $3.6 billion in thefts. 2025 was the worst year with $4.04 billion stolen, and the 2026 Kelp DAO rsETH bridge hack ($290-292M) highlights escalating risks as DeFi grows.

A threat actor named xorcat claimed on a dark Web forum that Polymarket experienced a data breach affecting over 300,000 users. The claims remain unverified, but if true, they highlight vulnerabilities in crypto platforms' data security, authentication processes, and third-party integrations.

A user's Gmail account was hacked, leading to a phishing scam involving Gemini and Ledger Wallet. The scammer convinced the user to transfer cryptocurrency to a SafePal 'vault,' resulting in the loss of all funds and email records.

The UK’s National Cyber Security Centre (NCSC) has announced it will no longer recommend passwords where passkeys are available, citing stronger security and resistance to phishing and breaches. Passkeys, stored on users’ devices, are positioned as a more secure alternative for logging into apps and websites.