Fraudsters Turn Open Banking Links Into a Free Stolen-Card Checking Service
Group-IB uncovered a scheme in which criminals abused a spend-management platform's open-banking integration to silently verify stolen card and bank credentials, while the platform unknowingly footed the bill....
Lookalike Microsoft Teams Domain Caught Harvesting Employee Login Credentials
Researchers have flagged a newly registered domain, teams-cloud[.]live, that closely mimics the Microsoft Teams sign-in page and interface to trick employees into handing over their credentials. One subdomain...
17,000-Domain Phishing Network Targets Japanese Banks and Payment Users
A Chinese-language phishing ecosystem used about 17,000 domains and three related kits to impersonate banks, payment services and major consumer brands. Japan was the primary target, while rapid...
Inside Iron Man System: The Phishing-as-a-Service Platform Behind a Billion Fake Emails
Researchers have linked a Chinese-run phishing platform called Iron Man System to roughly one billion phishing emails targeting 75,000 organizations, powered by a library of over 2,300 brand-impersonation...
Fake WatchGuard VPN Download Page Steals Credentials, Then Hands Over the Real Installer
A phishing site impersonating WatchGuard's VPN software portal harvested login credentials through a fake prompt before quietly delivering the genuine, digitally signed installer, a technique designed to leave...
Fake Academic Invites Hide a Live MFA-Bypassing Phishing Kit Targeting Google Accounts
Cisco Talos has detailed a phishing operation, tracked as UAT-11985, that uses real-time WebSocket connections to relay victims' Google logins step by step, letting operators intercept MFA challenges...
Microsoft Teams Adds Post-Delivery Warnings for Malicious QR-Code Links
Microsoft Defender for Office 365 is extending Teams protections to inspect URLs encoded in QR images and warn users when a destination is malicious. The rollout improves post-delivery...
Star Blizzard’s RedFlick Phishing Chain Targets More Than 100 Organizations
A Russia-linked operation is using attachment-free opening messages before sending encrypted archives that deploy the CosmicPulse backdoor. More than 100 organizations, particularly those involved with Ukraine-related policy and...