Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.

Top Tips is a weekly column where we explore practical ways to make technology work better for you. From improving productivity and strengthening digital security to discovering smarter ways to use everyday tools, we share simple, actionable insights to help you navigate the ever-evolving world of technology with confidence. AI is making online scams harder to recognize. From fake government announcements to convincing video calls, fraudsters are using synthetic content to exploit trust.

Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications. Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.

91% of Americans have been targeted by a scam, and 17% have fallen victim to one, according to a new survey by Consumer Reports. Notably, 20% of respondents said the latest scam they encountered was personalized, indicating that attackers are increasingly using automation and public or leaked information to craft targeted phishing attacks.

iGaming fraud detection already spans much of the player journey, from registration and identity verification to login, payments and account activity. But for phishing-driven account takeover (ATO), an important part of the risk can develop before suspicious activity appears inside the operator environment. That distinction matters as operators try to improve fraud detection without adding unnecessary friction.

Researchers at ReliaQuest have observed a surge in voice phishing (vishing) and Microsoft Teams phishing over the past several months, particularly from extortion groups like ShinyHunters. “Attackers overwhelmingly targeted users and their unmanaged devices to gain access to accounts,” the researchers write.

Researchers at Fortra are tracking a new variant of calendar phishing in which threat actors trick employees into sharing meeting links internally. The attackers pose as prospective customers and contact non-sales employees, asking to be directed to a sales representative in order to discuss a business opportunity. The attacker then sends the employee a meeting link to forward to a sales contact. The attack takes place as follows.

As millions of shoppers prepare their wishlists and await discounts for Amazon’s Prime Big Deal Days starting October 6, cybercriminals are gearing up for their own payday. In the weeks leading up to major shopping events, Amazon impersonation campaigns reach an annual peak.