Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Sophisticated online fraud techniques are growing more accessible to unskilled attackers, driven by AI tools and fraud-as-a-service platforms, according to Sumsub’s latest Identity Fraud Report. “hile the volume of attacks remains staggering, the nature of fraud is shifting,” the researchers write.

As explored in CYJAX’s recent blog, “PhishinGit – GitHub.io pages abused for malware distribution”, a core feature of GitHub is that it allows users to create and host free static webpages for repositories on github.io. Whilst this service is primarily used to display legitimate projects and host functional webpages, it is known to be used to host malicious files, infrastructure, and content.

This year's EDUCAUSE brought together leaders from IT, security, enrollment, and student services. The theme, “Restoring Trust,” reflects the challenges that higher education institutions and professionals are facing. Fraudsters are using new tools and techniques to target faculty and students. Whether they’re trying to gain access to sensitive information or steal student aid, the potential danger is real.

Account takeover is usually and unsurprisingly approached as a security incident, yet much of the customer impact begins earlier in the journey, long before security teams detect or analyse the event. When users face friction, lockouts, or unexpected changes to their accounts, trust starts to erode. This makes the account takeover impact on customer experience a major determinant of brand trust and loyalty.

Users should be particularly wary of holiday-themed scams over the next few weeks, according to researchers at Malwarebytes. “Mobile-first shopping has become second nature, and during the holidays, it’s faster and more frantic than ever,” Malwarebytes says. “Fifty-five percent of people get a scam text message weekly, while 27% are targeted daily. Downloading new apps, checking delivery updates, or tapping limited-time offers all feel routine.

The retail sector approaches the 2025 peak holiday season facing a perfect storm. We are no longer contending with opportunistic human fraudsters or rudimentary scripts. We face a tidal wave of autonomous, generative AI-powered agents capable of mimicking human behavior. According to Ran Arad, a subject matter expert at Memcyco, we must view phishing, digital impersonation, and account takeover (ATO) as an interrelated lifecycle. Usually, a phishing attack provides the link to an impersonating site.