Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Fraudsters are exploiting the increased public interest in prediction markets such as PolyMarket and Kalshi, according to researchers at Recorded Future. Criminal groups known as “traffers” are providing fellow crooks with “websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance” to target users of prediction markets.

A new report from TransUnion has found that 81% of digital fraud attacks target existing customer relationships, with more than half of U.S. businesses reporting increased scam and fraud activity over the past year.

People say they can spot AI writing a mile off. The em dashes. The word “delve.” The LinkedIn posts that begin with “I’ve been thinking a lot about leadership” and end without a single thought. I understand the reaction. I’ve read enough of them to develop a thousand-yard stare every time someone says they’re “unlocking” something. But I also don’t believe that all AI uses need to be thrown into the waste bin.

“Is it real?” has become a common question across our digital lives thanks to the rise of AI-generated content. A fair one, with deepfakes and AI-produced imagery flooding nearly every channel we use daily. A skeptical eye is a must, but our most recent Phishing Threat Trends Report reveals why that might not even be enough.

Researchers at Cisco Talos are tracking a significant increase in phishing campaigns that abuse legitimate platforms. Attackers abused more than 25 legitimate services over the past year, including “collaboration, productivity, file-sharing, survey, payment and AI-related platforms.” In two campaigns, attackers used order notifications from Staples and Dell to distribute phishing messages.

During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves. However, many don’t report odd emails, strange pop-ups or the USB stick they found in the car park. This can be due to embarrassment, fear of getting into trouble or not wanting to be the one who cried wolf.

The U.S. FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have issued joint advisories warning of election-themed scams targeting voters and spear phishing attacks targeting election officials.

Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.

Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications. Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.

Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter. After this, the user is taken to a spoofed Facebook or Google login page designed to steal their credentials and intercept their multifactor authentication codes.