Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Social engineering scams can come through any communications channel (e.g., email, web, social media, SMS, phone call, etc.). They can even come in the mail as the Nextdoor warning below shares. Source: Nextdoor They can even come in person and on the television.

Cybersecurity researchers are ringing the alarm on new phishing campaigns exploiting Cloudflare Workers, HTML smuggling, and generative AI (GenAI) to target user credentials. These innovative techniques highlight the sophisticated strategies cybercriminals are deploying to bypass security measures and harvest sensitive information.

The prevalence of cyber crime continues to soar, victimizing individuals in both their work and private lives. Cybercriminals are indiscriminate, targeting around the clock and across the globe. With digital security advancing, these criminals shift their focus to exploiting human weakness amidst increasingly secure technological environments.

As email compromise attacks increase, analysis of tactics provides context on how organizations need to evolve their defenses.

An increasing number of phishing campaigns from several threat groups are being tracked as they leverage legitimate Cloudflare services as part of account compromise attacks. Security analysts at Netskope take an expository look at the misuse of Cloudflare services for the purpose of enabling phishing attacks that leverage HTML Smuggling and Transparent Phishing tactics. We’ve seen HTML Smuggling attacks for several years, including its continued use this year.

A major botnet operation that controlled an estimated 19 million IP addresses and was responsible for $99 million in illegal gains was shut down this week, and an international law enforcement operation arrested its primary operator. Botnet operations may not be as top of mind as ransomware, but these attacks are still responsible for millions in losses and pose a massive threat to businesses and consumers.

This article investigates why Microsoft 365 is insufficient for email security in today’s digital landscape. Email security is a critical concern for businesses of all sizes. While Microsoft 365 offers a comprehensive suite of tools for productivity and collaboration, relying solely on it for email security might not be sufficient. Here’s why.

Security awareness training (SAT) and simulated phishing works to significantly reduce cybersecurity risk. We have the data, customer testimonials and government recommendations to prove it. Social engineering, especially as enabled by email, text messages, the web and phone calls, is involved in the vast majority of cybersecurity attacks. No other root initial access hacking method comes close.

The Evolution of Email Threats Email has long been a favored vector for cyber attacks. From the early days of simple phishing scams to the more advanced spear-phishing campaigns, email threats have consistently evolved. However, the integration of AI has brought about a paradigm shift in both the complexity and frequency of these attacks. AI-Powered Phishing Phishing attacks have traditionally relied on mass-distribution strategies, hoping to catch a small percentage of victims.

The China-aligned threat actor “Sharp Dragon” is launching spear phishing attacks against government entities in African and Caribbean countries, according to researchers at Check Point. “In recent months, we have observed a significant shift in Sharp Dragon’s activities and lures, now targeting governmental organizations in Africa and the Caribbean,” the researchers write.