Tech Industry News

Researchers at Cisco Talos are tracking a significant increase in phishing campaigns that abuse legitimate platforms. Attackers abused more than 25 legitimate services over the past year, including “collaboration, productivity, file-sharing, survey, payment and AI-related platforms.”

In two campaigns, attackers used order notifications from Staples and Dell to distribute phishing messages. The organizations themselves were not compromised, but the threat actors inserted phishing content into the fields that were supposed to contain shipping information.

During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves.

Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.

The U.S. FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have issued joint advisories warning of election-themed scams targeting voters and spear phishing attacks targeting election officials.

Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications.

Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.

Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter.

Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools.