CyberheistNews Vol 15 #44 | November 4th, 2025
[Mystery] Tough One: Is It or Is It Not an HP Scam?
By Roger Grimes
These days it can be hard to tell if something is or isn't a scam. Take this email I recently received. It claims to be from HP. It included a PDF file attachment.
It would be great if it actually told me the product it was referring to beyond some obscure serial number. I checked the serial number. It didn't match my HP printer sitting next to my desk. All my laptops and older desktop computers are Dell. I didn't like how it didn't have my full name. Just Roger. No product name.
The email tells me how to respond. It says to call a phone number (that's a little phishy-looking). We call these types of phishing emails "callback" phishing. The phone number was 1-800-407-6210.
I call it. An automated operator answers, identifying itself as some generic "consumer care registration line." It doesn't mention HP. I wasn't asked to register anything. I was being asked to renew a warranty.
It's very common for "callback" scams to be linked to phone numbers that, when called, are "official-sounding" but at the same time generic. That's because the fraudulent call centers are usually answering calls from potential victims involved in hundreds of different branding schemes.
The call center doesn't know what scam the victim has been sent, so they answer generically and ask the potential victim what they are calling about. The victim then usually tells them the brand item they are calling about, and the call center starts using the scam script for that brand.
I look up the phone number online and find a lot of sites saying the number is fraudulent.
[CONTINUED] at this blog post with screenshots and links:
https://blog.knowbe4.com/is-it-or-is-it-not-an-hp-scam
[Live Demo] Ridiculously Easy AI-Powered Security Awareness Training and Phishing
Phishing and social engineering remain the #1 cyber threat to your organization, with 68% of data breaches caused by human error. Your security team needs an easy way to deliver personalized training—this is precisely what our AI Defense Agents provide.
Join us for a demo showcasing KnowBe4's leading-edge approach to human risk management with agentic AI that delivers personalized, relevant and adaptive security awareness training with minimal admin effort.
See how easy it is to train and phish your users with KnowBe4's HRM+ platform:
- SmartRisk Agent™ - Generate actionable data and metrics to help you lower your organization's human risk score
- Template Generator Agent - Create convincing phishing simulations, including Callback Phishing, that mimic real threats. The Recommended Landing Pages Agent then suggests appropriate landing pages based on AI-generated templates
- Automated Training Agent - Automatically identify high-risk users and assign personalized training
- Knowledge Refresher Agent and Policy Quizzes Agent - Reinforce your security program and organizational policies.
- Enhanced Executive Reports - Track user activities, visualize trends, download widgets, and improve searching/sorting to provide deeper insights and streamline collaboration
See how these powerful AI-driven features work together to dramatically reduce your organization's risk while saving your team valuable time.
Date/Time: Wednesday, November 12 @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/kmsat-demo-2?partnerref=CHN2
When a "Contact Us" Form Becomes "Contact a Cybercriminal"
Cybercriminals want their payday. Unfortunately for the targets of phishing (and the organizations they work for) that means they're constantly refining their tactics to create more sophisticated attacks that are harder to detect, by both email security products and people.
Impersonation attacks enable cybercriminals to leverage the trusted relationships and, often, authority of people and brands that the recipient knows and trusts.
Business email compromise, for example, is one of the most effective methods for leveling up a phishing attack. Here, cybercriminals use a compromised legitimate email account to send phishing emails to contacts that are both unaffiliated with the sending address (e.g. contact lists they've obtained online) or, more effectively, to known contacts within the supply chain. The use of compromised accounts to send phishing emails enables them to:
Pass email authentication, such as DMARC: Authentication checks are a key mechanism that native security and secure email gateways (SEGs) rely on to detect malicious emails. Phishing attacks sent from legitimate domains will "trick" the authentication mechanisms into considering them safe.
Remove key signs of phishing: As the display name and email address will match, people can't rely on looking for a mismatch to uncover an impersonation attack. Additionally, the email address will follow typical business format (e.g. first name '.' surname) and come from an organization's correct domain, again removing signs of an attack, such as unusually long email addresses and lookalike domains.
Socially engineer the target: Where there isn't a pre-existing relationship with the sending address, people may still be taken in by a well-constructed attack, believing this contact is establishing a new interaction. This ramps up considerably with a pre-existing relationship as, previously, the target has had no reason not to trust the sender's address.
Read on for more detail and an example of how these attacks play out.
[CONTINUED] at this blog post with links:
https://blog.knowbe4.com/when-a-contact-us-form-becomes-contact-a-cybercriminal
Last Chance to Register for the Human Risk Summit
This is it, your last chance to join us for the Human Risk Summit on November 6 at 10 AM ET. If you're ready to transform how your organization tackles human risk, this event is for you!
In just half a day, you'll hear from investigative journalist Geoff White, connect with IT leaders who've built strong security culture and get an exclusive look at 2026 phishing trends. Plus, hands-on workshops and a sneak peek at what's coming on the human risk management roadmap. All designed to give you strategies you can implement immediately.
Register now:
https://gateway.on24.com/wcc/eh/1815783/human-risk-management-summit?partnerref=CHNLC
Report: Organizations Are Struggling to Keep Up With AI-Powered Attacks
Seventy-six percent of organizations are struggling to keep up with the sophistication of AI powered attacks, according to CrowdStrike's latest State of Ransomware Survey.
"Most organizations (87%) consider AI-generated social engineering tactics more convincing than traditional methods," the report says.
"The sophistication of these attacks creates new challenges for human detection, as AI can craft contextually appropriate messages that exploit specific organizational or individual security gaps. The threat extends beyond current capabilities: 87% of organizations expect deepfakes to become major attack vectors in future ransomware campaigns, with healthcare organizations (89%) and C-level executives (90%) expressing the greatest concern."
Additionally, the report found that many organizations are overconfident in their ability to defend against ransomware attacks.
"Of the organizations surveyed, 78% reported experiencing a ransomware attack within the past year," CrowdStrike says.
"Of those, half believed they were 'very well prepared' for ransomware, but fewer than a quarter recovered from an attack within 24 hours. Nearly 25% suffered significant disruption or data loss. This is the confidence illusion: Organizations overestimate their ransomware preparedness as adversaries become more sophisticated in their use of AI-powered tactics.
"The threat landscape changes so rapidly that it's easy for an organization to underestimate the sophistication of these modern attacks or misjudge its ability to recover." The researchers observed a similar phenomenon related to orgs' confidence in their employees' ability to spot phishing emails.
"Phishing was cited by 45% of victims as the initial point of compromise, making it the leading access vector for ransomware," the researchers write. "Despite 92% of organizations believing their employees are well trained to spot phishing emails, many incidents began when staff members clicked malicious links or opened infected files."
AI-powered security awareness training gives your organization an essential layer of defense against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 orgs worldwide trust the KnowBe4 HRM+ platform to strengthen their security culture and reduce human risk.
Blog post with links:
https://blog.knowbe4.com/report-organizations-are-struggling-to-keep-up-with-ai-powered-attacks
Big News: Cybersecurity tips on TikTok, Instagram, and YouTube Shorts!
Everyone deserves cybersecurity knowledge that's quick, clear and easy to apply. That's why we've launched bite-sized content on TikTok, Instagram and YouTube Shorts.
Why this matters to you:
Get quick, actionable cybersecurity tips you can actually use, whether you're protecting yourself at work, keeping your family safe online, or helping friends avoid costly scams.
What you'll learn:
- How to spot romance scams
- What to do when your password gets compromised
- How hackers deepfake voices to target your loved ones
- Why that "unpaid toll" text is probably a trap
- And much more practical security tips and best practices
The best part? Each tip takes less than 60 seconds to watch and is designed for everyone, from tech-savvy professionals to your parents who "just want their phone to work."
Follow us for security knowledge that actually sticks:
TikTok
@KnowBe4Inc
Instagram
@KnowBe4Inc
YouTube
@KnowBe4
REMEMBER: For in-depth cybersecurity trends and industry news, subscribe to the KnowBe4 blog at https://blog.knowbe4.com/
Let's stay safe out there.
Warm regards,
Stu Sjouwerman, SACP
Executive Chairman
KnowBe4, Inc.
PS: KnowBe4 Research Reveals Personalized Phishing Emails Using the Company Name Dominate:
https://apnews.com/press-release/pr-newswire/knowbe4-uncovers-surged-abuse-of-legitimate-platforms-by-cybercriminals-in-2025-8be560bf9520c89ec280f056a97bf66d
PPS: Did You Know? The KnowBe4 Student Edition has officially passed 1 million students!:
https://blog.knowbe4.com/introducing-knowbe4-student-edition-ksat
- Lucius Annaeus Seneca - Roman Statesman (5 BC to 65 AD)
- Sri Nisargadatta Maharaj - Indian Guru (1897-1981)
You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-15-44-mystery-tough-one-is-it-or-is-it-not-an-hp-scam
Only Half of Irish Workers Are Confident in Spotting Phishing Attacks
A new survey from Accenture warns that only 52% of Irish office workers are confident in their ability to identify phishing attacks, Irish Tech News reports. The survey also found that 10% of Irish workers have never received cybersecurity training, while 87% have received suspicious messages at work.
Additionally, 36% of respondents said they have received an email or text message impersonating a coworker. 46% of workers said they wouldn't know what to do if they encountered a phishing attack.
AI-driven phishing emails are the top concern for most Irish office workers, with 47% of respondents citing these attacks as their primary cyber-related worry. Additionally, 32% are concerned about deepfakes of their own likeness, and 31% are worried about deepfake videos impersonating company executives.
Jacky Fox, Senior Managing Director at Accenture Cybersecurity, commented, "These findings highlight the evolving nature of cyber threats in the age of AI and the urgent need for businesses to address gaps in training, tools, and reporting culture.
"While 52% of employees feel confident spotting phishing attempts, it only takes one person to be deceived for an attack to succeed, and human error remains the leading cause of breaches."
Fox also noted: "Our research also reveals a lack of clarity on responsibility, with employees split between whether cybersecurity is their job or IT's. This mindset treats security as a technical issue rather than a core part of business resilience, leaving organizations exposed when attacks disrupt operations, reputation, and trust.
"With AI-driven phishing and deepfake threats on the rise, businesses must prioritize training and foster a culture of shared accountability to stay protected."
KnowBe4 empowers your workforce to make smarter security decisions every day.
Irish Tech News has the story:
https://irishtechnews.ie/accenture-research-finds-only-half-of-irish-office-workers-are-confident-in-their-ability-to-identify-phishing-attacks/
New Study Warns of AI-Driven Extortion Attacks
A study from Malwarebytes has found that one in three mobile users has been targeted by an extortion scam, and one in five of these users has fallen victim. Additionally, one in six users has been targeted by sextortion, with a higher number of these attacks (38%) affecting Gen Z users.
"These personalized, high-pressure threats make extortion victims especially vulnerable, and while victims of all mobile scams suffer serious emotional, financial and functional fallout at the hands of their scammers, extortion victims experience outsized impact," Malwarebytes says.
Notably, AI has drastically improved the sophistication of these scams, particularly involving deepfakes in sextortion attacks.
"For victims of AI-driven scams, the fallout is even more extreme: 32% suffered reputation damage (vs. 21% for extortion victims overall), 29% suffered work/school consequences (vs. 11%), 24% had their personal information stolen (vs. 14%), and 21% had financial accounts opened in their name (vs. 13%), underscoring the threat of these evolving scams," the researchers write.
Shahak Shalev, Malwarebytes's Global Head of Scam and AI Research, stated, "AI has poured gasoline on extortion scams, making it easier than ever to target people with real or manipulated images or videos paired with real information about them from the dark web.
Shalev continued: "These ruthless scams weaponize shame, exploiting our deepest fears to force quick decisions and fast payouts. I want to remove the shame associated with scams and instead encourage people to share their stories to help educate others. If we can remove the stigma and silence around scams, I think we can help everyone take a step back and pause before acting on one of these threats."
Malwarebytes has the story:
https://www.prnewswire.com/news-releases/new-malwarebytes-research-reveals-that-one-in-six-mobile-users-targeted-by-sextortion-scams-302580370.html
What KnowBe4 Customers Say
"Hi Bryan, after some rework based on our environment, yes, very happy with KnowBe4. Also wanted to add that the support team have been fantastic as well, getting us up and running and guiding us through the many reworks as we fit KnowBe4 into our multiple business domains. I appreciate you checking in."
- V.J., IT Security Manager
"The experience is great. Setup was easy. The phishing system is way more flexible and effective than the Proofpoint one I was using before. Similarly, the training is head and shoulders above the training I using with Proofpoint. User feedback to “The Inside Man” is overwhelmingly positive. Some comment about the improbability of the scenario, but that just gives me an opportunity to explain how the tactics from the videos are applicable to their job. Oh, and the interface is better."
- S.S., Lead IT Security Architect
- New CoPhish attack steals OAuth tokens via Copilot Studio agents:
https://www.bleepingcomputer.com/news/security/new-cophish-attack-steals-oauth-tokens-via-copilot-studio-agents/ - Counter Ransomware Initiative stresses importance of supply-chain security:
https://therecord.media/counter-ransomware-initiative-software-supply-chain-guidance - Google disputes false claims of massive Gmail data breach:
https://www.bleepingcomputer.com/news/security/google-disputes-false-claims-of-massive-gmail-data-breach/ - U.S. declines to join more than 70 countries in signing UN cybercrime treaty:
https://therecord.media/us-declines-signing-cybercrime-treaty - No one pays ransomware demands anymore - so attackers have a new goal:
https://www.zdnet.com/article/no-one-pays-ransomware-demands-anymore-so-attackers-have-a-new-goal/ - CISOs Finally Get a Seat at the Board's Table — But There's a Catch:
https://www.darkreading.com/cybersecurity-operations/cisos-finally-get-seat-board-table - Your photo could be all AI needs to clone your voice:
https://www.helpnetsecurity.com/2025/10/30/face-to-voice-deepfakes-voice-authentication-risk/ - LinkedIn phishing targets finance execs with fake board invites:
https://www.bleepingcomputer.com/news/security/linkedin-phishing-targets-finance-execs-with-fake-board-invites/ - Canada Says Hackers Tampered With ICS at Water Facility, Oil and Gas Firm:
https://www.securityweek.com/canada-says-hackers-tampered-with-ics-at-water-facility-oil-and-gas-firm/ - Microsoft warns of AI-driven attacks targeting Africa:
https://www.darkreading.com/cyberattacks-data-breaches/cybersecurity-firms-see-surge-in-ai-powered-attacks-across-africa
- Virtual Vaca #1 Top 10 Places To Visit in Hungary - Travel Guide:
https://youtu.be/dMODHV5Naeo - Virtual Vaca #2 - Old City of Albi, France [Amazing Places 4K]
https://youtu.be/-IXJo6v2tXw - Virtual Vaca #3 To The Past - What Did Ancient Rome Look Like? (Cinematic Animation):
https://youtu.be/5XxA4CX_Ip8?si=3Fn-xt16v-iMqEJD - [SUPER MAGIC FAVE] World Champion magician Laurent Piron delivers a captivating Fool Us act:
https://www.flixxy.com/laurent-pirons-fism-grand-prix-winning-paper-ball-magic.htm?utm_score=4 - Flying Our Wingsuits Through a Narrow Canyon:
https://www.youtube.com/watch?v=1LicIDXQ5No - Need some space? Dolby Vision 4K HDR Ultra HD 2025:
https://youtu.be/Uz9LwJVtyek - This Convertible 4x4 has 700HP! The Apocalypse Speedster Cheetah:
https://youtu.be/WbsarYLEQQE - Experience Claude Monet's timeless impressionist masterpieces transformed by AI.
https://www.flixxy.com/step-inside-monets-garden-an-ai-animated-impressionist-dreamscape.htm?utm_score=4 - LockPickingLawyer: Easilok's Keypad Lock Is… way too easy:
https://youtu.be/3lS5_6D4q9k - For Da Kids #1 - Shy Horse Walks Off The Trailer And Finds the Best Life:
https://youtu.be/CatxDrv6vVg - For Da Kids #2 - Brave rescuer risks it all to save sloth from live wires:
https://youtu.be/zmhQgrmj4Mk - For Da Kids #3 - Rescue duck returns home with new boyfriend:
https://youtu.be/eqIhEX3JP8s - For Da Kids #4 - Black Cat Decides Not To Be A Stray One Day:
https://youtu.be/FcZq4XvgEGc - For Da Kids #5 - Boat crew pulls a turtle from the sea and saves her life:
https://youtu.be/HEWU3nBg1QU
