CyberheistNews Vol 16 #41 | October 13th, 2026
[Heads Up] Attackers Trick Your Employees to Share Fake Calendar Invites
Researchers at Fortra are tracking a new variant of calendar phishing in which threat actors trick employees into sharing meeting links internally.
The attackers pose as prospective customers and contact non-sales employees, asking to be directed to a sales representative in order to discuss a business opportunity. The attacker then sends the employee a meeting link to forward to a sales contact.
The attack takes place as follows:
- Prospect pretext. An external sender claims they want to buy and contacts a non-sales employee for the right point of contact.
- Helpful response. The employee engages, asks for availability, and confirms that they can route the request.
- Internal handoff. The sender provides a meeting-booking link and asks for it to be forwarded to sales.
- Trusted delivery. A sales representative receives the email containing a "book a meeting" button embedded with a link, forwarded from a known colleague. The forward changes the recipient's risk calculation.
- Calendar pivot. The booking page asks the user to choose a date and time, then introduces a Microsoft 365 work-or-school sign-in prompt, framed as necessary to complete or sync the booking.
In this last step, the sales employee is asked to enter their Microsoft 365 credentials, which is the end goal of the attack. The researchers note that this lengthy and indirect attack chain increases the effectiveness of the social engineering tactics.
The employee who receives the link is unlikely to click it, since the meeting isn't meant for them, and the sales employee is more likely to trust the link since it was forwarded by a known coworker.
"What makes this effective is not a clever email alone," Fortra says. "It is the trust chain: external sender, helpful employee, internal forward, sales recipient, booking page, sign-in prompt. Every step is individually familiar, so the full chain does not feel like a phishing chain."
More at the KnowBe4 Blog with links:
https://blog.knowbe4.com/warning-attackers-are-tricking-employees-into-sharing-malicious-calendar-invites
Personalized Security Awareness Training Proven to Reduce Risk by 87%
A whopping 68% of breaches still involve a human element. As attackers use AI to create hyper-personalized attacks, even your most security-conscious users can be fooled. Yet they're still getting the same generic training that ignores those real-world risks.
Join us for a live demo to see how our AI-Native Security Awareness Training helps you close the gap. Training that adapts to each user's actual risk, content you can build in minutes instead of months and defenses built for the way people are attacked today.
See how you can:
- Change behavior with training tailored to each user's role, behavior and risk level
- Prepare your workforce for real threats like vishing, deepfakes and AI-generated phishing
- Create custom content unique to your policies and workflows in minutes with generative AI
- Deliver real-time coaching the moment risky behavior happens – before it becomes a mistake
- Reduce Phish-prone™ Percentage from an industry average of 33.1% to 4.1% in one year (87% reduction in human-related cyber risk)
See how training that adapts in real time can close the gap generic training leaves open.
Date/Time: TOMORROW, Wednesday, Oct. 14, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/sat-demo-month1?partnerref=CHN3
New Phishing Campaign Uses Claude-Themed Lures
A phishing campaign is targeting Google accounts with lures that promise free subscriptions to Anthropic's Claude Max AI model, Malwarebytes warns.
"The site announces that Anthropic has passed 100 million users and is thanking people by giving away 10,000 free one-month subscriptions to Claude Max, its highest-usage plan," Malwarebytes says. "The presentation is careful, down to the real logo and colors, invented five-star reviews, and a long footer whose links lead almost entirely to genuine Anthropic pages.
"This is probably the most effective trust signal on the site, and it cost the operator nothing. A counter claims that fewer than 750 of the 10,000 slots remain, dropping by a few every several seconds. Nothing is actually being counted. The number is generated inside your browser and resets when you reload the page, so every visitor sees the same manufactured shortage."
The goal of the phishing site is to trick the user into entering the credentials to their Google account. The site uses the "browser-in-the-browser" technique to open a fake Google login window inside the tab.
"Two sign-in options appear, but only one works," the researchers explain. "The Apple button produces a pre-written notice saying that the method is temporarily unavailable. The email box discards whatever you type into it and triggers the Google button instead. Every route leads to the same place.
"Clicking the Google button doesn't open a real Google sign-in window. Instead, the page draws a browser window inside the existing tab, complete with a padlock and a correctly spelled Google sign-in address. It can even be dragged around the page.
"The address bar, padlock and everything inside the supposed window belong to the phishing page, not Google. It begins with a human-verification step rather than a password box, which may reassure visitors while helping to keep automated scanners away from the next stage."
More at KnowBe4 blog with links:
https://blog.knowbe4.com/new-phishing-campaign-uses-claude-themed-lures
Exclusive Look at the Latest Phishing Threat Trends
The threat landscape continues to evolve with more automation, more innovation from the attackers and a faster pace than ever before.
Attackers are turning headlines into phishing campaigns 5.4 times faster than they did four years ago. In this webinar, we'll explore this finding and what it means for your organization.
Get a first look at the newest edition of KnowBe4's Phishing Threat Trends Report. James Dyer, KnowBe4's Head of Threat Intelligence, breaks down the data from extensive analysis of phishing attacks that successfully landed in users' inboxes over the past year. Get the intelligence you need for proactive workforce risk management.
You'll gain insight into:
- The latest evolutions in the phishing threat landscape, how attackers are moving the goal posts of defense once again
- Why attackers are abandoning one-size-fits-all campaigns in favor of lures tailored to local habits, language and trust signals in specific countries and regions
- The tactics behind the 54% increase in toolkit-based phishing over the past two years
- How regional locations are facing more diverse threats than ever before. Why a threat in Zurich looks nothing like one in Dubai or Dublin, and what region-blind defenses are missing as a result
- What separates the security teams catching these threats early from everyone else, and how to move your program from reactive to proactive
Don't miss this exclusive look at the newest edition of the Phishing Threat Trends Report, and earn CPE for attending.
Date/Time: Wednesday, Oct. 21, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/phishing-threat-trends-2026?partnerref=CHN
Warning: Tech Support Scams Are Abusing Google Ads
Researchers at Netskope are tracking a phishing kit that hijacks users' browser windows to display fake security alerts. The malicious websites are distributed via Google Ads, and pose as normal online stores. Once a user clicks a link on the page, however, the site will present them with an urgent-looking security warning.
"The decrypted payload is tailored to the victim's operating system," the researchers write. "On Windows, it impersonates Windows Defender, with a fake 'Microsoft Defender Security Center' scan claiming the machine is infected with malware, stacked system dialogs, and a callback number.
"The macOS branch is the same scam reskinned over a fake Apple storefront. These are typical social engineering tactics used in tech scams, meant to induce panic and a sense of urgency to call the number they flash repeatedly."
Notably, the page also traps the victim on the screen, further increasing the sense of urgency and making the victim feel like the only solution is to call the phone number.
"The first click anywhere forces the page into full screen with requestFullscreen, hiding the address bar and tabs so the fake warning fills the whole display," Netskope says. "It then hides the mouse cursor and calls the browser's keyboard lock API to swallow the Escape key and other exit shortcuts, so the usual ways out stop responding.
"On top of that, it deliberately degrades the browser, playing alert sounds on interaction and running busy loops that make the page stutter and lag, reinforcing the illusion that the machine is broken. While the victim stays in full screen, a black lockout screen ('Do not restart or operate the computer… call immediately') flashes over everything, and trying to close the tab triggers the browser's own confirmation dialog carrying the scam's message.
"None of this actually locks the computer, and operating-system controls still work, but together they make a convincing page that pressures the victim into calling the number."
More at:
https://blog.knowbe4.com/warning-tech-support-scams-are-abusing-google-ads
KnowBe4 Now Integrates With Workday Learning
Keep your security awareness training records up to date and audit-ready with KnowBe4 for Workday Learning, a Workday Cloud Connect for Learning (CCL) integration.
This new Workday-certified integration natively connects the systems underpinning your security awareness training program. After a one-time configuration, KnowBe4 delivers the training while Workday captures the records, no more manual reconciliation required.
What this means to you:
- Training activity and completion data sync across both systems automatically within one to two seconds. This keeps your records accurate and your organization audit-ready.
- Your KnowBe4 training content lives in Workday natively. The KnowBe4 catalog within Workday is automatically refreshed so you don't have to manage SCORM files.
- Learners stay on Workday. Single sign-on launches training without separate portals, and users and enrollments are created automatically so there's nothing to pre-provision.
Your Guide to Get Started:
https://support.knowbe4.com/hc/en-us/articles/54076314336915-Workday-Integration-Guide
This self-serve integration is available for all Diamond and SAT Advanced KnowBe4 customers with the Workday Learning with CCL SKU. Simply follow the integration guide to get started, or reach out to your Customer Success Manager if you have questions.
Let's stay safe out there.
Warm regards,
Stu Sjouwerman, SACP
Executive Chairman
KnowBe4, Inc.
PS: Miss Last Week's CHN? You can read it here: "Why Microsoft’s Latest Defense-in-Depth Email Benchmark Is So Surprising"
https://blog.knowbe4.com/cyberheistnews-vol-16-40-why-microsofts-latest-defense-in-depth-email-benchmark-is-so-surprising
PPS: Interview with Kevin Mandia on AI: The Biggest Shift in Cybersecurity in 30 Years:
https://music.youtube.com/watch?v=cJsHel27Z6M&si=a7orGEwCRCWvVYbm
- Laura Ingalls Wilder - Author (1867–1957)
- Epictetus - Stoic Philosopher (approx. AD 55–135)
You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-16-41-heads-up-attackers-trick-your-employees-to-share-fake-calendar-invites
40,000 Phishing Sites Targeted the Financial Sector in H1 2026
Attackers used 40,000 unique phishing URLs to target the U.S. financial services sector during the first half of 2026, according to researchers at Netcraft. Payment service providers were the most frequently targeted, followed by banks, investments and brokerages, credit unions and card networks.
"Among subcategories of the financial services sector, payment service providers were the most highly targeted group, accounting for 37.2% of the total phishing volume against this sector during the reporting period. This reflects the use of payment service provider logos in scams impersonating other entities to extract victim funds.
"For example, PayPal impersonation accounts for 80.6% of the payment service provider group activity. Similarly, American Express dominated the card network group, accounting for 72.8% of attacks within it. The other groups had a much more even split, with no single brand accounting for the majority of observed malicious URLs in their subsector."
Attackers are increasingly abusing legitimate services to host their phishing sites, with AI tools enabling rapid deployment.
"The phishing infrastructure ecosystem mainly uses large and legitimate hosting services," the researchers write. "This trend is seen in phishing campaigns targeting other industries as well but is notable as the scale and speed of infrastructure deployment increases with agentic AI.
"These tools can be used to automate otherwise complex website development and deployment across a range of providers. The use of free services is often built into generative AI website builders and cloners, making them increase the use of these platforms even when abused.
"Free developer and app-hosting services accounted for 12.6% of phishing URL volume for H1 2026." KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
Netcraft has the story:
https://www.netcraft.com/blog/h1-phishing-landscape-report-financial-sector
Report: Ransomware Attacks Involving Data Theft Are Surging
Ransomware attacks involving data theft have surged by 275% in 2026, according to a new report from Zscaler. Attackers exfiltrated more than 896.2 terabytes of data from victim organizations, more than seven times the amount stolen during the 2023–2024 reporting period.
"Ransomware groups are exfiltrating more data to strengthen their extortion leverage," the report says. "The more sensitive and operationally important information attackers possess, the greater the potential business, reputational, and legal consequences of its public release.
"During ransom negotiations, threat actors often cite the potential legal and regulatory requirements of the incident, including those related to HIPAA, SEC disclosure rules and GDPR, to intensify pressure."
Attackers are increasingly targeting higher-level employees to gain initial access, using social engineering to obtain a foothold within the organization.
"Most victims (62%) in these campaigns held managerial titles or above," the researchers write. "These roles often span departments, approvals, customer and partner communications and a vast ecosystem of business applications. For attackers, that can translate into far-reaching visibility and access across the organization.
"Their accounts may also carry something attackers can exploit just as effectively as technical privilege: trust. A request, file or message coming from a manager may appear inherently credible, creating opportunities to gather additional information or extend an intrusion further into the organization."
These attacks are also leveraging generative AI to dramatically increase their sophistication. "GenAI can lend a hand at nearly every turn: sharpening recon, personalizing social engineering and phishing, generating malware code, building automated scripts and analyzing stolen data," Zscaler says.
"These capabilities help give attackers a better read on their targets and help them accelerate or adapt their tactics after compromise."
Zscaler has the story:
https://www.zscaler.com/blogs/product-insights/ransomware-data-theft-surged-275-2026-schools-hospitals-and-government
What KnowBe4 Customers Say
"Hi Bryan, I might not be your regular customer.
"I am not an IT person but work in HR. Your HR director in Netherlands, Marly B., persuaded me to look at KnowBe4 and we have been using it for the last 4 years. She is not only good in HR, but definitely has a commercial attitude.
"As HR is sending and picking out all the training, we have a very high rate of participation, around 70%-80%. I regular share KnowBe4 dashboard information in our All Hands Meeting and we make it an active subject in our company.
"I also follow up all the ‘clickers’ from the phishing test for awareness. I love KnowBe4, we use it a lot and have training every month. Short and no more than 10-15 min in total but with great results. There is more awareness, understanding of the different topics and the phishing test creates hilarious reactions on the Teams chats.
"Just though I would give you a HR outlook. Have a great weekend."
Kindest regards,
W.M., Director HR EMEA
- 30-min PODCAST: Inside this year’s Microsoft Digital Defense Report. Check what they say about phishing!
https://thecyberwire.com/podcasts/microsoft-threat-intelligence/79/notes - Engineer sentenced for locking over 3,000 devices on employer network:
https://www.bleepingcomputer.com/news/security/engineer-sentenced-for-locking-thousands-of-devices-on-employer-network/ - FBI Arrests Founder of Ransomware Negotiation Firm:
https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/ - Senate passes healthcare cybersecurity bill after 190 million impacted by Change Healthcare breach:
https://therecord.media/senate-passes-healthcare-cyber-bill-after-change-breach - Recent Taiwan simulation highlights U.S. cyberdefense gaps against China, experts warn:
https://www.nextgov.com/cybersecurity/2025/08/salt-typhoon-hackers-targeted-over-80-countries-fbi-says/407719/ - Russian cyberattacks against UK are 'Putin Tax' costing $3.3 billion, says lawmaker:
https://therecord.media/russia-cyberattacks-on-britain-putin-tax-graeme-downie - U.S. Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward:
https://www.securityweek.com/us-seeks-alleged-chinese-hafnium-hacker-with-10-million-reward/ - [BIG IC3 PDF] The FBI has seized tools used by Chinese hackers for cyber operations:
https://www.ic3.gov/CSA/2026/261008.pdf - Researchers warn of a surge in credential phishing attacks using remote management tools:
https://www.fortra.com/blog/increase-credential-phishing-remote-management-tools - AI-assisted phishing campaign uses event-themed lures to target researchers:
https://blog.talosintelligence.com/uat-11985/
- Virtual Vaca #1 - El Salvador: Santa Ana Volcano Hike & Other Highlights:
https://youtu.be/kVuUS2jqC0E - Virtual Vaca #2 - Positano, Italy - Amalfi in-depth tour:
https://youtu.be/3EHz-XtUMhI - Virtual Vaca #3 - Madeira, The Most Beautiful Island in Europe:
https://youtu.be/Sqq2rQACa0Y - Magician Fools Penn & Teller with Coin Magic Tricks:
https://youtu.be/py7zk_UiVdA - Racing America's Most Dangerous Mountain. Strap in for a run up Pikes Peak!
https://youtu.be/V2qsUUug1jo - Another Historic Cipher Falls to AI:
https://carter.church/writeups/the-letter-to-marmont/#war - Nobody Thought This Was Possible:
https://youtube.com/shorts/sYCEsTPJzuo - America Actually Built Something On Time and On Budget:
https://youtu.be/CBXkSJT1a7w - I Hiked World's Scariest Trail:
https://youtu.be/GF-i5-_mHWM - Antenna Basejump, 10 Seconds of Fun:
https://youtu.be/wIFlNn_1MJU - China Robotics - The "New Traffic Officer":
https://youtu.be/_14HvDleHYM - For Da Kids #1 - Defeated Pony Goes Through Remarkable Transformation:
https://youtu.be/44M7x-Rl9kU - For Da Kids #2 - Mama Dog Leads Rescuers To Her Puppies, Including One Born Green:
https://youtu.be/M6bFeZ7a09Q - For Da Kids #3 - Toddler’s Pony Best Friend Joins Her For Dinner In The Kitchen:
https://youtu.be/QsyuiZWRGnA - For Da Kids #4 - It’s A Pool Party! A Family Of Bears Frolicking In The Water In The Angeles National Forest:
https://youtu.be/-_5L8APMDPY - For Da Kids #5 - Woman Feeds A Baby Blue Jay Once And Everything Changes:
https://youtu.be/Zq7hVTnxgRo
