CyberheistNews Vol 16 #42 | October 20th, 2026
Warning: Phishing Attacks Are Using AI-Themed Ad Lures
A phishing campaign is using AI-themed lures to target employees who operate advertising accounts, according to a new report from Island. The campaign is launched from a phishing platform that poses as a portfolio of AI advertising tools, using branding from Gemini, Claude, ChatGPT, Perplexity and Muse.
The platform's operator added a fake Muse Ads lure eight days after Meta launched its Muse AI agent.
"Every brand gets its own pitch," the researchers write. "ChatGPT promises a Monday Google Ads brief. Gemini promises MCC (manager account) and linked-client support. Claude gets its own advertising portal, Perplexity offers campaign planning and spend audits, and Manus offers a private Meta integration.
"The copy is written in advertiser shorthand like MCC and ROAS, so a request to connect an account feels routine."
The phishing pages are designed to harvest passwords and intercept multifactor authentication codes to grant attackers access to victims' accounts.
"Each product was built around the same action: 'Connect,'" the researchers write. "Clicking it opened a browser drawn inside the real browser.
"The fake address bar displayed trusted origins such as accounts[.]google[.]com or an Okta tenant, while the real browser remained on the phishing domain. Behind the interface, the platform kept every password attempt, fingerprinted the device, and let an operator pick which MFA challenge the victim saw next."
Island notes that ad accounts are particularly valuable to attackers because they provide opportunities to launch downstream attacks against the victim's clients and customers.
"The lures are written for agency staff, media buyers, and manager-account administrators, because an advertising account is a spending account," the researchers write. "It carries a stored payment method and an approved budget, and a manager account can reach several client accounts, each with its own billing profile and linked users.
"For the victim, the card is the easy part: they can remove it within hours. Getting the account back is not. Attackers typically add their own admins and downgrade the legitimate owner, and recovery can take weeks or months while the account keeps serving ads. For a manager account, the damage reaches the agency's clients."
Blog post with links:
https://blog.knowbe4.com/warning-phishing-attacks-are-using-ai-themed-ad-lures
Your Exclusive Look at the Latest Phishing Threat Trends
The threat landscape continues to evolve with more automation, more innovation from the attackers and a faster pace than ever before.
Attackers are turning headlines into phishing campaigns 5.4 times faster than they did four years ago. In this webinar, we'll explore this finding and what it means for your organization.
Get a first look at the newest edition of KnowBe4's Phishing Threat Trends Report. James Dyer, KnowBe4's Head of Threat Intelligence, breaks down the data from extensive analysis of phishing attacks that successfully landed in users' inboxes over the past year. Get the intelligence you need for proactive workforce risk management.
You'll gain insight into:
- The latest developments in phishing and how attackers are moving the goalposts for defenders
- Why attackers are abandoning one-size-fits-all campaigns in favor of lures tailored to local habits, language and trust signals in specific countries and regions
- The tactics behind the 54% increase in toolkit-based phishing over the past two years
- How regional locations are facing more diverse threats than ever before
- What separates the security teams catching these threats early from everyone else and how to move your program from reactive to proactive
Don't miss this exclusive look at the newest edition of the Phishing Threat Trends Report, and earn CPE for attending.
Date/Time: TOMORROW, Wednesday, Oct. 21, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/phishing-threat-trends-2026?partnerref=CHN2
Phishing Is Now a Criminal Impersonation Industry. Here Is How to Fight Back
For years, we described phishing as an email problem: an attacker writes a convincing message, sends it to thousands of people and waits for someone to click. That model is now outdated.
Microsoft's disruption of YAM Store (see "PS" below), CoGUI and Iron Man exposed something much larger: a cloud-based impersonation industry. Criminals could buy Microsoft and Google accounts, hosting, phishing infrastructure and more than 2,300 templates impersonating banks, retailers, healthcare providers, police departments and government agencies across more than 150 countries.
The platforms did not simply translate messages. They localized brands, payment demands and institutions for each market. They used geofencing, fake CAPTCHA screens and anti-detection controls to keep researchers out. Telegram alerts and WebSocket connections let operators watch victims enter credentials and payment information in real time, then change what appeared on screen. This was phishing with criminals steering victims in real time.
Since January, Microsoft says the ecosystem enabled more than one billion malicious messages aimed at over 75,000 organizations. That scale is possible because impersonation has been productized. The criminal no longer needs technical skill, design talent or local knowledge. The service supplies all three.
This changes the defender's job. Blocking yesterday's domains and teaching employees to spot bad grammar will not be enough. Organizations need multilingual, multichannel social engineering simulations; phishing-resistant authentication; rapid reporting; and threat intelligence that updates training as quickly as criminal templates change.
The phishing email is now merely the storefront. Behind it sits an integrated supply chain built to manufacture trust, manipulate victims and monetize deception at cloud scale.
Blog post at:
https://blog.knowbe4.com/phishing-is-now-a-criminal-impersonation-industry.-here-is-how-to-fight-back
Maximizing Your Microsoft Defender Investment with KnowBe4 Defend
When organizations deploy Microsoft 365, security leaders face a fundamental question: Is native Microsoft Defender protection enough?
Microsoft recently evaluated real-world telemetry from live enterprise tenants running seven ICES add-ons on top of Microsoft Defender. The result? KnowBe4 Defend ranked #1 across every single metric reported, catching 3.7x more dangerous emails that Microsoft Defender missed than the field average, with the lowest overlap.
Join Stuart Clark, SVP of Product at KnowBe4, for a technical breakdown of Microsoft's independent production telemetry and a live demonstration of our ICES ecosystem architecture between Microsoft Defender and KnowBe4 Defend.
We will showcase:
- The #1 Benchmark Telemetry: How Defend caught 3.7x more dangerous emails that Defender missed with the lowest overlap (0.65%).
- Adversarial AI and Model Diversity: How independent behavioral models neutralize polymorphic AI, prompt injections and zero-payload BEC that slip through perimeter filters.
- Microsoft Teams Messaging and Posture Management: Extending protection beyond the inbox into Teams and remediating insecure collaboration configurations.
- Native SOC Workflows (Live Demo): Investigating Defend threat verdicts natively inside Microsoft Defender Threat Explorer.
- Advanced Threat Hunting via KQL (Live Demo): Querying Defend-enriched threat metadata directly inside Microsoft Sentinel and Defender XDR.
See why defense-in-depth no longer requires hopping between consoles or redundant gateway fees. Learn how to maximize your Microsoft 365 investment with cloud-native email security.
Date/Time: Wednesday, Oct. 28, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/ecs-ms-demo-month1?partnerref=CHN
Two Years From Our North Korean Fake Employee: This Week's Indictment
I received an email from Chad O'Carroll, Chief Executive Officer of the Korea Risk Group. He said:
"Dear Stu, Chad from KRG here (founder of NK News and NK Pro). KnowBe4's decision in 2024 to publish exactly how a North Korean fake employee got through your hiring process did more to educate the market than any government advisory, so I wanted to flag this week's development.
"On Oct. 13 the Justice Department charged 14 people over a remote IT worker scheme it says reached more than 70 U.S. employers across health care, communications, cyber support, retail and manufacturing. Two Americans were arrested for hosting laptop farms; 10 co-defendants are listed in China, half of them in Dandong on the North Korean border.
"In late September the FBI also searched more than 40 suspected laptop farms in Texas and seized about 187 laptops and KVM devices. The FBI's accompanying warning is the notable part: DPRK workers are now hiring Americans to front for them and passing entire jobs to other foreign nationals, which makes the red flags you listed in 2024 harder to spot.
"NK Pro covers this from the Pyongyang end, tracking which DPRK bureaus run the IT worker and cyber programs, how proceeds move, and what each new indictment, OFAC designation and advisory changes. Our story on the crackdown."
(Note there is a paywall, but you will get the idea.)
https://www.nknews.org/2026/10/us-announces-sweeping-crackdown-on-north-koreans-working-for-american-it-firms/
Here is my original blog post from July 23, 2024. It is still very much a risk:
https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us
Recently: FBI raids North Korean laptop farms in Texas:
https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/
KB4-CON Turns 10! Get Your $199 Pass Before October 31
We're celebrating a major milestone in 2027: 10 years of KB4-CON! And we're gearing up to make this anniversary event one you won't want to miss.
Join us April 13–14, 2027, back at the Orlando World Center Marriott for two action-packed days of cybersecurity insights, innovation and connection with the KnowBe4 community.
This year, you can look forward to:
- Inspiring keynotes and expert-led sessions exploring today's evolving cybersecurity landscape.
- Hands-on learning and product innovation to help you better protect your people, AI agents and organization.
- Unforgettable networking and celebrations with fellow security professionals, industry leaders and KnowBe4 experts.
The best time to secure your spot is NOW!
Our lowest registration price of $199 ends October 31. That's $200 in savings when you lock in your spot.
Ten years of KB4-CON is something worth celebrating, and we can't wait to celebrate with you.
Register Now:
https://kb4con.com/
Early Bird pricing ends October 31, 2026.
Let's stay safe out there.
Warm regards,
Stu Sjouwerman, SACP
Executive Chairman
KnowBe4, Inc.
PS: Microsoft disrupts major Chinese-language phishing ecosystem:
https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/
PPS: Article by yours truly: "When AI Does the Thinking, Who Does the Understanding?"
https://techstrong.ai/contributed-content/when-ai-does-the-thinking-who-does-the-understanding/
- Lao Tzu - Philosopher (60-531B.C.)
- Benjamin Franklin - Statesman and Inventor (1706-1790)
You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-16-42-extortion-groups-are-impersonating-help-desks-to-gain-initial-access
Report: Ransomware Attacks Hit a Record High in Q3 2026
The third quarter of 2026 saw the highest number of ransomware attacks to date, with 2,627 total attacks, according to a new report from Comparitech.
"All four key sectors saw significantly more attacks in Q3 2026 compared to Q2 2026," the report says. "Education saw the biggest uptick with an increase of 50 percent, followed by healthcare (up 39 percent), government (up 36 percent) and businesses (up 27 percent).
"Within the business sector, all sub-industries saw a rise in attacks from Q2 to Q3 2026, bar two. Legal firms saw a 26 percent decrease in attacks, while the construction sector saw a minor two percent decline. The industries with the biggest increases were finance (up 72 percent), technology (up 70 percent), businesses operating in the healthcare sector (up 35 percent) and utilities (up 32 percent)."
U.S. organizations were the hardest-hit, accounting for 41% of attacks in Q3 2026.
"1,066 (or 41 percent) of attacks were carried out on U.S. entities," Comparitech says. "This was a 34 percent increase from Q2 2026. Germany saw the second highest number of attacks with 121 in total – a 22 percent increase from Q2 2026 (99).
"Canada (103) and Italy (86) followed and both saw increases compared to Q2 2026 (four and 32 percent, respectively). But it was fifth-place India that saw one of the biggest increases in attacks, rising by 116 percent from 37 in Q2 2026 to 80 in Q3 2026.
"Argentina also saw a significant rise in attacks with 45 noted in Q3 2026, compared to 18 in Q2 2026 (a 150 percent increase)." The Qilin and Gentlemen ransomware gangs led the pack, with each launching more than 300 attacks.
"Qilin continued to dominate in Q3 2026 with 357 attacks in total, but was closely followed by The Gentlemen with 342 attacks," the researchers write. "Both groups increased their attacks by similar amounts. Qilin attacks rose 24 percent compared to last quarter, and The Gentlemen attacks rose 29 percent.
"Bigger increases were seen by Clop (up 4,700 percent from one attack in Q2 2026 to 48 attacks in Q3 2026). DireWolf upped its attacks by 1,450 percent and Rhysida by 200 percent. In contrast, Akira's attacks declined by 23 percent and LockBit's by 51 percent.
"Qilin and The Gentlemen had the most confirmed attacks with 27 and 26, respectively."
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
Comparitech has the story:
https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/
NIS2 Part One: Why Your NIS2 Supply Chain Strategy Is Already Falling Short
By Martin Kraemer
Tens of thousands of European organizations are legally accountable for the security of companies they do not control but on whose services they rely. Under Article 21(2)(d) of the NIS2 Directive, any in-scope entity is required to manage supply chain security, including the security aspects of its relationships with its direct suppliers and service providers.
Article 21(3) further specifies that an organization must take each supplier's specific vulnerabilities into account. However, neither article imposes anything at all directly on the supplier. Most organizations are currently trying to discharge their duty of care using a supplier questionnaire.
Ultimately, a questionnaire only captures the existence of controls at a given point in time; it cannot measure security that needs to be assessed as circumstances change and evolve, nor can it guarantee the full scope or efficacy of those controls.
Recent real-world cases across Germany, France and Italy highlight the severe operational gaps created by these regulatory and supply chain dynamics.
Keep reading for details for Germany, France and Italy with their scoping gaps and contractual realities:
https://blog.knowbe4.com/nis2-part-one-why-your-nis2-supply-chain-strategy-is-already-falling-short
[For Your Boss] The Business of Scamming Entrepreneurs
Michael Burtov, Chief Innovation Officer of Nova Southeastern University wrote:
"Right now, there are more scams in the U.S. than at any other time in history. In 2025 alone, consumers reported losing a record $15.9 billion to fraud, according to the Federal Trade Commission.
"But some of the most dangerous scams might not be technically illegal. And some of their favorite targets are entrepreneurs.
"An entire industry has emerged around selling founders the dream of success. Fake investors. Predatory accelerators. $25,000 masterminds. Pay-to-pitch schemes. AI business gurus. Fake awards. Fundraising consultants promising access to millions.
"In my latest talk, I expose what I call the Founder Exploitation Economy - an ecosystem built around monetizing the ambition, desperation, optimism and sometimes the life savings of people trying to build businesses.
"And here's what makes it so effective: Entrepreneurs don't fall for these schemes because they're stupid. Often, they fall for them precisely because they're entrepreneurs. We train founders to take risks, believe in improbable outcomes, move quickly, trust their instincts and recognize opportunities others overlook.
"Unfortunately, those same qualities can make them exceptionally attractive targets.
"In this talk, we'll explore:
- Why intelligent, experienced founders keep falling for scams
- The difference between fraud, deception and legally predatory business practices
- How fake investors, startup accelerators and fundraising consultants exploit founders
- The multimillion-dollar industry selling courses, masterminds, awards and entrepreneurial shortcuts
- How AI is transforming the economics of fraud
- How to recognize warning signs and protect yourself and your business
"The fact is scammers rarely sell you the scam. They sell you progress. They sell you hope. They sell you the next step toward the future you've sacrificed everything to build."
Here is his lecture on YouTube. Warmly recommended and I suggest you send a link to your boss:
https://www.youtube.com/watch?v=3xg4AT9XAkQ
What KnowBe4 Customers Say
"Hey Bryan, absolutely a happy camper. We can't find a better solution for our training needs, and I've recommended you guys to a lot of people. KnowBe4 is a solid program and our users love it too. Thanks for checking in!"
- O.B., IT Technician
- Report: Ransomware Attacks Hit a Record High in Q3 2026:
https://www.comparitech.com/news/ransomware-roundup-q3-2026-stats-on-attacks-ransoms-and-active-gangs/ - Phishing emails now target AI assistants:
https://www.malwarebytes.com/blog/ai/2026/10/phishing-emails-are-baiting-your-ai-assistant - Man admits to running network of 15,000 money mules for cybercriminals:
https://www.justice.gov/opa/pr/ukrainian-russian-dual-citizen-pleads-guilty-running-international-money-laundering - Leaked chats show Russian extortion gang sending ‘agents’ into U.S. law firms:
https://therecord.media/leaked-chats-show-russian-extortion-gang-sending-agents-to-law-firms - Cyber incident hits grocery stores in U.S., Netherlands and Belgium
https://therecord.media/cyberattack-groceru-ahold-delhaize - Anthropic: "AI models may be capable of self-replicating without access to a datacenter"
https://www.anthropic.com/research/self-replicating-ai - Ukrainian drones hit Yandex data centers, sparking claims that Russian troll farms went quiet:
https://www.helpnetsecurity.com/2026/10/13/ukraine-drone-strikes-yandex-data-centers/ - A16Z interview with Kevin Mandia. The Biggest Shift in Cybersecurity in 30 Years:
https://music.youtube.com/watch?v=cJsHel27Z6M&si=X--U1qbe3BV1XC0k - FBI Raids Over 40 Texas Homes, Charges Americans in North Korean ‘Laptop Farm’ Scheme:
https://gizmodo.com/fbi-raids-over-40-texas-homes-charges-americans-in-north-korean-laptop-farm-scheme-2000825918 - Microsoft and partners disrupt 1 Billion-message Chinese-language phishing kit ecosystem:
https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/
- Virtual Vaca #1 - Top 10 Places To Visit in Serbia:
https://youtu.be/fDAKsLk3GGs - Virtual Vaca #2 - Vardzia: The Incredible Ancient Cave City in the Mountains of Georgia:
https://youtu.be/YJ3I5CJmhqM - Virtual Vaca #3 - Rome Italy - In depth Tour city #17 of 30:
https://youtu.be/k-06AEicoaA - Teaching a humanoid robot to play cornhole with Gemini 4 Argon:
https://youtu.be/9PICEmtfpWU - Before WW1 - Seaside Films c.1900 Restored in 4K Color & Sound:
https://youtu.be/R2W-LyHBcnY - North Korea Built its Own Dubai:
https://youtu.be/xNyrk_DE7l0 - The Space Between // Diving Into the World of Wingsuit Flying:
https://youtu.be/RCE-vLxWDaQ - Silent Rave on New York's Wall Street:
https://www.instagram.com/reel/DeaJSQSyZN_/?obrf=NmE5MTZxc2hqNXli - The LockPickingLawyer Shows Why You Need LAYERS of Lock Picks:
https://www.youtube.com/watch?v=n7Yp0pOL6Co - Jean-Pierre Parent Fools Penn & Teller!
https://youtu.be/_-P4wjAROok - Tenzing — Official Trailer | Apple TV:
https://youtu.be/KkYCY5YR12U - For Da Kids #1 - Desperate pet store parrot convinced a man to get him out:
https://youtu.be/ThA8uxuerIs - For Da Kids #2 - Woman Sings To Her Horse While He Plays Guitar:
https://youtu.be/m4GKdDMDoOw - For Da Kids #3 - Baby and Curious Kittens Play Together for the First Time:
https://youtu.be/-fHm5iLPX70 - For Da Kids #4 - Watch How Friendly Cheetahs Are:
https://youtube.com/shorts/TvEV4MuT2b4 - For Da Kids #5 - Corgi Always Gets Front-Row Seat To Dolphins Leaping Out Of The Water:
https://youtu.be/nXCIEOpJIIo
