Security Awareness Training Blog

Phishing Blog

Learn about current phishing techniques, notable campaigns and attacks, what to watch out for 'in the wild', and more.

New QuickBooks-Themed Phishing Attack Seeks to Infect Victims with Dridex Malware

Purporting to be invoices and payment reminders, this new campaign targets users of the popular accounting software to install the banking trojan on its victims endpoints.
Continue Reading

Phishing Scammers Remove ‘External Sender’ Email Warnings Impersonating Internal Users

With little more than some CSS and HTML coding, a security researcher demonstrates how easy it is to eliminate security warnings placed on email messages by security products.
Continue Reading

Your Organization Needs to Take Security Awareness Training More Seriously

Your organization needs to take security awareness training (SAT) more seriously. I mean truly serious, really serious, and not relegated to some quasi-, semi-serious status that the vast ...
Continue Reading

Wine-Themed Phishing Attacks Have Turned Sour During the Pandemic

Scammers took advantage of people’s desire to order wine online during the pandemic, Decanter reports. Researchers at Recorded Future disclosed in a recent report that wine-related ...
Continue Reading

A Master Class on IT Security: Roger Grimes Teaches You Phishing Mitigation

Phishing attacks have come a long way from the spray-and-pray emails of just a few decades ago. Now they’re more targeted, more cunning and more dangerous. And this enormous security gap ...
Continue Reading

[NEW FEATURE] AI-Driven Phishing Helps Admins Deliver a Personalized Simulated Phishing Experience to Each User

We are excited to announce the availability of KnowBe4’s new AI-Driven Phishing feature. The KnowBe4 phishing platform now leverages machine learning to recommend and deliver informed and ...
Continue Reading

New IceID Phishing Attack Targets Website Owners Using Image Copyright Infringement as The Hook

Spotted by the Microsoft 365 Defender Threat Intelligence Team, this new phishing attack threatens legal action to trick victims into installing information-stealing malware.
Continue Reading

W-2 Form Office 365 Credential Scam Creatively Uses Typeform Service to Bypass Security Checks

By creating phishing site pages using an online service for building surveys and forms, scammers figured out an original way to trick users out of their Office 365 credentials.
Continue Reading

Cybersecurity Spend Is Now More Than 20% of the Average IT Budget As 91% of Organizations Suffering an Attack had Operations Impacted

The latest data from the Hiscox Cyber Readiness Report highlights how organizations are experiencing cyber threats and how they are responding to increase their readiness for next time.
Continue Reading

[HEADS UP] New Malware Families Found in Phishing Campaign

Researchers from FireEye's security team found new malware families in a financial phishing campaign. The Malware strains are dubbed Doubledrag, Doubledrop, and Doubleback and have been ...
Continue Reading

UK IT Decision Makers Fear Their Remote Workers Put Company Data at Risk for Data Breach

According to an annual survey from Apricorn, UK IT decision makers are fearing the worst as their staff continues to work in a remote environment.
Continue Reading

May the 4th Be With You and Your Users!

May the force be with you, May the fourth be with you, may the phish not attack you. Okay, so it does not quite rhyme, but you get the idea. We reach the fourth day of the fifth month of ...
Continue Reading

U.K. Royal Mail-related Phishing Scams Are Up 645%

New data from CheckPoint highlights how scammers are using simple shipping-related social engineering scams to trick victims into giving up personal information and credit card details.
Continue Reading

Why Should We Care About Personal Smishing Attacks?

I am not sure what is going on these days, but for several weeks, I have received far more SMS-based phishing (i.e., smishing) attacks than usual.
Continue Reading

Scammers Target Rogers Customers With SMS Messages

Scammers are targeting Rogers customers with text messages offering $50 refunds, according to BleepingComputer. The Canadian telecommunications provider suffered a widespread outage last ...
Continue Reading

Researchers Warn of EtterSilent Facilitating Risky Malware Delivery

Cybercriminals are using a new malicious document builder dubbed “EtterSilent,” according to researchers at Intel 471. The builder is used to craft Microsoft Office documents with macros ...
Continue Reading

Lazarus Group Uses New Technique to Avoid Detection

North Korea’s Lazarus group is using an interesting method to evade security measures, according to researchers at Malwarebytes. The threat actor is sending phishing emails with malicious ...
Continue Reading

Phishing Campaign Abuses Contact Forms

Attackers are abusing websites’ contact forms to send malicious emails to the websites’ owners, according to researchers at Microsoft. The emails contain bogus copyright claims with a ...
Continue Reading

Phishing Tactics Help Legitimate Pension Fund to Secure Meetings with Prospective Customers

Security researchers uncover a marketing campaign that takes a page from the cybercriminal phishing handbook to “trick” pensioners to have an introductory call with their fund expert.
Continue Reading

COVID-Related Phishing Attacks Return to Mid-Pandemic Heights

New data from Palo Alto Network’s Unit42 provides a wealth of insight into specifically how cybercriminals have leveraged COVID-related theming to ensure a successful phishing attack.
Continue Reading

Get the latest about social engineering

Subscribe to CyberheistNews