Human Risk Management Blog

Social Engineering

Latest social engineering news, analysis, tactics the bad guys are using and what you can do to defend your organization.

Game-Changer: Biometric-Stealing Malware

I have been working in cybersecurity for a long time, since 1987, over 35 years. And, surprisingly to many readers/observers, I often say I have not seen anything new in the ...

Credential Theft Is Mostly Due To Phishing

According to IBM X-Force’s latest Threat Intelligence Index, 30% of all cyber incidents in 2023 involved abuse of valid credentials. X-Force’s report stated that abuse of valid ...

[SCARY] You knew about OSINT, but did you know about ADINT?

WIRED just published a scary (long) article. I am summarizing it here and highly recommend you read the whole thing.

Face off: New Banking Trojan steals biometrics to access victims’ bank accounts

Venturebeat had the scoop on a fresh Group-IB report. They discovered the first banking trojan that steals people’s faces. Unsuspecting users are tricked into giving up personal IDs and ...

Nearly One in Three Cyber Attacks In 2023 Involved The Abuse of Valid Accounts

Thirty percent of all cyber incidents in 2023 involved abuse of valid credentials, according to IBM X-Force’s latest Threat Intelligence Index. This represents a seventy-one percent ...

[INFOGRAPHIC] KnowBe4’s Learner App by the Numbers

The KnowBe4 Learner App enables your users to complete their security awareness and compliance training conveniently from their smartphones and tablets.

The Unsettling Leap of AI in Video Creation: A Glimpse Into Sora

In the rapidly evolving landscape of artificial intelligence (AI), the launch of Sora by OpenAI marks an unnerving milestone in video synthesis.

State-Sponsored Threat Actors Targeting European Union Entities With Spear Phishing Campaigns

Numerous state-sponsored threat actors frequently launched spear phishing attacks against European Union entities last year, according to a new report from the EU’s Emergency Response ...

Only 7% of Organizations Can Restore Data Processes within 1-3 Days After a Ransomware Attack

New data on how organizations are able to respond to ransomware attacks also shows that paying a ransom is highly likely, despite having a policy of “Do Not Pay.”

Augmented Security: The Impact of AR on Cybersecurity

Recently, Apple launched its Apple Vision Pro to much fanfare and has pushed the discussion of Augmented Reality (AR) beyond the realms of gaming and entertainment. From healthcare ...

Iran-Aligned Threat Actor "CharmingCypress" Launches Spear Phishing Attacks

Researchers at Volexity warn that the suspected Iranian threat actor CharmingCypress (also known as “Charming Kitten” or “APT42”) has been launching spear phishing attacks against Middle ...

AI in Cyberspace: A Double-Edged Sword

The UK's National Cyber Security Centre (NCSC), recently shared its findings on how AI might reshape the cyber landscape. In two separate posts, the NCSC is warning that the global ...

Hard Lessons From Romance Scams

Seeing as this week is Valentine’s Day, I should have written something about rom coms, true love, and trusting your heart more. But this is not one of those posts. This post is about ...

Browser-Based Phishing Attacks Increase 198%, With Evasive Attacks Increasing 206%

A new report shows massive increases in browser attacks in the second half of 2023, with over 31,000 threats specifically designed to bypass security solution detection.

Unprecedented Rise of Malvertising as a Precursor to Ransomware

Cybercriminals increasingly used malvertising to gain initial access to victims’ networks in 2023, according to Malwarebytes’s latest State of Malware report.

[On-Demand Webinar] How to Fight Long-Game Social Engineering Attacks

Sophisticated cybercriminals are playing the long game. Unlike the typical hit-and-run cyber attacks, they build trust before laying their traps. They create a story so believable and ...

Generative AI Used to Launch Phishing Attacks

Criminal threat actors are increasingly utilizing generative AI tools like ChatGPT to launch social engineering attacks, according to researchers at Check Point.

New Phishing-As-A-Service Kit with Ability to Bypass MFA Targets Microsoft 365 Accounts

A phishing-as-a-service platform called “Greatness” is facilitating phishing attacks against Microsoft 365 accounts, according to researchers at Sucuri.

Social Engineering Masterstroke: How Deepfake CFO Duped a Firm out of $25 Million

Check out this one line for a moment...“duped into attending a video call with what he thought were several other members of staff, but all of whom were in fact deepfake recreations.”

Ransomware Payments On The Decline As Cyber Attackers Focus on The Smallest, And Largest, Organizations

New data for Q4 of 2023 reveals a sizable shift in the cyber threat landscape, with serious implications regarding ransomware and social engineering attacks targeting both the largest and ...


Get the latest insights, trends and security news. Subscribe to CyberheistNews.