Security Awareness Training Blog

Social Engineering Blog

Latest social engineering news, analysis, tactics the bad guys are using and what you can do to defend your organization.

Increase in BLM Domain Names Forecasts BLM Phishing Attacks

There has been a significant increase in DNS domain names containing blacklivesmatter or George Floyd’s name and there’s a good chance some of those are owned by people with malicious ...
Continue Reading

Twitter Takes Down Over 32,000  Nation State Accounts Involved in Disinformation Campaigns

Manipulation/disinformation campaigns are running rampant on social media and Twitter just took action -- again. "Disinformation" is a form of propaganda honed into an art form by Russia. ...
Continue Reading

Pretexting Defined

Pretexting is a social engineering tactic in which an attacker attempts to gain information, access, or money by tricking a victim into trusting them, according to Josh Fruhlinger at CSO ...
Continue Reading

[HEADS UP] Cybercriminals in Australia Harass Recipients with Abusive Transaction Descriptions on Bank Statements

There are bad guys in Australia that have given away money in order to use social engineering and harass people with abusive transaction descriptions that appear in online banking ...
Continue Reading

[Heads Up] The REvil Ransomware Gang Is Now *Auctioning Off* Their Victim Data

Intrepid investigative Reporter Brian Krebs had the news first. "The criminal group behind the REvil ransomware enterprise has begun auctioning off sensitive data stolen from companies ...
Continue Reading

Phishing Campaigns Using Google Firebase Storage

Scammers are hosting phishing pages on Google Firebase Storage to bypass email security filters, Threatpost reports. Firebase is a Google-owned application development platform that ...
Continue Reading

[Heads Up] The COVID Remote Work Mandate Skyrockets "Work From Home" Training Enrollments

KnowBe4 was one of the first to warn first about the impending COVID phishing tsunami on Jan 31, 2020.  The bad guys did not disappoint and went all-out, all cylinders firing, and pulled ...
Continue Reading

Preying on the Unemployed

An SMS phishing campaign has been exploiting the COVID-19 crisis by spoofing the website of a job placement agency, the New York Daily News reports. The scammers set up a website that ...
Continue Reading

The Three Pillars of the Three Computer Security Pillars

Much of the world, or at least the United States, is coalescing around the NIST Cybersecurity Framework. It’s a pretty good one to follow out of the many dozens that have been proposed ...
Continue Reading

Scammers Exploit Rollout of COVID-19 Contact-Tracing Apps

An SMS phishing campaign is telling people they’ve come into contact with someone who’s contracted COVID-19, Computing reports. The UK’s Chartered Trading Standards Institute (CTSI) ...
Continue Reading

Dutch Online Retailer Wehkamp Loses 144,000 Euros in Bankruptcy Business Email Compromise

Cyber criminals successfully gained access to email traffic between bankruptcy trustees and Wehkamp – one of the biggest online retailers in The Netherlands – writes RTL Z. Employees of ...
Continue Reading

That Email from President Trump? Yeah, That’s a Phishing Scam

New phishing scams impersonating President Trump and Vice President Pence are designed to install malware or be the start of an extortion scam.
Continue Reading

World's Largest Sovereign Wealth Fund Falls For $10m Social Engineering Attack

The Norwegian Investment Fund has been swindled out of 10 million dollars by fraudsters who pulled off a social engineering attack that the Norfund called "an advanced data breach" but ...
Continue Reading

Watch Out for the Coming Tsunami of Mortgage Rescue Phishing Scams

At this point in time, with 10 years of phishing attack analysis under our belt, we can predict with a high reliability level what will be showing up in the near future. We see two scams ...
Continue Reading

Why Does Someone Click and Become a Victim of a Scam?

One of the keys to thwarting social engineering attacks is knowing what makes us want to click on links or respond to emails, according to cybersecurity expert Raef Meeuwisse. In an ...
Continue Reading

[Scam of The Week] Unemployed Americans Are Now Deceived Into Grabbing ‘Remote Jobs’ As Money Mules

There are now tens of millions of people suddenly unemployed, looking for ways to make ends meet.
Continue Reading

Cybercriminals Lean Heavily on Social Engineering Tactics to Gain Access to Bank Accounts

A series of attack anecdotes shared by Brian Krebs shows how persistent and sophisticated scammers are in using social engineering tactics to gain access to their victim’s bank account ...
Continue Reading

What is the Right Password Policy?

What is the right password policy? Conventional password policies say you must have a password at least 8-12 characters long…16 characters or longer if it belongs to an elevated ...
Continue Reading

Q&A With Data-Driven Evangelist Roger Grimes on the Great Password Debate

I get asked a lot about password policy during my travels around the globe giving presentations and from people who email after webinars. Many of the questions are the same and I’ve ...
Continue Reading

Reuters: 'State-backed hackers targeting coronavirus responders'

LONDON/WASHINGTON (Reuters) - Government-backed hackers are attacking healthcare and research institutions in an effort to steal valuable information about efforts to contain the new ...
Continue Reading

Get the latest about social engineering

Subscribe to CyberheistNews