Krebs on Security

NOVEMBER 9, 2024

The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based based technology companies.

Hacking 284

Hacking Accountability Government Social Engineering 284

Malwarebytes

FEBRUARY 11, 2025

There are plenty of phish in the sea, and the latest ones have little interest in your email inbox. In 2024, Malwarebytes detected more than 22,800 phishing apps on Android, according to the recent 2025 State of Malware report. These Android phishing apps may sound high-tech, but they are not.

Phishing 124

Phishing Passwords Mobile Authentication 124

Krebs on Security

NOVEMBER 2, 2018

Thieves are combining SMS-based phishing attacks with new “cardless” ATMs to rapidly convert phished bank account credentials into cash. The text messages contained a link to unlock their accounts and led customers to a Web site that mimicked the legitimate Fifth Third site. Image: Mastercard.us.

Phishing 268

Phishing Banking Scams Accountability 268

Krebs on Security

FEBRUARY 1, 2021

Authorities in the United Kingdom have arrested a 20-year-old man for allegedly operating an online service for sending high-volume phishing campaigns via mobile text messages. ” SMS Bandits offered an SMS phishing (a.k.a. Image: osint.fans. “But on the telecom front they were using fairly sophisticated tactics.”

Phishing 359

Phishing Telecommunications Advertising Mobile 359

Krebs on Security

AUGUST 28, 2020

Email service provider Sendgrid is grappling with an unusually large number of customer accounts whose passwords have been cracked, sold to spammers, and abused for sending phishing and email malware attacks. “And I just am not seeing anything this egregious in terms of viruses and spams from the other email service providers.”

Accountability 362

Accountability Hacking Authentication Marketing 362

Krebs on Security

AUGUST 18, 2022

The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of dollars. ” A copy of the phishing message included in the PayPal.com invoice.

Scams 346

Scams Phishing Accountability Software 346

Krebs on Security

AUGUST 5, 2019

If you bank online and choose weak or re-used passwords, there’s a decent chance your account could be pilfered by cyberthieves — even if your bank offers multi-factor authentication as part of its login process. Image: Hold Security.

Banking 275

Banking Passwords Risk Accountability 275

Krebs on Security

AUGUST 9, 2021

That was right after KrebsOnSecurity broke the news that someone had hacked BriansClub and siphoned information on 26 million stolen debit and credit accounts. com, and was wondering when the funds would be reflected in the balance of his account on the shop. Shortly after it came online as a phishing site last year, BriansClub[.]com

Phishing 363

Phishing Cybercrime Accountability Advertising 363

Malwarebytes

MARCH 19, 2025

California Cryobank (CCB) is a sperm donation and cryopreservation firm and one of the US top sperm banks. The information potentially involved varies by customer but includes names and one or more of the following: Drivers license numbers Bank account and routing numbers. 2FA that relies on a FIDO2 device cant be phished.

Banking 88

Banking Data breaches Computers and Electronics Passwords 88

Troy Hunt

AUGUST 30, 2023

They'd observed a phishing campaign that had collected 68k credentials from unsuspecting victims and asked if HIBP may be used to help alert these individuals to their exposure. Last week I was contacted by CERT Poland. Data accumulated by the malicious activity spanned from October 2022 until just last week.

Phishing 353

Phishing Password Management Passwords Banking 353

Krebs on Security

FEBRUARY 8, 2021

Cyber cops in Ukraine carried out an arrest and several raids last week in connection with the author of a U-Admin , a software package used to administer what’s being called “one of the world’s largest phishing services.” The U-Admin phishing panel interface. Image: fr3d.hk/blog. ” U-Admin, a.k.a.

Phishing 333

Phishing Scams Banking Mobile 333

Krebs on Security

OCTOBER 1, 2018

Most of us have been trained to be wary of clicking on links and attachments that arrive in emails unexpected, but it’s easy to forget scam artists are constantly dreaming up innovations that put a new shine on old-fashioned telephone-based phishing scams. After the unauthorized charges, he had just $300 remaining in his account.

Scams 279

Scams Phishing Banking Mobile 279

Krebs on Security

APRIL 23, 2020

Many security-conscious people probably think they’d never fall for a phone-based phishing scam. On Friday, April 17, Mitch received a call from what he thought was his financial institution, warning him that fraud had been detected on his account.

Banking 363

Banking Scams Accountability Phishing 363

Krebs on Security

SEPTEMBER 1, 2023

Domain names ending in “ US ” — the top-level domain for the United States — are among the most prevalent in phishing scams, new research shows. government, which is frequently the target of phishing domains ending in.US. US phishing domains.US This is noteworthy because.US is overseen by the U.S.

Phishing 297

Phishing Telecommunications Government DNS 297

Krebs on Security

OCTOBER 13, 2021

A recent phishing campaign targeting Coinbase users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. A Google-translated version of the now-defunct Coinbase phishing site, coinbase.com.password-reset[.]com. The Coinbase phishing panel. million Italians.

Passwords 363

Passwords Phishing Accountability Mobile 363

Krebs on Security

NOVEMBER 16, 2022

A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode , an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic. com — which was created to phish U.S.

Malware 334

Malware Banking Phishing DDOS 334

Malwarebytes

APRIL 1, 2025

This update must be completed by 2025-03-16 to avoid any potential penalties or disruptions to your account. If the receiver were to scan the QR code, they would be sent to a phishing site. Perhaps they’ll sell the details on the dark web, or use them for themselves to get access to your Microsoft accounts.

Scams 82

Scams Phishing Artificial Intelligence Social Engineering 82

Malwarebytes

FEBRUARY 27, 2024

For the most popular operating system in the world—which is Android and it isn’t even a contest —there’s a sneaky cyberthreat that can empty out a person’s bank accounts to fill the illicit coffers of cybercriminals. What are Android banking trojans? Take the SharkBot banking trojan, which Malwarebytes detects and stops.

Banking 145

Banking Passwords Accountability Malware 145

Krebs on Security

NOVEMBER 19, 2021

One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle , a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Check out their partner list here ].

Scams 363

Scams Banking Passwords Authentication 363

Krebs on Security

MARCH 17, 2021

Here’s the story of one such goof committed by Fiserv [ NASDAQ:FISV ], a $15 billion firm that provides online banking software and other technology solutions to thousands of financial institutions. Vegh could see the message from his bank referenced a curious domain: defaultinstitution.com.

Banking 351

Banking Accountability Software Mobile 351

eSecurity Planet

MARCH 31, 2025

Karin Zilberstein, vice president of Product at cybersecurity company Guardio, says the platform consistently ranks among the top 10 most imitated companies in phishing schemes. The rise in artificial intelligence and advanced phishing methods has made it even harder. Use a strong, unique password for your Netflix account.

Scams 89

Scams Artificial Intelligence Phishing Passwords 89

Troy Hunt

SEPTEMBER 17, 2020

As I started delving back through my own writing over the years, the picture became much clearer and it really crystallised just this week after I inadvertently landed on a nasty phishing site. In the end I broke it down into 3 Ps: padlocks, phishing and privacy. Maybe they're plugging into the API directly from the account page there?

VPN 363

VPN Phishing DNS Encryption 363

Security Affairs

JUNE 4, 2024

Resecurity uncovered a cybercriminal group that is providing a sophisticated phishing kit, named V3B, to target banking customers in the EU. “Currently, it is estimated that hundreds of cybercriminals are using this kit to commit fraud, leaving victims with empty bank accounts. .

Banking 128

Banking Phishing Social Engineering Engineering 128

SecureWorld News

MARCH 20, 2025

March Madness is here, and while fans are busy filling out brackets and making last-minute bets, cybercriminals are running their own full-court presstargeting unsuspecting fans with phishing scams, fake betting apps, and credential-harvesting schemes. This scenario follows the common phishing tactics: strike at personal interest.

Scams 80

Scams Social Engineering Mobile Phishing 80

Malwarebytes

MARCH 4, 2025

PayPal scammers are using an old Docusign trick to enhance the trustworthiness of their phishing emails. The Docusign Application Programming Interface (API) allows customers to send emails that come from genuine Docusign accounts, and they can use templates to impersonate reputable companies.

Scams 134

Scams Accountability Phishing Banking 134

SecureList

MARCH 25, 2025

Note that for mobile banking malware, we retrospectively revised the 2023 numbers to provide more accurate statistics. We also changed the methodology for PC banking malware by removing obsolete families that no longer use Trojan banker functionality, hence the sharp drop in numbers against 2023. million detections compared to 5.84

Phishing 72

Phishing Banking Scams Mobile 72

SecureList

JUNE 10, 2024

Individual countries have adopted laws that require certain types of organizations to protect users’ accounts with 2FA. You typically do this after you get hold of the victim’s account credentials but before attempting to sign in to their account. The particular hack scheme depends on the type of 2FA that it targets.

Phishing 145

Phishing Banking Social Engineering Accountability 145

Krebs on Security

NOVEMBER 5, 2024

At the end of 2023, malicious hackers learned that many large companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with little more than a username and password (no multi-factor authentication required). banks, ISPs, and mobile phone providers. banks, ISPs, and mobile phone providers.

Cybercrime 280

Cybercrime Mobile Media Hacking 280

Thales Cloud Protection & Licensing

JANUARY 31, 2025

Level Up Your Security: Embrace Passkeys and Phishing-Resistant 2FA andrew.gertz@t Fri, 01/31/2025 - 15:17 Celebrate Change Your Password Day and 2FA Day by embracing passkeys and phishing-resistant 2FA. When a user registers with a service, a unique passkey linked to their account is generated and stored securely on their device.

Phishing 62

Phishing Passwords Password Management Authentication 62

Malwarebytes

MARCH 17, 2025

Financial information, like your banking credentials and crypto wallets. Work with them to take the necessary steps to protect your identity and your accounts. com (phishing) convertitoremp3[.]it com (Phishing) convertix-api[.]xyz com (phishing) convertitoremp3[.]it com (Phishing) convertix-api[.]xyz

Malware 137

Malware Adware Education Phishing 137

Krebs on Security

AUGUST 19, 2020

The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. The employee phishing page bofaticket[.]com. Image: urlscan.io.

Phishing 363

Phishing VPN Social Engineering Media 363

Security Affairs

MAY 19, 2024

A new Grandoreiro banking trojan campaign has been ongoing since March 2024, following the disruption by law enforcement in January. IBM X-Force warns of a new Grandoreiro banking trojan campaign that has been ongoing since March 2024. The banking Trojan is likely operated as a Malware-as-a-Service (MaaS).

Banking 133

Banking Malware Antivirus Accountability 133

Daniel Miessler

MARCH 10, 2022

The answer is remarkably simple, actually— phishing. This means traditional MFA is becoming increasingly useless against phishing in the real world. In other words, is there a type of MFA that’s resistant to phishing? There’s nothing to type, so there’s nothing to phish. The answer is yes.

Authentication 364

Authentication Phishing Passwords Accountability 364

The Hacker News

JULY 15, 2024

Retail banking institutions in Singapore have three months to phase out the use of one-time passwords (OTPs) for authentication purposes when signing into online accounts to mitigate the risk of phishing attacks. Customers who have activated their digital

Banking 137

Banking Retail Phishing Passwords 137

Malwarebytes

APRIL 3, 2025

Recently weve been seeing quite a few phishing campaigns using QR codes in email attachments. The lure and the targets are varied, but the use of a QR code to get someone to visit the phishing site is fast becoming a preferred method for cybercriminals. For example, banking apps will be often be installed on the same device.

Phishing 93

Phishing Banking Mobile Accountability 93

Krebs on Security

SEPTEMBER 29, 2021

That service quickly went offline, but new research reveals a number of competitors have since launched bot-based services that make it relatively easy for crooks to phish OTPs from targets. Some services also target other popular social media platforms or financial services, providing email phishing and SIM swapping capabilities.”

Passwords 348

Passwords Mobile Authentication Banking 348

Malwarebytes

APRIL 25, 2022

Imagine logging into your bank’s website after responding to a text message claiming you’re due a refund, only to see a warning to watch out for bogus texts: Beware of SMS phishing! Or has money already been withdrawn from your account? Please contact us immediately on (available 24/7 for victims of phishing).

Phishing 143

Phishing Banking Scams Accountability 143