Krebs on Security

FEBRUARY 1, 2021

Authorities in the United Kingdom have arrested a 20-year-old man for allegedly operating an online service for sending high-volume phishing campaigns via mobile text messages. ” SMS Bandits offered an SMS phishing (a.k.a. Image: osint.fans. “But on the telecom front they were using fairly sophisticated tactics.”

Phishing 357

Phishing Telecommunications Advertising Mobile 357

Malwarebytes

APRIL 1, 2025

This update must be completed by 2025-03-16 to avoid any potential penalties or disruptions to your account. To proceed with the update, please scan the QR code below with your mobile device or click the link provided to access the secure tax portal. If the receiver were to scan the QR code, they would be sent to a phishing site.

Scams 139

Scams Phishing Artificial Intelligence Social Engineering 139

SecureList

MARCH 3, 2025

million attacks involving malware, adware or unwanted mobile software were prevented. Adware, the most common mobile threat, accounted for 35% of total detections. million malicious and potentially unwanted installation packages were detected, almost 69,000 of which associated with mobile banking Trojans. A total of 1.1

Mobile 116

Mobile Malware Adware Banking 116

SecureWorld News

NOVEMBER 22, 2024

The United States Department of Justice (DOJ) has unsealed charges against five individuals accused of orchestrating sophisticated phishing campaigns tied to the notorious Scattered Spider cybercrime group. As this case shows, phishing and hacking has become increasingly sophisticated and can result in enormous losses.

Phishing 108

Phishing Identity Theft Cryptocurrency Cybercrime 108

Malwarebytes

JANUARY 17, 2025

A cybercriminal campaign linked to Russia is deploying QR codes to access the WhatsApp accounts of high-profile targets like journalists, members of think tanks, and employees of non-governmental organizations (NGOs), according to new details revealed by Microsoft. There are a few simple rules that will help you avoid this kind of phishing.

Phishing 140

Phishing Accountability Mobile Risk 140

Krebs on Security

NOVEMBER 10, 2021

KrebsOnSecurity recently heard from a reader who said his daughter received an SMS that said it was from her bank, and inquired whether she’d authorized a $5,000 payment from her account. Since this seemed like a reasonable and simple request — and she indeed had an account at the bank in question — she responded, “NO.”

Banking 363

Banking Phishing Scams Accountability 363

eSecurity Planet

FEBRUARY 10, 2025

In a stark warning to organizations and everyday users alike, cybersecurity experts and government agencies have sounded the alarm over a new breed of Gmail-targeted phishing attacks. AI-Enhanced Cyberthreats Recent intelligence indicates that the sophistication of Gmail phishing campaigns has reached new heights.

Phishing 113

Phishing Artificial Intelligence Password Management Accountability 113

Krebs on Security

AUGUST 18, 2022

The missives — which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction — state that the user’s account is about to be charged hundreds of dollars. ” A copy of the phishing message included in the PayPal.com invoice.

Scams 340

Scams Phishing Accountability Software 340

Security Boulevard

JANUARY 9, 2025

A bad actor is using a Microsoft 365 test domain and a self-created distribution list to bypass traditional email protections and entice victims to hand over their PayPal account information in what Fortinet's CISO is calling a "phish-free" phishing campaign.

CISO 113

CISO Phishing Accountability Social Engineering 113

Krebs on Security

AUGUST 9, 2021

In late 2019, BriansClub changed its homepage to include doctored images of my Social Security and passport cards, credit report and mobile phone bill information. That was right after KrebsOnSecurity broke the news that someone had hacked BriansClub and siphoned information on 26 million stolen debit and credit accounts. com, vclub[.]cards,

Phishing 362

Phishing Cybercrime Accountability Advertising 362

Krebs on Security

AUGUST 18, 2021

T-Mobile is warning that a data breach has exposed the names, date of birth, Social Security number and driver’s license/ID information of more than 40 million current, former or prospective customers who applied for credit with the company. T-Mobile hasn’t yet responded to requests for clarification regarding how many of the 7.8

Mobile 262

Mobile Identity Theft Accountability Cybercrime 262

Krebs on Security

NOVEMBER 2, 2018

Thieves are combining SMS-based phishing attacks with new “cardless” ATMs to rapidly convert phished bank account credentials into cash. A number of financial institutions are now offering cardless ATM transactions that allow customers to withdraw cash using nothing more than their mobile phones.

Phishing 269

Phishing Banking Scams Accountability 269

Krebs on Security

FEBRUARY 8, 2021

Cyber cops in Ukraine carried out an arrest and several raids last week in connection with the author of a U-Admin , a software package used to administer what’s being called “one of the world’s largest phishing services.” The U-Admin phishing panel interface. Image: fr3d.hk/blog. ” U-Admin, a.k.a.

Phishing 329

Phishing Scams Banking Mobile 329

Malwarebytes

FEBRUARY 13, 2025

Phishers are using AI-based phishing attacks which have proven to raise the effectiveness of phishing campaigns. These often start with a call to users, claiming their Gmail account has been compromised. How to avoid AI Gmail phishing Never click on links or download files from unexpected emails or messages.

Phishing 110

Phishing Artificial Intelligence Identity Theft Accountability 110

Krebs on Security

MARCH 20, 2023

A new breach involving data from nine million AT&T customers is a fresh reminder that your mobile provider likely collects and shares a great deal of information about where you go and what you do with your mobile device — unless and until you affirmatively opt out of this data collection.

Mobile 314

Mobile Wireless Advertising Telecommunications 314

Krebs on Security

OCTOBER 13, 2021

A recent phishing campaign targeting Coinbase users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. A Google-translated version of the now-defunct Coinbase phishing site, coinbase.com.password-reset[.]com. The Coinbase phishing panel. million Italians.

Passwords 362

Passwords Phishing Accountability Mobile 362

Malwarebytes

APRIL 3, 2025

Recently weve been seeing quite a few phishing campaigns using QR codes in email attachments. The lure and the targets are varied, but the use of a QR code to get someone to visit the phishing site is fast becoming a preferred method for cybercriminals. DocuSign , Adobe), which increases the perceived legitimacy of the phish.

Phishing 141

Phishing Banking Mobile Accountability 141

Krebs on Security

NOVEMBER 3, 2020

Two young men from the eastern United States have been hit with identity theft and conspiracy charges for allegedly stealing bitcoin and social media accounts by tricking employees at wireless phone companies into giving away credentials needed to remotely access and modify customer account information. Prosecutors say Jordan K.

Scams 343

Scams Wireless Identity Theft Mobile 343

Krebs on Security

JULY 23, 2018

Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity. a mobile device). a mobile device).

Phishing 240

Phishing Authentication Mobile Passwords 240

Krebs on Security

AUGUST 30, 2022

A recent spate of SMS phishing attacks from one cybercriminal group has spawned a flurry of breach disclosures from affected companies, which are all struggling to combat the same lingering security threat: The ability of scammers to interact directly with employees through their mobile devices. Image: Cloudflare.com. 2, and Aug.

Mobile 338

Mobile Phishing Authentication Accountability 338

Krebs on Security

OCTOBER 1, 2018

Most of us have been trained to be wary of clicking on links and attachments that arrive in emails unexpected, but it’s easy to forget scam artists are constantly dreaming up innovations that put a new shine on old-fashioned telephone-based phishing scams. After the unauthorized charges, he had just $300 remaining in his account.

Scams 279

Scams Phishing Banking Mobile 279

Krebs on Security

AUGUST 19, 2020

The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. The employee phishing page bofaticket[.]com. Image: urlscan.io.

Phishing 363

Phishing VPN Social Engineering Media 363

Tech Republic Security

JANUARY 24, 2023

The criminals took advantage of an API to grab personal details such as customer names, billing addresses, email addresses, phone numbers, dates of birth, and T-Mobile account numbers. The post How hackers stole the personal data of 37 million T-Mobile customers appeared first on TechRepublic.

Mobile 216

Mobile Accountability Data breaches Phishing 216

The Last Watchdog

AUGUST 19, 2021

At the start of this week, word got out that hackers claimed to have seized personal data for as many as 100 million T-Mobile patrons. According to the attackers, this was a configuration issue on an access point T-Mobile used for testing. T-Mobile left a gate left wide open for attackers – and attackers just had to find the gate.”.

Mobile 235

Mobile Data breaches Authentication Accountability 235

eSecurity Planet

OCTOBER 28, 2024

We’ll also look at increased phishing attacks, a couple of different Cisco flaws, and a Fortinet vulnerability that took some time to get its own CVE. The problem: A zero-day use-after-free vulnerability in Samsung Mobile Processor’s m2m scaler driver could lead to privilege escalation. webflow.io, which indicates a phishing site.

Phishing 102

Phishing Authentication VPN Software 102

SecureWorld News

MARCH 20, 2025

March Madness is here, and while fans are busy filling out brackets and making last-minute bets, cybercriminals are running their own full-court presstargeting unsuspecting fans with phishing scams, fake betting apps, and credential-harvesting schemes. This scenario follows the common phishing tactics: strike at personal interest.

Scams 86

Scams Social Engineering Mobile Phishing 86

SecureList

MARCH 25, 2025

Note that for mobile banking malware, we retrospectively revised the 2023 numbers to provide more accurate statistics. Key findings Phishing Banks were the most popular lure in 2024, accounting for 42.58% of financial phishing attempts. Cryptocurrency phishing saw an 83.37% year-over-year increase in 2024, with 10.7

Phishing 78

Phishing Banking Scams Mobile 78

Krebs on Security

AUGUST 25, 2023

And there are indications that fraudsters may already be exploiting the stolen data in phishing attacks. 19, 2023, someone targeted a T-Mobile phone number belonging to a Kroll employee “in a highly sophisticated ‘SIM swapping’ attack.” ” T-Mobile has not yet responded to requests for comment. .

Mobile 236

Mobile Cyber Risk Data breaches Cryptocurrency 236

Security Affairs

NOVEMBER 25, 2024

.” An SMS blaster attack is a cyberattack where a large number of malicious or fraudulent SMS messages are sent to mobile devices within a specific area or to a targeted group. SMS blaster attacks can exploit vulnerabilities in mobile networks and typically require proximity to the targeted devices for localized attacks.

Mobile 123

Mobile Scams Technology Telecommunications 123

Krebs on Security

DECEMBER 29, 2024

Much of my summer was spent reporting a story about how advertising and marketing firms have created a global free-for-all where anyone can track the daily movements and associations of hundreds of millions of mobile devices , thanks to the ubiquity of mobile location data that is broadly and cheaply available.

Scams 222

Scams Cybercrime Cryptocurrency Social Engineering 222

Daniel Miessler

MARCH 10, 2022

The answer is remarkably simple, actually— phishing. This means traditional MFA is becoming increasingly useless against phishing in the real world. It might have been a text, or it could have been something “strong”, like a mobile authenticator app like Google Authenticator or Authy. The answer is yes.

Authentication 364

Authentication Phishing Passwords Accountability 364

Krebs on Security

APRIL 11, 2019

and higher can now be used as Security Keys , an additional authentication layer that helps thwart phishing sites and password theft. a one-time token, key fob or mobile device). But Google said starting this week, any mobile phone running Android 7.0+ (Nougat) can serve the same function as a USB-based security key.

Mobile 266

Mobile Authentication Passwords Accountability 266

Krebs on Security

SEPTEMBER 29, 2021

That service quickly went offline, but new research reveals a number of competitors have since launched bot-based services that make it relatively easy for crooks to phish OTPs from targets. Some services also target other popular social media platforms or financial services, providing email phishing and SIM swapping capabilities.”

Passwords 343

Passwords Mobile Authentication Banking 343

Krebs on Security

DECEMBER 16, 2021

Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent “SIM swaps,” scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities. Image: twitter.com/erupts.

Cryptocurrency 363

Cryptocurrency Mobile Accountability Scams 363

Krebs on Security

FEBRUARY 26, 2023

But it’s worth revisiting how this group typically got in to targeted companies: By calling employees and tricking them into navigating to a phishing website. But we do know the March 2020 attack was precipitated by a spear-phishing attack against a GoDaddy employee. In a filing with the U.S.

Hacking 324

Hacking Social Engineering Phishing Scams 324

Malwarebytes

FEBRUARY 25, 2025

Losing data related to a financial account can have severe consequences. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device cant be phished. Keep threats off your mobile devices by downloading Malwarebytes for iOS , and Malwarebytes for Android today.

Passwords 145

Passwords Password Management Phishing Authentication 145

Krebs on Security

APRIL 23, 2020

Many security-conscious people probably think they’d never fall for a phone-based phishing scam. On Friday, April 17, Mitch received a call from what he thought was his financial institution, warning him that fraud had been detected on his account.

Banking 363

Banking Scams Accountability Phishing 363