Cybercrime

Suspicious traffic could be testing CDN evasion, says expert

SANS Institute honeypots recently captured curious requests with CDN-related headers.

Hybrid 2FA phishing kits are making attacks harder to detect

A new Salty-Tycoon hybrid is slipping through defenses undetected, and weakening enterprise MFA.

Newly discovered malicious extensions could be lurking in enterprise browsers

Once-trusted Chrome and Edge add-ons have quietly turned into tools for data harvesting, search manipulation, and a remote-execution backdoor affecting more than 4.3 million users.

RomCom tries dropping a not-so-romantic payload on Ukraine-linked US firms

The new RomCom campaign uses SocGholish fake update lures to deliver its Mythic Agent tool against US firms doing business with Ukraine.

SpyCloud Data Shows Corporate Users 3x More Likely to Be Targeted by Phishing Than by Malware

Scattered Lapsus$ Hunters target Zendesk users with fake domains

Researchers found over 40 fake domains using the same setup as the group's August Salesforce attack.

OpenAI admits data breach after analytics partner hit by phishing attack

Mixpanel warns of phishing attacks after criminals steal email addresses and organization IDs from some customer profiles.