This week on the Lock and Code podcast…
Crooks are taking a holiday. They’re counting on you to fund it.
For decades, cybercriminals have stolen roughly the same types of data. Biographical and personal details—like Social Security numbers, birthdates, addresses, and phone numbers—can be stolen to commit identity fraud. Credit card numbers, expiration dates, and CVC codes can be stolen to make fraudulent purchases. Usernames and passwords can, in the wrong hands, let a cybercriminal impers
Crooks are taking a holiday. They’re counting on you to fund it.
For decades, cybercriminals have stolen roughly the same types of data. Biographical and personal details—like Social Security numbers, birthdates, addresses, and phone numbers—can be stolen to commit identity fraud. Credit card numbers, expiration dates, and CVC codes can be stolen to make fraudulent purchases. Usernames and passwords can, in the wrong hands, let a cybercriminal impersonate someone, steal sensitive photographs to later use for extortion, or abuse a reputation.
All of these attack models seek to turn sensitive or important data into currency. But an emerging form of digital fraud is targeting data that, when used strategically, practically is currency: Loyalty points.
Loyalty points programs are run by nearly every type of consumer-facing business today, from hotels to airlines to grocery stores to donut shops. As repeat customers accrue these points, they can exchange them for discounted prices on future purchases, cutting the costs of hotel stays, flights, rental cars, and even entire vacations.
But the value stored within these loyalty points makes them a high target for cybercrime, said Kim Sutherland, Global Head of Fraud and Identity at LexisNexis® Risk Solutions.
“Most loyalty currency is worth about one cent per point, and then there are premium programs that can be worth more than that,” Sutherland said, explaining that 100,000 airlines points, for example, can be worth $1,000 in the US. “Why criminals care so much about this is because most of us are not paying attention to our loyalty programs the same way we would our bank account.”
But diligence is much needed here, Sutherland said, noting that one Chicago teacher only learned that 240,000 of his airlines points had been stolen because he received a basic confirmation email about their use. In another example, a man’s airline miles were stolen and fraudulently used to book rental cars in New York and Memphis.
Today, on the Lock and Code podcast with host David Ruiz, we speak with Sutherland about loyalty points theft— how it happens, what companies are doing to protect customers, and what people can do to stay safe.
“Some of us don’t even know how to access those points, right? Or we don’t even know we’re accumulating them, but the fraudsters do.”
Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve — phishing pages and fake executive profiles often do their damage within hours of going live, while manual removal can take days. A managed takedown program pairs continuous, verified monitoring with pre-authorized removal (in-certain cases), cutting the exposure window from days to hours. This matters most for consulting and professional services firms, where a spoofed domain o
Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve — phishing pages and fake executive profiles often do their damage within hours of going live, while manual removal can take days. A managed takedown program pairs continuous, verified monitoring with pre-authorized removal (in-certain cases), cutting the exposure window from days to hours. This matters most for consulting and professional services firms, where a spoofed domain or fake executive profile can compromise the client trust the business is built on.
How UNC3753 targeted US professional services firms in 2026
Between January and May of 2026, Google's Mandiant threat intelligence team tracked a financially motivated extortion campaign — attributed to a group known as UNC3753, or "Luna Moth," or "Silent Ransom Group" — working its way through dozens of professional, legal, and financial services organizations across the United States. The approach was almost old-fashioned. A benign-looking email about a data migration or an unpaid invoice, a follow-up phone call from someone posing as IT support, and a request to install "remote monitoring" software to fix the problem. No exploit. No malware dropped on day one. Just a firm's own trust in its brand and its people, turned against it.
It's a useful — if unsettling — reminder of why brand and executive impersonation isn't a side issue for professional services firms. It's often the entry point.
How much does phishing and impersonation actually cost US businesses
The scale of the problem, in dollar terms, is no longer subtle. The FBI's Internet Crime Complaint Center logged just over one million complaints in 2025 — the highest volume in the program's history — with phishing and spoofing making up roughly a fifth of all reports. Losses tied to phishing alone roughly tripled year-over-year, and business email compromise, which almost always starts with an attacker impersonating someone the victim trusts, accounted for over $3 billion in reported losses on its own. The mechanics of that damage matter too: the overwhelming majority of BEC losses move through wire transfer or ACH, rails that are fast, largely irreversible, and unforgiving of a slow response.
Put those two facts together and a pattern emerges. Impersonation attacks — of a brand, a partner, an executive, a vendor invoice — aren't rare or exotic. They're the default opening move. And once the fraudulent domain, profile, or listing is live, the clock the defender is racing isn't measured in days. It's measured in hours, sometimes less, before money moves or credentials are harvested.
Why are consulting and professional services firms specifically targeted?
Professional services firms occupy a strange position in the threat landscape. They're rarely the most technically fortified target, but they're consistently one of the most valuable ones. A consulting firm doesn't just protect its own data — it holds engagement records, financial models, and confidential strategy documents belonging to dozens of clients across industries. About 29% of U.S. law firms reported having experienced a security breach at some point, according to the ABA's most recent Legal Technology Survey — up from 25% just two years earlier. The same dynamic applies to consultancies. The firm is a single point of entry into a much larger web of client relationships.
That's precisely the exposure described in Cyble's case study of a U.S. consulting organization managing highly sensitive engagement data, confidential client information, and a large, distributed workforce operating across the country. As the case study describes it, the firm's brand, executives, and digital infrastructure were frequent targets specifically because of the trust clients placed in them as an advisor. Senior partners were likely of being impersonated through fake social profiles and spoofed domains. Fraudulent job postings and phishing campaigns leaned on the firm's own credibility to look legitimate. The attacker doesn't need to breach the firm's network if a client can be convinced, through a look-alike domain or a cloned executive profile, to simply hand over what the attacker wants.
That's the mechanism UNC3753 exploited nationally in 2026, and it's the exact exposure this consulting firm was trying to close.
What is the "whack-a-mole" problem in brand protection?
Here's where most brand protection programs quietly fail, and it isn't a detection problem — it's a speed problem.
A typical manual takedown workflow looks something like this: someone on the security or marketing team spots a phishing page or a fake LinkedIn profile impersonating a partner. They file an abuse report with the registrar or the platform. They wait. Maybe they follow up. Eventually, the page comes down — but by then, a new one has often already gone live, sometimes registered by the same actor under a slightly different domain.
This was exactly the challenge the consulting firm faced before its engagement with Cyble. Identifying and removing phishing pages, fraudulent job postings, and impersonating domains was, in the case study's own words, reactive and resource-intensive, leaving the brand exposed for longer than the firm considered acceptable. It's a program that looks active — tickets filed, pages eventually removed — while the actual window of exposure, the hours where a client or job candidate could act on the fake page, stays wide open. Volume of takedowns filed is an easy number to report. Speed of resolution is the number that actually protects anyone.
What does managed takedown response actually involve
The shift the case study describes isn't just "faster takedowns" — it's a change in the operating model, from reactive point-solution to continuous, managed coverage. Three pieces work together in the deployment:
Brand and Executive Monitoring continuously scans for phishing domains, fraudulent job postings, and impersonation attempts using the firm's name, alongside dedicated monitoring of senior leadership profiles across social platforms — catching the fake partner LinkedIn account or spoofed domain before it's had time to circulate.
Verification before escalation means the security team isn't drowning in unconfirmed alerts. Threats are validated as genuine before they ever reach someone's desk, which is what separates consolidated intelligence from just another noisy dashboard.
Managed Takedown Services then handle the actual removal — confirmed phishing pages, impersonating domains, and fraudulent listings — without the internal team having to individually chase registrars and platforms one abuse ticket at a time.
The outcome is a meaningfully shortened window between detection and removal — turning a slow, manual, ticket-by-ticket grind into something closer to continuous coverage. That's the real distinction between a takedown service and a takedown program: one reacts when someone happens to notice a fake page; the other is built to notice, verify, and resolve on a timeline that assumes attackers move fast, because they do.
Why client trust is the real asset at risk
For a consulting firm, the financial cost of an impersonation attack is rarely the headline risk. The deeper cost is what it does to the relationship a firm's entire business is built on. When a client, a job candidate, or a prospective hire can't tell the difference between a legitimate email from the firm and a spoofed one, the firm's advisory credibility — the thing it's actually selling — starts to erode. That's a slower, quieter kind of damage than a wire fraud loss, but for a professional services firm, it may be the more expensive one.
The lesson from both the national threat data and this specific engagement is the same – brand and executive impersonation isn't a marketing nuisance to be cleaned up occasionally. It's a live attack surface, moving at a speed that manual, ad hoc takedown processes were never built to match. Firms that treat it that way — with continuous monitoring, verified alerts, and managed resolution — are the ones that keep the exposure window measured in hours instead of days.
Frequently asked questions (FAQs)
What is a brand impersonation takedown service?
A brand impersonation takedown service identifies fraudulent domains, phishing pages, fake social media profiles, and impersonating job listings that misuse a company's name or logo, then works with registrars, hosting providers, and platforms to have that content removed.
How long does it take to take down a phishing site?
Timelines vary by registrar and hosting provider, but manual, ticket-based takedown requests commonly take days to resolve. Managed takedown programs that pre-verify threats and maintain direct relationships with providers can shorten that window to hours.
Why do manual takedown processes fail against brand impersonation?
Manual processes fail because they're reactive: a person has to notice the fake page, file a report, and wait for a third party to act, while attackers can register replacement domains faster than any single report gets resolved. The volume of tickets filed can look productive even while the actual exposure window stays open.
What's the difference between takedown volume and takedown speed?
Takedown volume measures how many fraudulent pages were reported or removed over time. Takedown speed measures how quickly a live threat is detected, verified, and taken down after it appears. Speed is the metric that actually limits damage, since most harm from a phishing page happens in its first hours online.
How can consulting and professional services firms protect executives from impersonation?
Dedicated executive monitoring tracks senior leaders' names and likenesses across social platforms and the web to catch fake profiles, spoofed communications, and impersonation attempts early, ideally paired with managed takedown so confirmed threats are removed without requiring the executive or internal team to handle it themselves.
Sources:
FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Cyble, "How Cyble Delivered Unified Multi-Layered Threat Intelligence to a U.S. Consulting Organization"; Google/Mandiant, "Ongoing Targeted Campaign Against US Law Firms" (2026); American Bar Association Legal Technology Survey.
Note The July 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. Due to the nature of some sources, it may be difficult to fully verify the accuracy of certain information; therefore, it is necessary to cross-check these details against official announcements. Major Issues RaidForums changed […]
Note The July 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. Due to the nature of some sources, it may be difficult to fully verify the accuracy of certain information; therefore, it is necessary to cross-check these details against official announcements. Major Issues RaidForums changed […]
This week on the Lock and Code podcast…
Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.”
Pithy as the phrase sounds, it is undeniably true.
Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.
Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.”
Pithy as the phrase sounds, it is undeniably true.
Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.
So how is it that, on the dark web, your stolen identity can be purchased for just 95 cents?
That’s what a Malwarebytes researcher found last month after spending 48 hours inside the dark web to investigate cybercrime. Across a variety of forums and directories, he found subscription plans for malware that steals information once implanted on a device. He found guides for deploying social engineering scams. He found people selling their services to build fake websites that trick people into handing over their usernames and passwords. And he found one of the dark web’s most traded commodities—personal data, packaged together about individual people, to help a cybercriminal commit identity fraud.
These packages are called “fullz.” For victims in the United States, a fullz contains a full name, Social Security Number, date of birth, address, and other personal details. That is enough, on its own, for a cybercriminal to potentially open a bogus line of credit, file a fake tax return, access financial accounts, or obtain medical services under someone else’s name.
As we wrote on Malwarebytes Labs:
“For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”
It’s the kind of risk that could scare anyone, especially considering the scale behind it. In just the first six months of 2026, Malwarebytes found more than 7,500 compromised data sets on the dark web containing more than 8.4 billion records.
And yet, even today, cybersecurity professionals still get asked why anyone should bother protecting their data.
The public, understandably, are exhausted. With data breaches happening every week—if not every day—cybersecurity can start to feel pointless. With young people unable to build financial security, they start believing that they have nothing worth stealing. And with Big Tech already collecting our every movement, behavior, click, and concern, people understandably feel powerless to fight any kind of data abuse, be it corporate or criminal.
So today’s episode approaches the question from a different direction. This isn’t about why you should protect yourself—plenty of company websites will tell you that, and most of them rely on fear. This is about why hackers want your data in the first place.
Today, on the Lock and Code podcast, host David Ruiz explains how cybercriminals turn a single repeated password into account takeover, how a screenshot of your house from Google Maps became a tool in extortion emails, and why the most benign information about you—an address, an age, one public photo—is often the most useful data a stranger can buy.
Note The June 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. Due to the nature of the sources, it is sometimes difficult to fully verify the accuracy of certain information, and this is noted accordingly. Major Issue On Hasan’s BreachForums, there was a series of […]
Note The June 2026 Dark Web Issue Trend Report summarizes major issues that occurred on the deep web and dark web. Due to the nature of the sources, it is sometimes difficult to fully verify the accuracy of certain information, and this is noted accordingly. Major Issue On Hasan’s BreachForums, there was a series of […]
Small and medium-sized businesses (SMBs) remain attractive targets for cybercriminals – in both mass cyberattacks and sophisticated campaigns targeting larger enterprises through trusted relationship attacks. At the same time, smaller businesses may lack the robust cybersecurity policies and necessary resources to protect themselves against an evolving threat landscape.
Kaspersky believes that raising awareness can help small and medium-sized enterprises develop an effective protection strategy.
Small and medium-sized businesses (SMBs) remain attractive targets for cybercriminals – in both mass cyberattacks and sophisticated campaigns targeting larger enterprises through trusted relationship attacks. At the same time, smaller businesses may lack the robust cybersecurity policies and necessary resources to protect themselves against an evolving threat landscape.
Kaspersky believes that raising awareness can help small and medium-sized enterprises develop an effective protection strategy. Ahead of International SMB Day on June 27, Kaspersky presents the findings of its 2026 threat analysis for SMBs, which includes real-world examples of attacks.
Key findings
In the first four months of 2026, Kaspersky solutions detected over 33,300 cyberattacks on SMBs masquerading as popular artificial intelligence (AI) tools – almost five times more than in 2025 and 39% more than the number of attacks disguised as the office and collaboration tools that Kaspersky’s research focuses on.
Popular messengers and communication services remained the attacker’s most widespread lure, with almost 415,000 attacks involving fake messenger apps and video conferencing software.
The attackers follow trends: the AI tools Claude and OpenClaw (ex-ClawdBot/MoltBot), which have gained popularity in 2026, were among the common AI lures.
Fraudsters use fake AI tools to scam businesses out of money, while corporate accounts on social media also remain targets.
The majority of initial accesses to corporate infrastructures sold on the dark web are allegedly accesses to SMBs. This could be because SMBs tend not to be as well protected as large enterprises and, at the same time, may be trusted contractors for those well-protected enterprises.
Malware and potentially unwanted applications (PUAs) disguised as popular services
Kaspersky researchers used data from Kaspersky Security Network (KSN) to explore how frequently malicious and unwanted files are disguised as legitimate applications that may be used by SMBs. KSN is a system for processing anonymized cyberthreat-related data shared voluntarily by Kaspersky users. For this part of the report, only anonymized data received from users of Kaspersky solutions for SMBs were analyzed.
According to a survey by the Small Business & Entrepreneurship Council (SBE Council), small business owners continue to embrace artificial intelligence and digital transformation as they maintain a generally positive outlook on the economy. Threat actors are also aware of the hype surrounding AI and exploit it for their own benefit. In particular, they actively distribute cyberthreats under the guise of popular AI services.
From January to April 2026, Kaspersky solutions detected 33,352 attacks on SMB users in which malware or potentially unwanted applications for PCs were disguised as five popular AI services. This figure represents an increase of almost five times compared to the previous year. This highlights an evolving trend in which threat actors are weaponizing trust in widely used AI platforms and services, especially popular ones like Claude. Kaspersky experts note that it’s important to download apps from official sources and to verify which apps are available for which platforms.
Share of attacks targeting SMBs in which malware or PUAs mimic the five popular, legitimate AI apps that Kaspersky’s research focuses on, first four months of 2025 and 2026 (download)
In the first four months of 2026, Kaspersky researchers also identified more than1,100 unique samples of malware and PUAs detected in the SMB sector that masqueraded as five popular AI applications, representing a 21% increase compared to the same period of 2025. The samples were mainly different types of Trojware (Trojans and Trojan-like malware), including those capable of downloading and running other malware on compromised devices. Trojware disguises itself as harmless files to trick users into installing them. Their functionality may vary depending on the particular type of Trojware. This may include stealing, deleting, blocking, modifying or copying users’ data, as well as other malicious actions. Trojware therefore represents a highly dangerous cyberthreat to entrepreneurs and businesses.
Kaspersky experts also note that the threat landscape is constantly evolving with new lures appearing all the time. For example, in the first four months of 2026, Kaspersky solutions blocked hundreds of attacks in which malware or PUAs for PCs were disguised as OpenClaw (previously known as Clawdbot or Moltbot).
Other lures for SMBs: Fake communication apps and office software
Kaspersky analysts also explored how attackers leverage other legitimate applications as lures to target SMBs. For example, from January to April 2026, Kaspersky solutions blocked 414,736 attacks on SMB users in which malicious software or PUAs for PCs were disguised as the popular communication apps that Kaspersky’s report focuses on. The number of attacks changed marginally compared to the previous year’s figure, indicating that the lure of fake communication apps remains a serious cyberthreat.
Share of attacks targeting SMBs in which malware or PUAs mimic the four legitimate communication apps covered by Kaspersky’s research, first four months of 2025 and 2026 (download)
Various fake office applications and collaborative platforms also remain among the lures that attackers may exploit to target SMBs. According to Kaspersky telemetry, more than 24,000 attacks were detected from January to April 2026 in which malware or PUAs for PCs were disguised as specific office applications.
Share of attacks targeting SMBs in which malware or PUAs mimic the six popular office applications and collaboration tools covered by Kaspersky’s research, first four months of 2025 and 2026 (download)
In 2026, AI-related baits have become more widespread among cybercriminals than traditional fake office and collaboration tools. Kaspersky experts note that the more publicity and hype there is around certain tools, the more likely a user is to come across a fake package online.
Scammers and phishers tricking victims into providing credentials and funds
In 2026, Kaspersky researchers observed a wide range of phishing campaigns and scams targeting businesses and entrepreneurs. Fraudsters mimic financial and AI services as well as other platforms in order to steal credentials, personal information and funds.
In the following example, fraudsters disguise themselves as a bank that allegedly offers services for businesses (in other similar schemes they may offer business loans). Entrepreneurs are prompted to visit a scam website and enter their data to open a business account. The requested information varies depending on the scam, but may include name, email address, phone number, social security number, date of birth and address. Scammers may then use this data in their schemes or sell it on the dark web.
Kaspersky experts advise: if you encounter such a website, you should not rush to enter any data. First, examine it. Does the purported financial organization actually exist? How old is the website? Check the WHOIS records and read user reviews before entering any information on the page.
Example of a scam page targeting entrepreneurs
As with many other cyberthreats, AI services are also leveraged as a lure in scams. For example, Kaspersky experts identified a scam website for an AI service “built for contractors”. According to the text on the fraudulent page, the tool can help with “estimates, invoices and schedule”. However, in reality, in such schemes victims usually receive nothing after paying for a subscription, while the scammers get all the money.
Example of a scam page promoting an AI tool
Kaspersky experts note that business accounts on social networks and messengers remain attractive targets for cybercriminals in 2026. In one scheme, phishers distributed notifications with fake alerts related to companies’ business pages. The notifications claimed that Facebook’s review system had detected behavior that seriously violated its Community Standards and Advertising Policies. To avoid permanent restriction of their business page on the social network, owners were prompted to fill out an appeal form and provide personal and business email addresses, phone numbers, as well as the name of their business page and the password for their social network account. The attackers’ goal was to obtain credentials. To reduce user vigilance and appear legitimate, fraudsters also sent victims a fake appeal code.
Example of a fake notification
Email threats: Fake online documents and exploitation of legitimate platforms
Email remains one of the most widely used channels for cyberattacks targeting enterprises, including small and medium-sized businesses. In 2026, attackers have frequently combined email distribution with the exploitation of legitimate third-party platforms. This is how phishers and scammers usually attempt to bypass traditional email filters and exploit user trust in reputable services. Kaspersky researchers have also observed a large number of schemes targeting corporate users in which phishers and scammers use fake online documents or nonexistent meetings as bait.
In one recent scheme detected by Kaspersky, the attackers sent a fake notification disguised as a letter from OneDrive. The victim was prompted to access the document by clicking a button, but in reality, it led to a phishing website where users risked losing their confidential data. To make the email appear legitimate, the attackers added a phrase designed to lower the victim’s vigilance: “This item is encrypted and hosted within your secure cloud perimeter.” They also parsed the recipient’s email address and used the extracted data in the fake notification text so that the email looked like a standard notification from this type of service: “[email address domain as company name] has successfully uploaded a new file for [the user’s name as stated in their email address].”
Example of a phishing scheme with fake online documents
Attackers also use other pretexts to trick victims into sharing confidential information, for example fake compliance issues. In the example below, the attackers posed as Apple representatives. The fake notification stated: “Apple has identified a compliance issue related to Google Ads campaigns directing traffic to Apple product detail pages associated with the victim’s seller account.” However, the button in the email led to a phishing website where users are tricked into sharing confidential data.
Example of a fake compliance issue notification
Kaspersky experts observed another notable two-stage scheme aimed at stealing credentials from corporate emails, which involved distributing an invitation to a nonexistent meeting. The scheme is deployed in two stages. In stage one, a corporate user receives an email about a fictitious meeting. After clicking the “Accept Meeting Invitation” button, the user is redirected to a legitimate Zoom Docs (previous Zoom canvas brand) page. In stage two, the victim is prompted to click a hyperlink that reads “Click Here to Accept Meeting”. However, the URL of a phishing page is hidden behind this hyperlink.
Example of an email with a fake meeting
Zoom Docs page containing the phishing link
Malware is also actively distributed via email. In 2025, individuals and corporate users encountered over 144 million malicious and potentially unwanted email attachments, representing a 15% increase from the previous year.
Kaspersky experts note that the lures used in subject lines and texts of malicious emails can appear relatively harmless and rather unsophisticated. In the example below, the attackers target businesses with a fake request for “the best quote for the items attached.” However, the attached file actually contains a Trojan.
Example of a malicious email
Corporate infrastructure access for sale: Posts on the dark web
To assess threat actor activity, Kaspersky Digital Footprint Intelligence experts analyzed hundreds of posts offering initial access to corporate infrastructures published on dark web forums from January to April of both 2025 and 2026. Kaspersky experts note that a single post may contain several offers for access to different allegedly compromised companies.
Example of a post on a darknet forum
Initial access brokers (IABs) sell initial access to compromised businesses, for example, via RDP or web shells. In their posts, IABs may provide information about the region where the allegedly compromised companies are located, their industry and revenue, as well as the type of access. IABs sell access that the buyers can then use for different purposes, including ransomware attacks, stealing corporate confidential information or other fraudulent activity. The price of initial access on dark web forums may depend on the revenue, industry or location of the allegedly compromised companies, or on the access privileges. For example, accounts with admin rights are usually more expensive because they can provide attackers with a wide range of possibilities.
According to the research, there were more posts offering initial access to companies of different sizes located in the Middle East (up 53% from last year), Africa (up 40%) and Latin America (up 17%). Meanwhile the number of posts related to companies located in Europe decreased by 34%. According to Kaspersky experts, this decline can be partially explained by the closure of a dark web forum containing such posts around the time of the study. The number of publications related to companies located in the APAC region also decreased slightly (down 4%), but remained at a consistently significant level for the second year in a row.
At the same time, the number of posts where the region was not specified decreased by 56% in 2026 compared to the previous year. Kaspersky analysts assume that this may indicate that initial access posts from IABs are becoming more targeted and unique.
Share of posts with initial access offers by business size
For this research, Kaspersky experts defined a small business as having an annual revenue of up to US$50 million, and a medium-sized business as having an annual revenue of between US$50 million and US$1 billion.
According to Kaspersky’s research, at the beginning of 2026 the share of posts on dark web forums with offers of initial access to allegedly compromised small businesses was larger than the shares of posts offering access to medium, large or nonprofit organizations. However, this share decreased in the first four months of 2026 compared to the same period in 2025. The share of posts concerning medium‑sized organizations also remained significant for two consecutive years. Taken together, posts concerning small and medium‑sizedorganizations account for more than half of all the analyzed posts with initial access offers on dark web forums.
At the same time for a certain number of posts initial access brokers didn’t indicate companies’ revenue, therefore, making it impossible to determine the size of the company.
Share of posts with initial access offers by business size, January–April 2025 (download)
Share of posts with initial access offers by business size, January–April 2026 (download)
Kaspersky experts note that despite the prevalence of posts concerning small businesses, threat actors may target medium‑sized businesses because they generate higher revenues than small businesses and may have weaker security defenses than large businesses.
SMBs can also become targets as a part of trusted relationship attacks, which enable the attackers to reach larger organizations. According to the Global Report by Kaspersky Security Services, the share of trusted relationship attacks among the initial vectors increased from 12.7% in 2024 to 15.5% in 2025. Therefore, the common belief that small and medium‑sized enterprises are of no interest to attackers is a misconception. Companies of all sizes need to understand the cyberthreat landscape, adhere to cybersecurity rules, implement appropriate cybersecurity solutions, and continuously improve employee awareness.
Cybersecurity action plan for SMBs
SMBs can reduce risks and ensure business continuity by investing in comprehensive cybersecurity solutions and increasing employee awareness. To protect themselves from the ever-evolving threat landscape, companies are advised to follow these rules:
Define access rules for corporate resources such as internet services, email accounts, shared folders, and online documents. Keep access lists up to date and revoke access promptly when employees leave the company.
Regularly back up important data to ensure the preservation of corporate information in case of emergencies.
Establish clear guidelines for using external services and resources. Create well-defined procedures for coordinating specific tasks, such as implementing new software, with the IT department and other responsible managers. Develop short, easy-to-understand cybersecurity guidelines for employees, with a special focus on account and password management, email protection, and safe web browsing. A well-rounded training program will equip employees with the necessary knowledge and ability to apply it in practice.
Raise employees’ security awareness. Conduct dedicated training to teach staff how to detect and address potential threats, and track their educational progress. Organizations can achieve this with the Kaspersky Automated Security Awareness Platform through interactive online modules and simulated phishing campaigns that build sustainable cyber hygiene habits across all teams.
Implement specialized cybersecurity solutions that fit your budget, size, and industry requirements, with an emphasis on scalability and ease of integration.
Kaspersky Small Office Security Premium is an easy-to-use solution that protects against advanced threats and also provides access to security awareness training for employees, making it ideal for micro-businesses.
Small and medium-sized enterprises with more mature IT expertise should consider Kaspersky Next Optimum, which is designed specifically for growing organizations and offers real-time protection, threat visibility, as well as EDR and XDR investigation and response capabilities.
Protect your business against email-borne threats.Kaspersky Security for Mail Server, a comprehensive email security platform that offers robust, multi-layered protection at mailbox and gateway levels, can help with this. Powered by machine learning and leading global threat intelligence, it effectively addresses all mail security challenges.
Adopt specialized solutions such as Kaspersky Digital Footprint Intelligence to monitor the surface, deep, and dark webs for information about a company’s credentials, leaked data, and lookalike websites. Small and medium-sized companies with limited IT security budgets can partner with a managed security service provider (MSSP) to access this comprehensive digital risk protection service at an affordable, subscription-based price point.
What would you trade for a technology that can do almost anything? For many people, the answer is clear: Everything they thought they could trust.In a few, short years, Artificial Intelligence (AI) tools have granted people unfettered access to easier writing, faster image generation, quicker coding, and near-instantaneous answers, advice, and information—advantages they value and want. But the same tools that can spruce up a dating profile or reimagine an old photograph can also manipulate the
What would you trade for a technology that can do almost anything? For many people, the answer is clear: Everything they thought they could trust.
In a few, short years, Artificial Intelligence (AI) tools have granted people unfettered access to easier writing, faster image generation, quicker coding, and near-instantaneous answers, advice, and information—advantages they value and want. But the same tools that can spruce up a dating profile or reimagine an old photograph can also manipulate the broader world online, and people are noticing.
According to new research from Malwarebytes, 88% of people said it’s becoming harder to tell what content online is genuinely human or real, with 84% saying that “convincing video evidence” no longer feels like proof. Further, 85% said it can be hard to tell scams apart from the real thing—a major uptick from the 66% who said the same thing last year.
These are the first signs of AI’s counterfeit world. Replete with fake websites, fake products, fake videos, fake pictures, fake voices, and even fake people, it is threatening to swallow the web.
The damage arrives in large moments and small, from the US parent who said they “received a voicemail that sounded exactly like my son’s voice, saying he was in trouble and needed money for legal fees,” to the two entirely unrelated respondents fooled by the same AI-generated video of rabbits bouncing on a trampoline, to the individual worried about “my grandfather showing me AI slop and he thought it was real.”
For this research, Malwarebytes surveyed 1,500 adults aged 18 and older across the US, UK, Austria, Germany, and Switzerland about their uses, feelings, and concerns regarding AI. The sample was equally split for gender with a spread of ages, geographical regions, and race groups, and weighted to provide a balanced view.
The complete findings can be found in the full report:
88% said it’s becoming harder to tell what content online is genuinely human or real
84% said convincing video evidence no longer feels like proof
85% of people said it’s hard to tell a scam from the real thing (up from 66% last year)
50% have experienced some form of AI fraud or scam, such as being misled by AI-generated photos of products or receiving a highly personalized scam message
19% have specifically experienced some form of AI-driven identity harm, including the 10% who have had someone use AI to generate sexually explicit content of them without permission
81% fear someone stealing their family’s likeness, yet only 13% have created a family codeword to guard against it
67% worry about voice cloning, yet only 19% have turned off voicemail recordings to prevent it
45% say it’s okay to use AI for personal emotional tasks (like writing wedding vows or a eulogy)
34% say it’s okay to use AI to help create or improve a dating profile
One in three self-avowed daily users of AI said it’s okay to generate explicit images of someone without their consent
Defeat would be the wrong lesson to take from all this. It is true now that the internet requires assistance, but there are plenty of safe places to seek help.
While Malwarebytes works to provide new tools, we’d like to remind both the AI anxious and the eager about the first rule of the internet: Remember the human. People’s voices, bodies, choices, and agency belong to them and them alone.
As for every fake video, product, website, and image, understand that there’s help. No one needs to navigate an artificial internet alone. Whether through scam detection, identity protection, and simple awareness, people have more options than they may realize.
When a senior executive at a Dubai-based energy conglomerate receives a WhatsApp message that appears to come directly from their CEO — complete with the right profile photo, a familiar tone, and an urgent wire transfer request. This type of CEO fraud, CEO impersonation scam, or executive impersonation attack is becoming one of the most effective forms of financial cybercrime targeting Gulf organizations.
According to Cyble’s Middle East & Africa Threat Landscape Report: Q1 2026 report,
When a senior executive at a Dubai-based energy conglomerate receives a WhatsApp message that appears to come directly from their CEO — complete with the right profile photo, a familiar tone, and an urgent wire transfer request. This type of CEO fraud, CEO impersonation scam, or executive impersonation attack is becoming one of the most effective forms of financial cybercrime targeting Gulf organizations.
According to Cyble’s Middle East & Africa Threat Landscape Report: Q1 2026 report, executive impersonation has emerged as one of the most targeted and financially damaging attack vectors facing organizations in the UAE, Saudi Arabia, and Qatar in 2026.
Why Gulf Executives Are Prime Targets
Gulf executives sit at a uniquely lucrative intersection for threat actors: energy wealth, cross-border financial authority, and high political exposure. The UAE and Saudi Arabia's sovereign wealth funds — ADIA, Mubadala, PIF — operate across dozens of markets, and the executives overseeing them routinely authorize large international transactions while maintaining visible digital footprints on platforms like LinkedIn.
That visibility draws both financially motivated attackers and state-sponsored actors. Senior figures at government-linked entities and national oil companies are espionage targets as much as fraud targets — a dynamic illustrated when threat actors attempted to harvest executive credentials at Saudi Aramco through spear-phishing emails designed to mimic internal communications.
What SAMA's Cybersecurity Framework Requires
For organizations operating in Saudi Arabia's financial sector, the Saudi Arabian Monetary Authority (SAMA) Cybersecurity Framework sets direct expectations around executive-level risk. The framework mandates that organizations implement identity and access management controls, establish threat intelligence programs, and maintain incident detection and reporting capabilities — including those that address impersonation risks at the leadership level.
Specifically, SAMA's controls require organizations to assess and manage risks associated with social engineering and targeted attacks against key personnel. This includes monitoring for unauthorized use of executive identities, maintaining awareness of digital exposure, and having documented response procedures when impersonation attempts are detected or confirmed.
Failure to meet these requirements carries regulatory consequences, but more immediately, it leaves financial institutions open to the kind of Business Email Compromise (BEC) CEO fraud, whaling attacks, and executive fraud schemes that have cost Gulf organizations tens of millions of dollars in recent years.
For executive stakeholders, Cyble's executivemonitoring provides a strategic view of of these external threats, helping organizations track emerging risks and make informed decisions before incidents escalate.
Attack Methods Specific to This Region
LinkedIn Impersonation: Attackers clone executive profiles on LinkedIn — photos, job history, connections — to approach employees or vendors with fraudulent requests, exploiting the platform's trusted reputation to bypass skepticism.
WhatsApp CEO Fraud: Because WhatsApp doubles as a primary business channel across the Gulf, attackers clone or hijack executive accounts to send urgent, convincing requests to finance and HR staff with little reason to question them.
Fake Domain Creation: Threat actors register lookalike domains — tweaked letters, swapped TLDs, added hyphens — to spoof corporate email and portal infrastructure, with Cyble tracking dozens targeting UAE and Saudi entities in 2025 alone, several timed to coincide with public announcements.
Deepfake Fraud: Threat actors are experimenting with AI-generated voice and video content to impersonate senior executives during financial approval workflows.
Publicly Reported Incidents in the Region
The threat is not theoretical. Several high-profile incidents have put Gulf organizations on alert in recent years.
In Qatar, a state-linked organization was targeted in 2022 as part of a broader campaign attributed to Iranian-nexus threat actors, with spear-phishing attempts specifically designed to harvest credentials from senior personnel. The incident underscored the political dimension of executive targeting in the region.
In Saudi Arabia, threat actors linked to the Lazarus Group — a North Korean state-sponsored actor — have been documented targeting financial institutions and energy sector executives through spear-phishing lures tailored to the Saudi business context, including fake recruitment offers and investment communications.
In the UAE, a 2023 incident involving a Dubai-based financial services firm saw attackers use a combination of LinkedIn reconnaissance and WhatsApp impersonation to attempt a multi-stage BEC fraud.
How Cyble Vision Detects Threats at the Recon Stage
Most executive impersonation attacks succeed not because defenses fail at the moment of attack, but because organizations have no visibility into the reconnaissance phase that precedes it. By the time a fraudulent LinkedIn profile is being used to approach employees, or a lookalike domain is sending phishing emails, the attacker has already completed weeks or months of preparation.
Cyble Vision is designed to interrupt this cycle early. The platform monitors across the surface web, deep web, and dark web for indicators that an organization or its executives are being profiled for attack. This includes detection of:
Lookalike domain registrations that mimic corporate identities are flagged in near-real time as they appear in certificate transparency logs and domain registries.
Dark web mentions of executive names, email addresses, or corporate credentials being traded or discussed in threat actor communities.
Fraudulent social media profiles that impersonate executives or use scraped corporate branding.
Leaked credentials from third-party breaches that could be used to compromise executive accounts or enable account takeover.
By identifying these indicators before campaigns become operational, Cyble Vision gives security teams critical lead time to respond — whether by dismantling malicious infrastructure, notifying at-risk individuals, or strengthening defenses before attackers can gain traction.
Get the intelligence that matters. Download the Cyble META Threat Landscape Report for a full breakdown of threat actors, attack patterns, and risk signals across META.
Introduction
The primary goal for attackers in a phishing campaign is to bypass email security and trick the potential victim into revealing their data. To achieve this, scammers employ a wide range of tactics, from redirect links to QR codes. Additionally, they heavily rely on legitimate sources for malicious email campaigns. Specifically, we’ve recently observed an uptick in phishing attacks leveraging Amazon SES.
The dangers of Amazon SES abuse
Amazon Simple Email Service (Amazon SES) is a cl
The primary goal for attackers in a phishing campaign is to bypass email security and trick the potential victim into revealing their data. To achieve this, scammers employ a wide range of tactics, from redirect links to QR codes. Additionally, they heavily rely on legitimate sources for malicious email campaigns. Specifically, we’ve recently observed an uptick in phishing attacks leveraging Amazon SES.
The dangers of Amazon SES abuse
Amazon Simple Email Service (Amazon SES) is a cloud-based email platform designed for highly reliable transactional and marketing message delivery. It integrates seamlessly with other products in Amazon’s cloud ecosystem, AWS.
At first glance, it might seem like just another delivery channel for email phishing, but that isn’t the case. The insidious nature of Amazon SES attacks lies in the fact that attackers aren’t using suspicious or dangerous domains; instead, they are leveraging infrastructure that both users and security systems have grown to trust. These emails utilize SPF, DKIM, and DMARC authentication protocols, passing all standard provider checks, and almost always contain .amazonses.com in the Message-ID headers. Consequently, from a technical standpoint, every email sent via Amazon SES – even a phishing one – looks completely legitimate.
Phishing URLs can be masked with redirects: a user sees a link like amazonaws.com in the email and clicks it with confidence, only to be sent to a phishing site rather than a legitimate one. Amazon SES also allows for custom HTML templates, which attackers use to craft more convincing emails. Because this is legitimate infrastructure, the sender’s IP address won’t end up on reputation-based blocklists. Blocking it would restrict all incoming mail sent through Amazon SES. For major services, that kind of measure is ineffective, as it would significantly disrupt user workflows due to a massive number of false positives.
How compromise happens
In most cases, attackers gain access to Amazon SES through leaked IAM (AWS Identity and Access Management) access keys. Developers frequently leave these keys exposed in public GitHub repositories, ENV files, Docker images, configuration backups, or even in publicly accessible S3 buckets. To hunt for these IAM keys, phishers use various tools, such as automated bots based on the open-source utility TruffleHog, which is designed for detecting leaked secrets. After verifying the key’s permissions and email sending limits, attackers are equipped to spread a massive volume of phishing messages.
Examples of phishing with Amazon SES
In early 2026, one of the most common themes in phishing emails sent with Amazon SES was fake notifications from electronic signature services.
Phishing email imitating a Docusign notification
The email’s technical headers confirm that it was sent with Amazon SES. At first glance, it all looks legitimate enough.
Phishing email headers
In these emails, the victim is typically asked to click a link to review and sign a specific document.
Phishing email with a “document”
Upon clicking the link, the user is directed to a sign-in form hosted on amazonaws.com. This can easily mislead the victim, convincing them that what they’re doing is safe.
Phishing sign-in form
The resulting form is, of course, a phishing page, and any data entered into it goes directly to the attackers.
Amazon SES and BEC
However, Amazon SES is used for more than just standard phishing; it’s also a vehicle for a very sophisticated type of BEC campaigns. In one case we investigated, a fraudulent email appeared to contain a series of messages exchanged between an employee of the target organization and a service provider about an outstanding invoice. The email was sent as if from that employee to the company’s finance department, requesting urgent payment.
BEC email featuring a fake conversation between an employee and a vendor
The PDF attachments didn’t contain any malicious phishing URLs or QR codes, only payment details and supporting documentation.
Forged financial documents
Naturally, the email didn’t originate with the employee, but with an attacker impersonating them. The entire thread quoted within the email was actually fabricated, with the messages formatted to appear as a legitimate forwarded thread to a cursory glance. This type of attack aims to lower the user’s guard and trick them into transferring funds to the scammers’ account.
Takeaways
Phishing via Amazon SES experienced an uptick in January 2026 and has remained relatively steady through Q1. By weaponizing this service, attackers avoid the effort of building dubious domains and mail infrastructure from scratch. Instead, they hijack existing access keys to gain the ability to blast out thousands of phishing emails. These messages pass email authentication, originate from IP addresses that are unlikely to be blocklisted, and contain links to phishing forms that look entirely legitimate.
Since these Amazon SES phishing attacks stem from compromised or leaked AWS credentials, prioritizing the security of these accounts is critical. To mitigate these risks, we recommend following these guidelines:
Implement the principle of least privilege when configuring IAM access keys, granting elevated permissions only to users who require them for specific tasks.
Transition from IAM access keys to roles when configuring AWS; these are profiles with specific permissions that can be assigned to one or several users.
Enable multi-factor authentication, an ever-relevant step.
Configure IP-based access restrictions.
Set up automated key rotation and run regular security audits.
Use the AWS Key Management Service to encrypt data with unique cryptographic keys and manage them from a centralized location.
We recommend that users remain vigilant when handling email. Do not determine whether an email is safe based solely on the From field. If you receive unexpected documents via email, a prudent precaution is to verify the request with the sender through a different communication channel. Always carefully inspect where links in the body of an email actually lead. Additionally, robust email security solutions can provide an essential layer of protection for both corporate and personal correspondence.
Many times a day worldwide, a boss asks one of their team members to perform a task during a video call. But is the person assigning tasks actually who they say they are? Or is it a deepfake? Instead of blindly following orders, employees must now ask themselves if they are becoming a victims of fraud.
Earlier this year, a finance worker found themselves talking on a video meeting with someone who looked and sounded just like their CFO. After the meeting was over, they then dutifully followed t
Many times a day worldwide, a boss asks one of their team members to perform a task during a video call. But is the person assigning tasks actually who they say they are? Or is it a deepfake? Instead of blindly following orders, employees must now ask themselves if they are becoming a victims of fraud.
Earlier this year, a finance worker found themselves talking on a video meeting with someone who looked and sounded just like their CFO. After the meeting was over, they then dutifully followed their boss’s instructions to send $200 million Hong Kong dollars, which equals $25 million.
But it wasn’t actually their boss — just an AI video representation called a deepfake. Later that day, the employee realized their terrible mistake after checking with the corporate offices of their multinational firm. They had been a victim of a deepfake scheme that defrauded the organization out of $25 million.
While deepfakes, also referred to as synthetic media, targeted at individuals typically serve to manipulate people, cyber criminals targeting businesses are looking for monetary gain. According to the CISA Contextualizing Deepfake Threats to Organizations information sheet, threats targeting businesses tend to fall into one of three categories: executive impersonation for brand manipulation, impersonation for financial gain or impersonation to gain access.
But the recent incident in Hong Kong wasn’t just one employee making a mistake. Deepfake schemes are becoming increasingly common for businesses. A recent Medus survey found that the majority (53%) of finance professionals have been targeted by attempted deepfake schemes. Even more concerning is the fact that more than 43% admitted to ultimately falling victim to the attack.
The key word from the Medus research is “admitted.” And it raises a big question. Do people fail to report being a victim of a deepfake attack because they are embarrassed? The answer is probably. After the fact, it seems obvious it was a fake to other people. And it’s tough to admit that you fell for an AI-generated image. But the underreporting only adds to the shame and makes it easier for cyber criminals to get away with it.
Most people assume that they could spot a deepfake. But that’s not the case. The Center for Humans and Machines and CREED found a wide gap between people’s confidence in identifying a deepfake and their actual performance. Because many people overestimate their ability to identify a deepfake, it adds to the shame when someone falls victim, which likely leads to underreporting.
Why people fall for deepfake schemes
The employee who was tricked by the deepfake of the CFO to the tune of $25 million later admitted that when they first got the email supposedly from his CFO, the mention of a secret transaction made them wonder if the email was actually a phishing email. But once he got on the video, they recognized other members of his department in the video and decided it was authentic. However, the employee later learned that the video images of his department members were also deepfakes.
Many people who are victims overlook their concerns, questions and doubts. But what makes people, even those educated on deepfakes, push their concerns to the side and choose to believe an image is real? That’s the $1 million — or $25 million — question that we need to answer to prevent costly and damaging deepfake schemes in the future.
Sage Journals asked the question about who was more likely to fall for deepfakes and didn’t find any pattern around age or gender. However, older individuals may be more vulnerable to the scheme and have a hard time detecting it. Additionally, the researchers found that while awareness is a good starting point, it appears to have limited effectiveness in preventing people from falling for deepfakes.
However, computational neuroscientist Tijl Grootswagers of Western Sydney University likely hit the nail on the head as to the challenge of spotting a deepfake: it’s a brand new skill for each of us. We’ve learned to be skeptical of news stories and bias, but questioning the authenticity of an image we can see goes against our thought processes. Grootswagers told Science Magazine “In our lives, we never have to think about who is a real or a fake person. It’s not a task we’ve been trained on.”
Interestingly, Grootswagers discovered that our brains are better at detection without our intervention. He discovered that when people looked at a picture of a deepfake, the image resulted in a different electrical signal to the brain’s visual cortex than a legitimate image or video. When asked why, he wasn’t quite sure — maybe the signal never reached our consciousness due to interference from other brain regions, or maybe humans don’t recognize the signals that an image is fake because it’s a new task.
This means that each of us must begin to train our brain to consider that any image or video that we view could possibly be a deepfake. By asking this question each and every time we begin to act on content, we may be able to begin detecting our brain signals that are spotting the fakes before we can. And most importantly, if we do fall victim to a deepfake, especially at work, it’s key that each of us reports all instances. Only then can experts and authorities begin to curb the creation and proliferation.
Entrar
