Cato CTRL exposed the MuddyWater SimpleHelp campaign in Israel using tax lures. Learn how the MuddyWater SimpleHelp campaign abuses RMM tools.

Related Posts:

• APT29 Uses Watering Holes and Plerdy Tracker to Deploy Mobile Exploits
• mSecure Security Notification Prompts Password Resets
• Threat Actors Hijack Enterprise AI Models in Costly LLMJacking Cloud Attacks

The post Suspected MuddyWater SimpleHelp Campaign Targets Israeli Organizations With Tax Lures appeared first on Daily CyberSecurity.

Trellix uncovers the Sirius Backdoor in fake FedEx tax invoices. See how the fileless Sirius Backdoor blinds EDRs and survives Windows OS resets.

Related Posts:

• Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
• Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal Crypto Recovery Phrases
• Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack

The post Fake FedEx Tax Invoice PDFs Deliver Fileless Sirius Backdoor to Windows Systems appeared first on Daily CyberSecurity.

A CAPCOM ID data breach exposed 11.77 million records, including emails and login activity. No payment data was leaked.

Related Posts:

• Quest Diagnostics Data Breach Hits Quanum Lab Services Manager Patient Records
• Zeabur Shutdown Follows Repeated Data Breaches
• Railway Security Incident Exposes Customer Environment Variables and Pauses All Deployments

The post CAPCOM ID Data Breach Exposes 11.77 Million Records appeared first on Daily CyberSecurity.

The EU's Booking.com DSA investigation targets fake listings, Booking.com phishing scams and hidden ads. Fines could hit 6% of global turnover.

Related Posts:

• Claude Duet AI Agent Takes On OpenAI Dots and Muse
• Gemini in Apple CarPlay Arrives on Google Maps
• Chrome ClickFix Protection Scans Risky Clipboard Commands

The post EU Opens Booking.com DSA Investigation Over Fake Listings and Phishing Scams appeared first on Daily CyberSecurity.

Chrome ClickFix protection in Enhanced Protection flags risky clipboard commands and uses cloud Gemini AI to block scam sites.

Related Posts:

• cURL Vulnerability Reporting Policy Shifts to GitHub
• Apple Blocks WebKit Identity Resolution in Privacy Shift
• UK CMA Moves to Unlock iPhone Contactless Payments

The post Chrome ClickFix Protection Scans Risky Clipboard Commands appeared first on Daily CyberSecurity.

Huntress uncovers a WatchGuard VPN phishing campaign where a WatchGuard VPN phishing site steals logins twice before serving the real client.

Related Posts:

• GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps
• Hirudo Android Banking Trojan Replaces Genuine Banking Apps With Patched Copies
• CodeAudit AI VS Code Extension Captures Developer Source Code in the Background

The post Fake WatchGuard VPN Site Steals Credentials Before Delivering Genuine Installer appeared first on Daily CyberSecurity.

Microsoft and Proofpoint executed a CoGUI phishing kit takedown, seizing domains from YAM Store and Iron Man after 1B scam messages hit 75,000 firms.

Related Posts:

• Meta, Tech Firms and Police Hit West Africa Scam Centers in Joint Operation That Led to 28 Arrests
• DOJ Charges Engineer After OpenAI Recording Device Arrest
• DOJ Disrupts DPRK IT Worker Schemes Across More Than 70 US Companies

The post Microsoft and Proofpoint Disrupt CoGUI Phishing Kit, YAM Store, and Iron Man appeared first on Daily CyberSecurity.

Kimsuky spear phishing lures target Ukrainian security experts with fake invitations, as Operation GitPower abuses GitHub and GitLab.

Related Posts:

• Massive Cyberattack Paralyzes French Supermarket Refrigeration
• Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
• UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers

The post Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower appeared first on Daily CyberSecurity.

UAT-11985 used AI-written lures and an AitM phishing kit in a Taiwan spear-phishing campaign that steals Google logins and bypasses MFA.

Related Posts:

• Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK
• The Devastating Ledger Security Breach
• The Reality of Ransomware Recovery Services

The post UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers appeared first on Daily CyberSecurity.

A Power BI phishing campaign uses Microsoft's real domain to install rogue ScreenConnect clients. Learn how it works and how to block it.

Related Posts:

• 16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases
• The Silent Threat of Midnight Mimosa Malware
• Rogue AI Agents Hijacked urlquery Scan Browsers to Reach Russian Bankruptcy Records

The post Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients appeared first on Daily CyberSecurity.

Denmark CPR data breach: attackers abused a firm's access, leaving CPR numbers exposed for 8.8 million people. Here is what to know and do.

Related Posts:

• Trump Mobile Data Breach Exposes 3,615 Customers in BYOD Leak
• AI Coding Agents Leak 13,000 Internal Screenshots to Public GitHub Repos
• Meta Muse Secretly Used Humans for AI Phone Calls

The post Denmark CPR Data Breach Exposes CPR Numbers of 8.8 Million People appeared first on Daily CyberSecurity.

Proofpoint exposed China-aligned TA419 credential phishing targeting AI experts. This TA419 credential phishing campaign uses AitM lures to steal logins.

Related Posts:

• Phishing Abuses RMM Tools for Persistent Network Access
• Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells
• Russia's Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor

The post China-Aligned TA419 Credential Phishing Hits AI Experts appeared first on Daily CyberSecurity.

Star Blizzard RedFlick phishing hit 100+ groups that back Ukraine, using scheduled tasks to drop the CosmicPulse backdoor after a single click.

Related Posts:

• Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells
• Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams
• SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections

The post Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor appeared first on Daily CyberSecurity.

University job scams are spreading through .edu account takeover. Proofpoint shows how fraudsters phish logins, then send fake jobs and bogus checks.

Related Posts:

• Russia's Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor
• SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections
• Microsoft Links JADEPUFFER Azure Attack to Agentic Ransomware Actor Storm-3168

The post Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams appeared first on Daily CyberSecurity.

SVG phishing attacks jumped in August 2026. Symantec explains how SVG smuggling hides fake logins and malware inside image files, and how to stop it.

Related Posts:

• Russia's Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor
• Nigeria-Based Fraudsters Hijack .edu Accounts to Run University Job Scams
• Microsoft Links JADEPUFFER Azure Attack to Agentic Ransomware Actor Storm-3168

The post SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections appeared first on Daily CyberSecurity.

Operation Master used a GlobalProtect flaw to steal utility data, then fed it into an invoice fraud platform that sent 2.4M+ fake bills in Brazil.

Related Posts:

• ShinyHunters Renews Oracle PeopleSoft Attacks With One-Character WAF Bypass
• Konni Launches Operation Conflict Compass Against Ukraine
• Kiteworks Mandates Global Precautionary Server Shutdown

The post Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud appeared first on Daily CyberSecurity.

Microsoft led a coalition disrupting EvilTokens cybercrime platform. Learn how the EvilTokens cybercrime platform used AI and device code phishing.

Related Posts:

• SideCopy APT Campaign Targets Academic Institutions
• The WaterPlum Cyber Actor Group Targets Global IT Professionals
• Operation RapidRust APT36 Campaign Targets Governments

The post Microsoft Disrupts EvilTokens Cybercrime Platform appeared first on Daily CyberSecurity.

Security researchers uncovered a new GhostCode phishing kit. Learn how the GhostCode phishing kit bypasses MFA to hijack enterprise Microsoft 365 accounts.

Related Posts:

• PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures
• Tajin Group Phishing Network Linked to Guarantee Marketplaces
• Smishing Triad Phishing Kit Exposed by Group-IB

The post GhostCode Phishing Kit Targets Enterprise Microsoft Accounts appeared first on Daily CyberSecurity.

Group-IB exposed a new Smishing Triad phishing kit used by Outsider. Learn how this Smishing Triad phishing kit steals financial data worldwide.

Related Posts:

• PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures
• Tajin Group Phishing Network Linked to Guarantee Marketplaces
• GhostCode Phishing Kit Targets Enterprise Microsoft Accounts

The post Smishing Triad Phishing Kit Exposed by Group-IB appeared first on Daily CyberSecurity.