Phishing | Breaking Cybersecurity News | The Hacker News

Government impersonation scams have evolved into a large, highly coordinated fraud ecosystem targeting citizens across the globe. CTM360 's latest threat intelligence research analyzes a widespread campaign, referred to as GovTrap, that demonstrates how attackers systematically exploit public trust in government institutions through thousands of fraudulent digital platforms. Unlike traditional phishing attacks that rely on simple deceptions, GovTrap campaigns replicate entire government service environments. These fraudulent platforms mimic official portals with high accuracy, including branding, language, workflows, and service structures. From tax portals and licensing systems to fine payment services, each fake site is designed to appear legitimate while functioning as part of a broader, scalable fraud operation. Read the full report here:  https://www.ctm360.com/reports/government-impersonation-phishing-govtrap-scams Scale and Targeting Patterns CTM360 identified mo...

The event that didn't exist At 2:14 p.m. on a Tuesday, an employee clicks a link. If you reconstruct the moment from your security stack, nothing happened. A browser process opened an HTTPS connection. The certificate was valid. The destination wasn't flagged. Traffic volume was unremarkable. No detections fired. Inside the browser session, a different story was unfolding. The page that loaded looked like a routine CAPTCHA with "verify you're human" framing, a prompt to complete a quick check to continue. The instructions told the user to press Windows+R, paste what had already been copied to their clipboard, and hit Enter. In the middle of a busy work day, they did. What they pasted was a shell script. It executed in the user's own context, with the user's own permissions, as a deliberate action the user performed with their own hands. Nothing about the browser session looked unusual. The page rendered normal web content. The clipboard write happene...

Most organizations believe they are prepared for ransomware, but they probably aren't. Sure, everything seems to be in place: backups and a plan for disaster recovery, plus recovery time objective (RTO) and recovery point objective (RPO) tracking.  But when a real attack happens, many fail to recover within acceptable timeframes, if at all.  Not because backups are missing but because they're not reliable or can't be retrieved quickly enough. Therein lies the gap between backup and true cyber resilience . Backup isn't worth much without fast and reliable recovery.  What actually happens when ransomware hits and recovery begins A realistic ransomware incident rarely looks like a sudden outage. It unfolds over time. Day 0 – Initial compromise Cybercriminals steal credentials through phishing or exposed services. Day 3 – Lateral movement Attackers move across endpoints and servers using legitimate tools. Day 7 – Privilege escalation Cyberattackers achieve domain a...

For security leaders, the inbox remains the front door for attackers. Here's why the smartest teams are adding adaptive, AI-driven protection to their cloud email security, not replacing them. Email is still the number-one attack vector for enterprises, and it is not even close. The FBI's Internet Crime Complaint Center reported that business email compromise alone generated $3 billion in losses in 2024 , with AI-enabled attacks accelerating the trend ( FBI IC3 Report ). The attacks that succeed today don't carry obvious malicious payloads. They rely on trust, tone, and timing; a spoofed vendor sending a "routine" invoice update, or a convincing impersonation of a CEO with an urgent request. No malware. No suspicious links. Just words, carefully chosen. Microsoft 365 is the backbone of productivity for most organizations, and Microsoft Defender and Exchange Online Protection do solid work catching known spam, malware, and co...

The conversation around AI in the SOC has mostly centered on efficiency: closing alerts faster, reducing queue backlog, and automating repetitive work that burns out L1 analysts. That framing is directionally right, and it matters because analyst fatigue is real. For teams dealing with high alert volume, analysts are often asked to make good decisions under a fragmented context and time pressure. But that framing is still incomplete. The bigger shift is not just workflow automation or orchestration of predefined playbooks. It is AI's ability to perform contextual, hypothesis-driven investigation across multiple telemetry sources, work that has traditionally depended on experienced L2 or L3 analysts and limited human time. When that capability can be applied consistently across every alert, it changes the operating model, not just the speed of the existing one. Two recent investigations at Prophet Security make that real. In both cases, the attacks were not obvious from signature-bas...

Here's what keeps me up at night. Not zero-days. Not sophisticated nation-state attacks. What worries me is the backlog. Every MSP has one. The list of security configurations that need fixing. The policies have been sitting in "report only" mode since last year. The E5 features that clients are paying for but nobody's turned on because it might break something. The app registrations with excessive permissions from three years ago that nobody's audited. The conditional access policies that need updating but keep getting pushed to next quarter. We all know this backlog exists. We tell ourselves we'll get to it. But quarters turn into years, and that backlog just grows. Meanwhile, AI attackers don't have a backlog. They have automation. Most breaches in Microsoft 365 won't start with a zero-day. They'll start with a setting that's been in "report only" for two years. Example tenant: critical Conditional Access policies exist but a...

Brand impersonation in e-commerce has evolved beyond isolated scam websites into a repeatable, industrialized fraud model operating at global scale . CTM360's latest threat intelligence research analyzes a coordinated campaign—referred to as FraudWear —that demonstrates how attackers are systematically exploiting consumer trust in well-known fashion brands through tens of thousands of fraudulent online stores. Unlike traditional phishing operations, these campaigns do not rely on simple deception or low-effort spoofing. Instead, they replicate the full structure and behavior of legitimate e-commerce platforms , including storefront design, product catalogs, checkout workflows, localized marketing, and payment processing. Each site functions as a disposable asset within a broader, resilient fraud ecosystem. Read the full report here: https://www.ctm360.com/reports/fraudwear-brand-impersonating-online-stores Scale and Targeting Patterns CTM360 identified more than 30,000 malicio...

CTM360 researchers have identified a large-scale fraud campaign involving thousands of fake banking websites that actively target users in the United States and the United Kingdom. Over the past year, more than 11,000 fraudulent bank domains were observed, with 8,000+ in the U.S. and 3,000+ in the UK, all operating without regulatory authorization or physical presence. These are not throwaway phishing pages. They are polished, SEO-optimized platforms that impersonate legitimate financial institutions, regulators, and lending services. Not Your Typical Phishing Fraud What sets this campaign apart is operational maturity. The fake banks offer services such as loans, mortgages, grants, and high-limit credit cards, often promising instant approval or no credit checks. Victims are funneled through simplified onboarding flows, fake KYC processes, and staged "approvals" designed to build trust before monetization. Once engaged, users are pressured to pay activation or processing fees ,...

Identity platforms are an organization's backbone of secure access. But what happens when you need to migrate from one identity provider to another? The stakes are high: downtime, broken integrations, compliance gaps, and user frustration. Yet, with the right strategy and preparation, these fears can be addressed head-on. Identity migration is intimidating If a migration is poorly planned and executed, it can mean lost productivity, frustrated customers, and a hit to your business' bottom line. Identity touches every corner of an organization, from HR systems to customer portals. Beyond downtime, migrations often expose brittle integrations, undocumented dependencies, and legacy technologies that no one wants to touch. Add compliance requirements (SOC2, HIPAA, DORA) and the pressure mounts. Even well-planned transitions can surface unexpected issues, edge cases, and broken processes. Why consider identity migration at all? Why migrate at all? Often, it's about cost savings, strea...

In a matter of months, AI became a tool relied on for daily critical tasks. Now, we are seeing it used just as easily to attack systems, deceive users, or even manipulate data. While full capabilities are still being explored, the most significant threats posed by AI are yet unknown. Even without knowing exactly what's coming, organizations can take meaningful steps now and develop identity security strategies to defend against AI-driven threats to avoid being an easy target. Suggestion 1: Start with the basics In the face of unknown AI-driven threats, one of the best places to start is with an identity security strategy that addresses the fundamentals.  When it comes to identity and access management, solutions that offer 'Preemptive Defense' (a term coined by Gartner) allow detection and protection before a user even authenticates to your systems. Think IP reputation checks, web application firewalls, machine learning-based risk scoring, user policies and app policies. Risky...