# Phishing Published articles for Phishing. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Fake parcel delivery messages steal your card and bank details DevFeed: [Fake parcel delivery messages steal your card and bank details]() Original publisher: [Read original article]() Author: Mieke Verburgh Published: 2026-09-18T07:44:22Z Content type: article Language: en Sources: [Malwarebytes]() Topics: [Security](), [online privacy]() Tags: [banking](), [card](), [delivery](), [email](), [financial](), [personal](), [phishing](), [scams](), [security](), [threat-intel]() ### AI overview The article describes parcel-delivery phishing campaigns that impersonate postal and courier services. A Belgian bpost campaign uses a small unpaid-customs-fee claim to direct victims to a fake website that collects personal, card, and banking information. ### Source excerpt Parcel delivery phishing messages impersonate familiar couriers and use small fees or promised refunds to steal personal and financial information. ## Revolut phishing texts appear days after data breach DevFeed: [Revolut phishing texts appear days after data breach]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-17T14:07:15Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Social engineering](), [passwords](), [VirusTotal]() Tags: [account](), [breach](), [password](), [phishing](), [revolut](), [scam](), [scams](), [social-engineering](), [threat-intel]() ### AI overview Revolut customers received phishing texts days after the bank disclosed customer data to a government impostor. The report says the campaign's connection to the breach is not yet known and describes a fake identity check designed to obtain passwords. ### Source excerpt Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government impostor. ## T-Mobile rewards points expiry texts are a phishing scam DevFeed: [T-Mobile rewards points expiry texts are a phishing scam]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-17T10:44:01Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [account](), [App]() Tags: [customer](), [links](), [messages](), [phishing](), [points](), [reward-points](), [rewards-points](), [scam](), [scams](), [t-mobile](), [threat-intel]() ### AI overview Malwarebytes reports a phishing campaign that sends fake T-Mobile rewards-point expiry messages. The messages use invented balances, urgent expiry dates, and phishing links to pressure recipients into clicking before verifying the claim. ### Source excerpt A large phishing campaign is using fake T-Mobile rewards points and looming expiry dates to pressure recipients into clicking malicious links. ## Search results are sending people to fake Bitrefill checkouts DevFeed: [Search results are sending people to fake Bitrefill checkouts]() Original publisher: [Read original article]() Author: Stefan Dasic Published: 2026-09-15T08:40:22Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Cryptocurrency](), [Bitcoin](), [Website]() Tags: [bitcoin](), [cryptocurrency](), [fraud](), [payments](), [phishing](), [qr-code](), [scam](), [scams](), [search](), [threat-intel]() ### AI overview Fake Bitrefill checkout pages are appearing in search results and copying the company's branding and payment flow. They persuade victims to send cryptocurrency to scammer-controlled addresses, with no goods delivered and little chance of recovering the payment. ### Source excerpt Fake Bitrefill checkout pages are appearing in search results and tricking people into sending cryptocurrency directly to scammers. ## Revolut falls for fake government requests, hands over customer data DevFeed: [Revolut falls for fake government requests, hands over customer data]() Original publisher: [Read original article]() Author: Connor Jones Published: 2026-09-14T11:26:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Cybercrime](), [Security]() Tags: [bitcoin](), [customer](), [cyber-crime](), [data](), [phishing]() ### AI overview Revolut handed over passports, selfies, and transaction histories after attackers used fake government requests and claimed responsibility for a crime while demanding 10,000 Bitcoin. ### Source excerpt Passports, selfies, transaction histories exposed as self-proclaimed culprits demand 10,000 Bitcoin ## UK.gov begins killing off passwords for 23 million users DevFeed: [UK.gov begins killing off passwords for 23 million users]() Original publisher: [Read original article]() Author: Carly Page Published: 2026-09-14T09:16:11Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [Passkeys](), [passwords](), [Cybersecurity]() Tags: [government-of-the-united-kingdom](), [password](), [passwords](), [phishing](), [security](), [uk](), [whitehall]() ### AI overview The UK government is beginning to replace passwords with passkeys for 23 million users. The change is intended to reduce phishing problems and save Whitehall approximately GBP 600 per day in SMS costs. ### Source excerpt Passkeys promise fewer phishing headaches - and GBP 600 a day off Whitehall's SMS bill ## The aircraft might not be flying, but the certificate has gone on vacation DevFeed: [The aircraft might not be flying, but the certificate has gone on vacation]() Original publisher: [Read original article]() Author: Richard Speed Published: 2026-09-12T09:00:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Cybersecurity](), [Artificial Intelligence](), [NVLink](), [Vibe coding](), [ARKTunnel](), [Cybercrime](), [.NET](), [how to create smooth CSS transitions]() Tags: [ai](), [bork](), [cybersecurity](), [malware](), [nvidia](), [offbeat](), [phishing](), [security](), [tailwind](), [ubuntu]() ### AI overview A news roundup covering security incidents, AI-related developments, semiconductor infrastructure, phishing, ransomware, open-source software, and web development. The supplied title concerns an aircraft certificate, while the body mainly contains unrelated headlines. ### Source excerpt Information is not forthcoming from this screen ## Crypto customers targeted by scammers after email marketing provider breach DevFeed: [Crypto customers targeted by scammers after email marketing provider breach]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-11T15:01:53Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [vulnerability](), [incident](), [API keys]() Tags: [attacks](), [breach](), [cryptocurrency](), [news](), [phishing](), [scams](), [security](), [supply-chain]() ### AI overview A Brevo breach enabled phishing emails targeting cryptocurrency-company newsletter subscribers. The attacker exploited a SAML SSO handling flaw, accessed 138 accounts, and used some accounts to send phishing messages or export contacts. ### Source excerpt A breach at email marketing company Brevo exposed Trezor, CoinTracking, and BitBox customers to phishing emails, but others may also be at risk. ## Android malware creates a hidden copy of your banking app DevFeed: [Android malware creates a hidden copy of your banking app]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-11T12:14:55Z Content type: news Language: en Sources: [Malwarebytes]() Topics: [Malware](), [App]() Tags: [android](), [app](), [credential-theft](), [fraud](), [malware](), [mobile](), [news](), [phishing](), [profile](), [security](), [transactions]() ### AI overview Gigabud is an Android banking Trojan that creates a work profile and clones a banking app so operators can conduct fraudulent transactions separately from malware detected in the personal profile. ### Source excerpt The Gigabud banking Trojan can clone a banking app into a separate work profile on an Android device to help hide fraudulent transactions. ## Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research DevFeed: [Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-10T22:38:35Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [anthropic](), [Claude](), [Cloaked Ursa]() Tags: [ai](), [ai-and-ml](), [anthropic](), [attacks](), [autonomous](), [bioweapons](), [claude](), [phishing](), [scams](), [security]() ### AI overview Anthropic says malicious actors used Claude models in attempted or disrupted cyber, surveillance, fraud, biological, and weapons-related activity. The article highlights alleged AI-assisted automation of cyberattack workflows by a Russian espionage group. ### Source excerpt Everyone from ShinyHunters to Russian freelancers is in on the illicit model fun ## Detect and disrupt AI-themed attacks with Microsoft Defender DevFeed: [Detect and disrupt AI-themed attacks with Microsoft Defender]() Original publisher: [Read original article]() Author: Rob Lefferts Published: 2026-09-10T16:00:00Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [Malware](), [Threat Research](), [spoofing](), [Microsoft]() Tags: [adversary-in-the-middle-aitm](), [ai](), [attacks](), [chatgpt](), [claude](), [copilot](), [credential-theft](), [deepseek](), [defender](), [github](), [malware](), [microsoft](), [phishing](), [security](), [social-engineering]() ### AI overview Microsoft describes AI-themed phishing, malvertising, credential theft, and malware campaigns that impersonate popular AI services and tools. It argues that attackers are exploiting trust and urgency around AI brands rather than compromising the referenced services. ### Source excerpt See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post Detect and disrupt AI-themed attacks with Microsoft Defender appeared first on Microsoft Security Blog. ## BlueMoon exploit kit turns Chrome and Windows flaws into attacks DevFeed: [BlueMoon exploit kit turns Chrome and Windows flaws into attacks]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-09-10T15:49:13Z Content type: article Language: en Sources: [Malwarebytes]() Topics: [BlueMoon](), [Vulnerabilities](), [Google](), [Microsoft]() Tags: [ai](), [attacks](), [bluemoon](), [bugs](), [chrome](), [news](), [phishing](), [update](), [vulnerabilities](), [windows]() ### AI overview BlueMoon is a shared exploit kit used by four espionage groups to exploit recently patched Chrome V8 and Windows vulnerabilities after phishing clicks. The article argues that attackers can weaponize public fixes quickly, making prompt patch deployment important; AI assistance is suggested only as an unproven possibility. ### Source excerpt Four different espionage groups used the same exploit kit to target recently fixed flaws, showing why "patch later" is a dangerous gamble. ## Trezor, BitBox users targeted in newsletter phishing spree DevFeed: [Trezor, BitBox users targeted in newsletter phishing spree]() Original publisher: [Read original article]() Author: Connor Jones Published: 2026-09-10T11:30:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Cybersecurity](), [Social engineering](), [Cybercrime]() Tags: [cyber-crime](), [cybersecurity](), [phishing](), [security]() ### AI overview Attackers exploit legitimate mailing channels to demand crypto wallet backups from Trezor and BitBox users. ### Source excerpt Attackers exploit legitimate mailing channels to demand crypto wallet backups ## Passkey-themed social engineering leads to identity and cloud compromise DevFeed: [Passkey-themed social engineering leads to identity and cloud compromise]() Original publisher: [Read original article]() Author: Microsoft Security Research, Krithika Ramakrishnan, Bharat Vaghela, Vaibhav Deshmukh, Subhajit Ghosh, Anusha Chakraborty, Akash Chaudhuri, Victor Chingtham and Ivan Macalintal Published: 2026-09-09T17:41:18Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [MFA](), [data-processing]() Tags: [adversary-in-the-middle-aitm](), [apis](), [attacks](), [authentication](), [cloud](), [data](), [identity](), [mfa](), [phishing](), [security](), [social-engineering]() ### AI overview Microsoft Security Research describes a passkey-themed social-engineering campaign that compromises cloud identities through AiTM phishing or device-code flows, establishes authentication persistence, and collects cloud data. It outlines investigation signals and recommends revoking sessions and removing unauthorized authentication methods after confirmed compromise. ### Source excerpt Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, and access SharePoint, OneDrive, and email data, along with key detection and mitigation guidance. The post Passkey-themed social engineering leads to identity and cloud compromise appeared first on Microsoft Security Blog. ## Black Hat USA 2026: Safeguarding DNS with Secure Access DevFeed: [Black Hat USA 2026: Safeguarding DNS with Secure Access]() Original publisher: [Read original article]() Author: Steve Vida Published: 2026-09-07T15:00:32Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [SIEM, Security, Observability](), [telemetry](), [NOC]() Tags: [apple](), [black-hat](), [cisco-secure-access](), [cisco-security-cloud](), [cisco-talos](), [cisco-xdr](), [cloudflare](), [cybersecurity](), [dns](), [google](), [network-operations-center](), [noc](), [phishing](), [privacy](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [statistics](), [telemetry]() ### AI overview Cisco reports on using Secure Access and DNS telemetry to protect the Black Hat USA 2026 network. The article highlights blocking unapproved encrypted DNS resolvers, DNS request statistics, and activity classified as hacking. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences, over a decade providing DNS Security. Learn about protecting DNS with Secure Access. ## ASCII smuggling crosses over from AI prompt injection to phishing evasion DevFeed: [ASCII smuggling crosses over from AI prompt injection to phishing evasion]() Original publisher: [Read original article]() Author: Microsoft Security Research, Noam Kochavi and Sarah Wolstencroft Published: 2026-09-03T16:00:00Z Content type: article Language: en Sources: [Microsoft Security Blog]() Topics: [ASCII](), [Machine Learning, Security Attacks](), [Language models](), [telemetry](), [Microsoft]() Tags: [ai-models](), [ai-security](), [ascii](), [microsoft](), [phishing](), [security](), [social-engineering](), [telemetry]() ### AI overview Microsoft describes a phishing campaign that uses invisible Unicode tag characters to split lure words and evade email parsing. The technique, known as ASCII smuggling, was previously prominent in AI prompt-injection research because models can process hidden text that people cannot see. ### Source excerpt Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them. The post ASCII smuggling crosses over from AI prompt injection to phishing evasion appeared first on Microsoft Security Blog. ## Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America DevFeed: [Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America]() Original publisher: [Read original article]() Author: Reese Lewis and Sara McBroom Published: 2026-09-03T10:00:58Z Content type: article Language: en Sources: [Unit 42]() Topics: [Language models](), [AI Chat](), [Incident response]() Tags: [agentic-ai](), [ai](), [chatgpt](), [cl-cri-1131](), [cl-cri-1163](), [claude-code](), [data](), [financial-sector](), [go](), [large-language-models-llms](), [malware](), [nextchat](), [operations](), [phishing](), [shipping-and-transportation](), [socks5](), [socktz](), [threat-research]() ### AI overview The article examines two ongoing intrusion and data-exfiltration campaigns targeting organizations in Latin America. It describes attackers using commercial large language models, proxy infrastructure, phishing, remote-access malware, and operational tooling. ### Source excerpt Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to disrupt operations. The post Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America appeared first on Unit 42. ## Defending against AI-fueled social engineering DevFeed: [Defending against AI-fueled social engineering]() Original publisher: [Read original article]() Author: Joe DeFever Published: 2026-09-01T00:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [Social engineering](), [spoofing]() Tags: [agentic-ai-alerting-security-analytics](), [ai](), [attacks](), [phishing](), [security](), [soc](), [social-engineering]() ### AI overview The article describes how AI enables personalized spear phishing, smishing, and deepfake-based impersonation at greater scale. It argues that defenders should detect behavioral signals rather than rely solely on static signatures and known patterns. ### Source excerpt AI is supercharging social engineering. Learn how SOC teams can detect deepfakes, spear phishing, and smishing before they cause real damage. ## Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams DevFeed: [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams]() Original publisher: [Read original article]() Author: Noam Sala Published: 2026-08-31T10:00:36Z Content type: article Language: en Sources: [Unit 42]() Topics: [Social engineering](), [Malware](), [remote access software](), [Microsoft](), [Cloaked Ursa](), [Entra ID](), [Incident response]() Tags: [attacks](), [cloaked-ursa](), [enterprise](), [entra-id](), [incident-response](), [malware](), [microsoft](), [microsoft-teams](), [payload](), [phishing](), [powershell](), [remote-access-trojan](), [social-engineering](), [spoof](), [threat-research](), [vishing](), [voice]() ### AI overview Spring Ring is a coordinated social engineering campaign that used external Microsoft Teams accounts and voice phishing to impersonate IT help desk staff. The operation targeted more than 150 employees across at least 10 companies and attempted to deliver remote monitoring and management tools or custom malware. A more advanced variant escalated to an NTLM relay attack against an organization's domain controller. ### Source excerpt Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42. ## How WhatsApp Upgraded to Secure, Seamless Sign-In for 1 Billion Users with Passkeys DevFeed: [How WhatsApp Upgraded to Secure, Seamless Sign-In for 1 Billion Users with Passkeys]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-27T17:00:00Z Content type: article Language: en Sources: [Android Developers Blog](), [Android Developers Blog]() Topics: [Passkeys](), [Authentication](), [Security, Privacy and Abuse Prevention](), [Cryptography](), [Android](), [App](), [API]() Tags: [android](), [api](), [app](), [authentication](), [credential-theft](), [cryptography](), [phishing](), [scale](), [whatsapp]() ### AI overview WhatsApp's adoption of passkeys provides a fast, phishing-resistant sign-in method for its large global user base. The article explains how passkeys use public-private key cryptography with biometric or screen-lock authentication, reduce reliance on inconsistent SMS OTP delivery, and simplify implementation through Android's Credential Manager API. ### Source excerpt Posted by Niharika Arora, Senior Developer Relations Engineer, Tracy Agyemang, Product Marketing Manager, Google and Mayank Manuja, Android Engineer, Meta WhatsApp is the world's largest messaging platform, serving billions of users globally. It is the default communication tool for people across diverse regions, connecting users through private, reliable, and secure messaging. "What excites me most is the sheer scale of WhatsApp's impact. Even a small improvement to WhatsApp touches billions of users worldwide," says Mayank Manuja, an Android Engineer on the WhatsApp Registration and Access team who led the design and implementation of passkey-based authentication for WhatsApp. Building for an audience of this magnitude requires navigating a vast range of network conditions, device capabilities, and levels of digital literacy. Recognizing the potential early, WhatsApp committed to adopting passkeys in 2023, becoming one of the first major consumer apps to integrate the technology. By implementing passkeys, WhatsApp aimed to provide a fast, phishing-resistant option that significantly reduces user friction while providing robust protection against account takeovers and credential theft. A user creating a passkey on WhatsApp for faster, more secure sign-ins. The Decision to Adopt Passkeys For WhatsApp, offering multiple access methods is key to making it easier for users to stay connected and regain access when needed. Passkeys offer users a streamlined, one-tap login experience that eliminates phishing risks and functions reliably even in regions where OTP message delivery can be inconsistent. Underneath, passkeys leverage public-private key cryptography to replace manual entry with biometric or screen lock authentication. This workflow drastically improves sign-in speeds by reducing the process to a single tap via a unified, bottom-sheet interface that keeps users engaged within the app's context. The benefits are twofold: passkeys offer users a streamlined login e ## AI-driven OSINT in the wrong hands - and why everyone could be a target for fraud DevFeed: [AI-driven OSINT in the wrong hands - and why everyone could be a target for fraud]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-08-27T09:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Artificial Intelligence](), [Reconnaissance](), [Social engineering](), [Web](), [Malware]() Tags: [ai](), [attacks](), [fraud](), [malware](), [phishing](), [privacy](), [research](), [social-engineering](), [vulnerability]() ### AI overview AI-powered OSINT is making it faster and easier for cybercriminals to gather publicly available information about potential victims. By linking accounts, relationships, images, and videos at machine speed, these tools can make fraud and social engineering more convincing and scalable, lowering the barrier to entry for attackers. ### Source excerpt It's getting cheaper and easier for cybercriminals to research potential victims. Here's what's still in your control. ## Identity Abuse Through Trusted Communication Channels DevFeed: [Identity Abuse Through Trusted Communication Channels]() Original publisher: [Read original article]() Author: Bill Batchelor Published: 2026-08-20T10:00:25Z Content type: article Language: en Sources: [Unit 42]() Topics: [Security](), [Authentication](), [Social engineering](), [Software as a service](), [Incident response]() Tags: [authentication](), [credential-theft](), [identity](), [identity-theft](), [incident-response](), [malware](), [mfa](), [phishing](), [remote-access-software](), [saas](), [security](), [social-engineering](), [threat-research]() ### AI overview Unit 42 examines how attackers abuse trusted enterprise communication and collaboration platforms for identity phishing, impersonation, credential theft, malware delivery and social engineering. The article describes how compromised identities can make malicious activity appear legitimate within authenticated collaboration sessions and offers recommendations for detecting and defending against these attacks. ### Source excerpt Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies. The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42. ## How state and local agencies can get ahead of fraud starting with the data they already have DevFeed: [How state and local agencies can get ahead of fraud starting with the data they already have]() Original publisher: [Read original article]() Author: Leanne Link Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [data](), [systems](), [Generative AI](), [Artificial Intelligence]() Tags: [agentic-ai-alerting-anomaly-detection-fraud-detection-government-state-local-government](), [applications](), [audits](), [data](), [fraud](), [generative-ai](), [government](), [phishing](), [synthetic](), [systems](), [tax](), [us]() ### AI overview This article explains how fragmented data across state and local government systems can delay fraud detection and remediation. It describes the growing scale of fraud, the use of generative AI by bad actors to fabricate identities and synthetic personas, and the operational, audit, financial, and funding consequences for agencies. ### Source excerpt Fraud and waste continues to be a challenge for state and local government agencies in the US. Though the data exists, the challenge is pulling it all together for an accurate anomaly detection and remediation. ## How QR-code phishing can slip past corporate security measures DevFeed: [How QR-code phishing can slip past corporate security measures]() Original publisher: [Read original article]() Author: Phil Muncaster Published: 2026-08-17T09:00:00Z Content type: article Language: eng Sources: [WeLiveSecurity]() Topics: [QR Code](), [Cybersecurity](), [Social engineering]() Tags: [business-security](), [corporate](), [cybersecurity](), [phishing](), [security]() ### AI overview The article explains how QR-code phishing ("quishing") can evade corporate defenses by hiding malicious URLs and directing employees to less-protected mobile devices. ### Source excerpt Quishing has become a popular alternative to traditional phishing. Here's how businesses can close the gap. [Next page]()