CySecurity News - Latest Information Security and Hacking Incidents: Identity Theft

Cyber Crime Identity Theft Investment Scam Tax fraud

Nigerian Hacker Sentenced To Eight Years For Fraud And Identity Theft

A Nigerian man has been sentenced to eight years in a U.S. prison for his role in wide-ranging hacking, tax fraud, identity theft, and investment fraud schemes. Chukwuemeka Victor Amachukwu, also known as “Chukwuemeka Victor Eletuo” and “So Kwan Leung,” pleaded guilty to conspiracy to commit computer intrusions and conspiracy to commit wire fraud. The sentence was announced by the U.S. Attorney’s Office for the Southern District of New York on October 19, 2026.

According to U.S. prosecutors, Amachukwu and Nigeria-based co-conspirators began targeting U.S. tax preparation businesses around 2019. They used spearphishing emails to gain access to the companies’ electronic systems, then stole tax and identity information belonging to at least about 800 customers. The affected businesses were located in New York, Texas, and other U.S. states.

The stolen data was allegedly used to file fraudulent tax returns with the Internal Revenue Service and state tax authorities. Prosecutors said the group sought fraudulent refunds of at least approximately $8.4 million and successfully obtained at least $2.5 million. The conspirators also used stolen identities to submit fraudulent claims under the Small Business Administration’s Economic Injury Disaster Loan program, receiving about $819,000 in additional payouts.

Amachukwu was also accused of participating in a separate investment fraud scheme. Prosecutors said he posed as a wealthy overseas financier to persuade U.S. victims to invest in purportedly valuable standby letters of credit. The investments did not exist, and Amachukwu and his co-conspirators allegedly pocketed more than $7 million in fraudulent proceeds.

In addition to the eight-year prison term, the 40-year-old was sentenced to one year of supervised release. He was ordered to pay $3,647,629.39 in restitution and forfeit $10,846,634.39. U.S. Attorney Jamie McDonald said the case demonstrated that offenders cannot assume they can operate safely from abroad, while the FBI was credited for its investigative work.

US Charges 14 People in North Korean IT Worker Scheme Targeting More Than 70 Companies



 

IT Security

Cyber Security Department of Justice fake remote tech jobs identity Identity Theft IT Industry IT Security

US Charges 14 People in North Korean IT Worker Scheme Targeting More Than 70 Companies

The U.S. Department of Justice has announced coordinated enforcement actions targeting a North Korean operation that allegedly used stolen identities and fraudulent remote employment to generate money for the regime. The investigation has resulted in charges against 14 individuals, two arrests and the seizure of approximately 187 computer devices. Authorities also searched more than 40 suspected laptop farms across Texas.

The operation allegedly enabled North Korean IT workers to secure remote jobs at more than 70 American companies, generating around $3 million in revenue. Investigators believe the money was transferred to sanctioned entities controlled by North Korea and may have supported its weapons programmes.

In a case announced by the U.S. Attorney’s Office for the Northern District of Ohio, American nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas were arrested under a four-count indictment involving wire fraud, money laundering and identity theft. The indictment also names several China-based individuals, including Sun Sheng Ming, Pei Li Guang and others, while two additional defendants remain unidentified under seal.

According to prosecutors, the alleged scheme operated from 2019 until approximately July 2025. North Korean workers used stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear to be Americans applying for jobs from within the United States. U.S.-based facilitators allegedly received company-issued laptops at their homes, configured the devices, installed remote-access software and helped transfer earnings to accounts controlled by North Korea. The affected employers operated in sectors including healthcare, communications, cybersecurity support, retail and manufacturing.

The companies were located across Ohio, 16 other states and the District of Columbia. Separately, the FBI carried out Operation Lonestar Roundup between September 21 and September 25, searching more than 40 residences in Texas suspected of hosting laptop farms. Investigators seized approximately 187 laptops and keyboard, video and mouse devices allegedly used to facilitate fraudulent employment and revenue generation.

Cybersecurity company CrowdStrike has identified the network of North Korean workers and their helpers as “Famous Chollima.” Investigators also identified fraudulent email accounts allegedly linked to the activity. The FBI has urged employers to add these addresses to their screening indicators and published a new public service announcement outlining detection and prevention measures.

Authorities warned that the schemes are evolving. North Korean workers are reportedly recruiting more American facilitators to evade improved corporate screening, assigning them additional responsibilities and, in some cases, subcontracting entire jobs to foreign nationals. The latest actions form part of the Justice Department and FBI’s DPRK RevGen: Domestic Enabler Initiative, which targets illicit revenue operations and the people supporting them inside the United States.

Previous enforcement actions were announced in June and November 2025 and April and May 2026. Officials have repeatedly warned that these workers can also use their access to steal sensitive company information or carry out data extortion. A 2022 advisory from U.S. agencies stated that individual North Korean IT workers could earn as much as $300,000 annually, contributing to hundreds of millions of dollars in collective yearly revenue.

The State Department has offered rewards of up to $5 million for information supporting efforts to disrupt North Korea’s illicit financial activities. The Justice Department stressed that the allegations in the court documents have not been proven. All defendants are presumed innocent unless found guilty in court.

Denmark Population Registry Breach Exposes 8.8 Million Citizens



 

User Privacy

CPR registry Data Breach Denmark Identity Theft User Privacy

Denmark Population Registry Breach Exposes 8.8 Million Citizens

Denmark is grappling with one of the most significant data breaches in its history after unauthorized actors gained access to the Central Population Register (CPR), exposing the personal information of approximately 8.8 million individuals. The breach, discovered in early October 2026, affects not only current residents but also includes data on people who have moved abroad and even deceased individuals. The CPR serves as Denmark's national civil registry and contains highly sensitive information including names, addresses, dates of birth, marital status, and unique CPR identification numbers that are integral to daily life in the Scandinavian nation.

The attack was carried out through a sophisticated method involving a private Danish company that had legitimate access to the registry system. According to authorities, threat actors misused this company's credentials to extract data from the CPR database. The Danish Data Protection Agency revealed that the attackers employed brute-force techniques to enumerate valid CPR numbers before systematically extracting associated personal data from each entry. This method allowed them to harvest information on a massive scale, impacting roughly 80% of the 11 million registered citizens currently in the CPR system, making it one of the largest population registry breaches ever recorded in Europe.

Security officials detected the breach on October 2, 2026, though the actual incident occurred earlier in September. Once the CPR administration became aware of the compromise, they immediately blocked the private company's access to the registry and launched a comprehensive investigation with police assistance. Minister for Research, Education and Digitalization Christina Egelund described the incident as extremely serious and promptly informed Parliament's Business and Digitalization Committee. The government has since implemented additional security measures to prevent similar incidents and is working with all relevant authorities to establish the full extent of the damage caused by this unprecedented security failure.

In response to the breach, Danish authorities have established a dedicated cyber hotline to assist potentially affected individuals and provide guidance through the website sikkerdigital.dk. Officials are urgently warning citizens to remain vigilant against unsolicited communications, emphasizing that criminals may use the stolen data to craft convincing phishing attempts. The government specifically cautioned that people should never disclose passwords or confidential information in response to telephone calls, emails, or similar communications, even if the caller appears to know their name, address, and CPR number. This warning is particularly critical because the exposed data could enable highly targeted social engineering attacks that would be difficult for ordinary citizens to identify as fraudulent.

The Denmark CPR breach represents a stark reminder of the vulnerabilities inherent in centralized population databases and the catastrophic consequences when such systems are compromised. As investigations continue, questions remain about how the private company's credentials were obtained and whether additional security lapses contributed to the scale of the breach. For millions of Danes, the incident means living with heightened risk of identity theft, financial fraud, and privacy violations for years to come. The breach also raises broader concerns about data protection practices across Europe and may prompt other nations to reassess the security of their own civil registry systems in an increasingly dangerous digital landscape where personal information has become a valuable commodity for cybercriminals worldwide.

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses



 

KrebsonSecurity

Credential Theft Cyber Security Data Breach driver’s license FBI Identity Theft KrebsonSecurity

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses

The FBI has opened an investigation into an apparent breach involving identity verification provider IDScan.net after a newly launched dark web service began advertising access to more than 153 million U.S. and Canadian driver’s license records.

The service, named Nexus, appeared on the Russian cybercrime forum Exploit on August 31, claiming access to identity documents belonging to more than 170 million people across North America. Its advertised database includes more than 153 million driver’s licenses, over 10 million identification cards, more than three million travel or international identity documents, and at least 579,000 medical cards.

An examination of the service indicates that the claimed volume may be credible. A search without filters reportedly produced about 11.5 million pages of records, with approximately 15 results per page. Canadian licenses accounted for roughly 1.1 million results, including 473,673 records from Ontario, while most listings originated from the United States.

The dataset also contains marijuana dispensary cards, commercial driver’s licenses and records marked “CAC,” potentially referring to U.S. government Common Access Cards. Nexus operators claim the information is being obtained through an ongoing compromise of a major identity verification company serving Fortune 500 customers. They claim to have continuously extracted new records for more than a year.

Evidence examined by KrebsOnSecurity also indicates that the database may still be receiving stolen information. The number of available driver’s license records reportedly increased by nearly 400,000 within 24 hours.

The exposed records are unusually detailed. One license examined by Krebs contained six image files showing the front and back of the document, including standard, infrared and ultraviolet captures. Each file carried a timestamp. In several cases, those timestamps corresponded closely with victims’ real-world activities.

Krebs tested the apparent pattern by obtaining permission to search for licenses belonging to more than a dozen acquaintances. Nine licenses were located, and each individual confirmed travelling on or around the dates associated with the image timestamps. Further comparison with rental records indicated the timestamps appeared consistent with Greenwich Mean Time.

The evidence initially pointed toward airports, but that theory weakened because the database contained no passports and several individuals had not presented their licenses at airport security. Two federal employees who appeared in the dataset said they used other government identification at airport checkpoints, but later handed their state licenses to Hertz when renting vehicles.

A particularly revealing comparison involved Krebs’ own license and his mother’s. Their records carried timestamps only seconds apart, corresponding to the time both licenses were handed to a Hertz representative. Another exposed license belonged to security researcher Zach Edwards, whose timestamp matched a trip to Las Vegas for DEF CON. Edwards said he showed his license to TSA, his hotel and Planet 13, but identified the dispensary as the only location that definitely scanned it.

That connection is notable because Planet 13 announced in 2022 that it had deployed IDScan.net’s VeriScan technology across 16 check-in stations at its Las Vegas SuperStore. The system captures government-issued identification, performs document authentication and can use white-light, infrared and ultraviolet imagery. IDScan.net says its technology performs more than 21 million identity verifications each month across more than 20,000 locations.

IDScan.net also publicly lists major organizations using its technology, including Hertz, Target, FedEx and Caesars Entertainment. Its current platform supports ID scanning, document authentication, data parsing and integrations through APIs and software development kits.

IDScan.net told KrebsOnSecurity that it was investigating but had not provided a substantive public explanation of the suspected incident. Its documentation shows that its systems can retain raw files generated during scans, while its security documentation describes encryption for data at rest and in transit.

The FBI’s New Orleans field office subsequently opened an official investigation into the suspected breach. The development adds a law-enforcement dimension to an incident that could expose highly sensitive identity information at unprecedented scale.

The potential consequences extend beyond conventional credential theft. Driver’s license information is legally recognized as identifying information, and stolen identity data can be used to open accounts, obtain services, commit financial fraud or impersonate victims.

The incident also exposes a difficult security trade-off in modern identity verification. Organizations increasingly depend on third-party systems to scan government credentials for travel, rentals, retail, financial services and age verification. TSA began enforcing REAL ID requirements for domestic air travel in May 2025, further embedding government-issued identification into everyday verification processes.

For now, the precise intrusion path, affected customers and total number of compromised individuals remain unconfirmed. However, the combination of detailed document images, matching timestamps, apparent fresh data collection and the FBI investigation makes Nexus a serious warning about the risks created when sensitive identity documents are concentrated within third-party verification infrastructure.

Nearly 7 Million Driver's License Numbers Exposed After AssuranceAmerica Data Breach



 

Identity Theft

AssuranceAmerica Data Breach Drivers license Financial Fraud Identity Theft

Nearly 7 Million Driver's License Numbers Exposed After AssuranceAmerica Data Breach

Nearly seven million people are being notified after a cyberattack on Atlanta-based auto insurer AssuranceAmerica exposed highly sensitive personal information, including driver's license numbers, Social Security numbers and insurance records, raising concerns about long-term identity theft risks.

According to the company's breach notice and filings submitted to state regulators, the incident began on March 16, 2026, when a threat actor gained unauthorized access to AssuranceAmerica's internal network using compromised employee credentials obtained through a phishing attack. The company detected suspicious activity the following day, secured the affected systems, and launched a forensic investigation to determine the scope of the compromise.

The investigation later revealed that the attackers had copied files containing personal information belonging to approximately 6.99 million individuals. The exposed data varies by person but may include names, residential addresses, driver's license numbers, Social Security numbers, taxpayer identification numbers, insurance policy and account details, claims information, as well as driver and vehicle records.

The scale of the breach makes it one of the larger disclosures involving government-issued identity documents this year. South Carolina alone reported that 611,046 residents may have been affected, according to the state's Department of Consumer Affairs.

Unlike passwords, driver's license numbers are not easily replaced after they are exposed. These identifiers are widely used to verify identity across banks, insurers, vehicle rental companies, government agencies and financial institutions. When combined with Social Security numbers and other personally identifiable information, they can enable criminals to apply for loans, open fraudulent accounts, submit false tax returns or impersonate victims during identity verification processes.

Law firm Edelson Lechtzin LLP, which announced an investigation into the incident, warned that the compromised information could be used to facilitate identity theft and other forms of financial fraud.

Although AssuranceAmerica identified the intrusion within roughly 24 hours, affected individuals were not notified until late June after investigators completed their review of the compromised data on June 15. The nearly three-month gap between the initial breach and customer notifications has drawn attention to the time required to determine exactly whose information had been accessed before notifications could be issued.

In its public notice, AssuranceAmerica said it disabled the compromised accounts, reset credentials, strengthened network monitoring and provided additional cybersecurity awareness training to employees. The company also engaged external forensic specialists to investigate the incident. However, it has not publicly confirmed whether all affected individuals will receive complimentary credit monitoring or identity protection services.

The AssuranceAmerica breach comes amid a growing number of incidents involving government-issued identity documents. In June, Texas disclosed a separate cyberattack affecting approximately three million driver's license and passport records maintained by the Texas Parks and Wildlife Department, adding to a broader trend of organizations reporting the theft of sensitive identification data.

The growing reliance on digital identity verification has also increased the amount of personal identification collected by businesses and online platforms. As governments and private organizations increasingly require users to upload driver's licenses and other official documents for account verification and age checks, cybersecurity experts warn that breaches involving these records can have lasting consequences because many of these identifiers cannot be easily changed once exposed.

Individuals who may have been affected are encouraged to closely review financial and insurance accounts for suspicious activity, consider placing a credit freeze or fraud alert with the major credit bureaus, monitor their credit reports for unauthorized accounts and remain cautious of phishing emails or phone calls that attempt to exploit information exposed during the breach. Victims should also follow guidance issued by their state consumer protection agencies and promptly report any suspected identity theft.

Council of Europe Data Breach Exposes Records of 10000 Employees After ShinyHunters Leak



 

Zero-Day Exploit

Council of Europe CVE-2026-35273 Cyber Extortion Data Breach Data Leak Employee Data Exposure Identity Theft Oracle PeopleSoft Vulnerability ShinyHunters Zero-Day Exploit

Council of Europe Data Breach Exposes Records of 10000 Employees After ShinyHunters Leak

Council of Europe is investigating a major data breach following the public release of approximately 297 GB of sensitive employee data by cybercriminal group ShinyHunters following the expiration of a ransom deadline.

An archive has been leaked that contains information regarding more than 10,000 current and former employees, contractors, and job applicants dating from 15 years ago. As one of Europe's leading human rights organizations since 1949, the Council of Europe has been an official observer at the United Nations since 1949. It represents 46 member states and is a central force in promoting democracy, human rights, and the rule of law throughout Europe.

Since the information it holds is sensitive, the breach of confidentiality is particularly significant. As reported by ShinyHunters, more than 429,000 files, including personnel data, were obtained from multiple Council departments, including human resources and administrative units. This was one of the largest breaches of personal data involving an intergovernmental organization in Europe.

Information available indicates that payroll records, bank account information, medical information, tax information, social security information, salary histories, personnel files, and thousands of CVs were exposed. Due to the large size of the dataset, identity theft, financial fraud, and highly targeted phishing are significantly more likely to occur. It has been reported that the breach is related to CVE-2026-35273, a critical 9.8-severity zero-day vulnerability affecting Oracle PeopleSoft's Environment Management Hub (PSEMHUB).

According to security researchers, the vulnerability allowed attackers to execute arbitrary code remotely without authentication. According to Google's Mandiant team, more than 100 organizations had actively exploited the vulnerability prior to Oracle's release of security guidance. Using the zero-day vulnerability in combination with older vulnerabilities, ShinyHunters obtained persistent access, migrated laterally through compromised environments, and exfiltrated data while posing as legitimate users.

The exploit was conducted between May 27 and June 9, before mitigations were available. ShinyHunters has also altered its extortion strategy significantly following the Council of Europe declining to meet the ransom demand. In response to the Council's refusal to pay the ransom, ShinyHunters announced it would permanently distribute stolen datasets through multiple mirror sites and torrent networks, thereby reducing the likelihood of future takedown efforts.

In addition, the incident adds to the growing number of campaigns involving ShinyHunterS Researchers have recently linked the group to attacks targeting multiple organizations, while Google's threat intelligence team has linked the group's latest activity to widespread exploitation of the Oracle PeopleSoft zero-day vulnerability before mitigations were available.

According to a brief statement issued by the Council of Europe, the organization was "investigating the matter and assessing the situation." Further comment was not provided. The organization has not yet announced a formal notification process or measures to protect individuals' identities. Zero-day exploitation and data extortion campaigns are becoming increasingly prevalent, with public disclosure increasingly taking precedence over traditional ransomware encryption.

The threat of persistent leak strategies is increasing, which is why organizations are being urged to strengthen vulnerability management, accelerate patch deployment, and improve incident response to minimize both institutions and individuals' long-term risks.

U.S. Secures Extradition of 19-Year-Old Linked to Scattered Spider



 

Social Engineering

Computer Intrusion CyberCrime cybersecurity news Data Breach FBI Cyber Division Identity Theft Ransomware Scattered Spider Social Engineering

U.S. Secures Extradition of 19-Year-Old Linked to Scattered Spider

US authorities have intensified their pursuit of individuals linked to the financially motivated hacking collective Scattered Spider, and the extradition of a 19-year-old suspect marks another significant development.

Peter Stokes, who is a dual citizen of the United States and Estonia, is accused of taking part in coordinated cyber intrusions, ransomware extortion, and fraud operations linked to the group, which disrupted more than 100 organizations across critical industries and generated more than $100 million in extortion payments for the group.

After Stokes was arrested in Finland on a Red Notice from Interpol, he was transferred to the United States to be tried on several federal charges, which included conspiracy, computer intrusion, and extortion, demonstrating the increasing international cooperation being deployed for the dismantling of one of the most persistent cybercrime groups.

In describing the prosecution, Federal officials said it is part of an ongoing effort to combat increasingly sophisticated cybercrime activities that target U.S. organizations across a range of industries. In his remarks, Andrew S. Boutros, U.S. Attorney for the Northern District of Illinois, co-chair of the Acting Attorney General's White Collar, Cyber, and Crypto Subcommittee Advisory Committee, stated that the allegations of the Scattered Spider attack caused widespread disruption to businesses nationwide and highlighted the increased capabilities of cybercriminals operating across international borders driven by financial gain.

The Justice Department has demonstrated its commitment to pursuing technologically advanced threat actors regardless of where they are located with the charges, he stressed. In support of this position, Brett Leatherman, Assistant Director of the FBI's Cyber Division, stated that the group has consistently used employee-focused extortion and network compromise campaigns, which have resulted in millions of dollars of financial losses and disruptions to critical business operations.

According to him, the investigation illustrates the importance of coordinating the efforts of domestic and international law enforcement to identify, disrupt, and prosecute cybercriminals, wherever they operate. The superseding criminal complaint alleges that Stokes is associated with several cyber intrusions allegedly conducted by his online alias "Bouquet," including activities that date back to his 16th year of age.

A prosecutor contends that these activities were part of Scattered Spider's overall intrusion campaign, which also includes Octo Tempest, UNC3944, and 0ktapus, which are also tracked by security researchers. According to the investigation, the group compromised more than 100 networks by using highly targeted social engineering techniques, enabling the deployment of ransomware, data theft, and extortion schemes that collectively resulted in over $100 million in ransom payments as well as millions more in recovery costs for the organizations affected.

The complaint details a number of incidents in which Stokes and his co-conspirators allegedly breached a luxury jewelry retailer's network in May 2025, exfiltrating sensitive corporate data and demanding approximately $8 million in cryptocurrency. According to reports, the company declined to negotiate with the attackers, removed them from its environment, and incurred remediation expenses ranging from $2 million to $3 million.

Stokes was reportedly apprehended at Helsinki Airport as he attempted to board a flight to Japan, where Finnish law enforcement officials confiscated two 2-terabyte hard drives as part of the investigation. According to investigators, Scattered Spider is not a traditional hierarchical cybercrime syndicate, but rather a decentralized, English-speaking network of young threat actors operating throughout the United States, the United Kingdom, and Europe.

In order to gain initial access, the attackers utilize sophisticated social engineering techniques rather than exploiting software vulnerabilities. In their investigations, investigators assert that Scattered Spider has consistently focused on human manipulation rather than technical exploitation. It has been reported that members impersonate legitimate employees when contacting corporate IT support desks, convincing them to reset their credentials or authorize their account access before moving laterally through compromised environments, exfiltrating sensitive data, and demanding payment under the threat of publication.

After the high-profile compromises of MGM Resorts and Caesars Entertainment in 2023, the group's techniques have come under scrutiny. The intrusion at MGM severely disrupted casino and hotel operations. Several security researchers have observed a sector-focused targeting strategy since then, connecting the collective with multiple campaigns against major UK retailers, including Marks & Spencer, Harrods, and Co-op before it moved on to target American insurance companies, followed by the aviation industry.

A. Tysen Duva, assistant attorney general, pointed out that the collective was responsible for over 100 network intrusions resulting in over $100 million in ransom payments. It is important to note that Stokes' case also represents the culmination of a broader international law enforcement campaign that has relentlessly dismantled the individuals operating under the pseudonym Scattered Spider.

During recent prosecutions, Scottish national Tyler Buchanan, 24, admitted to fraud and identity theft by admitting to his role in phishing campaigns targeting Twilio and LastPass. As a result, prosecutors stated that $8 million in cryptocurrency was stolen and carries a maximum sentence of 22 years in prison.

In addition, Florida-based member Noah Urban was sentenced in August 2025 to 10 years in prison as well as a $12 million fine, while U.K. citizens Thalha Jubair and Owen Flowers pleaded guilty in June 2026 in connection with the Transport for London hack in 2024. As indicated in court documents, Flowers admitted to conspiring to compromise the networks of U.S. healthcare providers SSM Health and Sutter Health, demonstrating how far prosecutions have spread in an effort to dismantle the group's international cybercrime network.

Despite successive arrests disrupting Scattered Spider's operations, cybersecurity researchers caution that the group's tactics continue to affect the wider threat landscape. As a result of the law enforcement actions of 2025, Mandiant observed a temporary drop in activity; however, it also stated that other financially motivated threat groups have begun replicating the collective's social engineering approach.

An important defensive lesson of the assessment is that identity verification processes are often the primary attack surface rather than perimeter security measures. It is recommended that assistance desk authentication procedures be strengthened and that phishing-resistant authentication methods, such as hardware-backed passkeys or security keys, be adopted as effective measures for limiting unauthorized access through credential reset abuse.

According to a joint advisory issued by U.S. and international cybersecurity authorities, once the attackers gained initial access, they have reportedly been observed monitoring internal collaboration platforms and taking part in incident response calls as a way of tracking defensive actions in real-time and evading containment measures.

Researchers believe the digital evidence recovered during Stokes' arrest in Helsinki may provide valuable information about the group's broader infrastructure as well as potential associates. Even though Stokes remains presumed innocent until proven guilty in court, this latest extradition highlights a growing international enforcement effort that is demonstrating the inability of geographical distance, decentralized operations, and youth to provide reliable barriers to coordinated cybercrime prosecution.

International authorities are increasingly combining cross-border investigations with coordinated prosecutions to pursue individuals behind sophisticated intrusion campaigns that can disrupt businesses and disrupt lives. Increasing sophistication in identity-based attacks requires organizations to strengthen authentication controls, harden help desk verification processes, and continuously monitor privileged access in order to reduce the impact of increasingly sophisticated social engineering tactics.

Financial Services Must Prepare for Attacks Originating Inside the Cloud



 

Zero Trust Security

AI governance Cloud Security Data protection Financial Cybersecurity Hybrid Cloud Security Identity Theft ransomware attacks Technology Threat Intelligence Zero Trust Security

Financial Services Must Prepare for Attacks Originating Inside the Cloud

With the increase in adoption of cloud-based infrastructure, digital banking ecosystems, and interconnected transaction platforms, cybersecurity has evolved from a regulatory requirement to a critical element of operational resilience.

Payment service providers, banks, insurance companies, and investment firms now process massive amounts of sensitive financial data and transactions across increasingly complex environments, which makes them persistent targets for sophisticated cyber-adversaries. It encompasses the protection of internal networks, cloud workloads, customer records, mobile banking systems, and critical transaction pipelines against unauthorised access, fraud, and compromise of data.

A comprehensive financial cybersecurity strategy today goes far beyond perimeter defence, in addition to protecting internal networks, cloud workloads, customer records, and mobile banking systems. As threats evolve, preserving the confidentiality, integrity, and accessibility of financial systems becomes increasingly important not only to prevent cyberattacks and financial losses, but also to maintain institutional trust, regulatory compliance, and overall financial system stability.

Cloud-based applications and distributed financial platforms are simultaneously expanding the attack surface for threat actors targeting the financial sector due to the increasing reliance on cloud-native applications. As explained by Cristian Rodriguez, CrowdStrike Field CTO for the Americas, an increasing frequency of cloud-based intrusions has been directly linked to the rapid migration of financial workloads and services to cloud-based environments.

By leveraging stolen credentials and compromised digital identities, attackers have bypassed traditional exploitation techniques altogether in many observed incidents. The ability to move discreetly across environments allows adversaries to exfiltrate data, deploy malware, and run ransomware operations at a large scale, as well as abuse cloud infrastructure to perform command and control functions.

Based on CrowdStrike's 2025 Threat Hunting Report, intrusions targeting the financial sector increased by 26 percent during 2024, with a significant portion associated with credentials acquired through cybercriminal marketplaces operated by access brokers. A significant increase of almost 80 percent in nation-state activity targeting financial institutions was also observed, reflecting growing geopolitical and economic reasons for these attacks.

There is an increasing focus on obtaining intelligence regarding mergers, acquisitions, investment movements, and broader market trends from threat groups, who use stolen financial data to support strategic influence operations and economic espionage.

Genesis Panda was observed as an actor in these operations, demonstrating the continued involvement of advanced state-aligned cyber groups in financial-driven cyber attacks. Due to the rapidly expanding digital footprint within the financial sector, cybersecurity has evolved from a technical safeguard to a critical business necessity. The financial sector is increasingly targeted by cybercriminals due to the vast amounts of sensitive customer information, financial credentials, and transaction records it manages.

By encrypting, segmenting networks, implementing multi-factor authentication, protecting endpoints, and continuously monitoring threats, organizations are ensuring that their security is strengthened to combat evolving threats. As a consequence of cyber incidents, institutions face fraud, ransomware, regulatory penalties, operational disruption, and reputational damage in addition to data theft.

Increasingly sophisticated attacks have made sophisticated technologies like intrusion detection systems, malware defense, and real-time incident response critical to reducing financial and operational risks. In addition to maintaining consumer trust, cybersecurity plays a key role in regulatory compliance and ensuring compliance with financial standards.

Several frameworks, including the Bank Secrecy Act, Dodd-Frank Act, Sarbanes-Oxley Act and PCI DSS, require strict controls regarding access management, data protection, and network security throughout financial environments. As threat groups become more sophisticated, their vulnerabilities are becoming more apparent across hybrid cloud environments, particularly where cloud control planes interact with legacy on-premises infrastructures.

The threat actor Genesis Panda has demonstrated a deep understanding of cloud architectures, exploiting configuration errors and identity vulnerabilities associated with integrating distributed IT systems on a regular basis. In order to keep abreast of evolving threat actors, attack indicators, and emerging configuration risks, financial institutions need to maintain constant engagement with cybersecurity vendors and intelligence providers.

According to Matt Immler, Okta's Regional Chief Security Officer for the Americas, security teams cannot afford to be complacent as cloud ecosystems grow increasingly complex, and that proactive vendor collaboration is essential for ensuring defensive readiness is maintained. For nearly two years, Okta’s Threat Intelligence Team has provided financial organizations with insights into active cyber campaigns and attack tactics through quarterly intelligence briefings.

A data-driven approach has proven beneficial to organizations such as NASDAQ, where security teams have been able to remain on top of rapidly evolving threats within the sector, according to Immler. Additionally, briefings have highlighted the increasing activity of groups such as Scattered Spider that exploit human weaknesses in order to gain unauthorized access to enterprise systems by manipulating help desks and identity recovery processes.

Additionally, CrowdStrike’s Cristian Rodriguez observed that zero-trust security frameworks that have traditionally been applied to identity and endpoint protection need to be extended to cloud workloads and operational infrastructure, to prevent attackers from lateral movement. Additionally, destructive malware such as wiper malware remains a major concern in many sectors.

In order to detect these attacks, which are intended to permanently destroy data and render systems inoperable, state-backed actors, particularly those linked to China, often use stealth-focused tactics that make them particularly difficult to detect. In particular, Immler noted that adversaries of this type often prioritize long-term persistence, quietly integrating themselves into target environments, remaining undetected for extended periods of time before unleashing disruptive payloads.

With this increasing challenge, organizations are increasingly finding it difficult to determine the accurate depth of compromise within financial networks, therefore reinforcing the importance of continuous monitoring, integrated threat intelligence, and resilient cloud security architectures.

Credential Theft Continues to Dominate Financial Attacks

The financial institutions are experiencing a significant increase in credential-driven intrusions due to sophisticated and targeted phishing campaigns. The threat actors are now utilizing a variety of methods to bypass multi-factor authentication, including adversary-in-the-middle attacks and QR-code phishing operations capable of fooling even experienced employees.

As of mid-2025, Darktrace observed nearly 2.4 million phishing emails across financial sector environments, with almost 30% targeting VIPs and high-privilege users, a reflection of the growing importance of identity compromise as an initial method of access.

Data Loss Prevention Risks Are Expanding

Organizations have expressed concerns about confidentiality and regulatory exposure as they struggle to safeguard sensitive information, leaving enterprise environments vulnerable to malicious attacks. In October 2025, Darktrace identified more than 214,000 emails with unfamiliar attachments sent to suspected personal accounts within the financial sector. There were also 351,000 emails that carried unfamiliar files that were forwarded to freemail services such as Gmail, Yahoo, and iCloud, reinforcing the concerns regarding the leakage of data, insider risk, and compliance failures regarding sensitive financial records and internal communications.

Ransomware Operations Are Becoming More Destructive

The majority of modern ransomware groups prioritize data theft and extortion before attempting to encrypt data. Cybercriminals, including Cl0p and RansomHub, have emphasized the use of trusted file-transfer platforms provided by financial institutions to exfiltrate sensitive information and exert increased reputational and regulatory pressure. Fortra GoAnywhere MFT was targeted by Darktrace research several days before the related vulnerability was publicly disclosed, showing how attackers are taking advantage of vulnerabilities before traditional patching cycles are available.

Edge Infrastructure Has Become a Primary Target

As a result of the growing threat of virtual private networking, firewalls, and remote access gateways, researchers have observed pre-disclosure exploitation campaigns affecting Citrix, Palo Alto, and Ivanti technologies, allowing attackers to hijack sessions, gather credentials, and enter critical banking environments lateral. VPN infrastructure is increasingly being described as a concentrated attack surface, particularly where patching delays and weak segmentation give attackers the opportunity to compromise systems more deeply.

State-Backed Threat Activity Is Intensifying

It has been reported that state-sponsored campaigns, linked to North Korean actors affiliated with the Lazarus Group, continue to expand across cryptocurrency and fintech organizations. According to investigators, malicious NPM packages, BeaverTail and InvisibleFerret malware, and exploiting React2Shell vulnerabilities were utilized to facilitate credential theft and persistent access. Organizations throughout Europe, Africa, the Middle East, and Latin America have been affected by the activity, demonstrating the global scope and extent of these financial crimes cyber operations.

Cloud and AI Governance Challenges Are Growing

There is an increasing perception among financial sector CISOs that cloud complexity, insider exposure, and uncontrolled AI adoption pose systemic security risks. Keeping visibility across distributed, multi-cloud environments while preventing sensitive information from being exposed through emerging artificial intelligence tools has become increasingly challenging. With the rapid integration of AI-driven technologies into operations, governance, compliance oversight and cloud security resilience are increasingly becoming board-level cybersecurity priorities rather than merely technical concerns.

Building Long-Term Cyber Resilience

Due to increasing sophistication of cyber threats, financial institutions are adopting resilient security strategies to strengthen cloud, identity, and data protection. AI-powered cybersecurity tools are being used increasingly by organizations across cloud and endpoint environments to enhance threat detection, automate security operations, and expedite incident response.

Meanwhile, financial firms are increasingly relying on third-party platforms, APIs, and connected services, which require stronger identity and access management controls. In addition to addressing resource and expertise gaps, many institutions are turning to managed security services to enhance operational readiness and address resource and expertise gaps.

A number of industry leaders emphasize that data protection is not simply a compliance obligation, but rather a fundamental business risk, putting greater emphasis on enterprise-wide governance, risk classification, and ownership of sensitive financial information. In light of the increasingly volatile cyber landscape, financial institutions are shifting their focus from reactive defenses to long-term operational resilience in response to this threat.

Cloud expansion, identity-driven attacks, ransomware evolution, and AI-related governance risks have all contributed to the strategic business priority of cybersecurity rather than an IT function alone. In order to maintain resilience, experts warn that continuous threat intelligence collaboration, enhanced identity security frameworks, proactive cloud governance, and increased incident response capabilities that are capable of responding to rapidly changing attack patterns will be necessary.

With attackers increasingly exploiting trust, misconfigurations, and human vulnerabilities in an environment, securing critical infrastructure, sensitive data, and digital operations will be a critical component of preserving institutional stability, regulatory confidence, and customer trust.

Surge in Digital Fraud Prompts Consumer Reports to Issue Safety Guidance



 

Scam Detection

Cyber Frauds Cybersecurity awareness Data protection Financial Fraud Prevention Identity Theft Mobile Security Online Scams Phishing Attacks Scam Detection

Surge in Digital Fraud Prompts Consumer Reports to Issue Safety Guidance

By incorporating digitally mediated communication into nearly every aspect of modern life, digital media has fundamentally reshaped the way individuals interact, transact, and manage daily responsibilities, adding convenience to nearly every aspect of life. However, this same interconnected infrastructure has also broadened cybercriminal attack surfaces.

Increasing communication channels, such as voice networks, social platforms, and messaging platforms, have led to an increase in fraud activity and sophistication. In addition to occasional phishing emails, persistent, multi-channel intrusion attempts have been developed that exploit user trust, behavior, and familiarity with platforms.

Digital fraud is a systemic risk that is characterized by the exploitation of technological interfaces to exploit financial assets, sensitive data, and identity credentials, and has become a systemic risk in this context. According to the Consumer Cyber Readiness assessment for 2025, there is an extensive exposure rate, with nearly half of the surveyed individuals reporting a direct encounter with fraudulent schemes.

Financial losses were a measurable component of these incidents, demonstrating the operational effectiveness of current threat models. Using a collaborative analysis conducted by consumer advocacy and cybersecurity organizations, the data also illustrates a shift in attack vectors as a result of these incidents.

Fraud attempts are now primarily transmitted through digital channels, including email, social media, SMS, and messaging applications. Message-based fraud has experienced significant growth, with its share increasing significantly year over year, reflecting both higher user engagement on these platforms and the relative ease with which attackers can execute scalable campaigns. This trend has been confirmed by observations of threat actors, which indicate that text-based scams generate substantial illegal revenue streams alone.

Even though technology providers are implementing enhanced safeguards and detection mechanisms within their ecosystems, these controls are subject to inherent limitations. The prevention of digital fraud increasingly requires user awareness, behavioral vigilance, and proactive security practices tailored to an evolving threat environment, as well as heightened awareness and behavioral vigilance.

Digital fraud in the Indian landscape has become even more intensified, as scale and frequency are combined to create sustained financial and psychological pressure on consumers against such a global backdrop. In recent years, fraudulent communication has become a persistent operational risk within the digital economy, as opposed to an isolated incident.

A successful fraud attack is not only financially severe but also extremely efficient, as threat actors often compress the fraud lifecycle into a few minutes by reporting loss patterns. In conjunction with the high interaction rate among recipients of suspicious messages, this acceleration indicates an active behavioral gap exploited by adversaries.

Through digital adoption, a larger attack surface is made available across payments, social platforms, and mobile-first services, leading to more targeted and context-aware fraud campaigns. As a consequence of the rapid evolution of attack methodologies, conventional phishing tactics are increasingly being supplemented by artificial intelligence-driven deception techniques, such as synthetic media and voice impersonation, compounding this challenge.

Furthermore, these tools enhance credibility at large scale, making detection more difficult for the typical user. This illustrates the continuing disparity between technological sophistication and the level of user readiness. Institutional response initiatives, such as awareness programs and reporting frameworks, are gaining momentum, yet they are often operating reactively in an environment defined by continuous innovation characterized by continuous threat.

Unless parallel advances are made in consumer education, real-time threat intelligence, and adaptive regulatory measures, the economic and systemic consequences of digital fraud will continue to hinder the country's digital growth ambitions. It is imperative that practical safeguards at the user level remain a critical line of defense in this increasingly complex threat environment.

In Consumer Reports, the importance of utilizing native security features embedded into modern smartphones is highlighted, which are designed to detect and filter potentially malicious communication immediately. This first line of defense against high volume scam attempts is provided by these controls, whether they are advanced message filtering capabilities on iOS devices or automated spam detection within Android-based messaging platforms.

The report recommends, however, that independent verification is necessary before initiating any financial transaction, particularly in scenarios involving urgency and emotional distress, which are common tactics used by impersonation-based fraudsters. Technical safeguards alone are not sufficient without disciplined user behavior.

By cross-checking requests using alternate communication channels, users can reduce the possibility of compromised accounts and deceptive communication. In addition, it is essential to use digital payment applications cautiously, since, despite their efficiency, they frequently lack the robust fraud prevention frameworks associated with traditional banking instruments. Because such platforms are not mandated to provide reimbursement mechanisms, users have a greater responsibility for due diligence.

Due to this, it is recommended that financial transactions be conducted only between verified and trusted recipients, and that higher-risk payments be made through a more secure and regulated channel, such as credit-backed transactions or direct bank transfers.

The combined measures demonstrate a broader reality in a digitally adversarial digital environment. Ultimately, resilience to digital fraud depends on a combination of technological controls, informed user judgment, and proactive risk mitigation within an increasingly adversarial digital environment.

Data Breach Alert: What It Means, Why It Matters, and How to Protect Yourself Immediately



 

Malicious Link

2FA Cyber Phishing Data Breach Financial Fraud Fraud Alert Identity Theft Malicious Link

Data Breach Alert: What It Means, Why It Matters, and How to Protect Yourself Immediately

Data breach notifications should never be ignored. Discarding them as junk mail can expose you to serious risks, including financial fraud, identity theft, and unauthorized access to your personal records.

These alerts are now extremely common. They often arrive as emails or letters from organizations such as banks, telecom providers, insurers, or even gyms. Because of their frequency, many individuals overlook them. However, the Identity Theft Resource Center reports that nearly 80 percent of people received at least one such notice in the past year, with many receiving several. This repeated exposure has led to what experts describe as “breach fatigue,” where individuals stop responding to warnings altogether.

The consequences of ignoring these alerts can be severe. Criminals may open credit accounts in your name, accumulate large debts within minutes, or misuse identification numbers to access services such as healthcare. For example, a recent breach involving a U.S.-based benefits administrator exposed Social Security numbers of 2.7 million individuals. In 2024 alone, 1.36 billion breach notifications were issued. While 2025 saw fewer victims overall, the incidents became more serious. Highly sensitive data, including Social Security numbers, appeared in two-thirds of cases, while financial details or driver’s license information were involved in roughly one-third.

Cybersecurity professionals, including Sandra Glading, Greg Oslan, and David Trapp, define a data breach as an incident where unauthorized actors gain access to systems and extract personal data. This information may include basic details such as names and contact information, or more sensitive data like passwords, banking details, or national identifiers. The level of risk increases significantly when multiple types of data are combined, as attackers can reconstruct identities and carry out complex fraud.

The scale of the issue has grown rapidly. The Identity Theft Resource Center recorded 3,322 breaches affecting more than 278 million individuals in the United States in 2025, marking the highest level on record and a 79 percent increase over five years. Two decades ago, such incidents were far less frequent. Around 2010, there were roughly 600 breaches annually, and attackers primarily targeted governments or large institutions. Today, the threat landscape has shifted toward mass exploitation driven by financial incentives. According to the Federal Bureau of Investigation, cybercrime losses reached $16.6 billion in 2024, demonstrating the scale of this criminal ecosystem.

How Do You Know If You’ve Been Affected?

In many countries, including the United States, companies are legally required to inform individuals when their personal data is compromised. Notifications may arrive via email, physical mail, or identity-protection services. In major incidents, the news media may report the breach before individuals receive direct communication.

However, this system is not foolproof. Experts warn that notifications often take months because companies need time to investigate. By the time you are informed, your data may already be in use by attackers.

At the same time, scammers exploit these situations by sending fake breach alerts. These messages may include links offering free credit monitoring or contact numbers. You should never act immediately on such messages. Always verify the information through the official website of the organization before clicking links or sharing personal data.

What to Do Immediately After a Data Breach

Security experts stress that speed matters. According to IBM, the average data breach remains active for 241 days, giving attackers an advantage before detection.

1. Identify What Information Was Exposed

Different types of data create different risks. For example, an exposed email address may lead to phishing attempts, while a leaked Social Security number can enable identity theft.

Carefully review the breach notification and locate the section that lists the compromised data. If the details are unclear, contact the organization directly. You can also use trusted breach-checking tools such as services provided by the National Cybersecurity Center or “Have I Been Pwned” to verify whether your email appears in known leaks.

2. Freeze Your Credit

A credit freeze prevents lenders from accessing your credit report, making it difficult for criminals to open new accounts in your name.

To do this, contact the three major credit bureaus:

• Experian

• Equifax

• TransUnion

This process is free and can typically be completed online within minutes.

3. Place a Fraud Alert

A fraud alert requires lenders to verify your identity before approving new credit.

You only need to contact one credit bureau, which will notify the others. Standard alerts last one year, while extended alerts for confirmed identity theft victims can remain active for up to seven years.

4. Monitor Financial Accounts Closely

Unauthorized transactions may appear quickly or after a delay.

Review your bank and credit card statements regularly for several months. Enable transaction alerts to receive real-time notifications of account activity. If you notice suspicious charges, report them immediately. Most financial institutions offer zero-liability protection, but timely reporting is essential.

5. Update Your Passwords

If login credentials are exposed, attackers often attempt to reuse them across multiple platforms.

Immediately change the password for the affected account. Then update any other accounts that use the same or similar credentials. Use strong, unique passwords for each account to reduce risk.

6. Enable Two-Factor Authentication

Two-factor authentication adds an additional layer of security by requiring a temporary code generated on your device.

Although it may seem inconvenient, it significantly reduces the chances of unauthorized access. Whenever possible, use authenticator apps instead of SMS-based codes, as they are more secure.

Additional Steps to Strengthen Long-Term Protection

After addressing immediate risks, you should adopt preventive measures:

• Use a password manager to create and store complex passwords.

• Enable passkeys, which rely on biometrics or device authentication instead of traditional passwords.

• Consider identity-protection services that monitor credit activity and data leaks.

• Stay alert to phishing attempts, especially after a breach, as attackers often impersonate trusted organizations. Avoid clicking unknown links or downloading unexpected attachments.

Experts also recommend tools like the Personal Cyber Advisor from the National Cybersecurity Center, which provides tailored guidance and alerts to help users reduce their risk.

Why This Matters Now

Data breaches are no longer rare or isolated events. They have become part of a large-scale, financially driven cybercrime ecosystem. The increasing frequency, combined with the growing sensitivity of exposed data, means individuals must take a more proactive approach to digital security.

Ignoring a breach notification is no longer a safe option. Acting quickly and following the correct steps can significantly reduce the potential damage.

Volvo Hit in Conduent Breach Affecting 25 Million



 

Volvo Breach

Conduent Hack Data Breach Identity Theft Ransomware attack Volvo Breach

Volvo Hit in Conduent Breach Affecting 25 Million

A major data breach at business services provider Conduent has spiraled into a large-scale security incident affecting at least 25 million people across the United States, with Volvo Group North America among the latest victims. The breach, originally disclosed in early 2025, is now understood to be far more extensive than first reported, impacting residents in multiple states and exposing sensitive personal data. Texas authorities now estimate that 15 million people have been affected, up from an initial 4 million, while more than 10 million individuals in Oregon have also been caught up in the incident.

Conduent first confirmed in November 2025 that a cyberattack in January 2025 had exposed personal data belonging to over 10 million people. The compromised information included names, addresses, dates of birth, Social Security numbers, and health and insurance details, making it highly valuable for identity theft and fraud. Earlier, in April 2025, the company had revealed that attackers stole names and Social Security numbers during the same January intrusion, highlighting a pattern of gradually escalating disclosures as the scale of the breach became clearer.

Operational disruption accompanied the data exposure, as Conduent disclosed that a January cyberattack caused service outages impacting agencies in multiple U.S. states. Wisconsin and Oklahoma reported issues affecting payments and customer support, underscoring how attacks on back-office providers can cascade into interruptions of public services. Subsequent investigation determined that hackers had maintained access to Conduent’s network from October 21, 2024, to January 13, 2025, giving them ample time to exfiltrate personal data, including Social Security numbers, dates of birth, addresses, and health-related information.

The Safepay ransomware group later claimed responsibility for the attack in February 2025, adding an extortion dimension to the incident. Conduent, which offers printing and mailroom services, document processing, payment integrity, and other back-office support, has been sending breach notifications on behalf of affected clients, including Volvo Group North America. According to a filing with the Maine Attorney General, Volvo reported that 16,991 employees were impacted, and the company said it only learned of the incident in January 2026, many months after the original intrusion window.

In its notification letters, Conduent informed individuals that some of their personal information may have been involved due to services provided to their current or former health plans. The company stated it is not aware of any attempted or actual misuse of the compromised data but is urging recipients to consider steps to protect themselves. As part of its response, Conduent is offering free identity protection services to those affected, reflecting ongoing concern about long-term risks posed by the theft of such highly sensitive information.

AI and Network Attacks Redefine Cybersecurity Risks on Safer Internet Day 2026



 

Network Attacks

AI technology AI threats Cyber Security Cyberattacks Digital Security Identity Theft Network Attacks

AI and Network Attacks Redefine Cybersecurity Risks on Safer Internet Day 2026

As Safer Internet Day 2026 approaches, expanding AI capabilities and a rise in network-based attacks are reshaping digital risk. Automated systems now drive both legitimate platforms and criminal activity, prompting leaders at Ping Identity, Cloudflare, KnowBe4, and WatchGuard to call for updated approaches to identity management, network security, and user education. Traditional defences are struggling against faster, more adaptive threats, pushing organisations to rethink protections across access, infrastructure, and human behaviour. While innovation delivers clear benefits, it also equips attackers with powerful tools, increasing risks for businesses, schools, and policymakers who fail to adapt.

Ping Identity highlights a widening gap between legacy security models and modern AI operations. Systems designed for static environments are ill-suited to dynamic AI applications that operate independently and make real-time decisions. Alex Laurie, the company’s go-to-market CTO, explained that AI agents now behave like active users, initiating processes, accessing sensitive data, and choosing next steps without human prompts. Because their actions closely resemble those of real people, distinguishing between human and machine activity is increasingly difficult. Without proper oversight, these agents can introduce unpredictable risks and expand organisational attack surfaces.

Laurie advocates moving beyond static credentials toward continuous, verified trust. Instead of assuming legitimacy after login, organisations should validate identity, intent, and context at every interaction. Access decisions must adapt in real time, guided by behaviour and current risk conditions. This approach enables AI innovation while protecting data and users in an environment filled with autonomous digital actors.

Cloudflare also warns of AI’s dual-use nature. While it boosts efficiency, it accelerates cybercrime by making attacks faster, cheaper, and harder to detect. Pat Breen cited Australian data from 2024–25, when more than 1,200 cyber incidents required response, including a sharp rise in denial-of-service attacks. Such disruptions immediately impact essential services like healthcare, banking, education, transport, and government systems. Whether AI ultimately increases safety or risk depends on how quickly cyber defences evolve.

KnowBe4’s Erich Kron stresses the importance of digital mindfulness as AI-generated content and deepfakes spread. Identifying fake content is no longer a technical skill but a basic life skill. Verifying information, protecting personal data, using strong authentication, and keeping software updated are critical habits for reducing harm. WatchGuard Technologies reports a shift away from malware toward network-focused attacks.

Anthony Daniel notes that this trend reinforces the need for Zero Trust strategies that verify every connection. Safer Internet Day underscores that cybersecurity is a shared responsibility, strengthened through consistent, everyday actions.

PayPal Subscriptions Exploited in Sophisticated Email Scam



 

Subscription Abuse

Cyber Fraud Identity Theft PayPal Scam Phishing Campaign Subscription Abuse

PayPal Subscriptions Exploited in Sophisticated Email Scam

Hackers have found a clever way to misuse PayPal's legitimate email system to send authentic looking phishing scams that are able to bypass security filters and look genuine to the end users.

Over the last few weeks, users are complaining that they are receiving emails from PayPal's legitimate address "service@paypal.com" informing that their automatic payment has expired. The emails successfully pass all the usual security checks such as DKIM and SPF authentication and have proved to be coming directly from PayPal’s mail servers.

One of the reasons these messages are potent is that the scammers have altered the Customer Service URL to take users to their own websites from where they can see fake purchase notifications, claiming victims have purchased high-priced electronics such as MacBooks, iPhones, or Sony devices for USD 1,300 to 1,600.

The spam text message contains Unicode characters which can make the words bold or in different fonts, all this is to help to get round spam filters and keyword detection. Instead, the messages tell recipients to call a phony “PayPal support” phone number to cancel or dispute the alleged charges.

BleepingComputer's analysis of logs and transactions shows that the PayPal Subscriptions feature is being abused by scammers. When merchants hold a subscriber's subscription, they can do so with their own mechanism, and PayPal, in turn, will notify subscribers via email. PayPal seems to be vulnerable to a subscription metadata attack - perhaps in an API or legacy platform - which lets attackers insert arbitrary text in the Customer Service URL field (it normally only accepts valid URLs).

The scammers can forge emails and register a fake subscriber account for an email address associated with Google Workspace mailing list. When these accounts receive the notification from PayPal, the mailing list service sends what looks like a legitimate e-mail from PayPal to the list of "victims", making it looks more and more like a scam.

Safety measures

Recipients should ignore these emails and avoid calling the provided phone numbers. These tactics historically aim to facilitate bank fraud or trick victims into installing malware on their devices . PayPal confirmed awareness of the scam and recommends customers contact support directly through the official PayPal app or website if they suspect fraudulent activity. Users concerned about account compromise should log into their PayPal account directly rather than clicking email links to verify whether any unauthorized charges actually occurred.

Screen Sharing on WhatsApp Turns Costly with Major Financial Loss



 

WhatsApp Security

Banking Malware Cyber Attacks Cybercrime Trends Digital Fraud Identity Theft Malware Threats Online Safety Screen Sharing Scam Social Engineering WhatsApp Security

Screen Sharing on WhatsApp Turns Costly with Major Financial Loss

Several disturbing patterns of digital deception have quietly developed in recent months, revealing just how readily everyday communications tools can be turned into instruments of financial ruin in an instant. According to security researchers, there has been an increase in sophisticated cybercriminal schemes utilizing the trust users place in familiar platforms, particularly WhatsApp, to gain access to the internet.

It is a common occurrence that what initially starts out as a friendly message, an unexpected image, or a polite call claiming that an “urgent issue” with a bank account is a crafted scam which soon unravels into a meticulously crafted scam. It is very possible for malicious software to be installed through downloading an innocuous-looking picture that can allow you to infiltrate banking applications, harvest passwords, and expose personal identification information without your knowledge.

There have been instances where fraudsters impersonating bank representatives have coaxed users into sharing their screens with the false pretense that they are resolving account discrepancy. When this has happened, these fraudsters can observe every detail in real time - OTP codes, login credentials, account balances - and in some cases, they will convince victims to install remote access programs or screen mirroring programs so they can further control the device.

It is evident from the intertwined tactics that a troubling trend in digital crime has taken place, emphasizing the need for increased vigilance among Indians and beyond, underscoring a troubling development. There is a fast-growing network of social-engineering groups operating across multiple regions, who are utilizing WhatsApp's screen-sharing capabilities to bypass safety measures and gain control of their financial lives by manipulating their screen-sharing capabilities.

Investigators have begun piecing together the contours of this network. Initially introduced in 2023 as a convenience feature, screen-sharing has since become a critical point of exploitation for fraudsters who place unsolicited video calls, pretend to be bank officials or service providers, and convince victims to reveal their screens, or install remote-access applications masquerading as diagnostic tools, to exploit their vulnerabilities.

Almost $700,000 was defrauded by one victim in one of the cases of abuse that spanned from India and the U.K. to Brazil and Hong Kong. This demonstrates how swiftly and precisely these schemes emerge. In describing the technique, it is noted that it is not based on sophisticated malware, but rather on urgency, trust, and psychological manipulation, allowing scammers to circumvent a lot of traditional technical protections.

Furthermore, criminal networks are enhancing their arsenals by spreading malicious files via WhatsApp Web, including one Brazilian operation that uses self-replicating payloads to hijack contacts, automate fraudulent outreach, and compromise online banking credentials through its use of malicious payloads distributed through WhatsApp Web.

The investigators of the fraud note that the mechanisms are based less on technical sophistication and more on psychological pressure intended to disarm victims. An unsolicited WhatsApp video call made by a number that appears local can be the start of the scam, usually presented as a bank officer, customer service agent, or even an acquaintance in need of assistance.

Callers claim to have an urgent problem to solve - an unauthorized transaction, an account suspension threat, or even an error in the verification process - that creates a feeling of panic that encourages their victims to comply without hesitation.

The imposter will initially convince the victim that the issue is being resolved, thereby leading to them sharing their screen or installing a legitimate remote-access application, such as AnyDesk or TeamViewer, which will enable the fraudster to watch every action that occurs on the screen in real time, as they pretend to resolve it.

By using this live feed, an attacker can access one-time passwords, authentication prompts, banking app interfaces, as well as other sensitive credentials. By doing so, attackers can be able to take control of WhatsApp accounts, initiate unauthorized transfers, or coax the victim into carrying out these actions on their own.

A more elaborate variant consists of guiding the victim into downloading applications that secretly contain keyloggers or spyware that can collect passwords and financial information long after the call has ended, allowing them to collect it all. When scammers have access to personal information such as banking details or social media profiles, they can drain accounts, take over accounts on social networks, and assume the identity of victims to target others on their contact list.

Authorities caution that the success of these schemes depends on trust exploiting, so user vigilance is key. According to the advisories, individuals should be cautious when receiving unknown phone calls, avoid sharing screens with unknown parties, disable installations coming from untrusted sources, and refrain from opening financial apps when they are receiving remote access.

These measures are crucial in order to prevent these social engineering scams from getting the better of them, as they continue to develop. As far as the most advanced variations of the scam are concerned, the most sophisticated versions of the scam entail criminals installing malicious software through deceptive links or media files in a victim's device, thus granting them complete control of that victim's computer.

When these kinds of malware are installed, they can record keystrokes, capture screens, gather banking credentials, intercept two-factor authentication codes, and even gain access to sensitive identity documents. It is possible for attackers to take control of cameras and microphones remotely, which allows them to utilize the device as a tool for surveillance, coercion, or a long-term digital impersonation device.

In addition to financial theft, the extent to which the compromised identity may be exploited goes far beyond immediate financial exploitation, often enabling blackmail and continuous abuse of the victim's identity.

In light of this backdrop, cybersecurity agencies emphasize the significance of adopting preventative habits that can significantly reduce exposure to cybercriminals. There is still an important role to play in ensuring that users do not download unfamiliar media, disable WhatsApp's automatic download feature, and keep reputable mobile security tools up to date.

WhatsApp still has the built-in features that allow them to block and report suspicious contacts, while officials urge individuals to spread basic cyber-hygiene knowledge among their communities, pointing out that many people fall victim to cyber-attacks simply because they lack awareness of the dangers that lurk.

There has been a surge of fraud attempts across messaging platforms, and Indian authorities, including the Indian Cybercrime Coordination Centre, as well as various state cyber cells have issued a number of public advisories about this, and citizens are encouraged to report such attacks to the National Cybercrime Reporting Portal as soon as possible.

In conjunction with these warnings, these findings shed light on a broader point: even the most ordinary digital interactions are capable of masking sophisticated threats, and sustained vigilance remains the strongest defense against the growing epidemic of social engineering and malware-driven crimes that are booming in modern society.

As the majority of the fraud is carried out by social-engineering tactics, researchers have also observed a parallel wave of malware campaigns that are utilizing WhatsApp's broader ecosystem, which demonstrates how WhatsApp is capable of serving as a powerful channel for large-scale infection. As an example of self-replicating chains delivered through WhatsApp Web, one of the most striking cases was reported by analysts in Brazil.

A ZIP archive was sent to the victims, which when opened, triggered the obfuscated VBS installer SORVEPOTEL, which was an obfuscated VBS installer. In this PowerShell routine, the malware used ChromeDriver and Selenium to re-enter the victim's active WhatsApp Web session, enabling the malware to take full control of the victim's active WhatsApp Web session.

In order to spread the malware, the script retrieved message templates from a command-and-control server, exfiltrated the user's contact list, and automatically distributed the same malicious ZIP file to every network member that was connected with it—often while displaying a fake banner that said "WhatsApp Automation v6.0" to give it the appearance of legitimacy.

Researchers found that Maverick was a payload that was evasive and highly targeted, and it was also accompanied by a suite of malicious capabilities. It was also packaged inside the ZIP with a Windows LNK file that could execute additional code through the use of a remote server that had the first stage loader on it. As soon as the malware discovered that the device was belonging to a Brazilian user, it launched its banking module only after checking for debugging tools, examining the system locale indicators such as the time zone and language settings.

A Maverick server monitoring website activity for URLs linked to Latin American financial institutions, when activated, was aligned with credential harvesting and account manipulation against regional banks, aligning its behavior with credential harvesting. As Trend Micro pointed out previously, an account ban could be issued as a result of the sheer volume of outbound messages caused by a similar WhatsApp Web abuse vector, which relied on active sessions to mass-distribute infected ZIP files.

These malware infections acted primarily as infostealers that targeted Brazilian banking and cryptocurrency platforms, thereby demonstrating the fact that financial fraud objectives can be easily mapped to WhatsApp-based lures when it comes to financial fraud.

It is important to note, however, that security analysts emphasize that the global screen-sharing scams are not primarily the work of a single sophisticated actor, but rather the work of a diffuse criminal ecosystem that combines trust, urgency, and social manipulation to make them successful. According to ESET researchers, these tactics are fundamentally human-driven rather than based on technical exploits over a long period of time, whereas Brazilian malware operations show clearer signs of being involved in structured criminal activity.

It is thought that the Maverick Trojan can be linked to the group that has been named Water Saci, whose operations overlap with those of the Coyote banking malware family-which indicates that these groups have been sharing techniques and developing tools within Brazil's underground cybercrime market.

Even though the associations that have been drawn between WhatsApp and opportunistic scammers still seem to be rooted in moderate confidence, they reveal an evolving threat landscape in which both opportunistic scammers and organized cybercriminals work towards exploiting WhatsApp to their advantage.

A number of analysts have indicated that the success of the scheme is a function of a carefully orchestrated combination of trust, urgency, and control. By presenting themselves as legitimate entities through video calls that appear to originate from banks, service providers, or other reliable entities, scammers achieve a veneer of legitimacy by appearing authentic.

In addition, they will fabricate a crisis – a fake transaction, a compromised account, or a suspended service – in order to pressure the victim into making a hasty decision. The last step is perhaps the most consequential: convincing the victim to share their screen with the attacker, or installing a remote access tool, which in effect grants the attacker complete access to the device.

In the event that a phone is gained access to, then every action, notification, and security prompt becomes visible, revealing the phone as an open book that needs to be monitored. Security professionals indicate that preventative measures depend more on vigilance and personal precautions than on technical measures alone.

Unsolicited calls should be treated with suspicion, particularly those requesting sensitive information or screen access, as soon as they are received, and any alarming claims should be independently verified through official channels before responding to anything unfounded. The use of passwords, OTPs, and banking information should never be disclosed over the telephone or through email, as legitimate institutions would not request such data in this manner.

Installing remote access apps at the direction of unfamiliar callers should be avoided at all costs, given that remote access applications allow you to control your device completely. It is also recommended to enable WhatsApp's built-in two-step verification feature, which increases the security level even in the event of compromised credentials.

Finally, investigators emphasize that a healthy degree of skepticism remains the most effective defense; if we just pause and check it out independently, we may be able to prevent the cascading damage that these highly persuasive scams intend to cause us.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Nigerian Hacker Sentenced To Eight Years For Fraud And Identity Theft

US Charges 14 People in North Korean IT Worker Scheme Targeting More Than 70 Companies

Denmark Population Registry Breach Exposes 8.8 Million Citizens

FBI Investigates Dark Web Service Offering 153 Million Driver’s Licenses

Nearly 7 Million Driver's License Numbers Exposed After AssuranceAmerica Data Breach

Council of Europe Data Breach Exposes Records of 10000 Employees After ShinyHunters Leak

U.S. Secures Extradition of 19-Year-Old Linked to Scattered Spider

Financial Services Must Prepare for Attacks Originating Inside the Cloud

Surge in Digital Fraud Prompts Consumer Reports to Issue Safety Guidance

Data Breach Alert: What It Means, Why It Matters, and How to Protect Yourself Immediately

Volvo Hit in Conduent Breach Affecting 25 Million

AI and Network Attacks Redefine Cybersecurity Risks on Safer Internet Day 2026

PayPal Subscriptions Exploited in Sophisticated Email Scam

Screen Sharing on WhatsApp Turns Costly with Major Financial Loss

Footer About

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item