Security experts have urged organizations to take a more considerate approach to cyber awareness training after a Canadian health board sent emails to staff offering paid leave as part of a phishing test.

Ron Johnson, interim chief executive at Newfoundland and Labrador Health Services, apologized for the phishing test last week, admitting the emails were sent in poor taste.

“We acknowledge the approach taken in this particular exercise was not appropriate, and we sincerely apologize to employees, physicians, and union representatives,” he wrote.

The phishing simulation prompted backlash after being circulated to hundreds of employees, and has since prompted a review of future activities, Johnson added.

“We value the feedback and are reviewing how future awareness exercises are developed and communication,” he said.

“It is important they reflect employee and physician perspectives, as well as our organizational values to foster a respectful and supportive workplace culture.”

This isn’t the first time an organization has been forced into a U-turn after a controversial phishing test campaign.

As ITPro reported in late 2024, the University of California Santa Cruz (UCSC) was heavily criticized for a “tone deaf” campaign which used a fake Ebola virus track and trace alert.

The campaign caused a panic on campus and was highly convincing, even employing links to a fake webpage set up to support those affected by the “outbreak”.

Phishing tests are a vital part of cyber hygiene

While this particular incident sparked ire among employees, phishing tests are a common practice by cybersecurity professionals to ensure staff remain vigilant to potential security threats.

Phishing attacks, in particular, are a leading cause of breaches at organizations across a range of industries – and the healthcare sector specifically is a prime target for cyber criminals.

Add AI into the equation, and the threat landscape faced by enterprises today is becoming increasingly perilous, with threat actors using the technology to refine techniques and curate highly convincing emails.

Rob Anderson, head of reactive consulting services at Reliance Cyber, told ITPro that the “best phishing exercises are realistic” – after all, they are intended to emulate the tactics used by cyber criminals.

"They should use the same sneaky tactics that threat actors may use, hopefully triggering the trained, instinctive suspicion we want staff to develop when handling unexpected emails,” he said.

“However, there is a fine line. Nobody likes to be made a fool of, especially at sensitive times.”

Anderson pointed to a phishing exercise by one UK police force’s Information Protection Unit, which circulated emails targeting staff in a typical fashion. Those who fell foul were met with a message stating: “whoops, you’ve failed this training”.

In this instance, Anderson said the Information Protection Unit had “failed to read the room”.

“A week earlier, the force had announced a restructure, with likely compulsory redundancies and transfers,” he said. “Police officers can be a vocal and cynical bunch, and they made their feelings known.”

A delicate balancing act

It’s here that phishing tests often become a delicate balancing act, according to Simon McNalley, identity and access management (IAM) technical director at Thales.

Ultimately, cybersecurity professionals need to ensure that simulations are “realistic enough to reflect the tactics attackers use” without “exploiting goodwill”.

“Scenarios involving pay, bonuses, annual leave, personal hardship, or other highly sensitive employment matters should be approached with caution, as they risk damaging confidence in legitimate internal communications,” he told ITPro.

Anderson echoed McNally’s comments, adding that human resources (HR), communications, and senior leadership should be consulted before campaigns go live.

Ultimately, McNally said the NL Health Services incident should serve as an example to other organizations hoping to keep staff on their guard in light of rising threats.

“There is a place for phishing simulations as part of building cyber awareness, especially as attackers routinely use such techniques. However, it’s vital that these exercises do not come at the expense of trust between employer and employee. Trust is a critical component of security culture,” he said.

“If awareness programs leave employees feeling misled, embarrassed or manipulated, organizations risk undermining the very behaviors they are trying to encourage.”

FOLLOW US ON SOCIAL MEDIA

Cyber criminals are exploiting AI hype to impersonate the branding of AI platforms such as ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic’s Claude, according to new research.

Microsoft Threat Intelligence said it's observed an uptick in phishing, malvertising, and search engine optimization (SEO)-driven attacks that ultimately lead to credential theft, financial fraud, or malware infection.

Campaigns focus on highly anticipated launches or emerging trends, using tried-and-tested tactics such as urgency-driven messaging, abuse of trusted services, and multi-stage redirection chains that require user interaction to evade detection.

"While traditional lures like invoices, payment notifications, or delivery alerts remain effective and continue to be widely used, AI-themed lures reflect a shift in social engineering that is likely to persist as a long-term tactic used by threat actors, from cyber criminal groups to nation states," the company warned.

ChatGPT users in the crosshairs

In one example, Microsoft said it had observed a ChatGPT-themed phishing attack delivering malicious URLs which led to phishing pages that collected credit card and personal information such as names and addresses.

The emails used the sender display name ChatGPT and the subject line: “To ensure your ChatGPT Plus continues to work – please update your payment method”.

This phishing activity, which consisted of 4,500 emails sent to targets in South Africa, was part of a broader campaign using similar themes and infrastructure that delivered as many as 100,000 emails on a single day to targets in Switzerland, Austria, and South Africa.

Microsoft noted the campaign affected a broad range of industries, including higher education and professional services.

Thousands targeted in a Claude-themed phishing attack

In another example, security experts spotted a phishing campaign impersonating Anthropic-branded services to target users with account-related lures tied to the Claude AI platform.

The campaign sent phishing emails to targets across more than 2,000 organizations, mainly in the US, UK, and India.

"The campaign used enforcement-themed messaging claiming that the recipient’s account was in violation of acceptable use policies and required immediate action," the company noted.

"The emails impersonated Anthropic’s popular AI service Claude using the display names Anthropic Teams and Anthropic PBC, masquerading as legitimate account-related communications. Subject lines followed a consistent structure of 'Claude Appeal Request' combined with date elements."

DeepSeek malvertising is a growing threat

Other examples included malvertising campaigns that use AI-themed terms such as 'Awesome AI Windows Plugin' and 'Flux Pro AI' in social engineering lures, and fake DeepSeek V4 installers on GitHub that delivered Vidar Stealer.

"Within hours of DeepSeek previewing their latest version, V4, attackers created a fake GitHub organization and repository. They copied real branding and benchmark data, added AI and SEO-search-friendly content, and pushed malicious archives that looked like installers," explained John Bruggeman, vCISO at CBTS.

"What the attacker did was not particularly exotic, but it was well timed and convincingly packaged. A user searching for the newest model could very easily end up in the wrong place, especially because the malicious repository showed up in GitHub, Google, Bing, or AI-assisted search results. The search results added legitimacy to the malware."

Remain vigilant

To counter these rising threats, Microsoft advised customers to configure automatic attack disruption in Microsoft Defender XDR, enforce multi-factor authentication (MFA) on all accounts, use the Microsoft Authenticator app for passkeys and MFA, and scope conditional access policies to strengthen privileged accounts with phishing-resistant MFA.

Other tips included:

• Enabling Zero-hour auto purge (ZAP) in Office 365
• Configuring Microsoft Defender for Office 365 Safe Links
• Invest in ‘advanced’ anti-phishing solutions

"The companies that have a handle on AI governance (policies and procedures) well will be the ones that make safe AI use easy, risky AI use visible, and malicious activity hard to ignore. That means publishing a clear list of approved tools, blocking obvious lookalike domains and very recently registered domains can help stop this kind of threat," said Bruggeman.

"Monitoring suspicious downloads and sign-ins, and training employees on the AI-themed lures should also be done right now - don't think that generic phishing examples from five years ago are going to cut it today."

FOLLOW US ON SOCIAL MEDIA

Two US nationals have been sentenced to 18 months in prison for their part in running 'laptop farms' aimed at raising money for the North Korean government.

Matthew Issac Knoot, of Nashville, Tennessee, and Erick Ntekereze Prince, of New York, were sent company-issued laptops under stolen identities. They then installed unauthorized remote desktop software that allowed fake North Korean IT workers to appear as legitimate US-based employees.

The two worked separately, but according to the Department of Justice, between them generated more than $1.2 million in revenue for the DPRK and impacted nearly 70 companies in the US.

"These sentences hold accountable U.S nationals who enabled North Korea’s illicit efforts to infiltrate US networks and profit on the back of US companies,” said assistant attorney general for National Security John A. Eisenberg.

“These defendants helped North Korean ‘IT workers’ masquerade as legitimate employees, compromising US corporate networks and helping generate revenue for a heavily sanctioned and rogue regime. The National Security Division will continue to pursue those who, through deception and cyber-enabled fraud, threaten our national security.”

Prince helped at least three DPRK IT workers obtain remote employment at US companies between around June 2020 and August 2024. Prince used his company, Taggcar Inc, to supply 'certified' IT staff using false and stolen identities.

He also kept laptops provided by the victim companies at his New York home, installing remote access software without authorization to make it look as if the DPRK IT workers were working there.

Prince was sentenced to 18 months in prison, followed by three years of supervised release. He was also ordered to forfeit $89,000, the amount the DPRK IT workers paid him for his help.

Knoot, meanwhile, ran a laptop farm from his Nashville home between around July 2022 and August 2023, supplying North Korean IT workers to at least four US companies.

These firms paid the DPRK IT workers associated with Knoot’s laptop farm more than $250,000 for their work - most of which was falsely reported to the IRS and Social Security Administration under the name of the actual US citizen whose identity had been stolen.

He and his co-conspirators cost the victim companies more than $500,000 for auditing and fixing their devices, systems, and networks.

Fake North Korean IT workers are rampant

The crimes mark the latest in a continuing series of North Korean campaigns to supply fake workers and steal money for the regime.

Notably, these groups increasingly use voice-changing software during remote interviews to disguise their accents, or using the AI app Face Swap to place their faces in stolen identity documents and generate convincing headshots for CVs.

A host of organisations in the US have been affected by these campaigns over the last two years. As ITPro previously reported, cybersecurity company KnowBe4 unknowingly hired a fake IT worker, who immediately began loading malware as soon as they received their Mac workstation.

“This scheme shows how national security threats now enter through ordinary business systems. These defendants helped North Korean IT workers pose as legitimate employees, gain access to American companies, and generate money for a sanctioned regime,” said US attorney Jason A. Reding Quiñones for the Southern District of Florida.

"These were not paperwork violations. They were deliberate acts that exposed U.S. businesses, compromised trust, and supported one of the world’s most dangerous adversaries. These sentences send a clear message: if you help foreign actors infiltrate American companies for profit, you will face federal prison and lose the money you made.”

FOLLOW US ON SOCIAL MEDIA

Microsoft has issued an alert over a large-scale credential theft campaign that uses lures centered around corporate codes of conduct.

The emails were related to internal compliance or regulatory issues, with display names such as 'Internal Regulatory COC', 'Workforce Communications', and 'Team Conduct Report'.

Subject lines included 'Internal case log issued under conduct policy' and 'Reminder: employer opened a non-compliance case log'.

The emails were sent using a legitimate email delivery service, likely originating from a cloud-hosted Windows virtual machine (VM).

The accusations and repeated time-bound action prompts created a sense of urgency, Microsoft researchers said. Similarly, the emails were based on polished, enterprise-style HTML templates with structured layouts and authenticity statements, making them appear more credible than most phishing emails.

The bodies of the messages claimed that a code of conduct review had been initiated, referenced organization-specific names embedded within the text, and instructed recipients to open a PDF attachment to see the materials of the case.

When clicked, users were first directed to one of two attacker-controlled domains - acceptable-use-policy-calendly[.]de or compliance-protectionoutlook[.]de.

The landing pages displayed a Cloudflare CAPTCHA, presented as checking that the user was coming 'from a valid session', and that likely served as a gating mechanism to impede automated analysis and sandbox detonation.

According to Microsoft, the attack chain ultimately led to a legitimate sign-in experience that formed part of an adversary in the middle (AiTM) phishing flow.

Unlike traditional credential harvesting, AiTM attacks intercept authentication traffic in real time, bypassing multifactor authentication (MFA).

As a result, the attackers were able to proxy the authentication session and capture authentication tokens that could provide immediate account access.

"Phishing campaigns continue to improve sophistication and refinement in blending social engineering, delivery and hosting infrastructure, and authentication abuse to remain effective against evolving security controls," the researchers warned.

What industries are affected?

Between 14 and 16 April this year, the Microsoft Defender Research team said it spotted a series of campaigns targeting more than 35,000 users across over 13,000 organizations in 26 countries. Most targets - 92% - were located in the US.

The campaign didn't focus on a single vertical but instead impacted a broad range of industries, most notably healthcare and life sciences (19%), financial services (18%), professional services (11%), and technology and software (11%).

Microsoft said organizations should review the recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to check for essential defenses and the ability to monitor and respond to threat activity. They should also invest in user awareness training and phishing simulations.

Enabling Zero-hour auto purge (ZAP) in Defender for Office 365 is advised to quarantine sent mail in response to newly acquired threat intelligence. Users are also urged to retroactively neutralize malicious phishing, spam, or malware messages that have already been delivered to mailboxes.

It's also worth manually checking for, and purging, unwanted emails containing URLs and/or Subject fields that are similar, but not identical, to those of known bad messages.

Organizations should enable password-less authentication methods or use authenticator apps, researchers said, and strengthen privileged accounts with phishing resistant MFA.

FOLLOW US ON SOCIAL MEDIA

Microsoft has issued a warning about a sophisticated new malware campaign targeting WhatsApp users.

Microsoft's security experts spotted a WhatsApp campaign at the end of February that makes use of malicious Visual Basic Script (VBS) files, tricking victims via social engineering techniques to run the files.

"Once executed, these scripts initiate a multi-stage infection chain designed to establish persistence and enable remote access," noted a blog post by the Microsoft Defender Security Research Team.

The attack blends into normal system activity by renaming real utilities before downloading dodgy payloads from normally trustworthy cloud services, including AWS and Tencent, taking control of the system by installing malicious Microsoft Installer (MSI) packages.

"By combining trusted platforms with legitimate tools, the threat actor reduces visibility and increases the likelihood of successful execution, " the post added.

If successful, attackers can escalate privileges and gain admin control, giving them the ability to stick around on compromised devices for a long time without being spotted.

To mitigate potential risks, Microsoft advised blocking execution of script hosts in untrusted paths, and monitoring for Windows utilities being renamed or hidden ones being executed.

More widely, Microsoft advised boosting monitoring of cloud traffic and registry changes, and — as ever — educating users about social engineering.

WhatsApp, Signal in the crosshairs

The advisory from the tech giant comes after the UK’s National Cyber Security Centre (NCSC) issued a similar warning to “high risk” individuals amid a fresh wave of attacks by state-backed threat actors.

According to the NCSC, hackers are flocking to popular messaging apps such as WhatsApp and Signal to conduct social engineering campaigns.

"The NCSC and international partners have seen growing malicious activity from Russia-based actors using messaging apps to target high-risk individuals," the security group said in a blog post.

The NCSC pointed to previous campaigns aimed at compromising government officials’ accounts by Chinese state-linked group, APT31, as well as attempts by the Russian-linked threat group Star Blizzard.

Beyond government officials, the NCSC said that high-risk individuals could include having a public profile but also anyone with "access to, or influence over, sensitive information".

These attacks could involve attempts to trick users into sharing login or account recovery codes, suddenly being a part of unexpected group chats, attempts to impersonate someone you know, and the usual phishing attempts using dodgy links or QR codes.

The NCSC said attackers could also add their device to a victim's account without them noticing.

Adam Boynton, Senior Enterprise Strategy Manager at Jamf, said the NCSC warning is a timely reminder that apps are only as secure as the device they are installed on — even if that app is well encrypted.

"Users often assume end-to-end encryption means end-to-end protection, but that’s not the case," Boynton said.

"If a device is compromised, or if a user is socially engineered into linking an attacker’s device to their account, encryption becomes irrelevant."

Staying safe

Be wary when messaging, regardless of the platform, the NCSC advised. Never share verification codes, don't click unexpected links or scan QR codes, and be aware that attackers may attempt to impersonate real contacts, so keep watch for unknown contacts or double entries.

To boost security in these apps, users are urged to enable two-step verification, or Registration Lock in Signal, and make use of passkeys local to devices in WhatsApp and Signal.

Turn on disappearing messages where possible to limit what's lost if an attacker does get access.

"However, you should have regard to any applicable record keeping requirements," the NCSC noted.

The organization advised against sharing sensitive information via apps, instead using corporate approved messaging services. As ever, ensure devices are well secured and updated to fix security flaws.

"For organizations with high-risk individuals, the lesson is clear: app-level security is not device-level security," added Boynton.

"Visibility into linked devices, enforced software updates, and ensuring sensitive communications happen on managed channels should already be baseline. The organisations best prepared for threats like these aren’t reacting to advisories — they’ve already built mobile security into their foundation."

FOLLOW US ON SOCIAL MEDIA

North Korean threat groups are using AI to ramp up efforts to infiltrate western companies with fake employees, according to new research.

Analysis from Microsoft’s Threat Intelligence Team shows three groups – Jasper Sleet, Sapphire Sleet, and Coral Sleet (formerly Storm-1877) – are using voice-changing software during remote interviews to disguise their accents and make their cover stories more convincing.

They're also using the AI app Face Swap to place their faces in stolen identity documents and generate convincing headshots for CVs.

"Threat actors are using AI to shortcut the reconnaissance process that informs the development of convincing digital personas tailored to specific job markets and roles," Microsoft warned in a blog post.

"Jasper Sleet leverages generative AI platforms to streamline the development of fraudulent digital personas. For example, Jasper Sleet actors have prompted AI platforms to generate culturally appropriate name lists and email address formats to match specific identity profiles."

The groups are also using AI to search job postings on jobs platforms such as Upwork, then using AI to make their applications meet the jobs' skill requirements.

This includes generating realistic names, email formats, and social media handles using AI prompts, writing AI-assisted resumes and cover letters, creating fake developer portfolios using AI-generated content, and using AI-enhanced images to create professional-looking profile photos and forged identity documents.

Microsoft noted that these personas are used across multiple job applications and platforms.

Voice cloning and agentic AI are in vogue

Elsewhere, Microsoft warned threat groups are using AI-generated voice cloning to impersonate executives or trusted individuals in vishing and business email compromise (BEC) scams

Once the fake workers are inside an organization, they use AI-enabled communications to support daily tasks and fit in with role expectations.

"For example, Jasper Sleet uses AI to help sustain long-term employment by reducing language barriers, improving responsiveness, and enabling workers to meet day-to-day performance expectations in legitimate corporate environments," Microsoft noted.

"Threat actors are leveraging generative AI in a way that many employees are using it in their daily work, with prompts such as 'help me respond to this email', but the intent behind their use of these platforms is to deceive the recipient into believing that a fake identity is real."

With the advent of agentic AI, Microsoft warned threat actors are also flocking to powerful new tools.

The tech giant’s threat intelligence team observed groups using agents to create semi‑autonomous workflows that help refine phishing campaigns, test and adapt infrastructure, maintain persistence, or monitor open source intelligence for new opportunities.

North Korean hackers are prolific

The problem of North Korean fake workers just won't seem to go away. While this trend primarily affected US companies, Google warned last summer that threat groups are now expanding campaigns to target European organizations.

Last month, Security Alliance (SEAL) warned that North Korean hackers are hijacking genuine LinkedIn profiles to apply for remote jobs and infiltrate enterprises.

Hackers typically use real identities, leveraging verified workplace emails and identity badges, and constructing credible employment histories to pass background checks.

Organizations are advised to tighten up their identity verification processes, including document checks and, wherever possible, in-person interviews.

FOLLOW US ON SOCIAL MEDIA

Google Threat Intelligence Group (GTIG) has identified a group with all the hallmarks of ShinyHunters using voice phishing (vishing) and fake credential harvesting websites to steal sensitive data.

In an advisory, the tech giant warned the group primarily gains access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes.

Once inside, the attackers target cloud-based SaaS applications to exfiltrate sensitive data and internal communications that they can use in subsequent extortion demands.

Google is currently tracking the activity under several threat clusters, including UNC6661, UNC6671, and UNC6240.

Last month, for example, UNC6661 pretended to be IT staff and called employees at targeted organisations, claiming that the company was updating MFA settings.

The threat actor then directed employees to victim-branded credential harvesting sites to capture credentials and MFA codes, with victims thereafter registering their own device for MFA.

According to Google, threat actors moved laterally through victim customer environments to exfiltrate data from various SaaS platforms.

While the attacks are targeted, analysis suggests that subsequent access is probably opportunistic, determined by the specific permissions and applications accessible via the individual compromised SSO session. Google stressed that the activity isn't the result of a security vulnerability in vendors' products or infrastructure.

"In some cases, they have appeared to target specific types of information. For example, the threat actors have conducted searches in cloud applications for documents containing specific text including 'poc', 'confidential', 'internal', 'proposal', 'salesforce', and 'vpn' or targeted personally identifiable information (PII) stored in Salesforce," researchers said.

"Additionally, UNC6661 may have targeted Slack data at some victims' environments, based on a claim made in a ShinyHunters-branded data leak site (DLS) entry."

Valuable intelligence

Cory Michal, CSO at AppOmni, praised the level of operational detail in the report, and particularly the volume and specificity of indicators of compromise that weren’t previously public.

This intelligence could prove vital for organizations that find themselves in the crosshairs moving forward, Michael noted.

“Publishing concrete domains, tooling names/artifacts, and workflow-level signals gives defenders something they can deploy immediately at scale (email/web filtering, OAuth/app controls, identity telemetry detections, and retro-hunting),” he said.

“It helps the ecosystem disrupt infrastructure and tradecraft faster by enabling consistent blocking and takedown actions across many organizations rather than each team rediscovering the same indicators in isolation.”

What can enterprises do to protect themselves?

Google has published guidance on hardening, logging, and detection against the threats.

Organizations responding to an active incident should focus on rapid containment steps, such as severing access to infrastructure environments, SaaS platforms, and the specific identity stores typically used for lateral movement and persistence.

Long-term defense, meanwhile, requires a transition toward phishing-resistant MFA, such as FIDO2 security keys or passkeys, which are more resistant to social engineering than push-based or SMS authentication.

“Companies should treat this as both a hunt and prevent problem: First, take the IoCs in the report and run them through your detection-and-response workflows (SIEM/SOAR, email security, web proxy/DNS, EDR, and SaaS audit logs) to identify any historical or active exposure," Michal added.

Michael added they should add continuous monitoring for look-alike domain registrations that incorporate their company name or common brands that they use for login, support, and HR.

"In many of these campaigns, those newly registered domains are a leading indicator, they show up before the first vishing call, so catching and blocking them early (and tightening your help desk/MFA enrollment controls in parallel) can meaningfully reduce the chance the intrusion ever gets to the “mass download and extortion” stage,” he said.

FOLLOW US ON SOCIAL MEDIA

A new phishing campaign is abusing trusted collaboration platforms like Microsoft Teams to bypass traditional email security.

Cybersecurity researchers at Check Point have discovered more than 12,000 malicious emails sent to over 6,000 users, most of which use legitimate Microsoft Teams guest invitations to impersonate billing alerts and trick victims into calling fake support lines.

Rather than relying on malicious links or attachments, attackers are exploiting built-in guest invitation options and finance-themed team names to dupe users with fake billing and subscription notifications.

The attacker starts off by creating a new team in Microsoft Teams and assigning it a finance-themed name designed to resemble an urgent billing or subscription notice.

One example given by Check Point researchers read: “Subscription Auto-Pay Notice (Ivoice ID: 2025_614632PPOT_SAG Amount 629. 98 USD). If you did not authorize or complete this m0nthly Payment,plese c0ntact our support team urgently.”

The aim here for attackers is to bypass automated detection by embedding obfuscation techniques in the team name. This includes character substitutions, mixed Unicode characters, visually similar glyphs, and the like.

After creating the team, the attacker uses the Invite a Guest feature in Microsoft Teams, sending the victim an email invitation from a legitimate Microsoft address, with the fake team name displayed prominently in large font.

"At first glance, the message appears to be a genuine Microsoft-generated notification, increasing the likelihood that users trust the content and follow the instructions," the researchers warned.

Recipients are then asked to call a fraudulent support number to resolve the "billing issue".

The fraudulent emails are being used to target a wide range of organizations, researchers noted, with 27% targeting manufacturing, engineering and construction and 1% technology/SaaS.

One-in-eight, meanwhile, went to educational organizations, followed by professional services at 11%, government at 8%, and finance at 7%.

"The distribution likely reflects broad Microsoft Teams adoption across these industries, rather than deliberate targeting," the researchers said. "This suggests the attacker’s primary objective was to exploit a trusted collaboration platform at scale, rather than focus on specific verticals."

Two-thirds of victims were in the US, with 16% in Europe and 6% in Asia.

Microsoft Teams scams are surging

Microsoft Teams, and indeed collaboration platforms and trusted brands, have become a common attack vector for cyber criminals.

This time last year, researchers at Sophos spotted threat actors posing at tech support workers to launch attacks through the platform.

More recently, the Scattered Spider hacking group expanded this technique by impersonating workers to ask IT teams to reset passwords or transfer MFA tokens using both Microsoft teams and Slack.

The hackers even set up fake identities and took part in company teleconferences and remediation and response calls to gather security information.

FOLLOW US ON SOCIAL MEDIA

The energy sector should be on the alert for a new multi‑stage adversary‑in‑the‑middle (AitM) campaign, Microsoft has warned.

Cloud collaboration platforms, particularly Microsoft SharePoint and OneDrive, are popular with threat actors thanks to their widespread presence in enterprise environments.

They offer built-in legitimacy, flexible file‑hosting capabilities, and authentication flows that attackers can take over and use to hide their presence.

This latest phishing and business email compromise (BEC) campaign, Microsoft said, abused SharePoint file sharing services to deliver phishing payloads. Emails with the subject line “NEW PROPOSAL – NDA” appeared legitimate, coming from a previously-compromised email address belonging to a trusted organization.

A number of user accounts have already been compromised, according to the Microsoft Defender Research team.

Victims clicking on a link included in the email were redirected to a fake login page, which collected their credentials. The attackers also altered inbox rules to mark all emails as "read", making their activity harder to detect.

They were then able to make use of trusted internal identities from the target to conduct large‑scale phishing attacks, both within the organization and externally, significantly expanding the scope of the campaign.

In one example, this phishing campaign involved more than 600 emails with a different phishing URL, which were sent to the compromised user’s contacts within and outside the organization, as well as distribution lists.

The attackers then made further efforts to avoid suspicion.

"The attacker read the emails from the recipients who raised questions regarding the authenticity of the phishing email and responded, possibly to falsely confirm that the email is legitimate," said the Microsoft team.

"The emails and responses were then deleted from the mailbox. These techniques are common in any BEC attacks and are intended to keep the victim unaware of the attacker’s operations, thus helping in persistence."

Tackling adversary-in-the-middle attacks

Microsoft highlighted the operational complexity of AiTM campaigns, saying that password resets alone are not enough to fix the problem.

Impacted organizations must, said the firm, make sure that they've revoked active session cookies, reversed the changes to MFA settings made by the attacker on the compromised user’s accounts and removed the altered inbox rules.

"While AiTM phishing attempts to circumvent MFA, implementation of MFA still remains an essential pillar in identity security and highly effective at stopping a wide variety of threats.

MFA is the reason that threat actors developed the AiTM session cookie theft technique in the first place," the team said.

The researchers also advised organizations to work with their identity provider to ensure security controls like MFA are in place.

They added: "Organizations should also consider complementing MFA with conditional access policies, where sign-in requests are evaluated using additional identity-driven signals like user or group membership, IP location information, and device status, among others."

FOLLOW US ON SOCIAL MEDIA

Cybersecurity researchers at Proofpoint have issued a warning over a surge in Microsoft 365 account takeovers through abuse of OAuth device code authorization.

This legitimate Microsoft login process is now being weaponized by both cyber criminal and state-aligned actors, who are tricking users into entering a device code on Microsoft’s real login page - instantly granting unauthorized access.

Proofpoint said the trend signals a major evolution in phishing, shifting attacks away from passwords and towards abusing trusted authentication flows.

Attacks start with an initial message containing a URL embedded behind a button, as hyperlinked text, or within a QR code. Once visited, it initiates an attack sequence leveraging the legitimate Microsoft device authorization process.

The user is presented with a device code with the claim that it's a one-time password (OTP). The user is directed to input the code at Microsoft’s verification URL - and once this is done, the original token is validated, giving the threat actor access to the targeted Microsoft 365 account.

"While this is not necessarily a novel technique, it is notable to see it used increasingly by multiple threat clusters including a tracked cybercriminal threat actor, TA2723," the researchers said.

"Proofpoint threat researchers have identified a malicious application for sale on hacking forums, which could be used for this type of campaign."

Meanwhile, some red team tools, such as Squarephish and SquarephishV2, can be used for this type of attack, helping to mitigate the short-lived nature of device codes and enabling larger campaigns than were previously possible.

In one example, researchers identified a campaign that used a shared document reminder alert to trick users into clicking a Google Share URL hyperlinked as text, to access a fictitious document called “Salary Bonus + Employer Benefit Reports 25”.

The URL leads to an attacker-controlled website with a domain localized according to browsing IP, and showing the targeted company branding.

Thereafter, the website prompts the user to input their email address and go through an authentication process that includes a code that, when input into the Microsoft-provided OAuth page, gives the threat actor access to the user’s Microsoft 365 account.

Proofpoint ascribes this activity to TA2723, a financially-motivated, high-volume credential phishing threat actor notable for its campaigns spoofing Microsoft OneDrive, LinkedIn, and DocuSign. It's seen the group conducting OAuth device code phishing since October.

But the technique is in use by other state-aligned actors, too, including UNK_AcademicFlare.

Since September, the Russia-linked group has been using compromised email addresses belonging to multiple government and military organizations to target bodies within government, think tanks, and the higher education and transportation sectors in the US and Europe.

Earlier this year, Volexity said it had identified several campaigns using the same techniques and carried out by Russian actors.

The company said it believed that at least one was CozyLarch - overlapping with DarkHalo, APT29, Midnight Blizzard, and CozyDuke. It said it was tracking the remaining activity under UTA0304 and UTA0307.

Proofpoint expects the abuse of OAuth authentication flows to continue to grow, with the adoption of FIDO compliant MFA controls. Organizations should strengthen their OAuth controls and educate users about these evolving threats.

"From the use of malicious OAuth applications for persistent access to the abuse of legitimate Microsoft authentication flows with device codes, "threat actors’ tactics to achieve account takeover are evolving with quick adoption across the threat landscape," the researchers said.

FOLLOW US ON SOCIAL MEDIA

Amazon has had hundreds of fraudulent job applications from North Korean threat actors since April last year, with the company uncovering one successful campaign internally.

According to chief security officer (CSO) Stephen Schmidt, the company has prevented more than 1,800 suspected DPRK operatives from joining since April 2024, and has detected 27% more DPRK-affiliated applications quarter over quarter this year.

“Over the past few years, North Korean (DPRK) nationals have been attempting to secure remote IT jobs with companies worldwide, particularly in the U.S,” Schmidt wrote in a post on LinkedIn.

“Their objective is typically straightforward: get hired, get paid, and funnel wages back to fund the regime's weapons programs.”

With this number of fraudulent applications, Schmidt said the company has a good insight into how these threats are evolving, and there are several notable areas of interest for enterprise security teams.

North Korean hackers are refining tactics

First and foremost, identity theft has become more calculated, Schmidt said, with operatives targeting individual software engineers who provide real credibility, rather than people with minimal online presence.

Operatives involved in these campaigns often work with facilitators managing “laptop farms”, Schmidt added. US locations that receive shipments and maintain domestic presence, while the worker operates remotely from outside the country.

LinkedIn strategies are also getting more sophisticated, with the fraudsters hijacking dormant accounts through compromised credentials to gain verification.

"We've also identified networks where people hand over access to their accounts in exchange for payment," he said.

Research shows LinkedIn has become a prime hunting ground for cyber criminals, with analysis by Clear Sky Security in late 2024 showing hackers are using the professional networking app to both target victims and build an online presence.

A more recent study from Bitdefender Labs also highlighted the growing threats enterprises face through the platform, uncovering an Iranian-linked campaign which took inspiration from previous North Korean efforts.

Notably, Schmidt warned threat actors are increasingly targeting AI and machine learning roles, both of which are growing in demand as companies ramp up adoption of the technology.

One hacker slipped through the cracks

The company admitted that one imposter did manage to slip through the cracks in a recent campaign, however.

According to reports from Bloomberg, the company discovered a fake systems development contractor by tracking keystroke inputs.

Security teams at the retail giant observed significant keystroke lag which raised the alarm. Typically, a US-based remote worker would record keystroke data within several milliseconds.

In this instance, however, the worker’s keystroke lag stood at “more than 110 milliseconds”, suggesting they were based outside the country.

Amazon isn't alone in falling prey to hackers involved in these campaigns. Last year, cybersecurity firm KnowBe4 inadvertently hired a North Korean hacker in an incident which prompted an overhaul of hiring processes at the company.

The individual managed to pass background checks, but were discovered after they began loading malware shortly after receiving their Mac workstation.

North Korean threats will continue

Repeated warnings have been issued over the threats posed by North Korean threat actors over the last 18 months. Attack methods have shifted rapidly, with operators choosing to infiltrate enterprises to wreak havoc with malware and to extract valuable intellectual property.

Earlier this year, the FBI issued guidance on how to avoid the scam, urging organisations to practice the principle of least privilege and ramp up monitoring and investigation of network traffic.

More recently, Google warned that fake North Korean workers were now popping up in increasing numbers in Europe, using online recruitment platforms including Upwork, Telegram, and Freelancer. They've also been carrying out more extortion attempts and targeting larger organizations.

"If you’re concerned about these threats in your organization, query your databases for common indicators: patterns in resumes, emails, phone numbers, educational backgrounds," advised Schmidt.

"Implement identity verification at multiple hiring stages and monitor for anomalous technical behavior: unusual remote access, unauthorized hardware. If you identify suspected DPRK IT workers, report it to the FBI or your local law enforcement."

FOLLOW US ON SOCIAL MEDIA

While most workers believe they can spot a phishing attempt, nearly one-in-four under-35s would fall for a suspicious message if they thought it came from a colleague or boss.

Four-in-five British workers told Accenture researchers they were confident they'd spot a suspicious message, even though more than a third have never received cybersecurity training.

Men show the biggest faith in themselves, being nearly twice as likely as women to report high confidence in spotting cyber threats, at 22% compared with 12%.

But younger workers in particular may be wrong about this. The survey of over 1,000 British employees found that 15% would share company data or make payments via messaging apps, without verifying the sender, if the message seemed to come from a leader or colleague.

Among under-35s, so those in the millennial and Gen Z demographics, this rose to nearly a quarter (24%).

“With cyber criminals weaponizing information from social media to deceive people with realistic messages or calls, employees must make faster judgement calls on what’s real and what’s not," said Kamran Ikram, Accenture’s security lead in the UK and Ireland.

"The workforce feels cyber confident – though its uneven among men and women – there remains a serious skills and training gap across the board. Being overconfident yet undertrained is a dangerous position to be in."

More cybersecurity training is needed

Notably, more than one-third (37%) of British workers have never received any cybersecurity training, including 44% of over-55s. Meanwhile, only one-in-five have been trained to recognize deepfakes or AI-generated phishing emails.

This lack of training is more significant in smaller companies, where 79% of microbusinesses with less than 10 employees and 55% of small firms with between 10 and 49 employees offer no cybersecurity training at all.

"Organizations must look to be resilient in every area of their operations and supply chain, which means ongoing education on cyber threats," said Ikram. "Businesses can’t rely on patchy preparedness when attackers are advancing by the day.”

Even when employees are receiving training, it's not adequately covering all the risks, Accenture found. Half of those that have been trained said they've received no guidance on using AI safely, such as what data should not be shared with public tools or how to identify AI-enabled attacks.

As a result, 17% have no awareness of AI-driven cyber threats while only 61% are aware of deepfake videos or AI-generated phishing emails, and fewer than half are aware of voice cloning or identity theft.

“AI is bringing immense opportunity to business, but it also is changing the risk landscape as criminals increasingly incorporate AI into their arsenal," said Ikram.

"Today, awareness of AI-enabled attacks is still uneven, and that gap is where the next wave of breaches will likely happen. But more than that - building a cyber-savvy workforce isn’t just about protecting your systems, it’s also what allows innovation and trust to scale together.”

Workers do at least have a sense of collective responsibility. While a quarter of British employees believe that the IT or security department is most responsible for protecting a company against cyber threats, more than twice as many accept that it's a joint responsibility across the organization.

MORE FROM ITPRO

• Are we in a cyber awareness crisis?
• Employee phishing training is working – but don’t get complacent
• Best online cyber security courses

A new spear phishing campaign has targeted more than 900 organizations with fake invitations from platforms like Zoom and Microsoft Teams.

Analysis from Abnormal.ai shows the campaign involves tricking victims into downloading legitimate remote monitoring and management (RMM) software such as ConnectWise ScreenConnect.

Thereafter, attackers are able to assume control of end-user devices and extract sensitive information.

"To manipulate targets into engaging and downloading ScreenConnect, the attackers employ advanced deception techniques built around impressive impersonations and familiar business contexts, effectively creating workflows that align with end-user expectations," researchers said.

"Specific tactics observed include the utilization of compromised legitimate email accounts, AI-generated phishing components, and strategic URL obfuscation methods, as well as the exploitation of trusted business tools such as file-sharing platforms for hosting malicious links."

Initial access comes via phishing emails from compromised accounts, disguised as meeting invitations via trusted entities like Zoom and Microsoft Teams.

Researchers noted the threat actors also incorporate various themes to make these invitations look legitimate, for example, "Meeting Invite - 2024 Tax Organizer".

Targets are then tricked into installing ScreenConnect through AI-generated landing pages, legitimate file-sharing platforms, direct session links, or executable email attachments.

Once installed, ScreenConnect gives the attackers remote access capabilities that enable comprehensive system control equivalent to direct access while avoiding detection due to minimal signal activity.

Attackers then leverage compromised systems for account takeover, including lateral phishing campaigns and credential harvesting. They often use the targetʼs email accounts to target colleagues and business partners with the same techniques.

"This campaign represents a significant evolution in cybercrime tactics," the researchers said.

"The weaponization of a legitimate IT administration tool — one designed to grant IT professionals deep system access for troubleshooting and maintenance — combined with social engineering and convincing business impersonation creates a multi-layered deception that provides attackers with the dual advantage of trust exploitation and security evasion."

How to stay safe

Researchers pointed out that the sophisticated and resilient infrastructure supporting these attacks implies a mature criminal ecosystem, with dark web vendors operating like legitimate software providers.

"The commoditization of advanced attack capabilities —driven by bad actors who profit from widespread tool adoption — has democratized complex cybercrime operations and poses an escalating threat to organizations across all sectors, particularly those with legacy security infrastructure or limited security awareness programs," they said.

The attackers don't appear to be targeting any particular sector, with a fairly even spread across industries. Most victims were based in the US, with Canadian, Australian and UK organizations also affected.

CISOs should deploy AI-powered email security solutions capable of detecting complex social engineering attacks that bypass traditional security controls, and establish comprehensive monitoring for legitimate remote access tools, focusing on unauthorized installations and suspicious usage patterns.

Similarly, researchers urged enterprises to update training programs to address evolving tactics and implement network segmentation and access controls to limit the potential impact of compromised systems with remote access capabilities.

MORE FROM ITPRO

• Hackers are targeting Windows Quick Assist remote desktop features to deploy ransomware
• The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employees
• State-sponsored cyber groups are flocking to the 'ClickFix' social engineering technique

The true scale of the Allianz Life data breach has been laid bare, with leaked credential notification site Have I Been Pwned putting the number of affected accounts at 1.1 million.

The numbers represent the vast majority of the company's 1.4 million customers in the North America region, along with the data of financial professionals and some Allianz Life employees contained in Salesforce Accounts and Contacts databases.

Data exposed in the incident is believed to include dates of birth, email addresses, genders, names, phone numbers, and physical addresses. According to Allianz, Social Security numbers were also taken.

More than seven-in-ten of the exposed email addresses had already been affected by previously-disclosed data breaches.

When the breach was first confirmed, Allianz Life said that 'most' of its North American customers had been affected, but that its core network and policy administration systems didn't appear to have been accessed.

The insurer said it would provide a full consumer notice once it has finished identifying and contacting affected individuals.

Jon Abbott, CEO of ThreatAware, described the scale of the breach as “significant”, noting that the data leaked represents a treasure trove of information to target victims.

"The sensitive and valuable information held in CRM tools is exactly why it’s targeted by attackers,” he said. “The data can be used by other cyber criminals for identity theft and phishing campaigns."

What happened with the Allianz Life data breach?

The breach, which took place on July 16 and was discovered a day later, is believed to have involved a social engineering attack that involved impersonating IT support staff.

This saw hackers ask employees to accept a connection to a Salesforce Data Loader, which was then used to exfiltrate data from the CRM system.

The attackers used malicious OAuth applications to infiltrate Salesforce instances, before downloading the company databases.

The attack has since been claimed by the notorious ShinyHunters threat group, which is believed to overlap with the Scattered Spider and Lapsus groups. They are now believed to be preparing a data leak site to pressure Allianz and other victims into making a ransom payment.

The group, which first emerged in 2020, is also believed to be responsible for attacks on Salesforce systems at several retailers, as well as at Google, Cisco, Qantas, Santander, Ticketmaster, Tokopedia, AT&T and most recently Workday.

Workday confirmed it had fallen victim to an attack last week, warning customers that exposed information could then be used in follow-up social engineering attacks - a common tactic for threat actors.

"Groups such as ShinyHunters rely on fast moving social engineering tactics – this typically involves calling and emailing employees of the victim organization and attempting to extort them. If this does not work, they then launch a leak site with the aim of pressuring victims into payment," said Abbott.

"This pattern in their attacks is why the security fundamentals are so important. Accurate asset inventories, tamper-proof identity verification and hardened service desk processes are all essential.”

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• Phishing tactics: The top attack trends
• Cheap cyber crime kits can be bought on the dark web for less than $25

Cybersecurity researchers at Check Point have identified a new, insidious social engineering technique that requires almost no user interaction.

The FileFix technique builds on an already widely used tactic called ClickFix, which according to Check Point tricks users into running malicious commands in the Windows Run dialog.

FileFix, meanwhile, opens a Windows File Explorer window from a web page and surreptitiously loads a disguised PowerShell command into their clipboard.

“When the victim pastes into the Explorer address bar, the malicious command executes,” researchers explained. “This attack relies not on software vulnerabilities but on exploiting routine user actions and trust.”

The researchers added that they have now observed known bad actors using FileFix in the wild. While the payloads are currently benign, they suggest this signals “an imminent shift to delivering real malware”.

“The rapid rise of the ClickFix technique in 2025 highlights that social engineering remains one of the most cost-effective and enduring methods cyber criminals use to breach defenses,” the researchers said.

“The fact that FileFix is already being tested and used in the wild mere days after its public disclosure shows how quickly attackers adopt new techniques and adapt to the evolving cyber threat landscape.”

Commenting on the Check Point findings, Dray Agha, senior manager of security operations at cyber security firm Huntress, said: “Threat actors [are] rapidly iterating to leverage foundational Windows workflows, making defenses that much harder to deploy”.

“By tricking users into 'pasting a path,' attackers execute malicious PowerShell without triggering standard warnings,” he added.

Agha warned that Huntress has also seen FileFix being used “aggressively in the wild, and it is succeeding in tricking users in huge numbers”.

How to protect yourself from FileFix

Check Point has laid out recommendations for security professionals to help protect against this attack, including:

• Monitoring phishing pages that mimic popular services and security verification screens, especially those using “Cloudflare-like” templates
• Implementing and fine-tuning detection rules to flag suspicious clipboard activity or unusual PowerShell executions triggered by user actions.
• Staying current with emerging social engineering trends and regularly updating user training, incident response plans, and security playbooks.

It also suggests encouraging “a culture of verification”, which will lead users to confirm unexpected or unusual requests with the relevant IT or security team before acting.

Users themselves should be “highly suspicious” of any web page or email that asks them to carry out unusual activity – especially copying and pasting.

They should also be educated that legitimate websites and software “rarely require manual execution of commands to fix issues”.

MORE FROM ITPRO

• Hackers are using fake tool installers to dupe victims
• Why social engineering is such a problem and how your business can protect itself
• Hackers are using PDFs to impersonate big brands in a new threat campaign

Had a call from a senior US official? It probably wasn't real. The FBI has issued a warning about an ongoing malicious text and voice messaging campaign in which scammers use AI-generated voices to target victims.

As part of the campaign, threats actors claim to be a senior US official in a bid to access personal accounts. The campaign began in April, according to the law enforcement agency, and it hasn't said which senior US officials are being impersonated.

AI-generated voice calls have been used in a few high profile attacks. Last year, an executive at Ferrari stymied a similar attack by asking about a book recommended by the person being impersonated.

Similarly, British engineering company Arup paid out $25 million to scammers who set up a false video call meeting to trick an employee while back in 2019 a British energy firm was targeted using AI-generated calls to a cost of more than £200,000.

In its advisory, the FBI said the "smishing" or "vishing" attacks, as the American policing agency called them, may be using AI tools to generate the voices.

"One way the actors gain such access is by sending targeted individuals a malicious link under the guise of transitioning to a separate messaging platform," the FBI said in a statement.

Once the account of one person is compromised, it can be used in future attacks.

"Access to personal or official accounts operated by US officials could be used to target other government officials, or their associates and contacts, by using trusted contact information they obtain," the FBI added.

"Contact information acquired through social engineering schemes could also be used to impersonate contacts to elicit information or funds."

The warning comes as 68% of businesses have said they've developed a "deepfake" response plan amid the rise in social engineering attacks, with separate research saying nearly two-thirds of finance professionals had been targeted by deepfake fraud.

Avoiding AI scams

The FBI warning noted that the scammers are using software to generate a phone number that isn't attributed to a specific phone. As such, anyone unsure of a message should verify the identity of the person calling with a bit of research, independently verify their correct number, and check that any information shared is correct.

However, Max Gannon, intelligence manager at Cofense, noted that threat actors can also spoof known phone numbers of trusted individuals or organizations. This, he said, adds another layer of risk for potential victims.

“Phone filtering does not typically detect when the number is being spoofed, giving a false sense of security to users who rely on their phones to tell them when something is a scam call,” he said.

When examining a video or image for signs of AI, the FBI suggested looking for subtle imperfections such as distorted hands or feet, indistinct faces, inaccurate shadows, voices matching facial movements, and other unnatural movements.

These practices could be the difference between swerving a disaster or falling victim, the agency added. However, it warned that AI-generated content has now “advanced to the point that it is often difficult to identify”.

As such, the FBI suggested people create a secret word or phrase to prove their identity, as well as the usual security advice of not trusting links or email attachments that haven't been verified. Additionally, individuals and enterprises should never send money, gift cards, or cryptocurrency to someone via the internet or phone.

"Both smishing and vishing techniques rely on social engineering to manipulate recipients, often by instilling a sense of urgency or fear," Gannon added.

"Threat actors are increasingly turning to AI to execute phishing attacks, making these scams more convincing and nearly indistinguishable from legitimate communication. For traditional phishing alone, Cofense has observed a 70% increase in BEC attacks from 2023 to 2024, which can be attributed to the increasing use of AI."

MORE FROM ITPRO

• Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
• Preventing deepfake attacks: How businesses can stay protected
• FBI issues guidance for enterprises as fake North Korean IT workers wreak havoc

Increased phishing training is paying dividends for enterprises, according to new research, particularly in larger enterprises.

Analysis from KnowBe4 shows awareness and resilience are improving based on what it describes as ‘Phish-prone Percentage’ (PPP) metrics. This tracks the percentage of employees likely to fall for social engineering or phishing attacks, the company said.

According to the firm’s 2025 Phishing by Industry Benchmarking Report, organizations have a baseline PPP of around a third worldwide on average - but can improve that dramatically with the right training.

Globally, PPP drops on average to 19% after three months' training, and to just 4.8% after 12 months. After a year's training, all regions achieved average improvement rates of more than 80%, with North America showing the biggest improvement at 90%, and South America a close second at 89%.

The highest baseline PPPs were found in South America at 39%, North America at 37%, and Australia and New Zealand at 37%. The most phish-prone of all were organizations with 1,000-plus employees in Australia and New Zealand, with 44.6% happily clicking on simulated phishing hyperlinks.

The most cautious, meanwhile, were organizations with fewer than 249 employees in both Asia and the United Kingdom and Ireland, where fewer than a quarter of employees clicked the links.

"The cybersecurity landscape in the UK and Ireland is rapidly evolving, driven by AI advancements, supply chain vulnerabilities, and a shift in how we view the human element in defense," said Javvad Malik, lead security awareness advocate at KnowBe4.

"AI offers both powerful tools and new risks, while supply chain security has become a critical focus due to its interconnected nature."

In the UK and Ireland, healthcare and pharmaceuticals, consumer services, and hospitality tend to have a higher initial baseline resilience to phishing attacks, especially in the case of larger organizations.

Similarly, bigger firms often start with a higher baseline, but show more substantial improvements over time. Researchers suggested this is perhaps because they can afford more comprehensive training resources.

Notably, KnowBe4 researchers said they have observed a shift in perception, with employers increasingly seeing their staff as a crucial line of defense against cyber threats.

There's also been a move away from punitive approaches to security training, with organizations now empowering employees to make security decisions and report potential threats without the fear of being penalized.

"The biggest shift is the growing recognition of employees as an essential line of defense, with organisations now fostering a culture of cybersecurity awareness," said Malik.

"While progress is being made, it is clear from the data in the Benchmarking Report that sustained security training is essential to drive long-lasting change."

MORE FROM ITPRO

• Fake file converter tools are on the rise – here’s what you need to know
• Hackers are using this new phishing technique to bypass MFA
• Cyber scams cost businesses $1.7 million per year, claims report

Notorious Russian threat group Midnight Blizzard has been mixing up its attack methods in recent months, according to analysis from Check Point, including targeting European diplomats with the lure of luxury events.

In a blog post detailing the campaign, researchers said the threat group has been targeting European governments and diplomats since January this year.

The campaign saw hackers impersonate a “major European Ministry of Foreign Affairs” and target victims with phishing emails inviting them to a wine tasting event.

Malicious emails curated by the group contained a link to deploy a backdoor dubbed ‘GRAPELOADER’, researchers added.

“The emails contained a malicious link that led, in some cases, to the download of an archive, eventually leading to the deployment of GRAPELOADER,” the blog post reads.

“In other cases, the link in the phishing emails redirects to the official website of the impersonated Ministry of Foreign Affairs.”

The malicious emails in question were sent from two distinct domains, according to Check Point - bakenhof[.]com and silry[.]com - and sought to mimic legitimate communications from a particular individual in the fake Ministry of Foreign Affairs.

When the target clicks the malicious link, this initiates the download of an archive dubbed ‘wine.zip’ which sets the next stage of attack in motion. This archive contained three files, including:

• A legitimate PowerPoint executable, ‘wine.exe’, which the group exploited for DLL side loading.
• A hidden DLL, ,AppvIsvSubsystems64.dll’, which researchers said serves as a “required dependency for the PowerPoint executable to run
• Another “hidden and heavily obfuscated” DLL, ppcore.dll, which functions as a loader and used to deliver the payload in later phases of the attack

Once wine.exe is executed and the GRAPELOADER DLL is side-loaded, researchers explained the malware copies contents of the wine.zip archive to a new location on the device disk.

“It then gains persistence by modifying the Windows registry’s Run key, ensuring that wine.exe is executed automatically every time the system reboots,” the blog post noted.

“Next, GRAPELOADER collects basic information about the infected host, such as the host name and username. This collected data is then sent to the Command and Control (C2) server, where it waits for the next-stage shellcode to be delivered.”

Sound familiar? You’re not far off

If you’re wondering why this sounds familiar, it’s because a similar campaign has already been carried out by the Midnight Blizzard.

Last year, the threat group targeted German politicians with fake invitations to a dinner reception using malware dubbed ‘WINELOADER’. This latest campaign, Check Point revealed, is a continuation of that previous flurry of attacks.

In this instance, GRAPELOADER is designed specifically for the initial stages of an attack.

“It is primarily used for fingerprinting the infected environment, establishing persistence, and retrieving the next-stage payload,” researchers said.

Detailed analysis of both show that they share a range of similarities, particularly with regard to code structure, obfuscation techniques, and string decryption processing, the company added.

Notably, Check Point revealed this particular campaign also included a new variant of WINELOADER being used in conjunction with GRAPELOADER, which suggests “codebase overlaps or shared development tactics”.

This new variant displayed improved stealth and evasion techniques, which researchers warned will muddle detection efforts.

Midnight Blizzard doesn’t quit

Midnight Blizzard, also known as Cozy Bear, is among the most active and aggressive threat groups operating globally. With links to the Russian government, the group has been identified as the culprit behind a raft of breaches in recent years, including an attack on Microsoft which saw email communications compromised.

This particular attack saw the group reportedly use password spraying techniques to compromise a legacy account. In the wake of the incident, Microsoft revealed the group was able to access a “very small percentage” of corporate email accounts.

Some of these accounts belonged to members of the tech giant’s senior leadership team, as well as staff from its security and legal teams.

MORE FROM ITPRO

• HPE alerts affected staff after Midnight Blizzard breach
• Sneak-and-peek Midnight Blizzard attack highlights “worrying flaws” in Microsoft security processes
• Midnight Blizzard is on the rampage again, and enterprises should be wary of its new tactics

Hackers are ramping up phishing campaigns involving fake helpdesk domains to target the legal, financial services, and accounting sectors in the US.

According to researchers at EclecticIQ, with the help of threat researchers Silent Push, the Luna Moth group - also known as Silent Ransom Group, UNC3753, and Storm-0252 - has carried out a flurry of 'callback phishing' attacks since March this year.

The group is believed to be linked to the 2021 BazarCall campaign, known for deploying Conti and Ryuk ransomware. However, it's recently turned its focus to data theft and extortion, threatening to expose stolen data on a dedicated leak site and demanding seven-figure ransoms.

In a blog post detailing the group’s TTP’s, researchers said the campaign begins with a phishing email that lures its victim into calling a fake helpdesk number. Here, live operators posing as IT staff deceive victims into installing remote monitoring and management (RMM) tools.

These applications, which include Syncro, SuperOps, Zoho Assist, Atera, AnyDesk, and Splashtop won't be flagged by security software as they're legitimate tools, researchers noted.

However, once installed, they give the attackers access to sensitive data.

Luna Moth then threatens to leak the data publicly on its own clearweb domain unless the victims pay a ransom of between $1 million and $8 million.

In order to collect victim data, the attackers have also registered typosquatted domains via GoDaddy, impersonating US firms to collect contact details and enable targeted social engineering.

Typical examples include [company_name]-helpdesk.com and [company_name]helpdesk.com.

"As of March 2025, EclecticIQ assesses with high confidence that Luna Moth has likely registered at least 37 domains through GoDaddy to support its callback-phishing campaigns," researchers said.

"Most of these domains impersonate IT helpdesk or support portals for major US law firms and financial services firms, using typosquatted patterns."

One example impersonated a US-based law firm, with a Contact Us form collecting names, emails, and a message from the victim, enabling attackers to identify high-value targets. Another uses a 'CISO Helpdesk’ lure.

"By impersonating a helpdesk for Chief Information Security Officers (CISOs), the phishing page leverages the authority and urgency typically associated with executive security communications," said the researchers.

"This approach is designed to increase victim compliance and maximize the chances of compromising privileged accounts within the target organization."

Luna Moth tactics are hard to spot

EclecticIQ warned that Luna Moth’s activities can be hard to spot as no malicious links or attachments appear in the phishing emails. Similarly, victims are installing signed, legitimate software themselves.

Meanwhile, few security tools can handle voice interactions and activity remains local to the infected machine and network.

"This slow-paced, trust-based approach slips past both signature-based and behavioral threat detection, revealing a critical blind spot in modern security architectures," they said.

The best strategy is to lock or restrict installations of Zoho Assist, AnyDesk, and other RMM tools unless they've been explicitly approved, researchers advised.

Organizations should track the use of RMM tools and file transfer utilities like WinSCP or Rclone for suspicious parameters and execution patterns.

They should also use email rules to flag messages from impersonated helpdesk domains, and give staff regular training on social engineering to help spot spoofed invoices and verify suspicious support requests.

MORE FROM ITPRO

• Hackers are duping developers with malware-laden coding challenges
• Fake file converter tools are on the rise – here’s what you need to know
• Why government email servers are top targets for state-backed hackers

Security experts have issued an alert over a new social engineering campaign using Zoom’s remote control features to take over victim devices.

In a report from Trail of Bits, researchers attributed the campaign to a cyber criminal group known as ‘Elusive Comet’, which attempted to target the company’s CEO on social media.

The campaign in question centers around abusing the video conferencing software’s remote control feature, which allows participants to take control of another users’ computer.

In a blog post detailing the CEO’s exchange with the group, the firm said the attack started with an invitation to appear on ‘Bloomberg Crypto’ as part of an interview.

These invitations were sent via social media or email, using phony email addresses mimicking official Bloomberg accounts belonging to journalists. Notably, invitations were sent via Calendly links, the company said, which are intended to lure the victim under the guise of authenticity.

“Two separate Twitter accounts approached our CEO with invitations to participate in a “Bloomberg Crypto” series—a scenario that immediately raised red flags,” the firm said in a blog post.

“The attackers refused to communicate via email and directed scheduling through Calendly pages that clearly weren’t official Bloomberg properties. These operational anomalies, rather than technical indicators, revealed the attack for what it was.”

Trail of Bits identified a number of accounts linked to the campaign and warned organizations to update monitoring systems to include these new indicators.

These included:

• X: @KOanhHa
• X: @EditorStacy
• Email: bloombergconferences[@]gmail.com
• Zoom URL: https://us06web[.]zoom[.]us/j/84525670750
• Calendly URL: calendly[.]com/bloombergseries
• Calendly URL: calendly[.]com/cryptobloomberg

Zoom attack relies on user trust

Trail of Bits warned that with the campaign relying on a feature in a legitimate service, it could pose a serious risk to unwitting users.

Upon entering a call with the threat actors, they change display names to ‘Zoom’ to make the request “appear as a system notification”. If granted access, the attacker can assume control of the victim’s device to install malware, exfiltrate data, or steal cryptocurrency.

“What makes this attack particularly dangerous is the permission dialog’s similarity to other harmless Zoom notifications,” the firm said. “Users habituated to clicking “Approve” on Zoom prompts may grant complete control of their computer without realizing the implications.”

Max Gannon, Intelligence Manager at Cofense, echoed Trail of Bits’ comments on the campaign, noting that the use of legitimate software by cyber criminals has become a serious problem for enterprises.

“The malicious use of legitimate software is a growing trend we've continued to see in 2025,” he said.

“In this case, threat actors are leveraging legitimate Zoom and Calendly links to bypass security controls. As trusted domains, their use in this attack makes it more difficult to detect and block."

Analysis from Mimecast earlier this year highlighted the growing threat posed by cyber criminals using legitimate services in attack chains. In its most recent threat intelligence report, the firm flagged more than 5 billion threats in the second half of 2024 alone, with ‘living off trusted services’ (LOTS) attacks a key cause for concern.

Also known as malware-free attacks, this approach is useful in helping cyber criminals circumvent authentication practices at target organizations, the study noted.

MORE FROM ITPRO

• Infostealer malware: What’s the threat to businesses?
• Forget MFA fatigue, attackers are exploiting ‘click tolerance’ to trick users into infecting themselves with malware
• Zoom-themed cyber attacks fuel rapid malware growth

State-sponsored hackers from North Korea, Iran, and Russia are exploiting the ‘ClickFix’ social engineering technique for the first time – and to great success.

Popular for some time with cyber crime groups, ClickFix is a social engineering practice that uses dialog boxes with instructions to copy, paste, and run malicious commands on the target’s machine.

The technique was first seen in early March last year, employed by initial access broker TA571 and the ClearFake cluster - but it soon spread far more widely.

According to researchers at Proofpoint, over a three-month period from the end of last year through the beginning of 2025, North Korea's TA457, Iran's TA450, and Russia's UNK_RemoteRogue and TA422 have all been making use of it.

"This creative technique not only employs fake error messages as the problem, but also an authoritative alert and instructions supposedly coming from the operating system as a solution," said Proofpoint.

Rather than revolutionizing their campaigns, the technique is replacing the installation and execution stages in existing infection chains. While it's currently limited to a few state-sponsored groups, Proofpoint said it expects the attack method to become more widely tested or adopted by threat actors.

North Korea's TA427 was first spotted using ClickFix at the beginning of this year, Proofpoint noted. The group targeted individuals in a handful of think tanks, masquerading as a Japanese diplomat and offering a meeting with the Japanese ambassador to the US, Shigeo Yamada.

Iran's TA450, meanwhile, used an attacker-controlled email address - support@microsoftonlines[.]com - to send an English-language phish to targets at more than 39 organizations in the Middle East.

They deployed the ClickFix technique by persuading the target to first run PowerShell with administrator privileges, then copy and run a command contained in the email body. Doing this installed remote monitoring software, allowing the group to conduct espionage and exfiltrate data from the target’s machine.

ClickFix abuse expected to surge

UNK_RemoteRogue has only used ClickFix once, researchers said. Notably, however, none of the aforementioned groups showed repeated use of the technique.

The security firm first hypothesized that this might be because it represented a trial period, or that the groups found the technique less successful than others for machine compromise.

With TA427 returning to ClickFix with a slightly varied infection chain in April, researchers now believe that the group is developing how it uses the ClickFix technique in its operations, and that more sightings are likely in the coming months.

One noteworthy finding from the Proofpoint research is that Chinese state-sponsored groups haven’t jumped on the bandwagon as of yet. This, researchers said, could change in the coming months.

"Given the technique’s trajectory around the world, there is a conspicuous absence in the use of ClickFix by a Chinese state-sponsored actor in Proofpoint investigations," said the firm.

"However, this is likely due to visibility, and there is a high probability that a China-nexus group has also experimented with ClickFix, given its appearance across many actors’ campaigns in a short period of time."

MORE FROM ITPRO

• The Iran cyber threat: Breaking down attack tactics
• Russia is targeting unpatched vulnerabilities – what can tech leaders do to shore up defenses?
• North Korean insider attacks are skyrocketing – dozens of US firms didn't spot the hacker in their midst

Troy Hunt, the security blogger behind data breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.

In a blog post disclosing the incident, Hunt described how the attack took place, with screen shots of the phishing email, which purported to come from his email marketing provider, Mailchimp.

The trap used a classic phishing tactic of including a button that linked to a page with a similar url to the legitimate one – mailchimp-sso.com (now deactivated) versus mailchimp.com.

Hunt, who said he was “really jet lagged and really tired” at the time entered his credentials and the one time password (OTP) and the page then hung, rather than loading.

“Moments later, the penny dropped,” Hunt wrote. “I logged onto the official website, which Mailchimp confirmed via a notification email which showed my London IP address.”

“I immediately changed my password, but not before I got an alert about my mailing list being exported from an IP address in New York,” he added.

Hunt himself and others in the industry reacting to the news have said this is an example of how hackers exploit human weaknesses to carry out successful attacks.

In the case of Hunt, tiredness led to lack of attention, which in turn led to him falling for a phishing scam of the kind he said he would typically have recognized early.

Erich Kron, security advocate at KnowBe4, said the incident is a prime example of how even a seasoned cybersecurity veteran can fall prey to cyber criminals.

"Social engineering is largely getting the right message to the right person at the right time, and that combination can lead to unfortunate situations such as this.”

Aditi Gupta, principal security consultant at Black Duck, echoed Kron's comments, noting that bad actors deliberately "feed on fear and weaknesses such as tiredness and a sense of urgency" to bait unsuspecting users.

"This recent phishing attack further highlights that, in the end, we are all humans, and sophisticated phishing attacks could get the best of us."

Kron commended Hunt, adding that he “deserves kudos” for revealing what had happened to him and using the incident as an opportunity to educate others.

For his part, Hunt said he has gone through the usual gamut of emotions felt by someone who falls for a scam, including feeling “so stupid” and acknowledged “[his] own foolishness”.

However, he also hit out at some of Mailchimp's own practices that he claimed are poor in relation to data security. These include not offering phishing-resistant two factor authentication (2FA) and not automatically deleting unsubscribed email addresses.

Hunt concluded his blog post by offering his “sincere apologies to anyone impacted by this”, but added that “on balance I think this will do more good than harm and I encourage everyone to share this experience broadly”.

MORE FROM ITPRO

• Hackers are using this new phishing technique to bypass MFA
• 10 quick tips for identifying phishing emails
• How hackers are using legitimate tools to distribute phishing links

LinkedIn has emerged as a lucrative hunting ground for cyber criminals in recent years, with threat actors conducting a range of social engineering campaigns centered around fake job offers.

Last year, security company Clear Sky revealed a social engineering campaign using fraudulent LinkedIn identities to trick users into downloading malware with these job offers, for example.

Led by an Iranian threat group, this particular campaign built on techniques first observed being employed by the North Korean Lazarus group.

Now, fresh details on the extent of the threat posed by the Lazarus group have been revealed by Bitdefender Labs. A report from the cybersecurity firm details how one scammer approached a researcher who was able to record the tactics employed in the threat campaign.

The scammer first approached the researcher with an ‘opportunity’ to work on a decentralized cryptocurrency exchange, claiming the final minimal viable product (MVP) was already complete and they would be employed as a front-end developer.

Bitdefender reported that once the target expressed interest in the vacancy, the scammer requested they provide a CV or personal GitHub repository link, which it said could be used to harvest personal data as well as make the offer appear genuine.

After these are supplied, the attacker shares a repository with the MVP or the project as well as a feedback document labelled ‘Candidate Evaluation and Feedback For’, which includes questions that cannot be answered unless the target runs the demo.

Analysis of the heavily obfuscated code revealed that it dynamically loads malicious code from a third-party endpoint. Bitdefender found that the payload is a cross-platform info-stealer engineered to target a range of popular cryptocurrency wallets.

The next payload drops further dependencies designed to ensure persistence on the target system, establish command and control (C2), and avoid detection.

Bitdefender said its analysis of the malware and operational tactics employed by the attacker indicated the attack was part of a larger campaign carried out by the Lazarus Group, a state-sponsored threat actor based in North Korea.

The attackers’ objectives extend beyond data theft, the report claimed, stating the group has been observed targeting victims working in sensitive sectors such as aviation, defense, and nuclear industries with the aim of exfiltrating classified information, proprietary technology, and corporate credentials.

The group have also been recorded targeting enterprises with fake job seeker scams, where hackers posing as remote IT workers based in other parts of the world try to gain entry to businesses in order to establish persistence on their corporate network.

How to protect yourself on LinkedIn

As a professional network, it’s not out of the ordinary to receive job offers via LinkedIn. The platform has an in-built jobs board, allowing enterprises to post vacant positions.

However, when approached by an individual, it’s wise to remain vigilant and be wary of any telltale signs that you may be prey for a cyber criminal.

Bitdefender set out a series of red flags individuals can look out for, including offers with vague descriptions of the role that do not correspond to an existing job posting on the platform.

Suspicious repositories that belong to users with ‘random names’ and lack proper documentation or a long contribution history are also strong indicators that the sender has malicious intentions.

Finally, users should also look out for spelling errors in any correspondence they have with the suspected scammer, as well as evidence of poor communication such as refusing to provide alternative contact methods.

There are also best practices Bitdefender recommends users can follow to minimize the risk they face of falling for similar scams, such as never running unverified code outside of virtual machines, sandboxes, or online code testing platforms.

MORE FROM ITPRO

• LinkedIn just swerved a lawsuit over AI model training claims
• Why social engineering is a major issue – and how you can stay safe
• A month in the life of a social engineering expert

Developers are being targeted in a new phishing campaign using fake CrowdStrike job offers, the security company has warned.

The firm noted that the campaign, first identified on 7 January, uses CrowdStrike’s recruitment branding to load crypto-mining malware onto the victim’s systems.

The campaign begins with phishing emails purporting to be part of a recruitment process informing victims that they have reached the interview stage for a junior developer role at CrowdStrike.

Victims are redirected to a malicious website disguised as a legitimate CrowdStrike domain, where they are prompted to install what it describes as an employee CRM application to schedule the interview.

However, the ‘CRM app’ is actually a malicious Windows executable written in Rust that loads the XMRig crypto miner onto their system.

XMRig is an open source tool used for mining cryptocurrencies such as Monero, but the tool is frequently leveraged by cybercriminals to use the computing resources of compromised machines to mine cryptocurrency on their behalf.

The miner is configured to run in the background on the target’s machine, using “minimal CPU resources to avoid detection” CrowdStrike noted.

The firm said the campaign highlights the importance of staying vigilant against phishing attacks that target jobseekers, advising developers currently in the recruitment process to verify all communications with CrowdStrike and avoid downloading “unsolicited files”.

It added that CrowdStrike does not interview potential applicants via instant message or group chat, and never asks candidates to download software for interviews.

Recruitment space is a happy hunting ground for social engineers

Phishing campaigns targeting jobseekers have become a recurring issue in the modern threat landscape, with the promise of a potential job offer often leading victims to let their guard down.

In November 2024, an investigation by Clear Sky Security highlighted one social engineering campaign using fraudulent LinkedIn identities to trick job seekers looking for a role in the highly competitive aerospace industry.

Earlier that year, in February, a group tracked as Moonstone Sleet by Microsoft was observed targeting software developers with a fake opportunity to work on a video game DeTankWar, which was actually a custom malware loader.

Commenting on the recently uncovered fake CrowdStrike campaign, Chance Caldwell, senior director of the Phishing Defense Center at Cofense, noted the focus of the campaign targeting prospects who had already applied for a role at CrowdStrike.

"While interview and job-related phishing emails are not uncommon, this is a very targeted campaign that goes beyond the vast majority of malicious campaigns we see with this theme,” he explained.

“The campaign uses URLs that were created to look like they might actually belong to CrowdStrike and the downloaded malware provides a pop-up that directs users to the real CrowdStrike support portal."

Caldwell added that the majority of phishing campaigns Cofense observes exhibit far less sophisticated mimicry, offering potential targets advice on how to spot a malicious social engineering campaign before it’s too late.

“Most of the use cases we see are lucky to have proper branding, much less the extended work done here to really portray themselves as CrowdStrike,” he said.

“It is very unlikely that a recruiter will direct someone to download an executable as part of the interview process. Any suspicious requests, such as this one, should be sufficiently verified before downloading anything and contact information should be verified through the legitimate company website."

New research has shown the flexibility of threat actors to rapidly iterate attack patterns in order to bypass security controls.

An investigation from security firm Proofpoint into a recent attack targeting a nuclear security expert at a US-based think tank revealed how well-resourced attackers change tactics on the fly to compromise different machines.

After realizing their initial payload wouldn’t work on a Mac, they quickly pivoted to new techniques known to work on targets who used Apple hardware.

The sophisticated operation saw skilled threat actors devise a seemingly benign email chain with the high-profile target and continue the conversation over the course of weeks to build trust and rapport, exploiting that to launch further attacks.

How the attack unfolded

The mid-May 2023 attack came from TA453, an Iranian state-affiliated threat actor, also tracked under the monikers: Charming Kitten; APT42; Mint Sandstorm; and Yellow Garuda, and saw them posing as members of the Royal United Services Institute (RUSI).

Using a multi-persona approach, the attackers - known for conducting espionage operations - started an email chain with the target seemingly seeking feedback on a project titled ‘Iran in the Global Security Context’.

The attackers sent multiple messages from different accounts, all referencing each other to generate a feeling of authenticity - a technique seen before in email hijacking campaigns.

After a single seemingly benign interaction, a malicious Google Script macro was delivered, intended to direct the target to a Dropbox URL. The URL hosted a password-encrypted .rar file, which contained a dropper masquerading as a PDF but was actually a Windows LNK file.

Using LNK files has been a hallmark of cyber attacks since Microsoft blocked VBA macros by default last year. Exploiting VBA macros had for years been the go-to method for installing malware using maliciously crafted Microsoft 365 files.

Proofpoint said, “Using a .rar and LNK file to deploy malware differs from TA453’s typical infection chain of using VBA macros or remote template injection”.

“The LNK enclosed in the RAR used PowerShell to download additional stages from a cloud hosting provider.”

However, the target was using an Apple computer, meaning that the delivered file would not run. The file it attempted to deliver was a newly identified PowerShell-based backdoor called GorjolEcho.

Once it realized GorjolEcho would not execute on macOS, TA453 then pivoted to re-launch the attack at a later date using a ported version of the backdoor that worked on Apple hardware.

The attackers continued the same seemingly innocent email conversation with the target and roughly a week after the initial Windows-based attempt, they relaunched the attack with the Apple-ported backdoor.

In this case, the malware was delivered via a password-protected ZIP file masquerading as a RUSI VPN solution and shared drive. 

After some interactions with the threat actor, the user would be persuaded to open the file. A series of bash scripts would have then installed a backdoor, dubbed NokNok.

Proofpoint judged that this was intended to serve as a foothold for further instruction and was almost certainly a port of the PowerShell backdoor.

The incident serves as a reminder of the adaptability of the threat actors. In this instance, LNK files were sent instead of Microsoft Word documents with macros, and swiftly ported to macOS when the opportunity arose. 

The state of Mac malware

As Apple hardware has become progressively more popular in the enterprise, it has become correspondingly more of a target for threat actors.

That said, according to Apple management specialist Jamf, in 2022 there was a drop in new malware infections. 

In its 2023 State of Malware report, Malwarebytes noted that while Mac malware was rare, it did exist. 11% of machines with detection events were infected by malware.

However, Michael Covington, VP of portfolio strategy at Jamf, told ITPro that 2023 had been a very active period for Apple security.

He said: “In the first half of the year, we saw some noteworthy developments in the threat landscape indicating that attacks against Apple devices were changing, both in terms of intensity and purpose”. 

“During this time, we saw the first real instance of ransomware emerge that was built specifically to target macOS. We also saw new malware in distribution, attributed to state-sponsored attackers, that used novel evasion techniques to avoid detection and bypass built-in platform protections to take root.”

Covington also noted the rise of cryptojacking threats aimed at Apple processors and the continued evolution of spyware being used against high-risk individuals - primarily in government and media, but also commended Apple’s actions to address active exploits.

He also warned of the risk posed by gullible or distracted users, particularly with regard to phishing attacks.

Proofpoint’s research is evidence of the adaptability of threat actors, their ability to respond to changes in the environment, and the continually evolving threat landscape.

Joshua Miller of Proofpoint said: “TA453’s capability and willingness to devote resources into new tooling to compromise its targets exemplifies the persistence of state-aligned cyber threats”. 

“The threat actor’s continued efforts to iterate their infection chains to bypass security controls demonstrate how important a strong community-informed defense is to frustrate even the most advanced adversaries.”

Search engines pushing malware to users continue to be one of the most pervasive cyber security threats facing organizations around the world.

Netskope’s 2022 Cloud and Threat report found that nearly 10% of all malware downloads in Q1 2022 were referred from search engines. 

Downloads of malicious software “mostly resulted” from weaponized data voids, or a combination of search terms that specifically appealed to business web users, the study found. 

Data voids occur when there is a lack of clearcut information available on search terms found in Google. Netskope said this means that content matching certain terms appears “very high in search results” - which in turn appeals to threat actors targeting certain users. 

The research revealed that threat actors are increasingly relying on malicious web content to target users by developing finely-catered websites spanning a range of categories, such as business, marketing, technology, education, and retail. 

These websites are often developed and populated in a patient manner by attackers to ensure they appear legitimate and dupe unknowing users. 

“Attackers have been populating their websites with enough content to make them seem legitimate, and only using them to host malicious content after they have been around long enough to blend in,” the report stated. 

“They have also been abusing free hosting services and compromising existing websites to deliver malicious content.”

Netskope’s findings on malvertising align with previous research into this attack method, which has surged in popularity among threat actors in recent months. 

An investigation by Bitwarden in January found that the volume of fake ads promoting malicious software and websites impersonating popular brands has increased markedly over the last year.  

Similar research from HP Wolf Security’s threat research division observed a surge in malvertising across 2022. 

In a blog post in January, the security firm warned that businesses were facing a significant volume of malicious websites aimed at compromising user accounts and targeting operations. 

“In the last two months, we’ve seen a significant increase in malware distributed through malvertising, with multiple threat actors currently using this technique,” researchers said.

The rise of malvertising has reached such a point in the last 12 months that researchers have raised questions over Google’s handling of the issue.

In a January Twitter thread, security researcher Will Dormann questioned why VirusTotal, which is owned by Google, was not being used to automatically examine sponsored links for malware. 

Dormann’s criticism followed an incident in which a popular crypto influencer fell victim to a malicious OBS link promoted in Google Search results. 

Social engineering risks still acute

Malvertising represents “just one of many” social engineering techniques frequently employed by threat actors, the Netskope study warned. 

In addition to leveraging search engines, attackers still focus heavily on targeting users via email platforms, collaboration apps, and chat applications to dupe victims. 

The study noted that the two most prevalent forms of malware still harnessed by attackers include Trojans, which accounted for 60% of all malware downloads in Q1 2022, and phishing downloads, which accounted for 13% of all incidents.

“Phishing scams, credit card skimmers, exploit kits, and other malicious web content continued to rise in 2022,” the report stated. 

“Compromised sites, sites created using free hosting services, and fake websites hosting seemingly legitimate content have helped attackers disguise malicious web content, making it difficult to filter malicious content using URL categorization alone.”

“The rise in cloud malware delivery and malicious web content underscores the importance of inspecting all content, from all destinations, for both web and cloud.”

Cloud apps placing users at risk 

Malware delivery via cloud applications remained a key point of concern, the study found. 

Over the last year, cloud malware delivery increased significantly, with malware downloads occurring from more than 400 cloud apps. 

Microsoft OneDrive remained the most popular weapon of choice for threat actors in this regard. 

However, Netskope observed a marked increase in the popularity of Google Cloud Storage, which saw “significant increase in usage as it gained popularity for object hosting across the web”. 

To mitigate rising malware threats, Netskope recommended that organizations deploy “multi-layered, inline threat protection” for cloud and web traffic.

In doing this, businesses can prevent inbound and outbound malware communications.

Similarly, it advised implementing “real-time coaching” for users to ensure safer app alternatives and to monitor unusual activity. 

Researchers from Darktrace have seen a 135% increase in novel social engineering attack emails in the first two months of 2023.

The cyber security firm said the email attacks targeted thousands of its customers in January and February 2023, an increase which it said matches the adoption rate of ChatGPT.

The novel social engineering attacks make use of “sophisticated linguistic techniques”, which Darktrace said include increasing text volume, sentence length, and punctuation in emails.

Darktrace also found there’s been a decrease in the number of malicious emails that are sent with an attachment or link.

The firm said that this behaviour could mean that generative AI, including ChatGPT, is being used by malicious actors to construct targeted attacks rapidly.

“Email is the key vulnerability for businesses today. Defenders are up against sophisticated generative AI attacks and entirely novel scams that use techniques and reference topics that we have never seen before,” said Max Heinemeyer, chief product officer at Darktrace.

“In a world of increasing AI-powered attacks, we can no longer put the onus on humans to determine the veracity of communications they receive. This is now a job for artificial intelligence.”

Survey results indicated that 82% of employees are worried about hackers using generative AI to create scam emails which are indistinguishable from genuine communication. It also found that 30% of employees have fallen for a scam email or text in the past.

Darktrace asked survey respondents what the top-three characteristics are that suggest an email is a phish and found:

• 68% said it was being invited to click a link or open an attachment
• 61% said it was due to an unknown sender or unexpected content
• Poor use of spelling and grammar was chosen by 61% too

In the last six months, 70% of employees reported an increase in the frequency of scam emails. Additionally, 79% said that their organisation’s spam filters prevent legitimate emails from entering their inbox.

87% of employees said they were worried about the amount of their personal information online which could be used in phishing or email scams.

Defending AI social engineering attacks

Email services have always been one of the primary vectors through which attackers can breach an organisation.

One of the most common ways to install malware on a victim's machine would be to embed malicious code inside a Microsoft Office document, such as an Excel file.

Microsoft has recently implemented a number of measures to help minimise the abuse of its software in phishing attacks. Most notably in 2022, it disabled VBA macros - the abused component which facilitated the automatic loading of malware via tampered Office documents.

The decision was greeted warmly, but the company didn't escape criticism. Some said the industry had been calling for such action to be taken against VBA macros for years, and that Microsoft could have prevented an untold number of attacks if it had acted faster.

More recently, it took the decision to block emails sent from potentially vulnerable Exchange servers.

Microsoft Exchange servers have been abused by hackers for years to launch highly convincing email campaigns, such as those involving email hijacking - using genuine email addresses to continue previous chains to increase the feeling of legitimacy.

The threat of AI to cyber security has been feared for some time and extends beyond just generative AI.

AI-driven malware, for example, was conceptualised years ago - malware that could install and analyse a specific environment, changing its payload to exploit its host most effectively. In reality, such attacks have been few and far between.

There are also fears around what deepfake technology could achieve in the phishing space. One possible attack could see a CEO's likeness abused to send video and/or audio instructions to employees in the finance department, for example, encouraging them to make payments to accounts under the attackers' control.

The latest work from Intel and its FakeCatcher system has aimed to develop a tool to detect deepfakes analysing the bloodflow in faces.

At present, Intel told IT Pro that it has a 96% success rate in identifying deepfake footage, and the technology could be embedded within video conferencing software to prevent deepfake phishing and social engineering attacks in the near future.

The US' Cybersecurity and Infrastructure Security Agency (CISA) has revealed that several federal civilian executive branch (FCEB) agencies have fallen victim to a widespread phishing campaign.

The campaign abused legitimate remote monitoring and management (RMM) software and emails were sent to staff starting in the middle of 2022. The majority were themed around helpdesk emails falsely notifying victims that they had been sent an accidental refund, or needed to cancel a subscription.

Links included in the emails led to a first-stage malicious domain which would launch an executable that connected to a second-stage domain that downloaded an RMM program.

CISA said threat actors would remotely monitor the victim’s screen and instruct them to access their bank account, then alter the balance to make it seem as though the victim had been sent money. They would then instruct for the 'excess' amount to be sent back to an account set up for the scam.

Although the agency did not provide specifics on the scam, its description bears a strong resemblance to the methods used prevalently by online scammers targeting vulnerable civilians.

Often claiming to be calling from tech support at a large company, such as Microsoft, they would block the victim's view of their display using the RMM tools and use a browser's 'inspect element' function to make the bank balance appear as though it had changed.

According to CISA's account, the threat actors used AnyDesk and ScreenConnect as portable executables, which can run without administrator privileges and are not flagged as malicious by antivirus programs or malware removal tools.

This allowed the software to run without being approved by network administrators at the affected agencies, and could have facilitated an attack on devices that shared an intranet with that of the victim.

Another method saw threat actors send victims emails urging victims to call a phone number on similar financial pretences to the emails containing links. They would then be urged to manually navigate to one of the threat actors’ malicious domains.

In June 2022, one FCEB employee called the number and was given instructions to open a malicious domain on their device. At the time the CISA detected the campaign in October 2022, traffic was being sent and received between a compromised FCEB server and the malicious domain ‘myhelpcare[.]cc’.

"Targets can include managed service providers (MSPs) and IT help desks, which regularly use legitimate RMM software for technical and security end-user support, network management, endpoint monitoring, and to interact remotely with hosts for IT-support functions," the CISA said.

"These threat actors can exploit trust relationships in MSP networks and gain access to a large number of the victim MSP's customers. MSP compromises can introduce significant risk - such as ransomware and cyber espionage - to the MSP’s customers."

The CISA has urged organisations to follow best practices for blocking phishing emails, and train employees to recognise techniques used by social engineers.

It has additionally recommended the use of enhanced application controls to prevent the installation and execution of portable unauthorised RMM software, and for RMM ports to be blocked at network perimeters.

In an advisory, the CISA noted that the threat actors behind the campaign appear to have run it for profit only but that similar techniques could be used by threat actors for significant harm.

The CISA, National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) SAID that threat actors could have sold remote access to victim accounts to more dangerous groups such as advanced persistent threat actors (APTs).

The agencies also warned that the attacks prove the potential for legitimate RMM programs to be used by threat actors to seize control of devices remotely, and bypass administrator controls to launch malware operations.

“In October, CISA identified a widespread cyber campaign in which cyber criminal actors leveraged RMM software to gain command and control of devices and accounts,” said the NSA in its press release.

“Malicious cyber actors could leverage these same techniques to target National Security Systems (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) networks and use legitimate RMM software on both work and home devices and accounts. Other RMM software solutions could be abused to similar effect.”

Over the past 12 months, the CISA has enacted strong, government-wide policies to strengthen the nation's cyber security posture. A notable example from the past year, was the bill that passed in August outlawing software containing any vulnerabilities to ensure secure-by-design federal systems.

In November 2021, it also launched a 'mandatory patch list' for FCEB agencies to abide by. This was comprised of the most dangerous and commonly exploited security vulnerabilities, complete with deadlines for each agency by which to apply the patches.

Paid advertising links on Google Search are being used by cyber criminals to push malware, in a strategy that could threaten businesses looking to use free software.

Top listings on the search engine that purport to link to legitimate software websites were instead found to be decoys leading to websites containing malware such as infostealers.

The abuse of Google's ubiquitous search engine was brought to light after a cryptocurrency influencer mistakenly downloaded a malicious package after clicking on an advertising link for popular streaming software OBS.

After running the executable file provided on the website, the victim's accounts on Substack and Twitter were hacked, and their NFT wallet was stolen.

Security researcher Will Dormann detailed the issue in a Twitter thread, and openly questioned why Google-owned threat analyser VirusTotal cannot be used to automatically check sponsored links for malware.

The popular file and link-checking website was acquired by Google in 2012, and flagged the malvertising links used in the campaign as threats when manually fed into the system.

Despite this, Google had not prevented the links from being blacklisted on their Ads platform, seemingly accepting money from threat actors without checking the listed links for threats at all.

In other cases, Dormann noted that VirusTotal didn’t flag links as malicious even though inspection of the packages they pushed contained highly suspicious Powershell commands.

He alleged that the threat actor behind this package is still paying Google for fake listings on software such as VLC Media Player, Rufus, and uTorrent.

Small and medium businesses could be at particular risk from this campaign, as these firms typically rely on free media and productivity software, the likes of which are being mimicked.

Some software developers appear to be aware of the issue, as those behind Notepad++ appear to have spent money to ensure their software appears in results first. OBS has issued an official warning and linked the only legitimate site from which its software may be obtained.

Malvertising, the method through which malicious software or links are hidden in seemingly safe advertising, is often used by hackers on untrustworthy websites behind suspicious banner ads.

“Protecting users is our top priority,” said a Google spokesperson in response to a request from IT Pro.

“We take dishonest business practices very seriously and consider them to be an egregious violation of our policies. Where we find ads that breach our policies we take immediate action.”

Google's ad policy prohibits the posting of links that hide malware, and in January 2021 the firm began to ask advertisers registered in certain countries to verify their identity.

The company did not directly respond to questions regarding why it has not implemented automatic VirusTotal scans for links on their platform.

Malvertising: A deeper issue

The HP Wolf Security Threat Research Team published a report on malvertising campaigns that used fake listings for popular free software as an attack vector.

Programs such as Audacity, Teams, Discord, and the Adobe Creative Cloud suite of apps were used as bait by threat actors to distribute malware.

Vidar Stealer, a malware strain used to steal data such as passwords and cryptocurrency wallets from victims, was one such program spread in the campaign, along with the Trojan IcedID which is used to steal financial credentials and compromise corporate networks.

Researchers noted that malicious packages downloaded through the campaign were large, with one example being 343MB. This is believed to be an antivirus evasion tactic, as larger files can circumvent automatic scans with some software.

“Many organisations use software distribution systems, which means that the software does not have to be downloaded by the end user but is provided by the system administrator,” said Patrick Schläpfer, malware analyst at HP Wolf Security.

“If you even block the download of such software for end users, you greatly limit this attack vector and are even more protected against such attacks.”

The use of Google Ads to deliver malware was also previously highlighted in July 2022 when Malwarebytes researchers warned of Google search results hiding malicious links. The sophisticated campaign used inline frames to push malicious domains onto users without revealing their URLs.

A smishing attack on Thursday led to a wide range of Uber's internal systems being breached by a seemingly unaffiliated teenage hacker, it has been claimed.

A report first emerged in The New York Times that the ride-sharing company had been hacked, with the threat actor themselves getting in touch with the publication to allege that he had gained access to internal systems such as Uber’s internal email, cloud storage systems and code repositories through a simple social engineering attack. In a text message sent to an Uber employee, the hacker impersonated an IT worker and convinced them that it was necessary to share an internal password.

As a variant of phishing in which SMS is used to mine targets for sensitive information, smishing is often combined with social engineering tricks for increased effectiveness. Victims may be more easily persuaded to hand over credentials to a supposedly trustworthy source if the attacker makes the situation seem urgent or seems to be suitably authoritative, both of which may have prompted the hacker to claim to be a key IT worker. Two-factor authentication (2FA) is a recommended measure to dull the impact of smishing attacks, and prevent compromised credentials from being used by hackers effectively.

Smishing and social engineering were recently used in sophisticated attacks on Twilio and Marriott. A report from September 2021 revealed that in the first six months of the year, smishing attacks surged 700% more than in the preceding six months.

The hacker claims to be just 18 years old, with self-taught skills in cyber security, and explained that he performed the breach because Uber’s security was especially weak. On Thursday, Uber confirmed that it was subject to a cyber attack through its official Twitter channel, and also stated that it is in dialogue with law enforcement. The company has not offered an in-depth description of the attack.

As part of the breach, the hacker gained administrator control of Uber’s HackerOne account, which it uses to pay white hat hackers bug bounties. The attacker proceeded to leave comments on all active bounty tickets reading “UBER HAS BEEN HACKED (domain admin, aws admin, vsphere admin, gsuite SA) AND THIS HACKERONE ACCOUNT HAS BEEN ALSO”.

The attacker also used this access to send out an email via policy update - which sends an automatic alert to the inboxes of anyone following a particular bounty programme - including a screenshot of a Telegram exchange, providing more details on how the hacker allegedly compromised Uber's systems.

In it, the hacker (identified in the conversation as 'Tea Pot') said that after he had gained access to the intranet, he obtained PowerShell scripts that "contained the username and password for a admin user in [privileged access management tool] Thycotic", which he said allowed him to "extract secrets for all services, [including] DA, DUO, Onelogin, AWS, [and] GSuite".

The New York Times also quoted two Uber employees, who wished to remain anonymous, who said the company had put out a warning to not engage with the company’s Slack channels while the attack was active, and shortly after all employees received a message reading “I announce that I am a hacker and Uber has suffered a data breach.”

There are concerns that younger people are increasingly turning to hacking as a hobby, driven by lack of opportunity amidst the cost of living crisis. A recent report by Censuswide, on behalf of International Cyber Expo, revealed growing concern among parents that hacking could become a pastime for young people.

“With hacking tools becoming increasingly accessible and affordable on the internet, we have witnessed a rise in ‘script kiddies’; inexperienced hackers who carry out cyber attacks,” stated Simon Newman, CEO of Cyber Resilience Centre for London and International Cyber Expo Advisory Council member.

“While ‘kiddies’ do not necessarily refer to the hacker’s age so much as their experience, many have been found to be teenagers. In fact, in the UK the average age of a referral to the National Cyber Crime Unit is just 15 years old.”

“Although law enforcement agencies are working hard to take down the websites and forums that promote hacking, the results of this survey also demonstrate a need for parents/guardians to take an active interest in what their children are doing online to prevent them from falling on the wrong side of the law.”

Uber has a history of hacking, having been very publicly compromised in a 2016 attack that resulted in the exposed information of 57 million users of its app and resulted in reputational damage for the firm. In June, a judge decided that the company’s former chief security officer (CSO) Joseph Sullivan would face wire fraud charges for his role in an attempted cover-up of the attack.

Uber declined to provide further comment to IT Pro.

Encrypted messaging platform Signal has confirmed that a number of its customers have been affected by the phishing attack on Twilio last week.

The company believes around 1,900 of its users are potentially affected by the breach of the communication API firm, with phone numbers and SMS verification codes potentially exposed to the hackers.

Signal said Twilio informed it of the breach at the time, and a subsequent investigation revealed the hackers gained access to Twilio’s customer support console.

“During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code,” said Signal in a public disclosure. “The attacker no longer has this access, and the attack has been shut down by Twilio.”

It added that the attackers specifically searched for three phone numbers out of the total 1,900 exposed, and the owner of one of these numbers has confirmed to Signal that their account was re-registered.

Re-registering a user’s account does not give the attacker access to any messages, profile information, or contact lists, Signal said, since this data is stored on a user’s device only.

“Your contact lists, profile information, whom you’ve blocked, and more can only be recovered with your Signal PIN which was not (and could not be) accessed as part of this incident,” it told customers.

By re-registering a user’s account, an attacker would be able to send and receive Signal messages from that phone number, however.

Signal is currently in the process of notifying all affected users by SMS and is de-registering Signal on all affected users’ devices. The 1,900 users will be required to re-register their accounts with their phone numbers on all devices they use.

This process began on Monday and Signal expects to complete it by the end of the day.

Since the action taken by Signal following Twilio’s breach, some users will have seen a banner in the app saying their account has been de-registered.

This may mean they were affected by the incident, it said, or it could indicate their account had been inactive for a long period.

Signal had previously prepared for this type of attack and is the reason it developed functionalities like Signal PINs and registration lock – a feature that prevents anyone else from registering an account with a user’s phone number.

This feature is not enabled by default, and Signal has recommended all users to enable it in the app’s settings menu, using a Signal PIN.

What happened in the Twilio breach?

Last week, several Twilio employees were targeted by socially engineered phishing attacks which resulted in some staff handing over passwords to the attackers.

SMS messages were sent with password reset links which directed targets to fake Twilio pages where attackers harvested the login credentials of some staff members.

Targets were addressed by their name, in some cases, and texts appeared to be sent from Twilio’s IT department, the company said.

It’s unclear who was behind the attack but it was thought the attackers were well-equipped given the thorough understanding of the company, able to link current and former employees with phone numbers and real names.

Twilio said it was aware that other companies were also targeted at the same time, one of which was revealed as Cloudflare.

The DDoS mitigation company confirmed it was also targeted by a phishing attack at around the same time as Twilio, but was not breached as a result due to the company-wide use of hardware-based, FIDO2-compliant multi-factor authentication (MFA) keys.

Cloud communications platform Twilio has admitted that hackers gained access to some customer data last week after a social engineering attack handed internal login credentials to threat actors.

Twilio employees were subjected to phishing texts requesting that they change their company passwords, each including a link with the keywords “Twilio”, “Okta” and “SSO” to make the URLs look more legitimate.

If an employee clicked the link, they were asked for their current credentials, which the threat actors harvested and used to access internal systems.

In an incident report, Twilio stated that the attacks were halted after the company “worked with the U.S. carriers to shut down the actors and worked with the hosting providers serving the malicious URLs to shut those accounts down.”

The phishing element of the breach was enhanced by social engineering on the part of the threat actors, who made the texts appear as if they were sent by the Twilio IT department. Texts also addressed employees by name in some examples.

The company also stated that it has heard first-hand that other companies were subjected to similar attacks, and that despite coordination with carrier networks the threat actors continue to operate. Investigations are ongoing.

The fact that former employees, as well as current employees, received the texts along with the threat actors’ reported ability to link phone numbers to individual names of employees, suggests a well-equipped operation backed by an understanding of the firm.

Twilio has been in touch with those customers whose data was potentially compromised and has no reason at this stage to suspect malicious activity outside of the accounts it has identified.

“We have reemphasized our security training to ensure employees are on high alert for social engineering attacks and have issued security advisories on the specific tactics being utilized by malicious actors since they first started to appear several weeks ago.

“We have also instituted additional mandatory awareness training on social engineering attacks in recent weeks. Separately, we are examining additional technical precautions as the investigation progresses.”

Social engineering attacks are difficult to mitigate because defence is only as strong as an individual’s ability to recognise something is wrong. There is little that security systems can do to protect a company's infrastructure if users are willing to give up their passwords over the phone, and clicking links sent from an unrecognised number carries a similar risk.

It is always best to double-check the origin of communications claiming to be from officials and to question requests to change your password. Two-factor authentication (2FA) can also be a good barrier between employees and unwanted login attempts.

“Phishing is an important component of social engineering,” stated Paul Brucciani, a cyber security advisor at WithSecure.

“Email recipients are more likely to be deceived by a phishing email read on a smartphone than a desktop machine. Other risk factors are time pressure and organisational change which makes it harder to discern whether the context of the email is appropriate (unusual requests are not regarded as suspicious by email recipients if they are not familiar with organisational changes that have been made).

"A well-crafted, untargeted phishing email can dupe as many as 30% of users in almost any organisation.”

Google users have been warned of a new malvertising campaign in which people searching for popular websites are instead redirected to scam sites by malicious adverts.

Searches for some of the most popular websites were found to produce adverts that had been crafted to appear as if they were legitimate links to the desired website, with some appearing as the first listing on a results page.

Websites mimicked by the threat actors include YouTube, Amazon, Facebook and Walmart, and in all cases appear to lead to a browser locker website where users are given scam warnings to call Microsoft support, or fake alerts from Windows Defender, according to researchers at Malwarebytes.

Malvertising, or the practice of hiding malware payloads behind online adverts, typically occurs on websites in more obvious ways, such as advertising that promises users free products or cash prizes.

In this case, however, researchers noted the sophistication of the campaign, with an example of a Facebook malvertising link containing no obvious discrepancies that might alert a user to its illegitimate nature.

However, because the malvertising uses Google Ads as its platform, it is still denoted as an advert with bold text in the top-left corner reading ‘Ad’. This allows discerning users to at least identify that it is not a direct link to the website they were searching for, although this still does not reveal its malicious nature.

Researchers also noted that the redirect mechanism used by the threat actors is complex enough to make it difficult to ascertain where the advert will send would-be victims through HTML analysis.

Upon clicking on the advert, the page the user is sent to will either redirect to the legitimate website as a ‘decoy’, or load a secondary script where the malicious URL is found.

This is then loaded within an inline frame, an HTML element that loads a page within another. This has the effect of replacing the page with the scam element, but the user is not actually redirected a second time.

In this way, the URL of the malicious browser locker page is hidden from the user, who only sees the interim of the .com ‘cloaking domain’ (in the case of Malwarebytes Labs, this was named ‘shopmealy’).

The fact that the adverts are listed on the search results before even some of the most popular websites in the world implies that the threat actors are willing to pay money in order to perpetrate the scam, which would be necessary in order to target keywords of such popularity.

Moreover, researchers found that the threat actors had separated the flows of the cloak and browser locker to prevent being taken down by authorities holistically, and used a mixture of expensive and free domains. The infrastructure of the malvertising also appears to have been hosted on both paid virtual private servers and free cloud providers (PaaS).

“Google's proprietary technology and malware detection tools are used to regularly scan all creatives,” reads the Google support page on malware in advertising.

“Fourth-party calls or sub-syndication to any uncertified advertisers or vendors are forbidden. Any ad distributing malware is pulled to protect users from harm. Any Authorized buyer whose creative is found to contain malware is subject to a minimum three-month suspension.”

Malwarebytes Labs have stated that all necessary reports have been filed to notify Google of the adverts, and researchers reported every such advert under the label ‘An ad/listing violates other Google Ads policies’.

IT Pro has contacted Google for comment.

A hacker has reportedly posted several internal documents online stolen from a Roblox employee, which the company said were stolen by cyber criminals through social engineering tactics.

The documents appear to contain personal information of multiple individuals and relate to some of the most popular games and creators on the platform, as reported by Motherboard.

The hacker behind the attack released a 4GB archive of documents and posted a selection of images in a Roblox forum post. The files include email addresses, identification documents, and spreadsheets which appear to relate to creators from Roblox.

Roblox is a platform that allows users to create and design their own games or worlds and play other users’ games while deploying microtransactions to monetise them. It’s worth around $68 billion and the company has claimed in the past that half of all children in the US play it in some form.

“Roblox has been actively investigating a phishing incident, which involved a Roblox employee being targeted by cyber criminals through social engineering tactics and using highly personalised scare tactics,” a Roblox spokesperson told IT Pro. “These stolen documents were illegally obtained as part of an extortion scheme that we refused to cooperate with. We acted quickly upon learning of the incident, engaged independent experts to complement our information security team and have tuned our systems to seek to detect and prevent similar attempts.”

This isn’t the first time the gaming platform has been targeted by hackers, as in 2020 a hacker bribed a Roblox employee to gain access to its back-end customer support panel. This allowed them to look up the personal information of over 100 million users and grant virtual in-game currency. The hacker was able to see users’ email addresses and change their passwords too. They could also ban users and remove two-factor authentication from their accounts.

Meanwhile, Bandai Namco, a video gaming giant, confirmed last week it had been the victim of a cyber attack. The organisation confirmed that several of its companies in Asian regions were breached by a third party on 3 July 2022. Some reports claimed that a ransomware group, that uses the names AlphV and BlackCat, were behind a large ransomware attack on the gaming company.

Marriott International has revealed that unknown hackers infiltrated its computer networks and then attempted to extort the company.

The incident reportedly took place a month ago and the attackers were able to exfiltrate 20GB of data including credit card and confidential information, according to DataBreaches. The hotel impacted appears to be BWI Airport Marriott in Maryland in the US.

The breach occurred because an attacker carried out social engineering and successfully tricked an associate at a Marriott hotel into giving them access to the associated computer, Marriott said in a statement to IT Pro.

“Our investigation determined that the information accessed primarily contained non-sensitive internal business files regarding the operation of the property,” added the hotel chain.

Marriott claimed that the incident was contained in six hours and that it had identified and was investigating it before they were contacted by the unknown attackers. The hotel chain hasn’t made any kind of payment to the attackers so far, although it didn’t reveal whether it had negotiated at all.

“They were communicating with us and went silent for no reason, it might be because of the high pricing, but we are always willing to find a deal with our clients and told Marriott that we can provide all the discounts in the world,” the attackers said, who contacted DataBreaches.

Marriott said that while most of the data acquired by the attackers was “non-sensitive internal business files”, the company will be notifying around 300 to 400 individuals and any regulators as required. It didn’t provide a full description as to what kind of information was involved for the individuals being notified. Law enforcement has reportedly been notified and Marriott said it was supporting that investigation.

The attackers provided samples of the data, some of which reportedly appeared to be internal business documents with confidential and proprietary information such as how to access a labour management and scheduling platform. Additionally, there appears to be a relatively recent file detailing the average wages by department.

Other documents contained information on hotel guests and personnel, including their names and jobs, as well as corporate credit card numbers for some companies paying for employees to stay at Marriott.

The attackers revealed they are an international group that has been working for approximately five years. They claimed to have avoided media coverage by establishing a reputation for keeping communications and relationships confidential.

The group also claimed to never encrypt anything as it doesn’t want to interfere with business. It also added it doesn’t attack critical government infrastructure but focuses only on businesses.

IT Pro has contacted Marriott for comment.

This isn’t the first time that Marriott has experienced a data breach. In 2020, it was fined £18.4 million by a UK data regulator for a 2014 data breach that affected 339 million guest records worldwide. The ICO found that the company failed to put appropriate technical or organisational measures in place to protect the personal data being processed on its systems, as required by GDPR.

An Android malware strain, known for its attacks on the Google Play store, has been spotted targeting the login pages of online banks, in what experts believe is a long-term shift in strategy by its developers.

The Brazilian Remote Access Tool (BRATA) first surfaced in 2018, targeting Android users with fake antivirus apps and similar security software in an effort to steal credentials.

However, new attacks suggest the group behind the malware has pivoted towards targeting financial institutions directly, attempting to put fake login pages in front of users trying to access online banking services.

The new variant has been flagged by the cyber security organisation Cleafy, who provided screenshots of a phishing page new to BRATA that mimics the login field for a prominent bank, asking users to input their PIN and client number.

“They usually focus on delivering malicious applications targeted to a specific bank for a couple of months, and then moving to another target,” Cleafy explained in a blog post on the discovery.

Moves to socially engineer the customers of specific banks indicate that BRATA’s threat actors are curating their pool of targets. Formerly localised to South America, efforts to steal financial information have resulted in a shift in focus towards users across mainland Europe and the UK, with Italy-based Cleafy first discovering the variant through increased activity across the region.

The evolution has also seen the introduction of new features, which allow the strain to seek permissions over SMS, GPS, and device management. Additionally, on install an event-logger plugin labelled 'unrar.jar' is downloaded from the BRATA command and control (C2) infrastructure. Cleafy expressed concerns that these additions “could be used to perform a complete Account Takeover (ATO) attack”.

At time of writing, targeted devices do not appear to be exchanging information with the threat actors behind the malware, and that this may indicate that the newest variant BRATA.A is still undergoing development, according to researchers.

However, the organisation has already identified a separate SMS stealer app connected to the BRATA C2 infrastructure, also targeting users in mainland Europe and the UK. With threat actors testing out new attack vectors linked by a common framework, there are fears that, once active, this variant could prove effective at taking over users’ financial accounts.

For this reason, Cleafy has assigned BRATA an Advanced Persistent Threat (APT) status, which they define as “an attack campaign in which criminals establish a long-term presence on a targeted network to steal sensitive information".

As malware evolves to deceive in more sophisticated ways, it is important that users keep up to date with threat prevention tactics, and only download apps from trusted sources.

Security BSides has promised to bring greater diversity to the organisation of future conferences after the secret booking of a banned conference speaker prompted anger among the security community.

The two-day US-based BSides Cleveland cyber security event hosted Chris Hadnagy, a social engineer previously banned by DEF CON for undisclosed misconduct claims, as a mystery guest speaker on its second day.

Hadngay gave his talk at 9am, with the event’s digital schedule only revealing his name after his talk had ended. This prompted a number of prominent cyber security experts to pull out of the remainder of the event, with many claiming the event had manipulated attendees.

Hadnagy was originally billed to speak at BSides Cleveland as far back as autumn 2021, but pulled out following the DEF CON controversy.

BSides has now promised that a team of four organisers will run each Cleveland event, with the team made up of diverse backgrounds, rather than just the one organiser. Security BSides will also step in to assist the organisers with logistics and advice on how to book guests.

The lone organiser tasked with running the most recent BSides Cleveland later apologised for the booking and has now stepped down, the organisation said.

“The decision to include Chris Hadnagy in the 2022 BSides Cleveland event was my decision,” said event organiser Rockie Brockway. “Furthermore, the decision to keep the opening speaker slot as special guest instead of naming Chris specifically was also my decision. I am apologising to everyone that my decisions harmed, whether strangers, family, sponsors, or friends, and I am deeply sorry for that.

“I understand that my decisions may have destroyed the trust that I have built over my years in the BSides community, and I accept accountability for my actions. Effective immediately I resign from BSidesCLE leadership.”

Following up on Twitter, Security BSides did not confirm if Hadnagy or similarly divisive speakers would be banned from other BSides regional events.

The organisations said it was a decentralised movement and that there is no central governing body that can prohibit future event organisers from selecting individual speakers. It conceded that the BSides Cleveland event “will likely inform others’ decisions”.

“2022 was the first year BSidesCLE had a two-day event,” said Security BSides in a statement. “It was well attended and successful by any metric, up until the morning of day two, when Hadnagy was revealed as the morning’s surprise guest. Cleveland has a sizeable security community that can continue to benefit from a healthy BSides.

“Conversations and debates will continue and wounds will take time to heal. This is only the first step in moving BSidesCLE into its next chapter.”

Who is Chris Hadnagy?

Hadnagy is a widely referenced expert on social engineering and author of a book on human hacking. Most recently in February 2022, he was banned from the prominent cyber security conference DEF CON for violations of its code of conduct, the nature of which have never been made public.

It is a rare occurrence that a cyber security conference bans individuals from speaking at events. Although the nature of the accusations against Hadnagy are not public knowledge, those with inside information believe the ban was justified.

In a follow-up statement regarding his banning, Hadnagy dismissed the allegations of misconduct as sexual in nature, having been told by organisers this was not the case, though he also said “I still don’t know what the accusations are”.

Hadnagy had previously been criticised for insulting a non-binary individual online, and used a previous BSides appearance to apologise for it.

He also said he has drawn criticism from his training courses between 2015 and 2017. Without drawing examples himself, notorious reviews included one from a blind person seeking advice to access one of Hadnagy’s courses but received unsympathetic responses from the social engineer.

Hadnagy said in his post-DEF CON statement that he was sorry for any offence caused and that he does not discriminate against anyone on any characteristic or trait.

At the most recent BSides Cleveland event, he delivered the same talk as the one he gave at the BSides Idaho Falls event last year. The talk’s topic was on cancel culture. The title of the talk at both events was also exactly the same: ‘Who needs a court of law? I have social media”.

Deepfake-driven cyber attacks are set to become more popular in the near future as the artificial intelligence technology (AI) becomes more widely used, security experts at Cisco warned this week.

Such attacks could involve fake videos of companies’ CEOs being sent to employees, telling them to conduct wire transfers, for example.

Deepfake technology involves training an AI program with large amounts of data in order for it to learn how any given individual would look when saying certain words, and how they sound, including accurate intonation and speech pauses.

“Well, your targets are those that have public personas, because you need lots of training footage to do this,” said Nick Biasini, head of outreach at Cisco Talos. “So it'd be much easier to pick your CEO, go after the CEO, because they're on video constantly, and they're talking constantly. You could use that to easily make a video of them that all of a sudden your CEO is calling you, it looks like your CEO sounds like your CEO, and they're telling you to do a wire transfer.”

“There literally is a threshold of how much data you need to establish a ground truth to model the voiceprint and once that model is sufficient, shove whatever you want through it,” said TK Keanini, VP of security architecture and CTO at Cisco Secure.

Keanini also said that social norms could become “super weird” if such attacks became more popular. Giving the example of a family member calling a loved one, knowledge of this kind of attack may result in scenarios where additional questions will need to be asked just to check that the person they are dealing with is real. In this sense, it's seen as an evolution of the type of phishing attacks we know today, with a layer of suspicion attached to communication from specific people.

Fears around the use of deepfake technology in the cyber security landscape have been present for a number of years. Trend Micro revealed that such attacks were on its list of top cyber threats for the future as far back as 2019, when it presented to delegates of CloudSec.

When asked if deepfake use in cyber security was simply a gimmick that would never materialise, Keanini said: “It's definitely real. It doesn't take much to fake the backgrounds, it's not that much further to fake the foreground”.

“And as we move more and more to [hybrid working] collaboration, everybody's on video conferencing now, so it makes it even easier to launch those types of attacks than it would have been before,” said Biasini.

The pair revealed their expectations during a discussion about emerging cyber threats, chief among which was the idea that social engineering tactics would become more sophisticated and more pervasive.

Speaking at Cisco Live, JJ Cummings, managing principal of threat intelligence and interdiction at Cisco, said that foreign adversaries, specifically, were using increasingly sophisticated social engineering tactics on victims, based on the cases Cisco Talos has seen.

“One of the things that we started to see and one of the groups that we're tracking, since at least September of 2021, is very directed, very effective social engineering,” said Cummings.

“[It involves] making phone calls to specific strategically targeted individuals within an organisation, convincing those individuals that they're members of IT, or some support staff, and those individuals are doing one of two things: possibly giving up a password, certainly accepting a multifactor authentication push to their device, letting the bad guy in because the bad guy’s stolen the password.”

Biasini said that social engineering should be one of the biggest concerns for businesses over the coming years, adding that because the security industry is getting better at stopping systems from being exploited, attackers will turn to people instead.

Deepfake technology is what’s going to make the threat “exponentially worse” and that “people have a hard enough time not trusting stuff that they read online; just wait until they're having to not trust their eyes and their ears when they're watching people say the things that they're saying,” he said.

The LAPSUS$ hacking collective managed to breach T-Mobile systems using employee credentials and downloaded more than 30,000 of the company’s source code repositories.

This is according to evidence obtained by investigative reporter Brian Krebs, who detailed the data breach on his KrebsOnSecurity blog.

LAPSUS$ members accessed T-Mobile's internal company tools on several occasions in March, using T-Mobile VPN credentials purchased through the dark web, including a stolen data trading platform known as the Russian Market.

Conversation screenshots obtained by Krebs show how easy it was for the hackers to find new login credentials in the case that a targeted employee had changed their password, using SIM-swapping to bypass two-factor authentication. LAPSUS$ member ‘Amtrak’ had detailed to a member known as ‘White’, who has been using the Lapsus Jobs account, how they had found a new T-Mobile employee account to target, allowing them to access the company’s Slack communications.

‘White’, also known as ‘WhiteDoxbin’ and ‘Oklaqq’, is an Oxford-based teenager who was one of the LAPSUS$ members arrested and charged in late March. He is believed to be one of the leaders of the hacking group, despite his young age – estimated to be 16 or 17 years old at the time of the attacks.

Screenshots obtained by Krebs seem to hint that the hackers’ legal guardians are aware of criminal activity, with ‘Amtrak’ telling ‘White’: “Parents knkw [sic] I simswap [sic]”.

Apart from T-Mobile’s Slack channels and Bitbucket source code repository, LAPSUS$ also managed to gain access to the company’s customer account management platform Atlas.

Despite this, T-Mobile has stated that “the systems accessed contained no customer or government information or other similarly sensitive information, and we have no evidence that the intruder was able to obtain anything of value”.

“Several weeks ago, our monitoring tools detected a bad actor using stolen credentials to access internal systems that house operational tools software. Our systems and processes worked as designed, the intrusion was rapidly shut down and closed off, and the compromised credentials used were rendered obsolete,” the company told KrebsOnSecurity.

This is the third known data breach for T-Mobile in 15 months, following an incident affecting around 200,000 customers in January 2021 and 47.8 million customers in August 2021. The company also fell victim to three other breaches between 2018 and 2020.

Commenting on the news, Mike Newman, CEO of identity & access management (IAM) solution provider My1Login told IT Pro that “this latest breach on T-Mobile is yet another example of how attackers are relying on credential theft to carry out ransomware attacks”.

“Today all ransomware gangs, from BlackCat to LAPSUS$ to DarkSide have been relying on compromised user accounts to gain an initial foothold on an organisation’s network and then turn off security controls, steal data and deploy ransomware. This means to fight back against these attacks we need to focus on improving the security of user credentials and passwords, so they can’t be stolen or socially engineered out of victims in the first place,” he added.

Welcome to issue 25 of IT Pro 20/20, distilling the most important themes of the previous month into a simple, easy-to-read package.

This month we look at the industry-wide push for sustainable development, which was very much on display at this year’s CES. We’ve highlighted a handful of major players that are doing some pretty interesting things.

A new year also brings new opportunities, and so we’ve also explained why there’s never been a better time to start a side hustle, and how to go about it.

The next IT Pro 20/20 will be available on 28 January – previous issues can be found here. If you would like to receive each issue in your inbox as they release, you can subscribe to our mailing list here.

Email phishing attacks that use the LinkedIn brand have increased by 232% since 1 February, 2022, research has revealed.

The attacks tend to use display name spoofing and stylised HTML templates to socially engineer victims into clicking on phishing links and then entering their credentials into fraudulent websites, according to cyber security firm Egress.

The emails use targeted subject lines associated with LinkedIn, including “You appeared in 4 searches this week” or “You have 1 new message”. The emails contain the LinkedIn logo and brand colours, as well as using other well-known organisation names, like American Express, to make the attacks more convincing.

When clicked, the phishing links send the victim to a website that harvests their LinkedIn log-in credentials, according to the research.

Current employment trends are making these kinds of attacks more convincing, with the research citing how “The Great Resignation” continues to dominate headlines as a record number of US citizens left their jobs in 2021 for new opportunities.

“It is likely these phishing attacks aim to capitalise on jobseekers (plus curious individuals) by flattering them into believing their profile is being viewed and their experience is relevant to household brands,” Egress stated in its report.

Although the display name is always LinkedIn and the emails follow a similar pattern, they are sent from different webmail addresses.

The security company said that it’s unknown whether these attacks are the work of one cyber criminal or a gang operating together. However, most targets are companies in North America and the UK, operating across a variety of industries.

Egress advised that individuals should take extreme caution when reading notification emails that request them to click on a hyperlink, especially on mobile devices. It recommends hovering over links before clicking on them to ensure they are going to a trusted source, and going directly to LinkedIn to check for messages and updates.

Last month, DHL overtook Microsoft as the most frequently mimicked brand for phishing attacks, accounting for 23% of all phishing attempts. Microsoft accounted for only 20% of all attempts, down from 29% the previous quarter. LinkedIn came fifth in the rankings, accounting for 8% of all phishing attempts.

With social engineering set to plague 2022, understanding cyber criminals’ tactics, and the mistakes they make, might help us defend against their efforts. This is the first entry in a four-part series, published weekly, exploring how social engineers plan their attacks – from identifying targets to exploitation.

Human beings are hard-wired to trust, help, connect and impress. It's what makes us so valuable to your organisation. These traits, unfortunately, also make humans your fatal flaw.

Social engineering is the art of tricking people into doing something that's in your interests and not in your victims’, with a view to gathering information or achieving an action, such as letting you into their house. It's a criminal tactic as old as time, and a perfect fit for today's networked workplace.

Cyber criminals have utilised social engineering effectively through the years, turning the best employees into unwitting accomplices in security breaches. The consequence, warn experts, has been a surge in active threats to critical and sensitive systems.

Know thy enemy

"There's a tidal wave of it coming," former cyber criminal and We Fight Fraud founder, Tony Sales, tells IT Pro. "National infrastructure is at risk because of social engineering. I think the whole country is at risk without even realising it."

Figures bear out this alarming language, with Verizon finding 85% of data breaches involve attempts to prey on human weaknesses. Purplesec claims, meanwhile, 98% of attacks rely on some form of social engineering.

Tony Sales is a former fraudster and founder of We Fight Fraud

It's easy to see why cyber criminals find social engineering so effective; it takes much less effort and ingenuity to con an individual into giving you access to company computers than hacking through corporate code. The poor weaponised employee has no idea what's going on.

If you're to stand any chance of avoiding this threat, you must know your enemy and recognise their tactics. "Unless you teach your staff about the human element, you are going to become a victim," says Sales, whose 30-year criminal career included identity fraud and two stints in prison. "If you do train them, though, you'll force the attackers to look elsewhere, at your less secure competitors." You must try, therefore, to get inside a social engineer’s heads before they can get inside yours.

The attack plan

Social engineering is, by its nature, a stealthy, hard-to-spot, compromising tactic that plays a role in most multi-stage attacks that demand long-term infiltration and observation. Usually, the attacker will use a combination of steps to achieve their aims. These can be as simple as tricking someone into revealing their system password (not difficult, given how many of us still use our pets' names and football teams as passwords), or as sophisticated as securing a job with a particular organisation in order to infiltrate its global security networks. Edward Snowden, in a way, did both.

Long before an ambitious social engineer can get stuck into spoofing finance staff with AI deepfakes pretending to be the CFO, however, they must decide how their action fits into the attack plan. They must also determine which employee to target, how to gain their trust, and to what ends: To steal money? Seize data and intellectual property (IP), which can then be sold on the black market or used in further attacks? Or are they hoping to exploit a flaw and infiltrate the organisation's network, then set off a row of domino compromises in a supply-chain attack?

Edward Snowden was at the heart of a sensational whistleblowing scandal early last decade

"Sophisticated attackers have a very clear understanding of how they’ll profit from their activities, just like a successful business," says James Stanger, chief technology evangelist at IT education group CompTIA. "If they want to steal passwords, for instance, they'll decide exactly how they will monetise those passwords to increase their profit at the lowest possible risk."

Cover your tracks

The nature of social engineering helps threat actors stay hidden or disguised, right up to the final breach, and even after the wider effects are noticed. The technique's heavy reliance on research, however, risks leaving a large online footprint, so this has to be addressed in the attack plan.

"They'd probably use Tor and a VPN to be as obfuscated as possible," says Kevin Curran, senior IEEE member and professor of cyber security at Ulster University. "It takes incredible concentration to be successful, there's a lot of effort involved in staying under the radar."

To reduce the effort, the social engineer may hire accomplices with complementary skillsets. Sales, for example, teamed up with hacker Solomon Gilbert. "Sol was probably one of the best hackers on the planet," says Sales. "My criminal mind works out a plan, and Solomon attaches what he needs to it, and then you get the 'boom'. We were ten times deadlier together than we'd ever have been individually."

An experienced social engineer, though, will exploit human flaws from the word go, and hire accomplices who have no idea what they're getting into. This reduces any risk for the criminal by limiting the number of people with knowledge of the conspiracy. "You could probably end up being a translator for a criminal gang and not know it," SE Labs founder Simon Edwards tells IT Pro. "If I was going to convince you to do something for me, I would pretend to be Apple, so you'd believe you were working for Apple to help them edit their messaging – and you wouldn't know any different."

In the next part of our series, we reveal how a social engineer smokes out the weakest links in an organisation and turns these people into attack vectors.

With social engineering set to plague 2022, understanding cyber criminals’ tactics, and the mistakes they make, might help us defend against their efforts. The second in our four-part series, published weekly, navigates the infiltration process and how criminals prey on our greatest weaknesses.

Once a master plan is formulated, the social engineer must find a way into their targeted system. The primary route of entry, of course, is a human being.

An attacker only needs to fool one person within your organisation to gain access to your core networks and sensitive data. They'll start with a pool of candidates, before whittling down this list, perhaps after first making contact to establish a basis of trust and learn who's most amenable to the lie and willing to unwittingly help out.

Smoking out weak links

The TalkTalk breach of 2015 demonstrated how attackers use social engineering to find easy targets. First, the stolen data delivered a pool of targets with TalkTalk accounts alongside detailed contact information. Then, when cold-calling potential victims, the attackers only tried to scam those who believed the story.

Businesses aren’t above being scammed in the same way. Former fraudster and We Fight Fraud founder Tony Sales tells IT Pro: "Social engineering's just a buzzword for lying. Some people understand what the lies are and are able to defend against them, and some people don't. We're seeing this happen to brands; it happened to Spar, and it impacted everyone in their supply chain."

The social engineer might start by choosing a particular department whose employees have access to a network through which you want to spread remote-access malware, explains Freeform Dynamics analyst Tony Lock. "If you can attack someone on the help desk, maybe customer support, who then gets attacked and compromised, it'll then trickle up to the line manager and the group manager, and then it gets up to the top."

Finance, IT and reception staff are common targets, and have the added bonus of being accustomed to dealing with urgent demands from outsiders every day. Workers within these departments are, therefore, unlikely to be overly suspicious when a new "client" tries to get to know them. If the attacker has experience of a particular department, it’ll also give them a head start in gaining trust.

"I understand what HR does within a corporate organisation and what its processes are," says Sales. In addition, he adds, HR staff deal with job applications, any one of which could be loaded with a backdoor that's set to install as soon as the "application" is opened.

Probing for holes

Insecure workplace tech helps in any breach, of course, and any competent social engineer will take that into account when selecting their target. A new recruit who's struggling with Windows updates on a decade-old computer will be valuable prey, for example.

Not much ingenuity is required to find flaws in a company's network. Firstly, the attacker might make a friendly, fraudulent call or two to IT to ask for advice on "updating my Windows 11", thereby confirming what operating system is being used. After that, they'd simply look up previous Microsoft patches. "You'd find out what's been fixed in older versions of Windows, then see if the same components are in Windows 10 and 11," says Kevin Curran, senior IEEE member and professor of cybersecurity at Ulster University.

Other perfectly above-board tools that social engineers may use at this stage include Shodan, which finds compromised IoT devices, and the flaw-detecting framework Metasploit. "The attackers could do a bit of probing and find out a department is running Apache 2.34, which they know has this certain flaw," Curran adds. "Then they'd use Metasploit to target it on the victim's machine."

Gathering Intelligence

The attacker's next step is to collect information about the person they plan to exploit. This will be infinitely useful in softening them up, gaining trust, and then exploiting that trust with a pretext, such as a phishing email laced with a backdoor. The idea is to prepare the ground so the email or call isn't suspicious at all, and to gather all the intelligence needed to craft a convincing and irresistible message.

Ambitious attackers approach this stage "like a marketing professional studying their target audience," says James Stanger, chief technology evangelist at IT education group at CompTIA. They'll use AI tools, data analytics and online stalking to get intimate knowledge of that person, including their devices, work roles and behaviour patterns, right down to when they have lunch.

Our human instinct to share and connect makes this easy for social engineers, suggests Sales. "My friends see me constantly beating on about this stuff on social media, but they still click video links they shouldn't, and they still share information they shouldn't. We all want to connect with the world and have a little story with it."

Sales is far from laying blame for criminal espionage at the feet of victims who are just trying to do their jobs. After all, social engineers will glean personal information from their victims one way or another, Lock concludes. "Machine learning mechanisms can troll and accumulate a huge swathe of information from social media, then do some analysis on that before anyone even looks at it."

In the next part of our series, we find out how social engineers exploit the trust of your best employees to break into a network or even bring down a supply chain.

With social engineering set to plague 2022, understanding cyber criminals’ tactics, and the mistakes they make, might help us defend against their efforts. The third in our four-part series, published weekly, navigates the exploitation phase and how cyber criminals embark on betraying our trust.

Exploitation is at the heart of a social engineering attack. Using a carefully-chosen employee, and based on extensive research, the social engineer now takes advantage of their target’s human flaws and best professional intentions.

The most common way to do this is by sending a phishing email. Once the preserve of rookie hackers who couldn't spell 'Nigeria', phishing in today’s age is considered a sophisticated form of social engineering, designed to glean credentials or trick the target into downloading remote-access malware. Phishing instances rose nearly one-third (32%) during 2021, according to PhishLabs, while F-Secure reported that email is now the most common method used to spread malware.

Long and short phishing trips

If they're in a hurry, the social engineer could fire off an email immediately. "A pretty common technique would be for me to send you an email that appears to be from Microsoft," says Simon Edwards, founder of SE Labs. "There are a number of ways I could do that, and if it works, then job done."

A more sophisticated attacker might stage a number of social engineering steps. For instance, they could hijack an email account, research its owner, and then pose as that person when contacting the employee they want to exploit.

Numerous tools help social engineers craft their phishing bait. From software that makes emails appear to come from anywhere, to AI algorithms that work out which sender would be the most convincing, these tools can be acquired in custom bundles. "There's an entire ecosystem of tools for this," says Freeform Dynamics analyst Tony Lock. "On the dark web you can buy a pre-packaged bunch of components, right down to tools that let you process the Bitcoin you extract in a ransomware attack. It's a mix and match."

Hooking human flaws

Emotions such as eagerness to please – and fear of being found out – are gold dust for social engineers, because they motivate the target to take the bait. The attacker must, therefore, make sure their pretext presses emotional buttons.

In a recent sextortion scam, whose attempted targets included at least two of our work contacts, fraudsters conned victims out of their passwords by threatening to release a video captured-by-webcam of them watching porn. No such video existed, but the victims were so terrified that they gave out their passwords anyway.

Greed is a powerful phishing lure. Kevin Curran, senior IEEE member and professor of cybersecurity at Ulster University, discovered this during a white-hat hacking job for a law firm. Asked to catch a Twitter troll, Curran tried to lure the perpetrator with assorted social media traps, but the only thing that worked was a fake email from a fake café, saying "we've found this iPad, is it yours?". Lo and behold, the troll got in touch. "He fell for it; he gave me his address," says Curran. "His greed got to him in the end."

Unpatchable human flaws are even easier to exploit in the workplace. Greed, nosiness and fear are common ingredients of corporate life. "We want to keep our bosses happy, because our livelihood depends on it," says Edwards. "If you don't want to lose your job, it's quite hard to ignore that text that appears to come from the CEO, saying you've got to pay this invoice now, otherwise we're going to lose £100,000."

If the phish doesn't bite

A successful social engineer will have backup targets in case the first attempt doesn't work, such as a supplier with less sophisticated security measures. A bill, spreadsheet, or PDF from that supplier could forge a backdoor into the target system – from where it may then move on up through the supply chain.

Other methods the criminal might consider include business process compromise (BPC), for example, posing as cleaning staff, or 'pharming' (aka watering hole), whereby they lure users to a bogus website or Wi-Fi hotspot then harvest sensitive information, such as system passwords or banking transactions.

The tactic of leaving malware-laced USB sticks lying around may be old hat, but devices are still useful lures. Curran recalls a Canadian cybercrime police team who treated a suspect to a gift to help them gather intel. "Inevitably, they give him a really good phone," says Curran, "and, of course, this phone was already compromised with a backdoor."

There are also deepfakes to contend with. This may sound like the stuff of TikTok, but Curran adds deepfake audio is "one of the biggest things we've seen in phishing over the last year". He recalls the case of a secretary transferring money to a criminal's account after a deepfake phone call that used her CEO's sampled voice. "She heard what she thought was her boss, so she did it without hesitation." Deepfakes are such a real and present danger that banks are now developing biometric authentication systems aimed at beating them. It’s simply the latest evolution in this long-running saga as the cyber security industry attempts to keep on top of the innovation in the social engineering space.

In the final part of our series, we reveal how an ambitious social engineer continues to manipulate their victim for months or years before – and after – the big attack.

With social engineering set to plague 2022, understanding cyber criminals’ tactics, and the mistakes they make, might help us defend against their efforts. The final entry in our four-part series reveals how to avoid devastating consequences when a social engineer pulls the trigger.

Once an attacker has tricked an employee into compromising a corporate network, you might be forgiven for thinking the social engineering exercise is over. This process can, however, carry on for years without the target organisation, or even those within its global supply chain, ever knowing.

SolarWinds was a cleverly identified target. Once attackers had established a backdoor into SolarWinds' code, they moved automatically into the networks of clients, including Microsoft, when they updated their software. The malware roamed through US computer networks for at least nine months undetected.

It's difficult to predict how regularly this happens in other supply chains. Once a social engineer has installed a backdoor, they can then come and go; studying transactions, monitoring communications, gathering information about customers and clients, and even collecting audio samples to use in a deepfake attack. All this activity allows the cycle of infiltration and manipulation to continue undetected.

Look and learn

Even in relatively simple attacks, the social engineer will bide their time between the initial compromise and making off with data or money. Kevin Curran, senior IEEE member and professor of cyber security at Ulster University, points to a cash theft from a law firm. First, an employee was tricked into downloading malware to the company's Microsoft Exchange network. The attacker then spent weeks patiently studying the servers, before finally using what they learned to craft a second fake message, this time to steal a mortgage deposit.

Once hackers established a backdoor into SolarWinds, they remained undetected for months

"They were hiding in plain sight," says Curran. "From reading emails, they knew when a deposit transfer would be legitimate and what it would look like. The client knew they'd have to send £40,000, so they were expecting it. And, of course, they sent the money off to the wrong account. A few days later, they rang up the law firm and said: “Did you get the deposit?” They hadn't; the money was completely gone."

Sophisticated malware is able to delete itself and its audit trails once the attack is done, but most malware stays on the system and is never found, says Curran. "Your average IT administrator would find it really hard to detect a backdoor. We have intrusion detection and prevention systems, we have SIEMs (real-time monitoring) software that looks for outliers and nefarious activity as such, but it's generally impossible. There's literally millions of packets of data flowing through a corporate network every second. How do you control and monitor every single subsystem?"

Carry on conning

Most social engineering attacks end with the theft of data. The attacker also has to monetise the stolen data, for instance by using it to scam the company's customers, or in the next stage of a supply-chain attack. Often, though, they'll sell it to third parties and then fence their ill-gotten goods. This helps to lower the risk while maximising profit in the shortest possible time.

Ransomware is a particularly efficient way to monetise a social engineering attack. With 84% of US organisations reporting phishing or ransomware incidents in July last year, according to Trend Micro, it seems attackers frequently use both tactics. Indeed, ransomware management requires good human manipulation skills. A carefully-crafted ransomware demand can tie the victim into a long-term hostage arrangement that keeps on paying.

"A lot of companies pay the ransom secretly, because they don't want to damage their brands," former fraudster and We Fight Fraud founder Tony Sales tells IT Pro. "That's dangerous, because now you're in an agreement with a criminal who owns you forever. It's like criminals getting an officer under their wing in prison."

Tony Sales is a former fraudster and founder of We Fight Fraud

What's the answer? Security software can't stop human manipulation, but it can block the technical exploit, so antivirus remains vital. Email security solutions can keep malicious messages at bay, but they need to be configured carefully. Two-factor authentication (2FA), disabling remote access to unnecessary servers, and bringing in audio passwords to defeat deepfakes will all help.

Tech solutions are only effective if staff are able to use them, however, cautions Sales, whose organisation trains companies and employees to spot attackers' tricks. "The tech guys understand all that stuff, but not poor old Bob or Sheila who gets caught out on the company email they've been using forever,” he says. “Security is convoluted and complex, and that's part of the problem.”

Perhaps the answer is to fight social engineering with social engineering. Don't blame employees for falling for phishing tricks, or exclude them from security decisions. Instead, get them involved. One "highly effective" option is to encourage staff to report suspected phishing attempts, finds a 2021 F-Secure report. A full one-third (33%) of emails reported by staff as suspicious were, indeed, malicious.

Harnessing your employees’ eagerness to excel at their jobs, and their desire to be involved in decisions, before a criminal has the chance to exploit those very qualities, is among the most viable routes to overcoming a social engineer in action.

Organizations in the education sector and local and state government are most at risk from email threats, according to a new report.

The report, published by IT security firm Cyren, also found that phishing remains the dominant form of attack against all industries.

Based on data gathered from nearly 45,000 incidents, researchers found that the education sector received over five threats per thousand emails received. State and local government bodies received just over two threats per thousand emails received, nearly double the amount received by the next most targeted industry, software.

The report also looked at the number of attacks per 100 users across a wide range of industries. It found that there were nearly 400 per 100 users in education compared to just over 150 in the construction industry.

Researchers said there was a surprisingly low rate for manufacturing, especially when compared to the construction industry, which is closely related.

“We observed 20 confirmed threats per 100 users in the manufacturing vertical. Without solid detection and automated incident response, a manufacturer with 100 Office 365 users would spend at least 16 hours manually investigating and remediating emails,” they added.

In a blog post, security researchers found that the data supported a widely held theory that phishing is a precursor to more damaging attacks such as business email compromise (BEC) and ransomware.

The report looked at phishing compared with malware and BEC attacks across four industries. Phishing remained the dominant threat in healthcare (76%), finance and insurance (76%), manufacturing (85%), and real estate (93%).

In healthcare, BEC attacks made up the remaining 24%. Researchers said that robust malware detection capabilities in the healthcare industry explains the high rate of BEC attempts.

“Attackers understand that they can’t easily slip malware past automated defenses, so they have shifted to social engineering tactics,” said researchers.

Researchers said that when it comes to solving the email threat problem, user education is an important component, but several organizations have “over-rotated” on the idea that users are responsible for keeping sophisticated email threats at bay.

“The predominant trend is to use an email hygiene technology such as Microsoft Defender for Office 365 to catch 80% of threats, deploy a specialized add-on to catch and contain zero-day phishing and most BEC attempts, enable employees to perform initial analysis on the small percentage of emails that are classified as suspicious (rather than malicious or clean), and automate incident response workflows to save time and reduce exposure,” added researchers.

Robinhood has revealed that an unauthorised third party has gained access to millions of customers’ data, adding to the company’s troublesome 2021.

The stock-trading platform said in a blog post that on 3 November a hacker socially engineered a customer support employee by phone and obtained access to certain customer support systems. The company said the unauthorised party obtained a list of email addresses for approximately five million people, and full names for a different group of two million people.

Robinhood added that for around 310 people, personal information like name, date of birth, and zip code were exposed, with a subset of around 10 customers having more extensive account details revealed, although it did not disclose what these details were.

Following the breach, the unauthorised party demanded an extortion payment, said the company, which informed law enforcement and is continuing to investigate the incident with the help of an outside security firm.

Robinhood is also in the process of making disclosures to those affected but believes that no social security numbers, bank account numbers, or debit card numbers were exposed. There has been no financial loss to any customers as a result of the incident.

“As a Safety First company, we owe it to our customers to be transparent and act with integrity,” said Robinhood chief security officer Caleb Sima. “Following a diligent review, putting the entire Robinhood community on notice of this incident now is the right thing to do.”

2021 has been a tricky year for Robinhood, which was summoned to a Congressional hearing in February after the company’s app facilitated a January GameStop squeeze. It was instigated by the subreddit r/WallStreetBets and the platform decided to halt trade on popular stocks, as reported by The Verge.

In July, the company had the worst debut ever for an IPO of its size, according to Bloomberg. Shares in the broker fell 8.4% below the IPO price in the company’s first trading session, the worst debut among 51 US firms that raised as much cash as Robinhood or more.

Ransomware operators are spreading BazaCall malware by tricking people into phoning fraudulent call centres and speaking with real humans, who provide step-by-step instructions on how to download a payload.

Attacks from BazaCall operators can move rapidly within a network, with hackers able to conduct extensive data exfiltration and credential theft, Microsoft has warned. They can even distribute ransomware within 48 hours of the initial compromise.

Apart from having backdoor capabilities, the BazaLoader payload also gives a remote attacker hands-on keyboard control for an affected user’s device.

“Our continued investigation into BazaCall campaigns, those that use fraudulent call [centres] that trick unsuspecting users into downloading the BazaLoader malware, shows that this threat is more dangerous than what’s been discussed publicly in other security blogs and covered by the media,” said the Microsoft 365 Defender Threat Intelligence Team.

“BazaCall campaigns forgo malicious links or attachments in email messages in [favour] of phone numbers that recipients are misled into calling. It’s a technique reminiscent of vishing and tech support scams where potential victims are being cold-called by the attacker, except in BazaCall’s case, targeted users must dial the number.”

When users are tricked into calling the number, they’re connected with actual humans on the other end of the line, who provide detailed guidance for installing malware on their devices.

The campaign relies on direct phone communication, as well as sophisticated social engineering tactics to succeed, but the tactic is proving difficult to prevent given the lack of obvious malicious techniques.

It starts with an email that uses various social engineering lures to trick victims into calling a number. This might include informing users about a trial that’s about to expire and that their card is set to be charged, asking them to phone the number provided in case they have any concerns. There are no attachments, links, or any other type of malicious call to action that would be spotted by a security filter.

Each message is sent from a different sender, normally through a free email service and compromised email addresses, with lures including fake business names that are similar to real companies.

Victims who do call the number will speak to a real person from a fraudulent call centre, whose aim is to direct the caller to visit a malicious website, disguised as a legitimate one. They’re asked to navigate to a page and download a file to cancel their subscription.

These files are macro-enabled Excel documents, which might be flagged by Microsoft Defender SmartScreen, although Microsoft has observed users bypassing these warnings to download the files anyway, likely at the instruction of the hacker. Users are then prompted to enable editing, and enable macros, which triggers the BazaLoader malware to be delivered.

“The BazaCall campaign replaces links and attachments with phone numbers in the emails it sends out, posing challenges in detection, especially by traditional antispam and anti-phishing solutions that check for those malicious indicators,” the research team added.

“The lack of typical malicious elements in BazaCall’s emails and the speed with which their operators can conduct an attack exemplify the increasingly complex and evasive threats that [organisations] face today.”

Security researchers have uncovered a new campaign targeting US taxpayers with malware-laced Microsoft Word documents that purport to contain tax-related content.

The scam ultimately aims to install NetWire and Remcos, two powerful remote access trojans (RATs) that enable attackers to take control of the victims' machines in order to steal sensitive information.

The scam could result in steep financial losses for taxpayers. Last year alone, the IRS identified more than $2.3 billion in tax fraud schemes.

According to a blog post by researchers at Cybereason, the new infection process is designed to evade antivirus tools and tricks targets into installing the malware via a tax-themed Word document containing a malicious macro that downloads an OpenVPN client on the targeted machine.

The malware dropper establishes a connection to the legitimate cloud service “Imgur” and downloads the NetWire or Remcos payloads by way of a technique called steganography, where the malicious code is hidden within an innocuous-looking jpeg image file.

Researchers said that the malware includes a variety of functions including the remote execution of shell commands on the infected machine, browser credential and history theft, the downloading and execution of additional malware payloads, screen captures and keylogging, as well as file and system management capabilities.

Assaf Dahan, senior director and head of threat research at Cybereason, said that social engineering via phishing emails continues to be the preferred infection method among both cyber criminals and nation-state threat actors.

“The potential for damage is serious and the malware allows threat actors to gain full control over a victim’s machine and steal sensitive information from users or their employers. In this research, we demonstrate how the attackers are leveraging the US tax season to infect targets at will,” he said

“The use of various techniques such as steganography, storing payloads on legitimate cloud-based services, and exploiting DLL sideloading against a legitimate software makes these campaigns very difficult to detect. The sensitive information collected from the victims can be sold in the underground communities and used to carry out all manner of identity theft and financial fraud,” said Dahan.

Paul Bischoff, privacy advocate at Comparitech, told IT Pro that this attack is particularly clever because it gets its payload from an image stored on a popular and trusted site, Imgur, instead of trying to download from the hacker's server.

“The attack is easy to prevent with good digital hygiene. Never click on links or attachments in unsolicited emails. Always verify the sender before clicking a link or attachment. Be especially skeptical of MS Office documents and be sure that macros are disabled by default on your MS Office apps,” he said.

Microsoft ended 2020 as the brand most frequently targeted by cyber criminals, with 43% of all brand phishing attempts related to the tech giant in Q4.

This was a 24% increase from the third quarter of the year, which saw 19% of all attempts linked to the tech giant, according to Check Point research.

The attempts are from criminals looking to steal personal information or payment credentials by impersonating well-known brands that are likely to be used by the employee and their organisation.

The technology industry was the most likely to be targeted by 'brand phishing', according to Check Point, closely followed by retail and shipping. Across October, November and, December, Microsoft was the brand most often imitated by hackers.

"Criminals increased their attempts in Q4 2020 to steal peoples personal data by impersonating leading brands, and our data clearly shows how they change their phishing tactics to increase their chances of success," said Maya Horowitz, director, threat intelligence and research, products at Check Point.

"As always, we encourage users to be cautious when divulging personal data and credentials to business applications, and to think twice before opening email attachments or links, especially emails that claim to from companies, such as Microsoft or Google, that are most likely to be impersonated."

Shipping firm DHL was the second most-spoofed brand for the end of 2020, as criminals sought to take advantage of the significantly higher number of shoppers placing their orders online. Many of these attacks involved delivery failure notices, asking the target to pay a nominal fee to arrange a new delivery.

Google actually came 7th on the list with only 2% of all brand-related phishing in its name. Amazon ended the year in fourth with 5% while LinkedIn, a Microsoft-owned platform, was third with 6%.

IT Pro has approached Microsoft as the findings will be of huge concern to the tech giant, especially as phishing attempts in its name have doubled over a sixth month period.

The internet has been one of the most revolutionary technologies of our age, and most agree that the transformation it’s brought to our society has been beneficial. Social media – one of the more recent arrivals on the scene – has also generally been a good thing, allowing us to connect with friends and family across the world, find people who have similar interests to us, and rapidly share jokes, memes and information.

This latter element, however, has slowly turned from a benefit into a problem. Disinformation and what might be termed “fake news” is seeping in everywhere, making it difficult to know what and who to believe.

In this week’s episode of the IT Pro Podcast, we speak to Andy Patel, a researcher with cyber security firm F-Secure, about what disinformation is, how it spreads and the negative effects it could have on businesses.

Footnotes

• QAnon: What is it and where did it come from?
• FBI warns of hackers spoofing its domain
• Dems ask Facebook, Google and Twitter for coronavirus disinformation reports
• WhatsApp restricts message forwarding to curb spread of 5G myths
• What is phishing?
• IT Pro Live: Fighting terrorism with technology
• Fake news 'is killing our minds', says Tim Cook
• Trend Micro's free web-based tool takes on hackers and fake news
• WhatsApp counters fake viral messages with new fact-check tool
• Satirical websites target Mark Zuckerberg with fake news
• Trump confirms US cyber attack on Russia election trolls
• What is hacktivism?
• The IT Pro Podcast: What COVID-19 can teach us about open data
• Biden team signals president-elect may target Section 230 and data privacy
• Dems ask Facebook, Google and Twitter for coronavirus disinformation reports
• Google turns its hand to fighting election abuse
• Facebook facing scrutiny amid claims it encourages spread of misinformation
• The IT Pro Podcast: The truth about 5G

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

More than half of businesses across the UK, Germany, France, Spain, and Italy have seen a rise in fraud levels this year, according to new research commissioned by identity management provider GBG.

Some of the most frequent attacks were credit and debit card fraud (56% of respondents), followed by phishing (46%), and e-transfer fraud (37%).

However, respondents said that they are currently least prepared to defend themselves from synthetic identity fraud (26%), IP piracy (26%), and social engineering attempts (25%).

What's more, one in three consumers said they had become more worried about becoming a victim of fraud as a result of the COVID-19 pandemic. Unfortunately, their fears may be justified; according to GBG, fraud has become a prevalent issue in 2020, with one in five consumers affected by identity fraud only this year.

The rise in incidents can be attributed to the digital acceleration powered by government-imposed lockdown restrictions and social distancing. This year saw many consumers open online accounts, with the most popular being shopping (47%), social media (35%), and online banking (31%), using mobile numbers (50%), email addresses (48%), and biometric data (28%) to log in.

GM of Identity Fraud, Europe at GBG, Gus Tomlinson, said that the research “shows that not only is identity fraud already prolific, the ‘trust gap’ it creates poses a risk to industries which will depend on digital trust if they are to thrive in 2021 and beyond”.

“For some businesses and even entire sectors, we are nearing a tipping point: get this balance wrong, and lose trust – and therefore customers – for good.”

GBG also warned that each individual identity fraud attempt could cost an organisation between £1,000 and £4,999 on average.

At the height of the pandemic in April, it was reported that about £2 million was lost to coronavirus-related fraud in the UK, with the NCSC warning that “an increasing number of malicious cyber actors are exploiting the current COVID-19 pandemic for their own objectives".

"In the UK, the NCSC has detected more UK government branded scams relating to COVID-19 than any other subject," the report added.

Twitter is investigating whether hackers gained access to the direct messages belonging to accounts of dozens of high-profile individuals following Wednesday’s hack.

The company has confirmed that approximately 130 accounts were targeted by attackers during the incident, including a handful of instances where hackers were able to send tweets.

Despite being able to access accounts to the degree where sending tweets was possible, Twitter said there’s currently no evidence that attackers accessed user passwords, so resetting these is not considered a necessary measure at this stage.

Although Twitter described the infiltration as a “social engineering attack”, the company is also investigating the possibility that an employee was bribed, according to the New York Times.

The company also hasn’t ruled out whether private data like direct messages had been accessed, although the extent to which the hackers gained access to a handful of the 130 compromised accounts suggests this is entirely possible.

“We’re working with impacted account owners and will continue to do so over the next several days,” Twitter said. “We are continuing to assess whether non-public data related to these accounts was compromised, and will provide updates if we determine that occurred.”

The option to download data from your Twitter account has been switched off during the ongoing investigation. The company also said it is taking “aggressive steps” to secure its systems.

This story has been updated to reflect new information. The original story is published below

Hackers targeted Twitter employees with access to company tools and internal systems in a “co-ordinated social engineering attack” to seize control of high profile accounts and launch a Bitcoin scam.

Several major account holders began posting suspicious messages last night on a co-ordinated basis, including Elon Musk, Bill Gates, Barack Obama, and Jeff Bezos, which between them have hundreds of millions of followers.

These messages described a scheme whereby all Bitcoin donated to a particular wallet, the same in each fraudulent tweet, would be sent back doubled, in light of that individual deciding to “give back”.

Having tracked the Bitcoin wallet, the hackers have, at the time of writing managed to solicit 376 fraudulent donations to the tune of 12.87 Bitcoin, equivalent to approximately £93,000.

Twitter confirmed at 10:45PM BST that it was aware of a security incident, and would investigate this urgently. The company subsequently placed heavy restrictions on many account holders, especially those who are verified, preventing them from tweeting or resetting their passwords, alongside “some other account functionalities”.

Those accounts that were compromised, having posted the fraudulent message, were also temporarily blocked entirely. These restrictions have been gradually lifted, with a handful of users only regaining the capacity to tweet as normal this morning.

Twitter soon confirmed in the early hours of the morning it had detected what it believed to be a coordinated social engineering attack by people who successfully targeted some of its employees with access to internal systems and tools.

“We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf,” the company said. “We’re looking into what other malicious activity they may have conducted or information they may have accessed and will share more here as we have it.

“We also limited functionality for a much larger group of accounts, like all verified accounts (even those with no evidence of being compromised), while we continue to fully investigate this. This was disruptive, but it was an important step to reduce risk. Most functionality has been restored but we may take further actions and will update you if we do.”

The company has confirmed it’s taken “significant steps” to limit access to internal systems and tools during its investigation, although these haven’t been outlined in any great detail.

It also appears employees targeted in the social engineering attack had direct access to users' accounts. For example, fraudulent Bitcoin tweets were often 'pinned', which could normally only be performed by logging into accounts.

Alarmingly, some of those involved in the hack told Motherboard they actually paid a Twitter employee to grant them access to their own account, with the accounts taken over using an internal Twitter tool. Some users have posted screenshots of the tool in question, and have been circulating these images online.

The incident is certainly one of the company’s biggest security breaches in history and follows a string of smaller-scale hacks over the previous few months and years.

Only last month Twitter alerted business customers after flagging a data breach, suggesting their personal details may have been compromised due to an issue with the way Twitter cached data on web browsers. The information of those who were signed up to the company’s advertising or analytics platform may have been accessed by third-parties as a result of the glitch.

This follows an incident in August 2019 in which Twitter found an issue with its privacy settings, meaning musers may have inadvertently been sharing data with third-parties. This, however, was more of a privacy violation than an out-and-out security breach.

The largest breach to date, barring this week’s incident, however, arose in 2018 after a bug allowed company staff to view account passwords in an unencrypted form. The company asked 330 million users, as a result, to change their passwords urgently for fear of their accounts being compromised.