#Social Engineering
All CosmicBytez Labs articles tagged #Social Engineering, across news, security advisories, how-to guides, and projects.
- News
F-Secure Launches Victim-First Scam Encyclopedia Covering 50+ Types of Consumer Fraud
F-Secure's Threat Intelligence team catalogued 50+ consumer scam types from the victim's perspective as losses double and 52% of victims now lose money.
- News
ASOS Links Data Breach to Social Engineering Attack, Credential Theft
ASOS confirms a stolen employee login — obtained via social engineering — not a Snowflake hack, was the root cause of its October breach.
- News
Fake ChatGPT, Gemini, and Claude Sites Steal Advertising Accounts and MFA Codes
A browser-in-the-browser phishing campaign impersonates AI tools to hijack ad account managers' logins and real-time MFA codes.
- News
250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms
Clover Health Investments and AngMar Management Services separately disclosed breaches exposing PII and PHI for over 250,000 people combined.
- News
Microsoft's X Account Hacked in Crypto Pump-and-Dump Scheme
Hackers hijacked Microsoft's 13M-follower X account on Oct. 1 to push a fake $Clippy token tied to $MSFT before Microsoft regained control.
- News
Astrana latest healthcare tech firm to report data breach to SEC
Astrana Health disclosed a material SEC breach after vishing attackers impersonating staff accessed servers, part of a 2026 healthcare breach wave.
- News
Astrana Health Data Breach Exposes Private, Confidential Information
Astrana Health told the SEC that hackers impersonating staff and spoofing its phone line accessed servers holding patient, provider, and business data.
- News
North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide
A joint law enforcement advisory says DPRK-linked WaterPlum hackers compromised 30,000 devices and stole $10.7M in crypto via fake job interviews.
- News
Early Scattered Spider Member Pleads Guilty to Cybercrime Spree
Ahmed Elbadawy pleaded guilty to wire fraud conspiracy and identity theft tied to Scattered Spider; prosecutors now seek $17.6M in forfeiture.
- News
Revolut Breach Ran 5 Months, Hit 680 High-Profile Accounts, Now Draws $3M Ransom Demand
New details show the Revolut breach ran 5 months via a spoofed Italian ministry email, hit 680 crypto-whale accounts, and drew a $3M ransom demand.
- News
Hackers Hijack HBO Max Reddit Account to Push ClickFix Malware Ads
Attackers took over HBO Max's verified Reddit account, running 108 malicious ads over 48 hours that used ClickFix lures to infect Windows...
- News
Revolut Discloses Data Breach Exposing Financial Info, Passports
A threat actor impersonating a government agency tricked Revolut into handing over passports, selfies, and full transaction histories.
- News
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface
Huntress details how attackers weaponize Claude Artifacts, shared AI chat links, and ClickFix lures to spread infostealers.
- News
AdaptHealth Confirms 4.1 Million People Exposed in ShinyHunters-Linked Breach
A contractor phishing attack gave attackers cloud access at AdaptHealth, exposing patient records for 4.1 million people in a ShinyHunters intrusion.
- News
Scammer Behind $245 Million Crypto Heist Pleads Guilty to RICO Charges
Malone Lam, ringleader of a social-engineering crypto theft ring, pleaded guilty to racketeering conspiracy over a $245M Bitcoin heist.
- News
Phishing Campaign Used Invisible Unicode Tag Characters to Slip Past Filters
Microsoft found a high-volume phishing operation hiding invisible Unicode tag characters inside words like 'funding' to dodge keyword-matching filters.
- News
Stronger Security Drives Ransomware Groups to Recruit From Within
As MFA and EDR harden perimeters, ransomware crews are increasingly recruiting employees and contractors as inside men to bypass defenses entirely.
- News
TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor
A new ClickFix variant, TerminalFix, tricks victims into running PowerShell via fake Cloudflare CAPTCHAs to install a stealthy reverse-tunnel implant.
- News
Hackers Abuse npm Mirrors to Host Phishing Redirect Pages
Threat actors are planting malicious HTML packages on npm and its mirrors that impersonate Cloudflare CAPTCHAs, silently redirecting victims to attacker sites.
- News
ReliaQuest Confirms Failed Data-Theft Attack After ShinyHunters Employee Impersonation
ReliaQuest disclosed a social engineering attack where ShinyHunters impersonated an employee to steal data — the attempt was detected and blocked.
- News
Apollo Discloses Data Breach from Ongoing Wave of Attacks Hitting Financial Sector
Apollo Global Management confirms a July 2026 breach via IT helpdesk social engineering, exposing PII including SSNs in a coordinated wave targeting PE firms.
- News
FBI: Hackers Using Social Engineering to Breach Accounts and Steal Explicit Content
The FBI warns hackers are breaching social media accounts to steal explicit content via credential stuffing, impersonation, and fake clone sites.
- News
AI Sends Global Crime Syndicates Into Fraud Nirvana
Organized crime groups worldwide have fully embraced AI as a force multiplier for fraud, enabling operations at a scale and sophistication that INTERPOL...
- News
Vishing Extortion Group UNC6671 Rebrands After Making Millions
Vishing extortion group UNC6671 (formerly BlackFile) rebrands into Redact, Pink, Helix, and Falcon after earning millions from enterprise voice phishing.
- News
COLDCARD Security Audit Phishing Attack Installs Remote Access Tool
Attackers impersonating COLDCARD hardware wallet makers are sending fake 'security audit' emails to exploit user anxiety over the RNG vulnerability....
- News
Microsoft Teams Vishing Attacks Lead to Chaos Ransomware Deployment
Threat actors are impersonating IT support staff in Microsoft Teams voice calls to gain remote access to corporate devices and deploy Chaos ransomware...
- News
ShinyHunters Data Leaks Fuel $2,000 Sextortion Email Scam
Threat actors are leveraging email addresses exposed in ShinyHunters data breaches to send highly personalized sextortion emails demanding $2,000 in...
- News
Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers
Threat actors are hijacking Steam discussion threads to pose as helpful community members, tricking frustrated gamers into running malicious PowerShell...
- News
UAC-0145 Uses ClickFix CAPTCHAs to Deliver Malware to Ukrainian Devices
Russian state-sponsored threat actor UAC-0145 is deploying ClickFix-style fake CAPTCHA prompts to trick Ukrainian targets into self-installing...
- News
Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court for their roles in the 2024 cyberattack on...
- News
INTERPOL Arrests 5,800 Suspects in Operation First Light 2026 Global Fraud Bust
A 3.5-month INTERPOL-led operation spanning 97 countries resulted in 5,811 arrests, $293 million seized, and 142,000 victims identified — targeting...
- Project
Gophish Phishing Simulation Lab: Security Awareness Testing in Docker
Deploy a self-hosted phishing simulation platform using Gophish in Docker. Build real-world phishing campaigns, track user engagement, and run security...
- News
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS
Phishing kits now fingerprint victims via user-agent headers to deliver OS-specific payloads automatically — device code phishing attacks spiked 1,380% in...
- News
Teen Suspect in Scattered Spider Hacks Is Extradited to US
Peter Stokes, 19, has been extradited from Finland to face federal charges tied to Scattered Spider's hundred-million-dollar cybercrime spree — the latest...
- News
Ransomware Thugs Masquerade as Interpol to Entice Small Biz
A ransomware campaign is impersonating Interpol to pressure small and medium-sized businesses into paying extortion demands, using law enforcement...
- News
Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Ukraine's SSU and the FBI have exposed a sustained Russian intelligence campaign using fake support SMS messages to steal Signal, WhatsApp, and Telegram...
- News
Ukraine and FBI Expose Russian Intelligence Campaign Stealing Signal Credentials via Fake SMS
The SSU and FBI jointly disclosed a sustained Russian intelligence operation targeting messaging credentials of government officials, military personnel,...
- News
Russia Used Social Engineering to Breach Prominent Messaging Accounts, Ukraine Says
Ukraine's SBU and the FBI have jointly exposed a long-running Russian intelligence operation using fake tech-support workers to steal messaging app...
- News
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool
Attackers are abusing compromised WhatsApp accounts to distribute malicious VBScript files disguised as financial documents, ultimately deploying a...
- News
WhatsApp Phishing Attack Uses Fake Business Docs to Hack PCs
An active malware campaign is targeting WhatsApp users across multiple countries with deceptive messages pushing VBScript-based droppers disguised as...
- News
FTC Warns of Record $3.5 Billion in Losses to Imposter Scams in 2025
The U.S. Federal Trade Commission warned that Americans lost $3.5 billion to imposter scams in 2025 — nearly tripling since 2020 — as AI-powered voice...
- News
Sniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts
Cybersecurity researchers have uncovered a large-scale phishing campaign by the Sniper Dz threat group targeting Middle East and North Africa users...
- News
Hackers Used Meta's AI Support Bot to Seize Instagram Accounts
Iran-linked hackers exploited Meta's AI support assistant to reset account credentials, briefly defacing the Instagram accounts of the Obama White House and…
- News
ChatGPT Share Links Abused to Host Fake Outage Pages Delivering Malware
Threat actors are exploiting ChatGPT's content-sharing feature to publish fake OpenAI outage pages that trick users into downloading trojanized ChatGPT…
- News
Ransomware Actors Show Up In Person to Steal Law Firm Data
FBI warns the Silent Ransom Group is targeting law firms by physically arriving on-site and social-engineering access to sensitive client databases.
- News
Verizon DBIR 2026: Healthcare Fends Off Rising Social
The 2026 Verizon Data Breach Investigations Report highlights how evolving social engineering tactics are making the healthcare sector more vulnerable,...
- News
KongTuke Hackers Now Use Microsoft Teams for Corporate
Initial access broker KongTuke has pivoted to Microsoft Teams for social engineering attacks, gaining persistent access to corporate networks in as little...
- News
Weaponized AI: The New Frontier of Fraud and Identity
Fake identity fraud powered by generative AI is projected to cause $40 billion in losses annually. Security leaders are warned that static defenses are no...
- News
Deepfake Voice Attacks Are Outpacing Defenses: What
AI-powered voice cloning requires just three seconds of audio to convincingly impersonate executives and employees. Adaptive Security's new research...
- News
FTC: Americans Lost Over $2.1 Billion to Social Media Scams
The U.S. Federal Trade Commission has released data showing staggering losses from social media fraud in 2025, representing a dramatic increase from...
- News
Threat Actor Uses Microsoft Teams to Deploy New 'Snow'
UNC6692 employs email bombing and Teams impersonation to deliver a three-component Snow malware suite — SnowBelt, SnowGlaze, and SnowBasin — enabling full...
- HOWTO
Phishing Trends Hitting Western Canadian SMBs in 2026
Five phishing patterns we're seeing specifically targeting small businesses across Alberta, Saskatchewan, and BC in 2026 — including invoice fraud…
- News
Apple Account Change Alerts Abused to Send Phishing Emails
Threat actors are exploiting Apple's legitimate account change notification system to embed fake iPhone purchase scams inside genuine Apple emails,...
- News
'It Reads Like a Spy Novel': $280M Drift Theft Linked to North Korean Fake Companies
A post-mortem of the $280 million Drift Protocol crypto theft reveals a sophisticated six-month North Korean social engineering operation involving fake...
- News
Cybercriminals Target Accountants to Drain Russian Firms'
Cybercriminals are stealing millions from Russian companies by compromising accountants' computers and disguising fraudulent transfers as routine salary...
- News
Drift $280M Crypto Theft Linked to 6-Month In-Person DPRK
Drift Protocol has revealed that the $280 million hack it suffered was the culmination of a six-month long operation in which North Korean-linked threat...
- News
$285 Million Drift Hack Traced to Six-Month DPRK Social
Drift has confirmed the April 1, 2026, theft of $285 million resulted from a meticulously planned six-month North Korean social engineering operation that...
- News
Traffic Violation Scams Switch to QR Codes in New Phishing
Scammers are sending fake "Notice of Default" traffic violation SMS messages impersonating state courts across the U.S., pressuring recipients to scan a...
- News
Axios npm Hack Used Fake Teams Error Fix to Hijack
The Axios HTTP client post-mortem reveals North Korean threat actors used a ClickFix-style fake Microsoft Teams error message to socially engineer a...
- News
UNC1069 Social Engineering of Axios Maintainer Led to npm
The North Korean threat actor UNC1069 used a sophisticated, targeted social engineering campaign against the Axios npm package maintainer Jason Saayman to...
- HOWTO
How to Detect and Block ClickFix Attacks
Learn how to detect and prevent ClickFix social engineering attacks using EDR rules, network monitoring, YARA signatures, and endpoint hardening. Covers...
- News
Fintech Giant Figure Technology Confirms Breach: Nearly 1
Blockchain-based lending platform Figure Technology Solutions confirms a data breach affecting nearly 1 million customers after ShinyHunters exploited an...
- News
Hacker Accesses 1.2 Million French Bank Accounts via FICOBA Database
The French Economy Ministry confirmed that a hacker stole credentials from a government official and accessed France's FICOBA centralized bank account...
- News
Scattered Lapsus$ ShinyHunters Alliance Hits 100+
The SLSH alliance combining Scattered Spider, Lapsus$, and ShinyHunters has attacked over 100 organizations since the start of 2026, breaching 60 million...
- News
ClickFix Attacks Evolve to Abuse DNS nslookup for Payload Delivery
Microsoft discloses a new ClickFix variant that uses DNS nslookup commands to retrieve and execute malicious PowerShell payloads, marking the first known...
- News
Claude AI Artifacts Abused to Distribute macOS Infostealer
Threat actors are abusing publicly shared Claude AI artifacts and Google Ads to deliver the MacSync infostealer to macOS users through ClickFix social...
- News
Malicious Chrome Extension 'CL Suite' Steals Meta Business
Security researchers have uncovered a malicious Chrome extension called CL Suite that steals TOTP 2FA seeds, Meta Business Manager data, and analytics,...
- News
ClickFix Campaign Targets European Hotels with Fake
A sophisticated phishing campaign dubbed PHALT#BLYX is targeting European hospitality organizations with fake Booking.com cancellation emails that display...
- News
North Korea Deploys AI-Generated Video and ClickFix
North Korean threat actors are running sophisticated campaigns using AI-generated deepfake videos and the ClickFix social engineering technique to target...
- News
FBI Warns of AI-Generated Deepfake Phishing Targeting
The FBI and CISA issue joint advisory on sophisticated AI-generated deepfake voice and video attacks targeting C-suite executives in financial...
- News
North Korean Hackers Use Fake Zoom Meeting to Target Crypto
UNC1069, a North Korean APT group, deployed a sophisticated ClickFix scam using a fake Zoom meeting to target a cryptocurrency executive in a social...
- News
AI-Powered Phishing Achieves 54% Click-Through Rate
Microsoft reveals adversaries using AI for automated vulnerability discovery, phishing campaigns, and malware generation. AI-crafted phishing emails...