grep -rl "social-engineering" ./articles
Microsoft says extortion groups tied to ShinyHunters and Helix are phoning staff about urgent passkey or single sign-on updates, then steering them into relayed sign-ins or device-code approvals. Once in, they register an MFA method of their own, map the tenant through Microsoft Graph and take files at under 1,000 an hour to stay unremarkable.
Kaspersky documented Nimbus Manticore sending trojanised technical assignments to software engineers via LinkedIn. The instructions give a three-hour clock, forbid AI assistance, and state that the backend component is already correct — which is where the malicious code is.
TerminalFix is ClickFix with one substitution. A fake Cloudflare CAPTCHA asks you to paste a command, and instead of the Run dialog it sends you to Windows Terminal or PowerShell — where long multi-line scripts actually work. The end of the chain is a Python reverse tunnel that lets the operator reach anything your machine can see.
Days after the leak, an ISO began circulating claiming to be the leaked build. Testers report it is 99.99% empty zeroes padded around roughly 50KB of malware, and that the installer whitelists the entire C: drive in Windows Defender before it runs. The file size was the disguise: 113GB is what a real game looks like.
A viral mystery pointed Instagram users at a Telegram channel charging ₹500 for the reveal. The totals now circulating are ₹3 crore, ₹8.3 crore and ₹10 crore — for the same event. There is no police statement, no named victim and no mainstream report. The one thing anyone can check is the multiplication, and it does not work.
ShinyHunters registered a fake ReliaQuest SSO page and rang staff one by one, each time impersonating a named colleague from the security team. One person typed their password and approved the push. ReliaQuest says the attackers got view-only access to an Okta dashboard and nothing else — and the interesting part is which controls held.
Marcus Hutchins at Expel picked apart SynkLoader, pushed through Microsoft Teams by attackers posing as the IT help desk and hosted on Azure so the download looks legitimate. Its PhishLocker module paints a convincing Windows 11 lock screen to harvest the password. It is a borderless full-screen app, and Alt+Tab exposes it.
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.
Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.
Hudson Rock reported on 16 August that a seller calling himself TheHatman is offering Entra directory exports from McDonald's, TCS, Vodafone, HCL and five others. TCS says it found no credible evidence and the data is at least four years old. Gap says the same. Nobody has independently authenticated any of it — and the records would still be useful to an attacker if every word of the denials is true.
Group-IB's WindRelay pairs a reader on the victim's Android with an emulator at the attacker's terminal, relaying EMV commands over WebSocket in real time. SpyNote installs it silently; the victim is talked into the tap.
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.
Attackers took over Instagram accounts using photos from the target's own public profile, a public deepfake generator and a VPN. Better liveness detection would not have stopped it, because the bot could be talked into the rest.
Flight 591 out of Las Vegas carried 199 passengers and a network called 'Delta WiFi Fast' that served a page harvesting Google logins. Crew killed the Wi-Fi for 30 minutes; federal officers boarded on landing.
CERT-UA describes UAC-0145 posing as recruiters for a real consulting firm, running Zoom interviews, then handing over a WireGuard config that fails on purpose — so the candidate downloads 'SopraVPN' instead.
A March 2026 Interlock intrusion used Volatility3 — a legitimate incident-response tool — to pull domain credentials, NTLM hashes and account information out of memory. The rest of the chain was a ClickFix lure and PowerShell.
Sophos tracked STAC4749 across dozens of North American organisations between February and June 2026. Attackers used external Teams accounts and IT-themed personas to talk their way into remote access, then deployed a modular backdoor and, in at least three cases, Chaos ransomware.
Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.