Chief Security Fanatic | CISO | Speaker | Columnist | Author | Radio Host | Board Member | Forbes Tech Council | TEDx | Canadian-American

YouTube video by Nick Espinosa

operation against Outsider Enterprise read more about FBI disrupts massive AI-powered phishing service using a million URLs

At a glance Actor or group APT42 (Iran-linked; also tracked as TA453) Activity type AI-assisted spear-phishing, credential theft, TAMECAT backdoor delivery Targets or victims Defense and government figures, a US think tank, nuclear-energy sector contacts Scale Multiple hand-picked individuals; not mass phishing Jurisdiction or law-enforcement status

IBM’s 2025 Cost of a Data Breach Report shows that attackers are increasingly using AI to strengthen phishing and deepfake impersonation, putting service desks and onboarding workflows at greater risk. Organizations can reduce this exposure by verifying identity before sensitive actions and using tools like Specops Secure Onboarding to block impersonation and protect new credentials. #IBM #MGMResorts #Clorox #SpecopsSecureOnboarding

🎓 Faux résultats du bac : repérez l’arnaque résultats bac, évitez le phishing et consultez uniquement les canaux officiels.

Russische hackgroepen, AI-phishing en spyware vormen een groeiende bedreiging voor de veiligheid van bedrijven, overheden en burgers wereldwijd. Ontdek hoe je je kunt beschermen tegen deze cyberdreigi...

 Spanish authorities have dismantled a highly advanced AI-driven phishing network and arrested its mastermind, a 25-year-old Brazilian developer known online as “GoogleXcoder.” The operation, led by the Civil Guard’s Cybercrime Department, marks a major breakthrough in the ongoing fight against digital fraud and banking credential theft across Spain.  Since early 2023, Spain has been hit by a wave of sophisticated phishing campaigns in which cybercriminals impersonated major banks and government agencies. These fake websites duped thousands of victims into revealing their personal and financial data, resulting in millions of euros in losses. Investigators soon discovered that behind these attacks was a criminal ecosystem powered by “Crime-as-a-Service” tools — prebuilt phishing kits sold by “GoogleXcoder.”  Operating from various locations across Spain, the developer built and distributed phishing software capable of instantly cloning legitimate bank and agency websites. His kits allowed even inexperienced criminals to launch professional-grade phishing operations. He also offered ongoing updates, customization options, and technical support — effectively turning online fraud into an organized commercial enterprise. Communication and transactions primarily took place over Telegram, where access to the tools cost hundreds of euros per day. One group, brazenly named “Stealing Everything from Grandmas,” highlighted the disturbing scale and attitude of these cybercrime operations.  After months of investigation, the Civil Guard tracked the suspect to San Vicente de la Barquera, Cantabria. The arrest led to the seizure of multiple electronic devices containing phishing source codes, cryptocurrency wallets, and chat logs linking him to other cybercriminals. Forensic specialists are now analyzing this evidence to trace stolen funds and identify collaborators.  The coordinated police operation spanned several Spanish cities, including Valladolid, Zaragoza, Barcelona, Palma de Mallorca, San Fernando, and La Línea de la Concepción. Raids in these locations resulted in the recovery of stolen money, digital records, and hardware tied to the phishing network. Authorities have also deactivated Telegram channels associated with the scheme, though they believe more arrests could follow as the investigation continues.  The successful operation was made possible through collaboration between the Brazilian Federal Police and the cybersecurity firm Group IB, emphasizing the importance of international partnerships in tackling digital crime. As Spain continues to strengthen its cyber defense mechanisms, the dismantling of “GoogleXcoder’s” network stands as a significant milestone in curbing the global spread of AI-powered phishing operations.

  Artificial intelligence (AI) has firmly taken center stage in today’s enterprise landscape. From the rapid integration of AI into company products, the rising demand for AI skills in job postings, and the increasing presence of AI in industry conferences, it’s clear that businesses are paying attention. However, awareness alone isn’t enough. For AI to be implemented responsibly and securely, organizations must invest in robust training and skill development. This is becoming even more urgent with another technological disruptor on the horizon—quantum computing. Quantum advancements are expected to supercharge AI capabilities, but they will also amplify security risks. As AI evolves, so do cyber threats. Deepfake scams and AI-powered phishing attacks are becoming more sophisticated. According to ISACA’s 2025 AI Pulse Poll, “two in three respondents expect deepfake cyberthreats to become more prevalent and sophisticated within the next year,” while 59% believe AI phishing is harder to detect. Generative AI adds another layer of complexity—McKinsey reports that only “27% of respondents whose organizations use gen AI say that employees review all content created by gen AI before it is used,” highlighting critical gaps in oversight. Quantum computing raises its own red flags. ISACA’s Quantum Pulse Poll shows 56% of professionals are concerned about “harvest now, decrypt later” attacks. Meanwhile, 73% of U.S. respondents in a KPMG survey believe it’s “a matter of time” before cybercriminals exploit quantum computing to break modern encryption. Despite these looming challenges, prioritization is alarmingly low. In ISACA’s AI Pulse Poll, just 42% of respondents said AI risks were a business priority, and in the quantum space, only 5% saw it becoming a top priority soon. This lack of urgency is risky, especially since no one knows exactly when “Q Day”—the moment quantum computers can break current encryption—will arrive. Addressing AI and quantum risks begins with building a highly skilled workforce. Without the right expertise, AI deployments risk being ineffective or eroding trust through security and privacy failures. In the quantum domain, the stakes are even higher—quantum machines could render today’s public key cryptography obsolete, requiring a rapid transition to post-quantum cryptographic (PQC) standards. While the shift sounds simple, the reality is complex. Digital infrastructures deeply depend on current encryption, meaning organizations must start identifying dependencies, coordinating with vendors, and planning migrations now. The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has already released PQC standards, and cybersecurity leaders need to ensure teams are trained to adopt them. Fortunately, the resources to address these challenges are growing. AI-specific training programs, certifications, and skill pathways are available for individuals and teams, with specialized credentials for integrating AI into cybersecurity, privacy, and IT auditing. Similarly, quantum security education is becoming more accessible, enabling teams to prepare for emerging threats. Building training programs that explore how AI and quantum intersect—and how to manage their combined risks—will be crucial. These capabilities could allow organizations to not only defend against evolving threats but also harness AI and quantum computing for advanced attack detection, real-time vulnerability assessments, and innovative solutions. The cyber threat landscape is not static—it’s accelerating. As AI and quantum computing redefine both opportunities and risks, organizations must treat workforce upskilling as a strategic investment. Those that act now will be best positioned to innovate securely, protect stakeholder trust, and stay ahead in a rapidly evolving digital era.

  Even though phishing scams are predicted to continue to pose a serious cybersecurity threat in the years to come, recent research has highlighted the fact that a worrying gap in awareness among business leaders has been identified as a major concern.…

AI-generated phishing has surged to become the top initial-access vector in Q1 2026 incident-response engagements, accounting for 35% of investigated compromises and overtaking exploitation of external vulnerabilities. Attackers are using AI to craft highly personalized, polymorphic lures that abuse legitimate services and valid accounts, prompting calls for defenders to adopt AI-driven defenses and reinforce identity and MFA protections. #CiscoTalos #Gmail

The Human Firewall: Why Your Skepticism is the Only Security That Matters in the AI Phishing Age By @AutoPaybump I.T. Has One Weak Link Left: How to Spot the 8 Digital Red Flags That Cybercriminals (and AI) Need You to Ignore. We all have antivirus software, we've updated our passwords, and we think we're safe. But the uncomfortable truth is that in 2025, with state-of-the-art defenses in place, the biggest vulnerability in any organization—or any home network—is still the person sitting in the chair.

Automated attack kits, A.I. phishing bots and plug-and-play ransomware are all speeding up a boom in cybercrime and transforming hacking into an insatiable subscription service that increasingly targets every sector. Cybercrime has transitioned from individual actors operating alone into an industry with organized crime warefare, it is driven by Crimeware-as-a-Service (CaaS) automated tools and subscription-based attacks are now available to even the most foolish assailants.