Watch out for that credit card warning email in your inbox

The Ultimate Cyber Con You ever hear the one about the thief who never had to break in? No crowbars and no alarms tripped. No ski masks, just a well-worded email, a little deception and boom, millions...

AI-generated social engineering attacks are becoming more convincing across email, social media, and web apps, making them harder to spot. Email remains the dominant delivery channel, with 98% of fraudsters using it in some way, according to the Verizon DBIR. #VerizonDBIR #Email

Email attackers now favor tailored campaigns that exploit trusted relationships and routine workflows instead of obvious technical flaws, with phishing accounting for 58% of attacks and BEC/VEC comprising the more targeted, high-impact campaigns. Abnormal AI's 2026 report highlights redirect chains, link shorteners (TinyURL and t.co), VIP impersonation, lateral compromises, and invoice...

James Junior Aliyu, a Nigerian national who used the aliases "Old Soldier" and "Ghost", was sentenced to 90 months in U.S. prison for his role in an international scheme that hacked business email accounts and redirected millions in wire transfers. The ring, active since at least 2017, is estimated to have...

Threat actors are abusing Microsoft Azure Monitor to send callback phishing emails that impersonate the Microsoft Account Security Team and warn of unauthorized billing charges. These alerts are sent from azure-noreply@microsoft.com and pass SPF, DKIM, and DMARC checks, using editable alert descriptions and attacker-controlled mailing lists to deliver urgent invoice-themed messages urging victims to call fraudulent phone numbers. #AzureMonitor #WindowsDefender

Attackers are now leveraging SVG images with obfuscated JavaScript to perform stealthy redirection attacks through spoofed emails. This technique allows them to direct users to malicious sites without their knowledge. The recent research by Ontinue, as reported by HackRead, sheds light on the detection and defense against these attacks. SVG images, being XML-based, can contain JavaScript, which attackers obfuscate to evade detection. When included in spoofed emails, these images can execute malicious scripts to redirect users to harmful sites. This method bypasses traditional security measures that do not inspect image file contents. The impact on the cybersecurity landscape is significant, as it represents an evolution in phishing attacks that can evade detection and increase success rates. Cybersecurity professionals must update their detection and prevention strategies to inspect and analyze SVG files for embedded scripts. Advanced email filtering solutions and web filtering to block access to known malicious sites are essential. User education on the risks of opening emails from unknown sources and the dangers of embedded images is also crucial. This analysis is based on verified research by Ontinue, focusing on factual information and actionable insights without speculation.

In 2024, cyber insurance company Coalition reported that 60% of claims were due to business email compromises and fund transfer frauds. These email attacks represent the majority of reported incidents.

The article describes the setup of a phishing server to bypass SPF checks and spoof the sender of an email. Technical details include the use of SPF (Sender Policy Framework) to verify the authenticity of emails. The main impact is the ability to send fraudulent emails by circumventing security mechanisms.

PCI DSS 4.0 mandates DMARC by March 31, 2025, to combat phishing. Non-compliance risks $100K fines, email fraud, and low deliverability.