Qfinity Security

Crime crew impersonates help desk, abuses Microsoft Teams to steal your data

Coming in cold with custom Snow malware

A previously unknown threat group using tried-and-tested social engineering tactics - Microsoft Teams chat invitations and helpdesk staff impersonation - is also using custom malware in its data-stealing attacks, according to Google's Threat Intelligence Group.…

Coming in cold with custom Snow malware

Leak-site bragging meets breach hunters as Have I Been Pwned flags millions of records

Latest in long-running pwning of Cisco kit found in mystery Fed agency

World's largest biomedical dataset lifted and shifted on Chinese mega marketplace

NCSC passes judgment: passkeys pass muster, passwords fail

Plus, the payload references 'TeamPCP/LiteLLM method'

Gov admits 'incident' as forum sellers boast of fresh haul covering up to a third of the population

Data from browsers, cryptocurrency wallets, 200+ extensions hoovered up

Plus: Court papers reveal nonprofit paid a ransom worth nearly $26.8 million

CEO suspects silicon sidekick behind 'surprising velocity' breach - cyber crims shop stolen data for $2M

Mexican IT services firm admits it was hacked, but says client operations weren't affected

Fake emails already doing the rounds as ransomware crew boasts about what it allegedly stole

Tyler Buchanan admits role in scheme that stole at least $8 million in virtual currency

Social engineering: 'low-cost, hard to patch, and scales well'

Publisher claims misconfigured Salesforce-hosted page leaked data

Some customer orgs tell staff to block inbound email from the provider

Vuln old enough to drive lands on CISA's exploited list

Honey, the skids are fighting again

Google Sites lure leads to bogus root certificate

Travel giant says names, contact details, dates, and hotel messages potentially exposed

Names, addresses, dates of birth, and bank details accessed, though not passwords

ShinyHunters claims it accessed Snowflake metrics via third-party tool

Cops bust latest scam, return $12m to bilked victims

Possible link to Mr. Raccoon's claimed Adobe break-in

Malicious PDFs abuse legit features to harvest system data and decide which victims get a 2nd-stage payload

Attackers slipped into the process and redirected funds, leaving the company scrambling to recover the cash

ChipSoft's website remains down but emails are functioning

Who needs MFA when you've got EvilTokens?

Bots are now firmly in the toolbox, helping crooks scale old scams

200 orgs and 5,000 devices compromised so far in Vlad's latest intelligence grab, Microsoft reckons

First public downstream victim, but won't be the last

How to avoid social engineering attacks? Employee training tops the list

Researchers say some targets correlate with cities hit by Iranian missile strikes

Also, EU probes Snapchat, RedLine suspect extradited, AstraZeneca leak claim surfaces, and more

Brussels notifying 'Union entities' whose data may've been snatched in websites breach

Vulns in Dutch football club's systems didn't just expose data – they let outsiders play with accounts, and even lift stadium bans

They cleverly mimic most traits of a real phone

Nearly 300 employees caught up in intrusion at benefits provider Navia

Aleksei Volkov sentenced after enabling attacks that cost victims millions

'It freakin' worked' says Rob Joyce - and shows how relentless AI agents can find holes humans miss

Voice phishing is second most common initial access method across all IR probes, and top in cloud break-ins

Trio-Tech International initially said hack wasn't 'material,' but then stolen data was published

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Millions of hijacked devices powered traffic floods targeting defense systems and beyond

Lack of clear criteria risks encouraging firms to lean on state support instead of worrying about insurance

Last time: Beijing-backed snoops and ransomware crims. Who's next?

Iran-linked attackers wiped employees' devices using Intune

Interlock's post-exploit toolkit exposed

Researchers map full org chart of the scam from dodgy recruiters to helpful Western collaborators

Operations and hospital networks not affected, we're told