PhishingInfosecurity Magazine·21 hours ago
Fake Recruiter Scams Target Corporate Credentials on Mobile
RecruitTrap campaigns use mobile-optimized phishing pages to target enterprise credentials
← Back
PhishingThe Hacker News·4 hours ago
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes
Researchers have uncovered a phishing-as-a-service platform called AnonyMousKIT that uses AI voice agents to impersonate Apple Support and target owners of stolen devices, attempting to extract passcodes and two-factor authentication codes to bypass Activation Lock. The credit-metered service automates social engineering attacks by calling victims and deceiving them into revealing sensitive authentication credentials. This approach represents an evolution in device theft operations, combining AI-driven voice phishing with stolen device monetization tactics.
Read full article at The Hacker News ↗Related Articles
PhishingThe Hacker News·22 hours ago
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised. Most of the affected companies are US-based. Mirage2FA Campaign
PhishingThe Hacker News·22 hours ago
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor’s use of npm isn't to infect developers who install it, but to use the
PhishingHelp Net Security·1 day ago
ShinyHunters taunts ReliaQuest after its own employee falls for social engineering attack
ReliaQuest confirmed that one of its employees fell victim to a social engineering attack that provided attackers with a password and temporary access to the company's identity system. Extortion group ShinyHunters subsequently posted screenshots on its leak site, claiming responsibility and taunting the cybersecurity firm over the breach. The incident followed an earlier exchange between ShinyHunters and ReliaQuest's threat research team on social media.