Threat actors are spoofing user-agent strings to impersonate AI crawlers from OpenAI, Anthropic, Google, Perplexity, and other companies while scanning websites for exposed credentials and configuration files. According to GreyNoise research, attackers exploit the fact that web requests are not authenticated by their user-agent declarations alone, making it trivial to forge legitimate-looking crawler identities. This technique allows adversaries to blend malicious reconnaissance traffic with legitimate AI indexing activity.
Read full article at Help Net Security ↗The Spring Ring campaign exploits Microsoft Teams as a vector for voice phishing attacks aimed at enterprise environments, with attackers using social engineering to gain access to sensitive systems. Researchers at Unit 42 have documented how this threat group leverages voice-based deception to ultimately deploy malware and target domain controllers within targeted organizations.
Fraudsters are leveraging Microsoft Teams and other enterprise chat applications to conduct scams targeting Chinese victims, convincing them to transfer substantial funds. The exploitation of these widely-trusted business communication platforms has generated a surge in complaints, highlighting how scammers are adapting their tactics to abuse legitimate enterprise tools.
Authorities disrupted multiple global cybercrime rings this week, marking significant progress in international enforcement efforts. Attackers leveraged DocuSign in phishing campaigns associated with NovaCookies, exploiting trusted document services to increase credential theft effectiveness. Spark RAT activity was observed targeting Cambodia through exploitation of vulnerable drivers, demonstrating continued geographic-specific malware campaigns.
Move past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.