Keepnet has released a free iOS app called SMS/Call Reporter that enables users to quickly report suspicious text messages and phone calls with a single tap. The application is available for both personal use and organizational deployment, with an Android version planned for future release. For Keepnet customers, reported incidents integrate directly into their Extended Human Risk Management platform.
Read full article at Help Net Security ↗The ongoing social engineering threat, which dates back to late 2025, tricks victims into granting threat actors long-term access to their accounts. The post FBI raises alarm over deceptive phishing campaign targeting prominent people appeared first on CyberScoop.
A coordinated vishing campaign called Spring Ring exploited Microsoft Teams by creating fake IT support accounts designed to impersonate internal teams, targeting employees across more than 10 companies between January and April 2026. Attackers contacted over 150 employees through these fraudulent accounts, attempting to trick them into installing malware or granting remote access to their systems. The campaign demonstrates how legitimate collaboration platforms can be weaponized for initial network compromise when attackers craft convincing social engineering pretexts.
The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and it was the most common initial access method Microsoft’s team observed last year, accounting
Threat actors are spoofing user-agent strings to impersonate AI crawlers from OpenAI, Anthropic, Google, Perplexity, and other companies while scanning websites for exposed credentials and configuration files. According to GreyNoise research, attackers exploit the fact that web requests are not authenticated by their user-agent declarations alone, making it trivial to forge legitimate-looking crawler identities. This technique allows adversaries to blend malicious reconnaissance traffic with legitimate AI indexing activity.