Via #LLRX @psuPete Recommends Weekly highlights on #cybersecurity issues, 9/8/25 - 5 highlights from this week: States Have More #Data About You Than the Feds Do. #Trump Wants to See It; #Instagram Map lets your friends, possibly exes, track your every move; #Samsung phones can detect AI voice #phishing attacks w One UI 8; #Uber Gets Report of #Sexual #Misconduct Every 8 Min; #HomeDepot & #Lowes Share Data From Hundreds of #AI #Cameras w #Cops. #privacy #cybercrime https://www.llrx.com/2025/08/pete-recommends-weekly-highlights-on-cyber-security-issues-august-9-2025/

WinRAR zero-day vulnerability (CVE-2025-8088) exploited by Russian-tied RomCom hackers in phishing attacks to plant malware via malicious archives! Extracted files auto-run from Startup folders, enabling remote code execution. Update to WinRAR 7.13 NOW to stay safe!

Read more: https://www.bleepingcomputer.com/news/security/winrar-zero-day-flaw-exploited-by-romcom-hackers-in-phishing-attacks/

#WinRAR #CyberSecurity #Malware #RomCom #Phishing #ZeroDay #InfoSec
#newz

#Phishing attacks exploit #WinRAR flaw CVE-2025-8088 to install #RomCom
https://securityaffairs.com/180967/hacking/phishing-attacks-exploit-winrar-flaw-cve-2025-8088-to-install-romcom.html
#securityaffairs #hacking #malware

Po prostu dajemy się nabrać na łudząco podobne do naszej strony poczty elektronicznej.

Więcej informacji https://lttr.ai/AhOfl

Adult sites are stashing exploit code inside racy .svg files - Dozens of porn sites are turning to a familiar source to gen... - https://arstechnica.com/security/2025/08/adult-sites-use-malicious-svg-files-to-rack-up-likes-on-facebook/ #javascript #security #exploits #phishing #biz⁢ #scams

GenAI Used to Impersonate Brazil's Government Websites

Threat actors are leveraging generative AI tools like DeepSite AI and BlackBox AI to create phishing templates that closely mimic official Brazilian government websites, such as the State Department of Traffic and Ministry of Education. These malicious replicas are boosted in search results using SEO poisoning techniques. The phishing pages collect sensitive personal data, including CPF numbers and addresses, validating the information through APIs to build credibility. The ultimate goal is to trick victims into making payments via Pix, Brazil's instant payment system. Technical analysis reveals AI-generated source code signatures, including TailwindCSS styling, explanatory comments, and non-functional elements. The campaign demonstrates the evolving sophistication of phishing attacks empowered by generative AI tools.

Pulse ID: 6896279970e62c2bef3c1a32
Pulse Link: https://otx.alienvault.com/pulse/6896279970e62c2bef3c1a32
Pulse Author: AlienVault
Created: 2025-08-08 16:36:41

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Phishing: Klickt NIEMALS auf angebliche #Bank- Links in Mails, sondern geht selbst auf die Seite Eurer Bank und loggt Euch dort ein. Sonst kann es teuer werden: https://www.lto.de/recht/nachrichten/n/8u10323-olg-oldenburg-phishing-betrug-grobe-fahrlaessigkeit-haftung-bank?utm_source=Eloqua&utm_content=WKDE_LEG_NSL_LTO-Daily_DesignEditor_EM&utm_campaign=wkde_leg_mp_lto_daily_ab13.05.2019&utm_econtactid=CWOLT000039862474&utm_medium=email_newsletter&utm_crmid=

Reading comprehension assistance needed, please. I don't understand this paragraph below:

"On June 10, 2025, Precision Endodontics of Raleigh discovered that its email account had been accessed by an unknown entity and that phishing emails were sent out to a small part of its prior contact list. In addition, its contact list of names and email addresses were compromised by the unknown entity. No evidence exits (sic) to suggest that there has been any attempt to misuse any of the information."

Isn't the last sentence contradicted by the prior statement that phishing emails were sent out? Isn't that an attempt to misuse any of the information?

PHISHING ALERT!

We have identified a phishing campaign targeting Mastodon users.
The attackers' goal is to convince users to click on a link, take them to a fake payment page, and steal their credit card details.

Watch the video and avoid falling into the trap!

WhatsApp: nuove funzioni contro truffe e messaggi sospetti

https://gomoot.com/whatsapp-nuove-funzioni-contro-truffe-e-messaggi-sospetti/

Maybe time to share some more #phishing pages again in the future..

#365phish

https://talks-radical-accuracy-qualifying[.]trycloudflare[.]com/loading?screen=passwordloading

phish referral fills in the domain details.

Google confirms a data breach via its Salesforce system, attributing the attack to hacker group ShinyHunters
Stolen info includes SMB contact details—no sensitive data reported.
Attackers used voice phishing to access cloud databases

Part of a wider pattern of Salesforce-targeted breaches.

@zackwhittaker
@Techcrunch@flipboard.com
@techcrunch@threads.net

https://techcrunch.com/2025/08/06/google-says-hackers-stole-its-customers-data-in-a-breach-of-its-salesforce-database/

Here’s how #deepfake #vishing attacks work, and why they can be hard to detect

https://arstechnica.com/security/2025/08/heres-how-deepfake-vishing-attacks-work-and-why-they-can-be-hard-to-detect/

My first phishing text message that looked convincing, targeting my pension account, "verify your address." Of course I didn't click on the link, oh hell no! I traced the number to spammer fraud web pages. When I get home, I'll see who their hosting provider is, etc.

That link could have wiped out my retirement. With the fraud safety government offices closed, this is going to be one of many attempts to remove our last strings of survival...

[BEWARE] Mozilla warns of Phishing Attacks targeting Add-On Developers.

According to Mozilla's advisory, these phishing emails are impersonating the AMO [addons-mozilla-org] team and claim that the targeted developer accounts require updates to maintain access to development features.

https://blog.mozilla.org/addons/2025/08/01/warning-phishing-campaign-detected/

Cybercriminals are getting personal, and it’s working https://www.helpnetsecurity.com/2025/08/07/email-attacks-q2-2025/ #cybercriminals #emailsecurity #VIPRESecurity #BECscams #phishing #News

Chinese Groups Stole 115 Million US Cards in 16-Month Smishing Campaign – Source:hackread.com https://ciso2ciso.com/chinese-groups-stole-115-million-us-cards-in-16-month-smishing-campaign-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #PhishingScam #CyberAttack #CyberCrime #Hackread #Phishing #security #Smishing #Telegram #China #Fraud #Meta #Scam

Chinese Groups Stole 115 Million US Cards in 16-Month Smishing Campaign https://hackread.com/chinese-stole-115-million-us-cards-smishing-campaign/ #Cybersecurity #PhishingScam #CyberAttack #CyberCrime #Security #Phishing #Smishing #Telegram #China #Fraud #Meta #Scam

I got a very weird mail…

According to headers (and DKIM!) it came from Google, specifically "no-reply@accounts.google.com",
but not to my gmail address, but my private one (that is the backup address for the google account).

The text is (in German) that I've not logged in to my account in 8 months and accounts get deleted after 2 years of inactivity.

All links (in the HTML even!) go to accounts.google.com

The only outliner is an image loaded from lh3.googleusercontent.com

WTF?! #phishing

Threat Actors Use GenAI to Launch Phishing Attacks Mimicking Government Websites https://gbhackers.com/threat-actors-use-genai-to-launch-phishing-attacks/ #CyberSecurityNews #cybersecurity #CyberAttack #Phishing #AI