Topic
Fraudulent messages built to induce recipients to surrender credentials, money or access, usually by imitating a trusted sender or a routine business process.
Cisco Talos tracks UAT-11985, an APT sending Taiwan research affiliates fake event invites that lead to a Google login proxy capturing MFA codes. The proxy relays entries to Google in real time, so a code typed into the fake page reaches the attacker first.
Reality
Microsoft accounted for 33% of the brand-impersonation phishing attempts Check Point Research tracked in Q3 2026, up from 23% in Q2. Its examples include fake Antigravity and Apple pages that get visitors to run terminal commands themselves.
Reality
Fortra researcher Cadence Riddle tracked a 12-fold rise in malicious emails mentioning RFQ from October 2025 to September 2026. Nearly 73% of the lures pointed to a credential-stealing login page, Help Net Security reported.
Reality
FBI warns that scammers are using AI-generated voices, images and messages to pose as candidates three weeks before the 2026 midterms. Cofense's Max Gannon says to verify any solicitation through the FEC website or vote.gov, never the link sent.
Reality
Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. The check can keep automated scanners from reaching the next page, so a URL scan may inspect only the CAPTCHA.
Reality
Check Point researchers tied 10,187 domains in one September window to a phishing network whose root pages return 404 while lures sit on hidden paths. A root-page check can clear a live site when the full URL arrives by SMS, email or WhatsApp.
Reality
North Korea's Kimsuky targeted Ukrainian diplomacy and security experts with fake conference invitations, Genians reported Monday. Most observed attempts failed, and Genians' researchers say the aim may be intelligence on the war.
Reality
Check Point says voters struggle to tell real campaign outreach from fraud, citing election-office warnings between July and September. Its researchers saw no activity aimed at voting systems or vote counting; the exposure they describe is in messages sent to voters.
Reality
Malwarebytes found a wave of fake Calendly pages posing as Meta Careers that harvest Facebook and Google passwords and 2FA codes. The page stays in contact with the attackers' server as the victim types, so a stolen code can be used before it expires.
Reality
The Identity Theft Resource Center says 24% of H1 2026 breach notices named the attack vector, the lowest rate it has recorded. Over 471 million victim notices went out in the same half, according to the group.
Reality
Barracuda research describes phishing emails whose hidden prompts tell AI inbox assistants to present them as urgent or to add a vendor payment change. Malwarebytes' account says an ignored message can return as the assistant's own recommendation.
Reality
Sublime Security says calendar phishing is growing exponentially as apps like Google Calendar add invites automatically, even from emails sent to spam. That moves the defence from the mail filter to calendar settings and to what staff do with an unexpected meeting.
Reality
Researchers at haveibeensquatted.com found three Cyrillic letters that still break Chromium's whole-script lookalike check in current Chrome. A name built on one can display close to a real brand, so the address bar is a weaker check than users are taught.
Reality
Lookalike 'DEV SUPPORTS' comments on new dev.to posts now lead writers to a form asking for card number, CVV and exact balance, a dev.to writer reported. It follows a password-stealing wave by two weeks and is built to slip past writers who learned to spot that one.
Reality
Phishing emails carrying fake PDF invoices are installing Action1's remote-management agent, SANS ISC handler Xavier Mertens reported. It follows a ScreenConnect campaign he documented a few days earlier that used the same fake-invoice lure.
Reality
Asos says hackers took detailed profiles of potentially millions of customers, after first telling investors only basic contact details may have been accessed. The revision followed the attackers' approach to the BBC, so the people holding the records set the timing of the fuller disclosure.
Reality
Yubico and Okta's survey of 1,890 tech and security professionals found 23% work where multifactor login is not required on every application. With 88% still rating their company secure, at least one respondent in nine gave both answers.
Reality
Check Point says organizations averaged 2,803 cyber attacks a week in September, up 48% on a year earlier. The figures come from the vendor's own count, and they support checking mail link filtering and AI prompt controls before spending anything new.
Reality
Scammers posing as Hollyland, Nike and Spotify lure YouTube creators to fake brand-deal portals that take Google passwords and one-time codes, ESET found. One sign-in hands over Gmail, Drive and the channel itself.
Reality
Scammers posing as Hollyland are sending YouTube creators tailored sponsorship offers that end at a fake Google login, WeLiveSecurity reported. That page takes the password and the one-time code, and with them the account that owns the channel.
Reality
Security · October 5, 2026 · Confirmed6 publishers
Security · September 30, 2026 · Confirmed6 publishers
Security · October 6, 2026 · Confirmed2 publishers
Security · October 1, 2026 · Confirmed6 publishers
Security · October 5, 2026 · Confirmed2 publishers
Security · September 30, 2026 · Confirmed3 publishers
Security · September 29, 2026 · Confirmed3 publishers
Security · August 14, 2026 · Confirmed3 publishers
Product · August 16, 2026 · Confirmed3 publishers
Security · August 21, 2026 · Confirmed3 publishers
Security · August 25, 2026 · Confirmed2 publishers
Security · August 26, 2026 · Confirmed4 publishers
Security · August 29, 2026 · Confirmed2 publishers
Security · September 3, 2026 · Confirmed2 publishers
Security · August 28, 2026 · Confirmed6 publishers
Build · September 6, 2026 · Confirmed3 publishers
Security · September 10, 2026 · Confirmed4 publishers
Security · September 16, 2026 · Confirmed2 publishers
Security · September 22, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Leadership · September 20, 2026 · One report1 publisher