Pretexting is a type of social engineering attack in which the scammer manipulates their target into sharing private information or sending money by making up a story. Pretexting can occur on the phone, via text message, through email or in person. The goal of pretexting scams is typically to infect your device with malware, steal your money, breach private data and more.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! A couple of real nasty Open Source issues in the past week. The first and most recent is Ghostscript. Could well be a lot of SaaS products affected.

New data illuminates how healthcare leaders can prioritize resilience. Organizations find themselves at the intersection of progress and peril in the rapidly evolving digital healthcare landscape. The latest data underscores that the trade-offs are significant and pose substantial risks to healthcare institutions. One of the foremost obstacles is the disconnect between senior executives and cybersecurity priorities.

Over the last twelve months, the Internet security landscape has changed dramatically. Geopolitical uncertainty, coupled with an active 2024 voting season in many countries across the world, has led to a substantial increase in malicious traffic activity across the Internet. In this report, we take a look at Cloudflare’s perspective on Internet application security. This report is the fourth edition of our Application Security Report and is an official update to our Q2 2023 report.

Ransomware is more prolific and expensive than ever. Depending on the source you read, the average or median ransomware payment was at least several hundred thousand dollars to well over several million in 2023. Marsh, a leader in cybersecurity insurance, wrote that its customers paid an average of $6.5 million in ransom in 2023 (after just paying an average of $1.4 million in 2023).

Mobile devices have become so integral to both business and personal lives that it is difficult to imagine a life without them. There’s more attack surface area as a result, and it’s IT’s job to mitigate the risk of cyberattacks. Insider threats are often involved, because employees and their devices can be one of the weakest links in the security chain.

Researchers at Abnormal Security have observed a 360% increase in phishing attacks against state and local government entities over the past year. The researchers write, “While phishing tends to consistently increase each year and regularly accounts for the majority of advanced threats, this level of growth is extraordinary.” Threat actors often use phishing to gain a foothold within an organization before launching more follow-on attacks.

Many smaller organizations aren’t sure where to start with threat intelligence; it may seem like the kind of maturity reserved for large organizations. Threat intelligence is a proactive cybersecurity strategy focused on collecting information about current threats, analyzing it, and using that information to identify and mitigate threats within the network. It’s approachable even for smaller organizations that don’t have the resources for novel research and analysis.