Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

ClickFix is an emerging social engineering technique that has gained traction among both cybercriminals and APT groups due to its effectiveness and low barrier to execution. First observed around October 19, 2023, disguised as Cloudflare anti-bot protection, ClickFix deceives users into taking action to “fix” a non-existent issue, often through fake reCAPTCHA pages, spoofed software updates, or fraudulent security prompts.

99% of phishing emails that reached inboxes last year did not contain malware, according to a new report from Fortra. Attackers were much more successful using malicious links or purely response-based social engineering. Fortra explains, “Anti-malware scanning, sandboxing, and other pre-delivery security processes are increasingly common and make it more difficult for emails containing malware payloads to reach user inboxes.

Group-IB has published a report on SIM swapping attacks, finding that attackers continue to use social engineering to bypass technical security measures. SIM swapping is a technique in which an attacker takes over a victim’s phone number, which enables them to access the victim’s accounts. This involves tricking the telecom operator into reassigning the victim’s phone number to a SIM card controlled by the attacker.

Most people know not to click on obvious spam emails, but today’s scams are polished, highly personalized, and AI-powered. Whether it’s a fake banking alert, a deepfake customer service call, or a cloned e-commerce website, social engineering fraud often spreads fast. When customers see familiar branding, hear a confident voice, or receive a message that appears to come from a trusted source, it’s easy to comply and get duped.

From fake job postings to fake candidates, it’s clear the job market has changed in the past few years. Finding a job ad that sparks your interest is now only half the battle — the other half is making sure it’s not a scam. I see three or four LinkedIn posts about job searches and applications gone wrong every day. I’ve read tales of recruiter impersonations, postings for roles that don’t exist, and ads that demand money in order to apply.

Hackers don’t always need malware or harvested credentials to break into systems and accounts. Why bother with technical hacks when bad actors can trick people into getting what they want? From deepfake video calls impersonating friends or relatives to perfectly cloned login portals that steal credentials in real-time, social engineering scams are more convincing than ever. In fact, social engineering now accounts for 70 to 90% of cyber attacks.

AI is advancing at lightning speed, but it’s also raising some big questions, especially when it comes to security. The latest AI making headlines is DeepSeek, a Chinese startup that’s shaking up the game with its cost-efficient, high-performing models. But it’s also raising red flags for cybersecurity pros. DeepSeek overnight became a top contender, mostly driven by curiosity.

Since December 16, 2024, Arctic Wolf has observed increased activity in a social engineering campaign associated with Black Basta ransomware. In this campaign, threat actors were observed using Microsoft Quick Assist and Teams to impersonate IT personnel and engage in malicious activities upon contacting victims. This is a continuation of the Black Basta campaign we reported on in a security bulletin sent in June 2024.