Researchers at Menlo Security warn that a phishing campaign is exploiting Google Drawings to evade security filters. The phishing emails inform the user that their Amazon account has been suspended, instructing them to click on a link in order to update their information and reactivate their account. The phishing page is crafted with Google Drawings, which makes it more likely to fool humans while evading detection by security technologies.

For the fifth year in a row, we've been honored with the TrustRadius Tech Cares Award! This recognition is a testament to our unwavering commitment to corporate social responsibility (CSR) and the incredible efforts of our team. What makes this recognition so special is that it celebrates companies that go above and beyond in their CSR programs. At KnowBe4, we've always believed that our responsibility extends far beyond our products and services.

Just when we thought we had something special with our very own North Korean hacker, it turns out this type of fraud has made it to the Volunteer State. A recent arrest in Nashville, Tennessee is just another example of this global tactic finding its way into U.S. organizations. Fortunately, the authorities caught up with this one. According to the tech news site Cyberscoop, authorities arrested a 38-year-old man for allegedly getting himself hired by U.S. and British companies under false identities.

The financial repercussions of the May 2024 ransomware attack on the electronics manufacturing services firm Key Tronic underscores just how costly these attacks are. Key Tronic makes parts for a number of sectors, including computer, telecom, medical, industrial, automotive and aerospace. They were struck in May with a ransomware attack by Black Basta, which claimed to have stolen 500 GB of data.

New analysis shows users can be convinced to copy and paste malicious code on behalf of the attacker. I first saw this kind of attack earlier this month – where the user is asked to launch the Run dialog box and paste in a malicious command. I never thought I'd see something similar again, but I was wrong.

A report from Darktrace has found that 62% of phishing emails in the first half of 2024 were able to bypass DMARC verification checks in order to reach users’ inboxes. “Building on the insights from the 2023 End of Year Threat Report, an analysis of malicious emails detected by Darktrace / EMAIL in 2024 underscores the implication that email threats are increasingly capable of circumventing conventional email security tools,” the report says.

The Cyber Security Agency of Singapore (CSA) has warned that threat actors are increasingly using AI to enhance phishing and other social engineering attacks, Channel News Asia reports. The CSA’s report found that cybercriminals are selling tools that automate these attacks, allowing unskilled threat actors to launch sophisticated attacks.

Researchers at Malwarebytes spotted a malvertising campaign that abused Google Ads to target people searching for Google Authenticator. If someone typed “Google Authenticator” into Google, the malicious ad would be at the top of the search results. The ad copied the website description from the real Google Authenticator, but would redirect users to a phishing site. “We can follow what happens when you click on the ad by monitoring web traffic,” the researchers explain.

The use of the Microsoft brand in phishing attacks demonstrates both its widespread credibility as well as the continued success of attacks leveraging it. Each quarter, security vendor Check Point builds its’ Brand Phishing Ranking, identifying the top ten impersonated brands used in phishing attacks. And, while we’ve seen Microsoft at the top of this quite a few times before in their previous rankings, it’s the growth we see in their latest report covering Q2.

When it comes to creating a strong cybersecurity culture, one of the most powerful tools we have at our disposal is the Phish Alert Button (PAB). This unassuming little add-in for your email client can make all the difference between falling victim to a malicious email and stopping a potential cyber attack in its tracks. And yet, many employees hesitate to use it, fearing the embarrassment of being wrong. I've been there myself.