Category Archive
Social Engineering
30 reports·All intelligence
Bulwark Black cyber threat intelligence filed under Social Engineering.
Showing 1–24 of 30 reports
Trusted Notifications, Untrusted Instructions: Close the Email Content Gap
Cisco Talos reports phishing carried by legitimate order notifications and delivery reports. Practical controls for email inspection, callback verification and response.
One Stolen Identity, Several SaaS Platforms: Respond Beyond the Mailbox
A Sophos case connects vishing, password recovery and a device-backed session to SharePoint downloads and a ServiceNow export. A practical cross-SaaS response plan.
RMM Phishing Turns Trusted Admin Tools Into Persistent Access
Microsoft observed phishing campaigns abusing legitimate MSP360 RMM and ScreenConnect to create redundant remote access. Here is what SMB and government-contractor defenders should monitor.
Custom GPT ClickFix Shows Why AI Trust Needs Browser-to-Shell Controls
Attackers abused ChatGPT Custom GPT pages and fake verification prompts to push victims into a ClickFix-to-RAT chain. Here is what SMB and government-contractor defenders should monitor.
ClickFix Shows Why Brand Impersonation Needs Workflow-Based Defense
Recorded Future’s ClickFix research shows how trusted logos and verification prompts can turn users into the delivery mechanism. Here is how SMBs and government contractors should defend the workflow, not just the payload.
EvilTokens Shows Why Device Code Phishing Needs Identity Controls
Microsoft says EvilTokens helped compromise more than 12,000 inboxes by abusing device code authentication. Here is what SMBs and government contractors should lock down now.
Passkey Phishing Shows Why Microsoft 365 Needs Enrollment Guardrails
Microsoft is tracking passkey-themed social engineering that turns MFA enrollment trust into Microsoft 365 cloud compromise. Here is what SMBs and government contractors should monitor and lock down.
Revolut Breach Shows Why Data Requests Need Verification Controls
Revolut confirmed sensitive customer data was disclosed after fraudulent requests appeared to come from a legitimate government agency email domain. Here is what SMBs and government contractors should tighten now.
AI Invoice Fraud Shows Why Finance Needs Verification Controls
Microsoft observed a million-email AI-assisted executive impersonation campaign pushing fabricated invoices and ACH payment requests. For SMBs and government contractors, the fix is not just better spam filtering — it is finance workflow verification.
Teams Helpdesk Impersonation Shows Why Remote Support Needs Guardrails
Microsoft’s Teams helpdesk impersonation case shows why remote support sessions need verification, tool control, user-writable execution limits, and WinRM monitoring.
Nisos DPRK Investigation Shows Why Remote Hiring Is a Security Control
Nisos’ DPRK employment-fraud investigation shows why remote hiring, contractor onboarding, identity verification, and access control now belong in the same security conversation.
Fake Claude Opus 5 App Shows Why AI Tooling Needs Software Control
A fake Claude Opus 5 GitHub desktop app delivering RevStealer shows why AI experimentation needs approved software paths, endpoint controls, and credential-theft triage.
TerminalFix Shows Why Fake CAPTCHA Lures Are Network Access Problems
Microsoft’s TerminalFix campaign turns fake CAPTCHA social engineering into DLL sideloading, persistence, Active Directory reconnaissance, and reverse-tunnel access. The lesson for SMBs and government contractors: compromised workstations can become internal proxy nodes.
Signed ClickOnce Lures Show Why Hiring Workflows Need Endpoint Guardrails
A fake Web3 interview chain used signed ClickOnce delivery to deploy credential stealers and a Go hVNC RAT. Here is what SMBs and government contractors should tighten now.
StopAndProtect Shows Why WordPress Sites Are Attack Infrastructure
Check Point Research exposed StopAndProtect, an operation abusing thousands of compromised WordPress sites for ClickFix delivery, malware staging, command routing, victim logging, data theft, and ransomware. The practical lesson: public websites need the same ownership, telemetry, and incident-response discipline as other production infrastructure.
PurpleDelta Shows Why Remote Hiring Is Now an Insider-Risk Control
Recorded Future’s PurpleDelta research shows North Korean IT worker operations using fabricated personas, AI-assisted interviews, remote desktop tooling, and facilitators to enter legitimate remote technical roles. Defenders should treat hiring, identity proofing, endpoint onboarding, and contractor access as one security workflow.
Signed ClickOnce Shows Fake Interviews Are Now a Credential-Theft Delivery System
A fake Web3 interview chain used a signed ClickOnce app to deliver stealers and a RAT. Here is what SMBs and government contractors should change in endpoint, identity, and hiring-workflow defenses.
Ghost Phishing Shows Why Email Security Must Follow the Browser
Ghost phishing hides the real lure until the browser renders it. Here is what SMBs and government contractors should do to defend Microsoft 365 identities.
ARToken Shows Microsoft 365 Tokens Are the New BEC Control Plane
Cisco Talos uncovered ARToken, an EvilTokens-linked phishing-as-a-service panel built around Microsoft 365 token theft, device-code phishing, mailbox access, SharePoint operations, and BEC automation. The practical lesson: treat identity tokens, inbox rules, and cloud collaborati
SmartApeSG Okendo Compromise Shows Third-Party Widgets Are Supply-Chain Risk
Zscaler ThreatLabz reported that SmartApeSG injected malicious JavaScript into the Okendo Reviews widget, creating downstream exposure across e-commerce sites. Here is what SMBs and government contractors should do about third-party browser code risk.
Maine Breach Portal Hoax Shows Disclosure Systems Need Verification Controls
Maine took its public breach notification database offline after fake disclosures were published. The lesson for SMBs and government contractors: public trust workflows need verification, moderation, and correction controls.
Pink Extortion Shows Microsoft 365 Defense Starts With Vishing Controls
Unit 42 is tracking Pink / CL-CRI-1147, a Com-affiliated extortion brand using vishing, credential theft, and Microsoft 365 data exfiltration. Here is what SMBs and government contractors should lock down now.
Error 524 Smishing Shows Why Fraud Infrastructure Needs CTI
Group-IB documented a global smishing operation using fake error pages, geofencing, and encrypted WebSocket exfiltration. Here is what SMBs and government contractors should take from it.
Chinese-Language PhaaS Shows MFA Bypass Is Becoming Real-Time Fraud
Google’s reporting on Chinese-language phishing-as-a-service shows why MFA bypass, real-time OTP interception, and digital wallet fraud require phishing-resistant authentication and session monitoring.