Asos informed customers that hackers gained access to extensive personal data, including names, addresses, contact numbers, emails, customer IDs, and search queries on their platform. The breach was confirmed after cybercriminals contacted BBC News with samples of the stolen information, revealing the scope of the data compromised. The retailer emphasized that no payment or login details were accessed and warned customers to be vigilant against impersonation scams.
bbc.co.uk
· 2026-10-08
Security firm Island discovered a phishing campaign using fake ChatGPT, Gemini, Claude and Perplexity sites that target advertising agency staff and media buyers. The sites exploit the recent launch of Meta's Muse AI agent and use browser-in-browser techniques to fake Google login windows, capturing credentials and MFA codes to hijack high-value ad accounts.
bleepingcomputer.com
· 2026-10-06
Nikkei revealed that unknown hackers accessed two employee email accounts, one of which was used to send thousands of phishing emails in September. The breaches involved a Google Workspace account in July and a Microsoft 365 account in September, prompting the company to change passwords and warn staff about ongoing threats. No customer or reader data was affected in these incidents, according to Nikkei.
bleepingcomputer.com
· 2026-10-06
Proofpoint researchers reported that China-linked group TA419 ran a July phishing campaign impersonating US officials, including a former White House science and technology policy staffer, to steal credentials from AI experts at US think tanks, universities, defense contractors and law firms. The campaign followed similar activity in February, when the group posed as an Anthropic employee to target a think tank AI policy expert, and is part of a pattern Proofpoint says dates back to at least April 2025.
darkreading.com
· 2026-10-05
A technology writer describes receiving a highly personalized PR solicitation email that referenced detailed facts about their book and career, prompting a closer look at how scammers now use AI to craft convincing, tailored pitches. The piece compiles guidance on recognizing red flags in such messages and verifying unsolicited outreach before responding.
fastcompany.com
· 2026-10-03
Security firm Huntress found attackers had built a Custom GPT named 'Plus 5.6' hosted on the real ChatGPT.com domain, designed to look like an official OpenAI model. The bot told users ChatGPT was unavailable and pushed them to a fake Cloudflare security check page that instructed them to copy and paste a Windows command, a technique known as ClickFix, which could install malware capable of accessing files, screens, webcams and microphones. Huntress says some victims reached the fake bot via a sponsored Google ad for 'ChatGPT' placed above organic search results.
androidauthority.com
· 2026-10-01
QR codes were created in 1994 by Denso, a Toyota parts supplier, as a way to speed up factory scanning by packing far more data into a single code than a barcode could hold. Engineer Masahiro Hara led the project, drawing on the board game Go for the grid design and testing printed materials to find a black-to-white ratio that scanners could reliably detect. The format spread slowly through Japanese camera phones before becoming a global fixture in payments, tickets, logins and marketing.
techspot.com
· 2026-10-01
Microsoft researchers say the Russian state-linked group Star Blizzard is using a new technique called RedFlick to deploy its CosmicPulse backdoor. The chain starts with phishing emails leading victims to open a VHDX virtual disk containing a disguised LNK file, which triggers hidden commands, a decoy PDF, and an MSI installer that sets up three scheduled tasks to reconnoiter the system and fetch further payloads, including a downloader called NOROBOT/BAITSWITCH that ultimately installs CosmicPulse.
bleepingcomputer.com
· 2026-09-30
Chijioke Timothy Odimegwu and Harafat Mogaji, former airmen stationed at Dover Air Force Base, were sentenced to a combined 189 months in federal prison for running business email compromise and phishing schemes that diverted corporate wire transfers, including a $1.68 million payment from an Iowa City victim and a $720,000 payment from an Ohio victim. Odimegwu received 111 months and must pay over $366,000 in restitution, while Mogaji got 78 months and owes nearly $996,000, with both facing three years of supervised release afterward.
bleepingcomputer.com
· 2026-09-29
A cybersecurity vendor is promoting 'Identity Telemetry,' a real-time monitoring approach meant to complement traditional Identity Governance tools like role-based access and periodic reviews. The pitch argues that static governance policies alone cannot detect breaches as they happen, and organizations need continuous visibility into identity events to catch active threats.
bleepingcomputer.com
· 2026-09-29
Criminals in Portugal, France and Germany have been mailing counterfeit credit cards and letters warning recipients that their card is expiring, urging them to scan a QR code to "activate" a replacement. The code leads to a fraudulent banking site that harvests login credentials, giving attackers access to victims' real accounts. Some fake cards even bear the recipient's actual name to increase credibility, according to digital banking advisor Georg Hauer.
wired.com
· 2026-09-26
Asus disclosed that a breach affected part of its eShop platform, exposing customer contact details and order records, though it says no payment or financial data was compromised. The company has not specified how many customers were affected, which regions were involved, or how long the breach lasted, and says it has contained the incident and is investigating.
tomshardware.com
· 2026-09-25
GoKawiil