GoKawiil
Tech News
InfoHawk researchers identified 820 malicious domains impersonating 35 restaurant brands, most using the .delivery top-level domain, designed to mimic online food-ordering sites. The scheme reverse-proxies genuine restaurant websites but swaps in a fraudulent checkout form that collects credit card numbers and SMS verification codes sent by banks.
Cybersecurity firm KELA has identified an active scam network of 248 fraudulent domains impersonating 189 US banks and financial firms, many using patterns like 'secure-bank.com' or 'disable-bank.com.' The sites display fake 'suspended' notices to automated scanners and security researchers while remaining fully live and functional for the victims they target, according to KELA's report published Tuesday.
T-Mobile published a cybersecurity report claiming successful SIM swap attacks on its customers have fallen more than 99% since 2022, alongside a 99% reduction in phishing-related employee credential breaches. The carrier also says it has blocked billions of scam calls and texts, crediting stronger identity verification, biometric checks, and features like SIM Protection and Port-Out Protection.
Polymarket suspended trading on its international site after hackers stole roughly $2.6 million from about 700 traders, according to the Wall Street Journal. The company says the breach stemmed from a flaw in DebugBear, a third-party website monitoring tool, and has pledged to reimburse affected users. Polymarket's website was inaccessible at the time of reporting.
A new explainer outlines the different layers of email encryption, noting they guard against distinct threats such as account compromise, network eavesdropping, data breaches and physical theft. It emphasizes that connection-level encryption (TLS) protects data in transit between a device and an email provider, while other threats like phishing or accidental deletion require different safeguards.
Cofense reports an ongoing phishing campaign, active since September, that impersonates Anthropic by offering fake early access to a supposed new AI social media tool. Victims who click through are routed via GoTo Webinar links to a spoofed Zoom sign-in page designed to harvest Google or Microsoft account credentials through SSO.
Interpol's third annual Operation Serengeti, a two-month crackdown across 20 African countries and the US, resulted in nearly 1,500 arrests, recovery of $105 million in stolen funds, and the shutdown of almost 11,000 malicious networks. The operation targeted groups behind ransomware, phishing, and cyber-enabled fraud, building on prior sweeps that arrested 1,006 and 1,209 suspects in 2024 and 2025 respectively.
Surfshark reports that a counterfeit TikTok Shop site generated over 320,000 phishing blocks between May and September 2026, accounting for 19% of all global phishing domain blocks tracked by its web content blocker. The VPN provider says the fake site remained the most-blocked phishing domain into October and is still active, with overall monthly phishing blocks rising 524% from April to September.
The University of Copenhagen confirmed hackers breached one of its test environments, detecting the intrusion last Tuesday and disclosing it days later. Exposed data for roughly 525,000 people may include full names, national identity numbers, phone numbers and email addresses, while a later update added 20,000 staff and students whose campus access PIN codes were also compromised.
Capcom disclosed that a third party gained unauthorized access to its Capcom ID membership service, exposing email addresses for more than 11.7 million users. The company said personal details like birth dates, gender and nicknames were exposed for 43 accounts, and 196 account passwords were changed without authorization, though no credit card data was involved. Capcom said it detected the intrusion on October 19, blocked further access, and reported the incident to police and its security advisory board.
The New York Knicks sent staff an email offering free NBA championship rings, which turned out to be a simulated phishing test tied to owner James Dolan's cybersecurity push. Employees who clicked the link were required to attend mandatory cybersecurity training, according to The New York Times. Separately, The Athletic reported that many Knicks assistant coaches and longtime Madison Square Garden staff did not actually receive championship rings during the team's banner-raising ceremony.
Madison Square Garden employees received a late-September email claiming 'your Employee Championship Ring is here,' asking them to click a link and pick from two ring designs, according to The New York Times. Employees who clicked were required to attend a mandatory cybersecurity class, team sources told the Times, as owner James Dolan has grown increasingly concerned about cybersecurity.