Microsoft Threat Intelligence and its Digital Crimes Unit disclosed a Chinese-language phishing ecosystem built around a marketplace called Yam Store, tracked as Storm-3119. The operation sold phishing kits and infrastructure, including repurposed Microsoft and Google domains, and since January has sent over one billion phishing emails and texts to more than 75,000 organizations worldwide. Microsoft and Resecurity identified three kits used in the campaigns—CoGUI, Haozi/Phoenix, and Iron Man System—linked to developers tracked as Storm-2990.
darkreading.com
· 2026-10-14
Microsoft and Japan's National Police Agency disrupted a cybercrime ecosystem that sent over a billion phishing messages to more than 75,000 organizations in 150 countries, including over 750 million targeting Microsoft customers this year. The investigation traced the activity to a marketplace called YAM Store, linked to phishing kits CoGUI, Haozi and Iron Man System, which sold compromised Microsoft and Google accounts and hijacked domains to impersonate real organizations.
bleepingcomputer.com
· 2026-10-14
Security researchers from Genians, Proofpoint, Digital Security Lab Ukraine and Enki White Hat report that North Korean state-linked hacking groups, including one tracked as TA406 (also known as Konni or Opal Sleet), have been spear-phishing Ukrainian government, policy and academic targets since at least February 2025. The campaign aims to gather intelligence on Ukraine's wartime position after North Korea began sending 14,000 to 15,000 troops to support Russia in October 2024.
darkreading.com
· 2026-10-13
Asos informed customers that hackers gained access to extensive personal data, including names, addresses, contact numbers, emails, customer IDs, and search queries on their platform. The breach was confirmed after cybercriminals contacted BBC News with samples of the stolen information, revealing the scope of the data compromised. The retailer emphasized that no payment or login details were accessed and warned customers to be vigilant against impersonation scams.
bbc.co.uk
· 2026-10-08
Security firm Island discovered a phishing campaign using fake ChatGPT, Gemini, Claude and Perplexity sites that target advertising agency staff and media buyers. The sites exploit the recent launch of Meta's Muse AI agent and use browser-in-browser techniques to fake Google login windows, capturing credentials and MFA codes to hijack high-value ad accounts.
bleepingcomputer.com
· 2026-10-06
Nikkei revealed that unknown hackers accessed two employee email accounts, one of which was used to send thousands of phishing emails in September. The breaches involved a Google Workspace account in July and a Microsoft 365 account in September, prompting the company to change passwords and warn staff about ongoing threats. No customer or reader data was affected in these incidents, according to Nikkei.
bleepingcomputer.com
· 2026-10-06
Proofpoint researchers reported that China-linked group TA419 ran a July phishing campaign impersonating US officials, including a former White House science and technology policy staffer, to steal credentials from AI experts at US think tanks, universities, defense contractors and law firms. The campaign followed similar activity in February, when the group posed as an Anthropic employee to target a think tank AI policy expert, and is part of a pattern Proofpoint says dates back to at least April 2025.
darkreading.com
· 2026-10-05
A technology writer describes receiving a highly personalized PR solicitation email that referenced detailed facts about their book and career, prompting a closer look at how scammers now use AI to craft convincing, tailored pitches. The piece compiles guidance on recognizing red flags in such messages and verifying unsolicited outreach before responding.
fastcompany.com
· 2026-10-03
Security firm Huntress found attackers had built a Custom GPT named 'Plus 5.6' hosted on the real ChatGPT.com domain, designed to look like an official OpenAI model. The bot told users ChatGPT was unavailable and pushed them to a fake Cloudflare security check page that instructed them to copy and paste a Windows command, a technique known as ClickFix, which could install malware capable of accessing files, screens, webcams and microphones. Huntress says some victims reached the fake bot via a sponsored Google ad for 'ChatGPT' placed above organic search results.
androidauthority.com
· 2026-10-01
QR codes were created in 1994 by Denso, a Toyota parts supplier, as a way to speed up factory scanning by packing far more data into a single code than a barcode could hold. Engineer Masahiro Hara led the project, drawing on the board game Go for the grid design and testing printed materials to find a black-to-white ratio that scanners could reliably detect. The format spread slowly through Japanese camera phones before becoming a global fixture in payments, tickets, logins and marketing.
techspot.com
· 2026-10-01
Microsoft researchers say the Russian state-linked group Star Blizzard is using a new technique called RedFlick to deploy its CosmicPulse backdoor. The chain starts with phishing emails leading victims to open a VHDX virtual disk containing a disguised LNK file, which triggers hidden commands, a decoy PDF, and an MSI installer that sets up three scheduled tasks to reconnoiter the system and fetch further payloads, including a downloader called NOROBOT/BAITSWITCH that ultimately installs CosmicPulse.
bleepingcomputer.com
· 2026-09-30
Chijioke Timothy Odimegwu and Harafat Mogaji, former airmen stationed at Dover Air Force Base, were sentenced to a combined 189 months in federal prison for running business email compromise and phishing schemes that diverted corporate wire transfers, including a $1.68 million payment from an Iowa City victim and a $720,000 payment from an Ohio victim. Odimegwu received 111 months and must pay over $366,000 in restitution, while Mogaji got 78 months and owes nearly $996,000, with both facing three years of supervised release afterward.
bleepingcomputer.com
· 2026-09-29
GoKawiil