Nature Futures' fiction section has released a new short story, 'ESC (DC)²,' following a hacker who hitchhikes through rural Iceland toward a decommissioned facility called Skýborg while preparing a covert intrusion. The narrative blends tradecraft jargon with a tense, atmospheric journey across snowy terrain near Egilsstaðir. The piece ends mid-scene as the protagonist approaches a cluster of black structures guarded by armed figures.
nature.com
· 2026-11-06
Binance disclosed that North Korean hackers posed as job recruiters to contact a wallet-team engineer, then convinced them to download a malicious 'coding assignment' that bypassed the company's security tools. The initial breach let attackers pivot through an internal tool to compromise two more engineers' machines, eventually gaining access to systems controlling billions in crypto assets, resulting in a record $6.3 billion theft.
techcrunch.com
· 2026-11-03
Binance disclosed that attackers used a multi-stage social engineering campaign, including bogus job interviews, to compromise an engineer's computer, then used a hijacked internal AI tool to take control of two more employees' laptops. This access was used to drain Binance's wallets of $6.3bn in cryptocurrency, prompting the exchange to suspend global withdrawals until service resumed on Sunday.
bbc.co.uk
· 2026-11-03
A new TransUnion report finds that fraudsters increasingly target established customer relationships rather than sign-up processes, using social engineering, deepfakes, text spoofing and stolen credentials to impersonate customers or brands. Account login made up 53% of suspected digital fraud in the first half of 2026, and 58% of organizations said fraud is evolving faster than their ability to detect it.
darkreading.com
· 2026-10-23
Microsoft will roll out AI-powered, context-aware phishing detection in Teams starting in early November 2026, with general availability expected worldwide by mid-December. The feature analyzes conversation context—particularly in external first-contact chats—to spot phishing, impersonation and social engineering attempts without relying solely on malicious links or files, and Microsoft says it won't retain message content for training or other purposes.
bleepingcomputer.com
· 2026-10-23
Security researchers describe a growing cybercriminal tactic of targeting executives' family members and friends, who often lack the security training given to leadership, to gain backdoor access into corporate systems. Google Cloud's Office of the CISO warned in March that personal attacks against executives are rising, and BlackCloak's Brian Hill notes attackers can map a household's routines and relationships through reconnaissance before pivoting to impersonation, device compromise, or phishing.
darkreading.com
· 2026-10-09
ASOS revealed that hackers impersonated a trusted contact to obtain an employee’s login details, which were then used to access data on third-party platforms. The breach exposed customer names, contact information, and some non-sensitive account data, but not payment details or passwords. The company has secured affected systems and is investigating with external support and authorities.
bleepingcomputer.com
· 2026-10-08
Security researchers at Flare identified a ClickFix social-engineering campaign distributing the CrocoRat remote access Trojan and cryptocurrency stealer via a misspelled domain showing a fake house-wiring image. Instead of fetching malware directly, the pasted PowerShell command queries an attacker-controlled DNS TXT record, which returns instructions for the next stage of the attack.
darkreading.com
· 2026-10-06
A technology writer describes receiving a highly personalized PR solicitation email that referenced detailed facts about their book and career, prompting a closer look at how scammers now use AI to craft convincing, tailored pitches. The piece compiles guidance on recognizing red flags in such messages and verifying unsolicited outreach before responding.
fastcompany.com
· 2026-10-03
Apple has introduced a security feature called Impersonation Risk Detection in iOS 27 and iPadOS 27 aimed at flagging social engineering scams. When a supported app detects a user is about to take a sensitive action, like making a payment or changing a password, it analyzes account and device signals and returns one of three risk levels: unknown, medium, or high. The receiving app then determines how to respond to that risk score.
zdnet.com
· 2026-09-30
Apple has introduced a new opt-in security feature called Impersonation Risk Detection in iOS 27 and iPadOS 27, designed to identify social engineering scams as they happen. The feature runs entirely on-device, analyzing behavior in real time and sending only a risk label—not underlying personal data—to supporting apps.
engadget.com
· 2026-09-29
BleepingComputer is partnering with Material Security for a live webinar on September 23 examining documented Google Workspace breaches. Speakers Rajan Kapoor of Material Security and Rick Fitzgerald of Fireside Consulting will dissect two incidents where attackers used social engineering and rogue OAuth apps to gain access, then walk through the response decisions that followed.
bleepingcomputer.com
· 2026-09-22
GoKawiil