Security researchers from Check Point have discovered an active phishing campaign that uses Google Classroom as a gateway. Within a week, the attackers sent over 115,000 fraudulent emails.

Researchers have tested the effectiveness of various phishing training courses in a study involving 19,000 test subjects. The result: training courses help less than expected.

Passkeys and FIDO authentication are designed to provide robust protection against phishing attacks. However, researchers have now discovered a critical loophole that can undermine even strong passkey authentication. Attackers can exploit a targeted downgrade technique to force users into using insecure login methods. This risk grows as FIDO adoption spreads across organizations.

Cyber criminals are currently using a sophisticated trick to carry out targeted phishing attacks. The method abuses Proofpoint's link wrapping system and leads unsuspecting users to manipulated Microsoft 365 pages.

ClickFix is already being used by a number of nation-state actors such as APT 28 and Kimsuky. The distribution of stealer malware such as Lumma Stealer via the social engineering campaign is particularly popular.

Cybercriminals are becoming more sophisticated, and one of the most dangerous tactics they use against businesses is spear phishing. Unlike traditional phishing, which involves sending mass emails to random recipients, spear phishing is highly targeted.

General Dynamics, one of the largest defense and aerospace companies in the USA, has fallen victim to a targeted phishing campaign. Attackers managed to gain access to the social security accounts of several dozen employees.

A new, highly sophisticated form of phishing is alarming security experts. Cyber criminals are using artificial intelligence and sophisticated spoofing techniques in a new scam to deceive over 2.5 billion Gmail users.