All news with #social engineering tag

Social-Engineered Help Desk Breach Costs Clorox $380M

🔐 Attackers affiliated with the Scattered Spider group exploited weak vendor phone procedures to obtain repeated password and MFA resets from Cognizant’s service desk, then used the access to escalate to domain-admin footholds at Clorox. Clorox says the intrusion caused roughly $380 million in damages, including remediation and extended business-interruption losses. The case highlights failure to follow agreed verification processes and the amplified risk of outsourced help desks. Organizations should enforce out-of-band caller verification, immutable reset logs, and automated containment to reduce the attacker window.

Data Is the New Diamond: Evolving Salesforce Data Theft

🔒 Recent Unit 42 analysis details ongoing data theft campaigns targeting Salesforce environments, notably a Salesloft Drift supply chain intrusion attributed to UNC6395 that may have started with reconnaissance as early as March 2025. Threat actors claiming links to Muddled Libra and Bling Libra have promoted stolen datasets on Telegram and announced new RaaS ambitions, while some channels were removed by September 5. Unit 42 emphasizes the prominence of social engineering by operatives tied to "The Com," predicts shifts toward data theft extortion and other monetization tactics, and recommends engagement with RH-ISAC, adoption of Salesforce mitigations, and use of Unit 42 incident insights to strengthen people and process defenses.

Latest Social Engineering Trends Targeting Enterprises

🛡️Social engineering remains the favoured vector as attackers combine psychological manipulation with accessible AI tools to target high-value corporate roles. Recent incidents show sophisticated pretexting, voice cloning and mass email flooding used to create urgency and extract funds or credentials. Fraudsters increasingly exploit collaboration platforms such as Microsoft Teams and legitimate utilities like Quick Assist to appear trustworthy and gain remote control. Organizations should harden collaboration settings, enforce conditional access and MFA, and reduce privilege scope to limit the blast radius of any compromise.

Affiliates Drive Growth of 'Soulless' Scam Gambling Network

🔍 A surge of polished scam gambling sites has been traced to a Russian affiliate program called Gambler Panel, which provides a turnkey "fake casino" engine, marketing templates, and step-by-step fraud guides. Ads promise $2,500 promo credits and lure users into making ~$100 cryptocurrency "verification" deposits that are then milked through pressured wagering. The program touts up to 70% revenue shares, a large affiliate base, and a Telegram vetting channel.

Crypto Firms Freeze $47M Linked to Romance Baiting

🔒 Several cryptocurrency firms, including Chainalysis, Binance, OKX and stablecoin issuer Tether, collaborated to block $46.9m in USDT tied to a Southeast Asia-based romance baiting (pig butchering) operation. Chainalysis traced payments from hundreds of victim wallets into five collector wallets and a consolidation address before funds were moved to intermediary accounts. At the direction of an APAC law enforcement agency, Tether froze the assets in June 2024, preventing those proceeds from reaching scammers.

BlueHat Asia 2025 Call for Papers Closes Sept 5 — Bengaluru

📢 BlueHat Asia 2025 in Bengaluru is now accepting talk submissions through September 5, 2025. Hosted by the Microsoft Security Response Center (MSRC), the two-day event on November 5–6 invites security researchers and responders of all experience levels to present findings, lessons learned, and industry guidance. Topics of interest include vulnerability discovery and mitigation, exploit development and detection, AI/ML security, IoT/OT and critical infrastructure protection, DFIR, social engineering, and reverse engineering. Submissions require a title and a sufficiently detailed abstract; a full academic paper is not necessary, and MSRC cases may be presented only after at least 30 days have passed since the associated fix was published. To explore co-presentation or partnership opportunities, contact bluehat@microsoft.com.

Applying AI Analysis to Detect Fraud and Exploits in PDFs

🛡️ VirusTotal has extended Code Insights to analyze PDF files by correlating the document’s visible content with its internal object structure. The AI inspects object trees, streams, actions, and the human-facing layer (text/images) to surface both technical exploits and pure social-engineering lures. In early testing it flagged numerous real-world scams—fake debt notices, QR-based credential traps, vishing alerts, and fraudulent tax-refund notices—that traditional engines missed when files contained no executable logic.

Why Muddled Libra Draws Disproportionate Media Attention

🛡️Unit 42 explains why Muddled Libra receives outsized attention: the group uses a consistent playbook, industry-focused waves of attacks, and unusually convincing English-language vishing that makes attribution and impact more visible. In 2025 cases, about 50% led to DragonForce ransomware deployment and data exfiltration, heightening executive concern. The report highlights practical defenses such as Conditional Access Policies and analytic correlation with tools like Cortex XSIAM to detect and disrupt operations.

Task scams: Don't pay to get paid — warning for jobseekers

⚠️ Task scams are rising employment frauds that lure jobseekers with easy micro-tasks and visible “earnings,” then pressure victims to pay to unlock funds. The schemes use gamification, spoofed sites and messaging apps, often asking for cryptocurrency deposits or “level-up” fees. Victims see initial fake gains, then lose payments with no recourse. Always verify recruiters and never pay upfront.