Latest cybersecurity reporting from selected sources.

The North Korean state-sponsored hacking group known as ScarCruft (aka APT37) has been observed using spear-phishing messages impersonating Microsoft Account security notifications to deliver a new malware called NarwhalRAT

North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim's KakaoTalk desktop application to distribute malicious payloads to certain contacts

LastPass warns customers it has not been breached, after phishing emails falsely claim a hack and urge users to update their desktop app

2020 Hack Has Cost EyeMed About $12.6M in Multiple Regulatory Fines, SettlementsBenefits provider EyeMed Vision Care has agreed to pay $5 million and improve its security practices to settle class action litigation involving a 2020 phishing breach. The incident has been the subject of previous multimillion dollar settlements and enforcement actions by multiple state regulators.

Medication Tech Firm Says Hacking Incident Contained to One Employee Email AccountA Florida firm that offers medication therapy management services to health plans is notifying nearly 150,000 individuals that their information was potentially compromised in a phishing attack affecting one employee's email account for only about an hour. Why do users still fall for phishing scams?

Organizations in 12 States Hit by 2024 Integrated Oncology Network Phishing CaseAt least two dozen cancer care centers and oncology practices in 12 states are reporting to federal regulators that nearly 123,000 patients were affected by a 2024 email phishing breach involving its parent organization, Integrated Oncology Network, which is owned by Cardinal Health.

Large Health Data Breach Started With Phishing Lure in Employees' EmailTennessee-based Numotion, one of the largest U.S. providers of wheelchairs and other health-related mobility products is notifying nearly 500,000 people of a 2024 email hacking incident that potentially compromised their personal and health-related information.

Russian SVR Targeting Government, Academia, Defense Organizations GloballyA Russian-state hacking group is posing as Microsoft employees and sending malicious configuration files as email attachments to target organizations across the world. The campaign has the hallmarks of a Midnight Blizzard phishing campaign although its use of an RDP configuration file is novel.

Aviram Azari Bombarded Climate Climate Activists With a Torrent of Phishing EmailsAn Israeli private eye faces nearly seven years in U.S. prison after admitting he had overseen a hacking campaign against climate change activists. A Manhattan federal judge on Thursday sentenced Aviram Azari to 80 months in prison after he pleaded guilty in April 2022.

Microsoft on Tuesday said it took steps to disable fake Microsoft Partner Network (MPN) accounts that were used for creating malicious OAuth applications as part of a malicious campaign designed to breach organizations' cloud environments and steal email

The FanDuel sportsbook and betting site is warning customers that their names and email addresses were exposed in a January 2023 MailChimp security breach, urging users to remain vigilant against phishing emails. [...]

The FanDuel sportsbook and betting site is warning customers that their names and email addresses were exposed in a January 2023 MailChimp security breach, urging users to remain vigilant against phishing emails. [...]

Phishing campaigns involving the Qakbot malware are using Scalable Vector Graphics (SVG) images embedded in HTML email attachments

An Iranian-aligned hacking group uses a new, elaborate phishing technique involving multiple personas and email accounts to lure targets into opening malicious documents. [...]

A new business email compromise (BEC) campaign has been discovered combining sophisticated spear-phishing with Adversary-in-The-Middle (AiTM) tactics to hack corporate executives' Microsoft 365 accounts, even those protected by MFA. [...]

OpenSea warns users that they are likely to be targeted in phishing attacks after a vendor employee accessed and downloaded its email list.

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new wave of social engineering campaigns delivering IcedID malware and leveraging Zimbra exploits with the goal of stealing sensitive information

Details of a new nation-state sponsored phishing campaign has been uncovered setting its sights on European governmental entities in what's seen as an attempt to obtain intelligence on refugee and supply movement in the region

Ukraine's Computer Emergency Response Team (CERT-UA) has warned of Belarusian state-sponsored hackers targeting its military personnel and related individuals as part of a phishing campaign mounted amidst Russia's military invasion of the country

The Computer Emergency Response Team of Ukraine (CERT-UA) warned today of a spearphishing campaign targeting private email accounts belonging to Ukrainian armed forces personnel. [...]