Latest cybersecurity reporting from selected sources.

Also, US Sanction Cybercrime Enablers, Celine Dion Ticket ScamThis week, ransomware victims paying less, cybercrime sanctions, Celine Dion ticket scams, 23andMe to pay $18 million, a 13-year old Daixin infection, Spiral ransomware, Patch Tuesday, CISA ordered rapid SharePoint patching and Spanish police busted a cybercrime ring. Sore Egyptian World Cup losers.

Complaint Says Service Generated More Than 1.5 Million Malicious URLsGoogle has sued a Chinese phishing-as-a-service provider accused of teaching customers to use Gemini to generate and customize scam websites, a campaign linked to more than 1.59 million phishing URLs, over 100,000 victims, and widespread credential and financial theft.

Victims Increasingly Face Multiple Compromises From a Single IncidentIdentity theft scams are increasingly unfolding as coordinated, AI-assisted attack chains that begin with phishing or impersonation escalate into account takeovers, device compromise and broader fraud, according to the Identity Theft Resource Center.

Top European Court Advisor Says Policy Should Be 'Refund Now, Sue Later'Banks must promptly refund phishing victims when the scams lead to unauthorized transactions, an advisor to the European Union’s top court has said. The case in question involves an unnamed Polish woman who got duped on an online auction platform.

Bitcoin Joining Fee for Affiliates and No Proven Victims Cited by ResearchersNewcomer ransomware group 0APT is being branded a "likely scam operation," not least after a list of over 200 supposed victims turned out to be bogus, if not entirely AI-generated - never mind a 1 bitcoin joining fee for would-be affiliates and outdated crypto-locking malware.

Little Progress Made to Mandate Customer Reimbursement for Financial ScamsFinancial scams and synthetic identity fraud showed no signs of slowing in 2025, as regulators focused on fraud prevention over reimbursement for victims. But some countries joined the United Kingdom in advancing new anti-scam measures that focus on prevention and industry accountability.

UN Says Southeast Asian Scam Centers Generate $41 Billion in Illicit Annual ProfitsSoutheast Asian scam centers tied to $41 billion in illicit annual profits gleaned from romance and investment scams, ongoing gambling, and holding some of the hundreds of thousands of victims trafficked to work at the centers to ransom, continue to fuel geopolitical conflict across the region.

Only Regulations Can Convince Meta to Cut Its Revenue Stream From Fraud VictimsHow motivated would you be to stop a source of revenue if you discovered that some of your advertisers are scamming your customers? Most businesses would want to protect their customers. In the strange universe of social media giant Meta, incentives for doing the right thing are totally different.

Users Download Malware in Bid to Placate MetaA newly surfaced FileFix social engineering campaign puts a new spin on ClickFix attacks by goading users into loading malware under the guise of reporting a wrongful account suspension to social media giant Facebook. Victims likely get sucked into the scam by following a link from a phishing email.

Apate.ai CEO Dali Kaafar on Turning the Tables on Fraudsters With AI-Powered BotsMajor banks in Australia are now using bots to foil scammers. The bots are designed to pose as potential victims, extract real-time intelligence and waste scammers' resources. The data is then pushed directly into fraud detection systems used by banks, telecom providers and government agencies.

Apate.ai CEO Dali Kaafar on Turning the Tables on Fraudsters With AI-Powered BotsMajor banks in Australia are now using bots to foil scammers. The bots are designed to pose as potential victims, extract real-time intelligence and waste scammers' resources. The data is then pushed directly into fraud detection systems used by banks, telecom providers and government agencies.

$150 Million Stolen From Victims and Laundered, Allege Federal ProsecutorsFour Ghanian nationals have been charged with stealing more than $100 million by perpetrating romance scams and business email compromises against U.S. organizations, as well as laundering the stolen proceeds. Three of the suspects have been extradited to the United States to stand trial.

Also: ToolShell Hits South Africa, Most Americans Are Online Fraud VictimsThis week: Did China sneak a peek into ToolShell? ToolShell hacking in South Africa, Cisco flaws, an Arizona woman sentenced for aiding North Korea. Most Americans scammed online, a NASCAR data breach and a claimed data leak at France's Naval Group. Orange telecom disrupted. Dating app Tea breach.

Also: Scammer Gets 12-Year Sentence for Dodging RestitutionAbacus Market's suspected exit scam, crypto scammer gets 12 years for dodging restitution, GMX exploiter returns funds, BigOne's $27M hack, Arcadia Finance's $3.5M theft, NZ woman's trial for alleged murder and a DOJ crypto fraud filing's potential unmasking of MoonPay victims.

Mandiant Says Malware Spread Through Fake AI Video Ads Seen by MillionsOnline scammers are converting excitement over generative artificial intelligence into fraudulent sites that infect victims with malware, says threat intel firm Google Mandiant in a report exposing a year-long campaign to distribute infostealers and backdoors.

FIs Must Invest in AI-Fueled Behavioral Biometrics to Go Beyond Static CredentialsScammers are increasingly turning to account takeover fraud, as financial institutions ramp up their defenses. Instead of luring victims into making authorized transactions, cybercriminals are bypassing them altogether, hijacking their digital identities and draining accounts from within.

Also, Oracle Denies Cloud Breach, Blames Hack on Obsolete ServersThis week, Port of Seattle notified victims, Oracle blamed hack on obsolete servers, Google and Microsoft released April patches, WK Kellogg breached, six arrested in Spain for AI-investment scam, Scattered Spider's "King Bob" pleaded guilty, SmokeLoader users busted.

Jason Costain on Ways Traditional and Digital Banks Could Learn from Each OtherDigital-only banks promise speed and sleek digital experiences but are not the best places to handle scam victims. Without branches to visit, victims find themselves stuck in a loop of chatbots, said Jason Costain, former head of fraud analytics and threat management at NatWest Group.

Jason Costain on Ways Traditional and Digital Banks Could Learn from Each OtherDigital-only banks promise speed and sleek digital experiences but are not the best places to handle scam victims. Without branches to visit, victims find themselves stuck in a loop of chatbots, said Jason Costain, former head of fraud analytics and threat management at NatWest Group.

Also: Hackers Use npm Packages, MassJacker Malware and Fake $TrumpThis week, Garantex admin arrested, hackers used npm packages to steal crypto data and deployed MassJacker malware to steal coins, infected victims with $Trump lures. Also, U.S. authorities seized hacked Ripple funds and a California warning about scams.