CoFense Scam News

Amazon Phish Hunts for Security Answers and Payment Information

OAuth Phishing Alert: Fake ‘Adobe Drive X’ App Abusing Microsoft Login

Stolen Information Used in Personalized Immigration-Themed Attack 

When Data Tools Become Dangerous: MS Power BI Links Used in Phishing Campaigns

Cofense Intelligence has continually observed the abuse or usage of legitimate domain service exploitation. This report highlights observed phishing threat actor abuse of .gov top-level domains (TLDs) for different countries over two years from November 2022 to November 2024.

The Cofense Phishing Defense Center (PDC) has discovered a new wave of sophisticated attacks that leverage judicial receipts for legal processes with multiple-layer techniques to distribute and execute SapphireRAT. 

Despite modern secure email gateways (SEGs) embracing AI capabilities, many phishing emails still reach users’ inboxes. Therefore, employees need proper training to be able to identify attacks.

Cofense Intelligence has recently issued a Flash Alert regarding a Social Security Administration-spoofing campaign that delivers ConnectWise RAT.

Cofense Intelligence has recently identified a series of end-of-year and holiday bonus-themed credential phishing emails.

A secure email is an email that uses encryption and authentication to protect the privacy and integrity of the shared information. 

Security awareness training (SAT) has been around for over a decade and is now common practice. Today, most responsible corporations run an SAT program. That might seem like a victory for internet security, and in a sense, it is. Yet, from the point of view of improving cybersecurity outcomes, most of the SAT field died years ago—innovation brains eaten away—leaving behind solutions walking around as “compliance checkbox” zombies. This is a huge problem.

The fight to protect digital systems from cyber criminals grows more challenging every day, especially with the rise of sophisticated tools like the recently discovered Rockstar 2FA phishing-as-a-service kit. Featured in a recent article from Forbes, this latest exploit is causing waves due to its ability to bypass two-factor authentication (2FA), a security measure that has previously been regarded as a gold standard.