CoFense Scam News

The Cofense Phishing Defense Center (PDC) uncovered a phishing campaign that disguises malware as a digital event invitation, exploiting recipients’ curiosity to lure them into downloading a malicious file. The attack uses a fake CAPTCHA and invitation page to deliver a legitimate ConnectWise ScreenConnect installer, which threat actors abuse as a remote access trojan (RAT) to gain control of victims’ devices. This campaign highlights how simple social engineering tactics and the misuse of trusted software can lead to serious compromises, reinforcing the importance of phishing awareness, employee reporting, and effective threat detection.

Cofense’s Beyond Human Risk: Measuring Secure Behavior with an AI-Driven Platform webinar examined how Secure Behavior Management (SBM) closes that gap through competency measurement, which shows what employees can actually demonstrate rather than what they have completed. The Cofense platform brings together employee competency, real-world phishing behavior, and the actions organizations can take to improve readiness. This blog breaks down the 5 key takeaways from the session.

Cofense Intelligence has been tracking a series of email campaigns that target the accommodation industry with fake guest complaints or reviews that deliver blockchain technology-abusing malware. These emails appear to likely be a continuation of a prior series of predominantly Booking.com-spoofing emails that were seen delivering various remote access trojans (RAT) via ClickFix fake CAPTCHA websites. This report is a broad overview of these campaigns’ email templates, how the Ethereum and TON blockchains are being abused, and the similarities between the EtherRAT and TONResolver malware payloads found in these campaigns. 

Cofense Vision now fully integrates with Google Workspace, giving organizations a faster, more accurate way to find and remove phishing threats that reach Gmail inboxes. 

Lee Martin explores why security awareness programs need to move beyond measuring activity and risk to focus on whether employees are actually getting better at recognizing and responding to phishing. Cofense’s approach to Secure Behavior Management connects measurable employee competency with real-world phishing and remediation signals, giving organizations a clearer picture of what employees know, where gaps exist, and how they respond when real threats reach the inbox.

Cofense, the leader in intelligence-driven post-perimeter phishing defense, today announced an expansion of its AI-driven Phishing Defense Platform through Cofense Command Center, its orchestration layer for measurement and reporting. The new Competency Dashboard measures how employees recognize, report and respond to phishing threats, giving security teams evidence of program effectiveness rather than training completion. 

The Cofense Phishing Defense Center (PDC) team has recently investigated a newly emerged Ransomware-as-a-Service (RaaS) operation organized by the Global Group, a financially motivated cybercriminal group running a Ransomware-as-a-Service (RaaS) platform. Targeting high-value, large-scale enterprises across different industries, escalating threats to the global digital economy. Global Group is a rebranding of the legacy Black Lock and Mamona ransomware families by inheriting an established backend infrastructure, reusing core code artifacts, and launching an immediately scalable extortion enterprise. 

Threat actors are impersonating OpenAI and ChatGPT in phishing emails, using fake subscription payment alerts to create urgency and trick users into updating their billing information. The emails use legitimate-looking branding and redirect victims to convincing fake ChatGPT login pages designed to steal account credentials. As AI tools become more widely used, attackers are adapting familiar credential-theft tactics to capitalize on users’ trust in popular platforms like ChatGPT.

Threat actors are impersonating university leaders and using fabricated sexual misconduct allegations to pressure recipients into downloading Zoho Assist, a legitimate remote access tool abused to gain control of victims’ computers. The campaign uses convincing university branding and trusted services such as Google Drive to bypass email security controls, with more than 80% of observed targets tied to healthcare-related universities. Once installed, the RAT can enable threat actors to control the system, access sensitive information, transfer files, and potentially deliver additional malware such as ransomware.

Cofense AI is purpose-built for phishing, using expert-validated intelligence from real-world threats to identify malicious emails and continuously strengthen detection. It extends that intelligence across the phishing lifecycle, connecting campaign-level detection and rapid remediation with targeted employee training based on the threats organizations actually encounter. By combining explainable AI, auditable automation, and human oversight in one connected platform, Cofense helps security teams respond faster while turning each verified attack into stronger future defenses.

The biggest change in browser-related threats is not a new flaw in browser software. It is a shift in how threat actors operate. Instead of breaking into the browser, they increasingly trick the people using it by exploiting the trust employees place in familiar browser experiences and workflows. By mimicking legitimate login screens, software update prompts, authentication requests, and security checks that people see every day, threat actors persuade users to disclose credentials, grant access to their computers, or install malware. As a result, any browser-enabled device can become a target, making browser patching alone insufficient to prevent these attacks.

The blog explains how phone scams have become a highly scalable phishing tactic, with attackers impersonating trusted brands like Amazon, Microsoft, Apple, and others to trick recipients into calling fraudulent phone numbers by creating urgency and fear of account compromise or unauthorized purchases. It highlights how AI and low-cost tools make these campaigns easy to create, rapidly mutate, and distribute at scale, while outlining the simple process scammers use to launch them and the behavioral tactics they rely on to manipulate victims.