Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

knowbe4

New ConsentFix Technique Tricks Users Into Handing Over OAuth Tokens

Dec 30, 2025 By KnowBe4 Team In KnowBe4
Researchers at Push Security have observed a new variant of the ClickFix attack that combines “OAuth consent phishing with a ClickFix-style user prompt that leads to account compromise.” The technique, which the researchers call “ConsentFix,” tricks victims into copying and pasting a localhost URL containing an authorization token, then pasting it into a phishing page.
Read Post
memcyco

Fraud Team Postmortems and Account Takeover Prevention

Dec 30, 2025 By Ezra M. In Memcyco
Fraud analysts know the pattern too well. After an account takeover incident, the postmortem confirms what happened. A stolen credential was used. A bot executed a replay. A mule account attempted a transfer. Yet the origin of the compromise remains unclear. The postmortem becomes an autopsy on a loss that already occurred. The core issue is the Window of Exposure.
Read Post
knowbe4

Most Parked Domains Lead Users to Scams or Malware

Dec 29, 2025 By KnowBe4 Team In KnowBe4
Over 90% of parked domains now direct users to malicious content, compared to less than 5% a decade ago, according to researchers at Infoblox. “Parking threats are fueled by lookalike domains,” Infoblox explained. “No domain is immune. When one of our researchers tried to report a crime to the FBI’s Internet Crime Complaint Center (IC3), they accidentally visited ic3gov. Their phone was quickly redirected to a false “Drive Subscription Expired” page.
Read Post
11:11 systems

How to Spot and Avoid Scams: A Holiday Survival Guide

Dec 23, 2025 By Scott Gray In 11:11 Systems
Can you believe it? The holiday season is finally here! For many of us, that means nostalgic traditions, quality time with family, and—let’s be honest—a significant amount of online shopping. The convenience of browsing for gifts from the comfort of our homes is undeniable, especially in our hybrid work environment. However, this surge in digital activity and scams also signals the busiest time of year for cybercriminals.
Read Post
memcyco

Social Engineering Tactics 2026: How Attackers Are shifting from Email to 'Swipe-Up' Scams

Dec 23, 2025 By Ezra M. In Memcyco
The image of the cyber attacker is changing. For years, the industry focused on email gateways and typo-squatted domains like citi-bank-security.com. But according to Tzoor Cohen, CTI Lead at Memcyco, the battleground has shifted. In 2026, the most dangerous social engineering tactics typically don’t start in an inbox. They start on social media, utilize legitimate infrastructure like Bitly, and exploit the user interface (UI) of mobile devices to hide malicious intent.
Read Post
safeaeon

Deepfake Cyber Fraud Attacks: Risks, Examples, and Prevention

Dec 22, 2025 By SafeAeon Inc. In SafeAeon
Artificial Intelligence (AI) has been a revelation. It has changed the way things are done. AI is being used in almost every industry because it speeds up the ability to perform tasks and reduces the chance of errors. But there is a dark side to this highly advanced technology. Scammers are using AI to create sophisticated attacks and are achieving success with them. Deepfake cyber fraud attacks are one such type where malicious actors use deep learning techniques and AI to manipulate existing media.
Read Post
knowbe4

Unmasking the Deepfake Threat: A Game-Changer for Reducing Human Risk

Dec 18, 2025 By Roger Grimes In KnowBe4
Today, anyone can find a picture of absolutely anybody and it is also not difficult to find a sample of their voice. By combining these it is shockingly easy to create a realistic AI deepfake video of that person. The video may not be perfect, and an experienced AI deepfake enthusiast might be able to see signs of it not being real, but it will be good enough to fool 99% of people. Cybercriminals have been creating and using AI-enabled deepfake technologies since early 2024 to socially engineer people.
Read Post
memcyco

Account Takeover Detection in Action: The Telemetry Signals You're Missing

Dec 17, 2025 By Ezra M. In Memcyco
For most enterprises, account takeover (ATO) detection is a game of lagging indicators. You see the spike in failed logins at the WAF level, the impossible travel flag in your SIEM, or – worst case – the chargeback report weeks later. This latency exists because traditional defenses monitor the perimeter (the login endpoint) rather than the environment (the user’s browser). By the time a request hits your backend authentication service, the attack chain is already in its final stage.
Read Post
inetco

Tales from the fraud frontlines: How to avoid getting bitten by Visa VAMP

Dec 17, 2025 By Joe Kitos In INETCO
The Visa Acquirer Monitoring Program (VAMP) has quickly become one of the most discussed (and feared) compliance frameworks in the payments industry. With stricter enforcement beginning October 1, 2025, merchants and acquirers around the globe are scrambling to understand how to stay within Visa’s tightening thresholds and avoid painful penalties.
Read Post
inetco

INETCO's Bijan Sanii on Conversations Live: 'Cybersecurity is an arms race. AI today, quantum tomorrow'

Dec 16, 2025 By Joe Kitos In INETCO
At the recent Conversations Live with Stuart McNish panel on cybersecurity — part of the thoughtful public affairs dialogue series produced in partnership with the Vancouver Sun — industry leaders gathered to unpack the real-world risks shaping organizational resilience and national security. The event, held on Dec. 10, 2025, brought together experts from across the cybersecurity landscape to go beyond headlines and explore strategies for responding to evolving threats.
Read Post
knowbe4

Phishing Campaign Targets Executives With Phony Awards

Dec 16, 2025 By KnowBe4 Team In KnowBe4
A phishing campaign is targeting executives with phony offers for awards, according to researchers at Trustwave SpiderLabs. The attackers first dupe the victims into handing over their credentials, then use the ClickFix social engineering technique to trick them into installing malware. “The campaign uses a high-value executive recognition lure, ‘Cartier Recognition Program,’ to target executives,” the researchers write.
Read Post

FAIK Everything: The Deepfake Training Playbook

Dec 16, 2025 By KnowBe4 | Human Risk Management In KnowBe4
Learn how to understand, combat, and even create synthetic media in this essential deepfake training session with Perry Carpenter, KnowBe4's Chief Human Risk Management Strategist. Deepfakes and synthetic media are no longer futuristic threats—they are here now, and organizations are already experiencing deepfake-related attacks. A May 2024 study showed that 25.9% of organizations have experienced deepfake-related attacks, with other indicators suggesting the number may be closer to 90%. It is high time to prepare people to deal with this evolving threat.
View Video
knowbe4

Deepfake Training: A Strategic Advantage Against Emerging Threats

Dec 15, 2025 By KnowBe4 Team In KnowBe4
Deepfake attacks have become more compelling and realistic than ever before. Attackers are impersonating trusted leaders with convincing videos and voice, making it harder for employees to know what is real. Traditional awareness training is a good start, but nothing replaces first-hand exposure to real and synthetic content when it comes to telling deepfake videos from authentic ones. That’s why today we’re introducing KnowBe4’s Deepfake Training Content.
Read Post
persona

5 fraud and identity experts on 2025-2026 trends

Dec 15, 2025 By Louis DeNicola In Persona
As with previous years, we asked identity and fraud experts to reflect on the closing year and share a few predictions for the next. You’ll get unique perspectives from fraud fighters, researchers, and an executive. We asked them about unexpected fraud trends, which tactics will become more valuable, leadership’s changing perceptions, and AI, of course. But we kicked things off with a lighthearted question.
Read Post
inetco

INETCO CEO discusses global expansion and payment security on leading SME podcast

Dec 12, 2025 By Joe Kitos In INETCO
In a recent appearance on the CanadianSME Small Business Podcast, INETCO CEO and Founder Bijan Sanii shared strategic insights for Canadian companies pursuing global growth, particularly in fast-moving underserved markets where payment fraud and infrastructure challenges are rising. Here are the five most important takeaways from the conversation.
Read Post
memcyco

Cyber Threat Trends 2026: Why Timing, Not Sophistication, Now Defines Risk

Dec 12, 2025 By Eran Tsur In Memcyco
When it comes to cyber threat trends in 2026, risk will increasingly be defined less by new attack techniques and sophistication, and more by when defenses engage. Across malware delivery, identity abuse, fraud, misinformation, and brand impersonation campaigns, the same pattern keeps emerging. Damage rarely occurs because controls are missing entirely. It occurs because protection activates after exploitation has already begun. In short, attackers aren’t simply becoming more sophisticated.
Read Post
splunk

When Your Fraud Detection Tool Doubles as a Wellness Check: The Unexpected Intersection of Security and HR

Dec 11, 2025 By Matthew J Joseff, CFE In Splunk
Let’s face it: humans are creatures of habit, and nothing rattles us quite like the prospect of change. (Just ask anyone who’s dared to swap out the office coffee brand—revolutions have started over less.) According to SHRM's research on change fatigue, today’s relentless pace of disruption is exhausting employees faster than a budget ergonomic chair. But here’s where it gets fascinating—where security, HR, and fraud analysis converge in ways you might not expect.
Read Post

Deepfake Candidates Are Getting Hired - Here's How

Dec 9, 2025 By Cloudflare In Cloudflare
Hiring in 2025: Is the person you hired even real? Deepfakes resumes. Outsourced interviews. Candidates landing jobs they never intended to do. We've moved from KYC to KYE, and organizations haven't caught up yet. In the latest episode of The Connectivity Cloud Podcast, we explore how attackers are weaponizing the job market with Vladimir Krupnov and Blake Darché. For anyone in hiring, HR tech, or security leadership, this is a must-listen.
View Video
memcyco

MFA Isn't Enough: How Attackers Bypass Authentication and What Actually Stops Account Takeovers

Dec 9, 2025 By Ezra M. In Memcyco
Multi-factor authentication (MFA) became the industry’s default safeguard for login security. Yet attackers now bypass MFA at scale, often in seconds. Banks, fintech platforms, and digital enterprises are discovering the hard truth. MFA isn’t account takeover (ATO) prevention. It only verifies the user – and attackers have learned to compromise the session itself. Modern ATO defenses must protect beyond the login, inside the browser, and in real time.
Read Post
avast

Don't get scammed: Your holiday guide to spotting fake e-shops

Dec 8, 2025 By Aneta Šeráková In Avast
Avast advises how to spot fake e-shops, recognize new methods scammers use, and remain safe this holiday season. Holiday shopping is in full swing, and so is the hunt for great deals. As online shopping becomes the default for many, a shadowy industry of fake e-shops is growing right alongside it. The holiday season is the perfect time for scammers. People are hurried, stressed and busy getting the best gifts for their loved ones, which makes it harder to stay alert.
Read Post

How to Recognize Holiday Phishing Scams | The Eighth Day of Scam-mas

Dec 8, 2025 By Avast In Avast
On the 8th night of Scam-mas, Hannah Klein almost fell for a Hanukkah online scam. See how Avast Scam Guardian blocks phishing links and protects personal data. Stay safe from holiday online scams this season! SUBSCRIBE to our Avast channel for more tips, updates, and advice: YouTube.com/Avast CHAPTER TIMESTAMPS: FOLLOW US.
View Video
Credit Monitoring 101: What It Means and Why You Should Consider It

Credit Monitoring 101: What It Means and Why You Should Consider It

Dec 8, 2025 By SecuritySenses In SecuritySenses
Credit cards have inevitably become synonymous with modern spending habits and offer numerous benefits. However, they are also the gateway to credit card fraudsters and hackers who want your card information to make illegal transactions under your name. It's almost impossible to prevent data breaches, but you can still take ample measures to safeguard yourself. One of them is choosing the best identity theft protection service that offers reliable credit monitoring. Let's take a look at why you need this particular solution.
Read Post

How to Spot Tampered or Drained Gift Cards | The Sixth Day of Scam-mas

Dec 6, 2025 By Avast In Avast
On the sixth day of Scam-mas, Daniel discovers a gift card scam lurking on the shelf — but Avast helps him spot the warning signs before Deceivus can strike! Stay safe from tampered or drained gift cards this holiday season. SUBSCRIBE to our Avast channel for more tips, updates, and advice: YouTube.com/Avast CHAPTER TIMESTAMPS: FOLLOW US.
View Video
knowbe4

Report: Sophisticated Fraud Attacks Are on the Rise

Dec 4, 2025 By KnowBe4 Team In KnowBe4
Sophisticated online fraud techniques are growing more accessible to unskilled attackers, driven by AI tools and fraud-as-a-service platforms, according to Sumsub’s latest Identity Fraud Report. “hile the volume of attacks remains staggering, the nature of fraud is shifting,” the researchers write.
Read Post
frenetik

Cyber Startup Frenetik Launches with Patented Deception Technology That Bets Against the AI Arms Race

Dec 2, 2025 By Frenetik
While most cybersecurity companies pour resources into AI models, massive compute, hoovering up all the data, and enhanced analytics to detect and prevent threats, Frenetik, a Maryland cyber startup, is betting on something simpler: making sure attackers don't know what defenders know. The company emerged today with a fundamentally different approach using novel cyber deception and a newly issued U.S. patent to back it.
Read Post
cyjax

DefacinGit - Defacement page templates hosted on GitHub

Dec 2, 2025 By CYJAX In CYJAX
As explored in CYJAX’s recent blog, “PhishinGit – GitHub.io pages abused for malware distribution”, a core feature of GitHub is that it allows users to create and host free static webpages for repositories on github.io. Whilst this service is primarily used to display legitimate projects and host functional webpages, it is known to be used to host malicious files, infrastructure, and content.
Read Post
persona

3 takeaways from the 2025 EDUCAUSE annual conference

Dec 2, 2025 By Sam Breitbach In Persona
This year's EDUCAUSE brought together leaders from IT, security, enrollment, and student services. The theme, “Restoring Trust,” reflects the challenges that higher education institutions and professionals are facing. Fraudsters are using new tools and techniques to target faculty and students. Whether they’re trying to gain access to sensitive information or steal student aid, the potential danger is real.
Read Post
memcyco

Why Account Takeover Is a CX Problem, Not Just a Security One

Dec 2, 2025 By Julian Agudelo In Memcyco
Account takeover is usually and unsurprisingly approached as a security incident, yet much of the customer impact begins earlier in the journey, long before security teams detect or analyse the event. When users face friction, lockouts, or unexpected changes to their accounts, trust starts to erode. This makes the account takeover impact on customer experience a major determinant of brand trust and loyalty.
Read Post
knowbe4

Scammers Are Exploiting the Holiday Shopping Season

Dec 1, 2025 By KnowBe4 Team In KnowBe4
Users should be particularly wary of holiday-themed scams over the next few weeks, according to researchers at Malwarebytes. “Mobile-first shopping has become second nature, and during the holidays, it’s faster and more frantic than ever,” Malwarebytes says. “Fifty-five percent of people get a scam text message weekly, while 27% are targeted daily. Downloading new apps, checking delivery updates, or tapping limited-time offers all feel routine.
Read Post
Malvertising 101: When the Top Ad on Your Search Is a Trap

Malvertising 101: When the Top Ad on Your Search Is a Trap

Dec 1, 2025 By SecuritySenses In SecuritySenses
Online searching is something we do on a daily basis, often more than once, and we usually rely on the first result that appears. While it's the most practical solution, it's not the safest. In recent years, we've seen a growing threat called malvertising, which is a much more sophisticated trap than most of what we're accustomed to seeing. The numbers indicate that this is an increasing concern, and we'll explain how to protect yourself from it.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.