Financial Spear Phishing Digest

• Trusted account compromise: A phishing link posted on Coldcard’s official X account demonstrates how hijacked corporate social channels deliver...

Hoxhunt's platform enables evaluation of human resilience through adaptive, behavior-focused simulations rather than static completion metrics.

-...

• ProFTPD CVE-2015-3306 (CVSS 10.0) enables unauthenticated file writes via mod_copy, exposing decade-old FTP servers in credit unions.
• ONLYOFFICE...

US domain seizures of Microscan and FishHub tools show partial defensive value by blocking reconnaissance and post-compromise access for China-linked...

Traditional link inspection fails against vendor impersonation, which often uses no links—just routine invoice or remittance-change requests.

Key...

Fully automated AI-written spear phishing achieved a 54% click-through rate that matched human expert messages.

Intelligence analysts spot programme convergence through repeated joint advisories and court seizures targeting the same Chinese contractor ecosystem,...

AI tools now let attackers produce voice clones and deepfake videos that convincingly impersonate bank staff or executives, while generating polished...

Microsoft Teams will surface signals from certified third-party deepfake detectors analyzing meeting audio and video for synthetic manipulation, while...

CFOs face rising AI executive impersonation via deepfakes, but detection alone fails due to multi-bank blind spots.

• Scale of threat: 81% of firms...

Familiar conversation context now drives business email compromise more than suspicious senders. Attackers compromise vendor inboxes or hijack ongoing...

Researchers at UC Berkeley's Human Rights Center analyzed 6TB of leaked Mexican military emails using graph databases to map personnel networks and...

Financial teams blocking domains waste effort on assets attackers replace in under 24 minutes for roughly a dollar.

• Servers persist across...

Generative AI has eliminated spelling and grammar tells in phishing lures, with machine-written content reaching at least 51% of spam by April...

In the Georgia agricultural vendor scam, payment requests from an address differing by just a character or two bypassed routine checks, resulting in...

Attackers now embed traditional phishing lures alongside hidden prompt injections in the same message, targeting financial workflows where AI...

Compromising an identity and access-management system turns a single intrusion into prolonged exposure, as attackers leverage legitimate profiles to...

AI lowers barriers to trust-building in financial fraud by enabling scalable deepfakes, voice cloning, and synthetic IDs for impersonation and...

Process-name impersonation of SpamSniper and ShareTech lets BPFDoor variants and AVERAT conceal persistence and C2 on telecom appliances by mimicking...

• AI-brand impersonation offers free Claude Max subscriptions to target Google accounts
• Realistic design copies official logos, colors, and genuine...