Fake ChatGPT Custom GPTs Push ClickFix Attacks to Drop RAT
September 30, 2026
Threat actors use sponsored Google search ads for fake ChatGPT tools to run ClickFix attacks that trick victims into installing
Phishing
Fake ChatGPT Custom GPTs Push ClickFix Attacks to Drop RAT
Threat actors use sponsored Google search ads for fake ChatGPT tools to run ClickFix attacks that trick victims into installing remote access trojan malware.
Ex-Air Force Members Sentenced to 189 Months for BEC Scams
Two former US Air Force members received a combined 189-month federal prison sentence for running a multi-year business email compromise and phishing scheme.
Times Car Breach Exposes 6.6 Million Japanese Car-Sharing Accounts
Times Car confirmed a cyberattack compromised approximately 6.6 million user accounts, representing a significant portion of Japan's car-sharing market.
Over 16,000 Supabase Databases Exposed Due to Misconfiguration
Security researchers found more than 16,000 misconfigured Supabase databases with publicly readable tables exposing PII, passwords, and tokens.
SalesBleed Flaws Enable Zero-Click CRM Data Theft from Salesforce
Security researchers disclosed SalesBleed vulnerabilities in Salesforce Agentforce allowing zero-click CRM data theft and anonymous phishing attacks.
Microsoft Seizes 50 EvilTokens Phishing Sites, UK Arrests 2
Microsoft announced court-authorized takedown of EvilTokens phishing service on September 22, seizing 50 sites. UK police arrested 2 suspects. 12,000 inboxes compromised.
SideCopy Expands India Targeting to Academic Institutions
SideCopy threat actor expanded targeting from Indian government to academic institutions using spear-phishing with ReverseRAT and mshta.exe abuse, per Trellix research.
Fake LastPass Authenticator Uses Signed Driver to Disable EDR
Fake LastPass Authenticator installer distributed via GitHub installs Microsoft-signed kernel driver to disable antivirus and EDR before deploying password stealer.
Attackers Use BYOD Weaknesses to Access M365 via Graph API
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure and identify targets for extortion ...
Ohio Man Sentenced to 15 Years for AI-Generated Sextortion
Federal prosecutors secured a 15-year prison sentence for an Ohio man who created deepfake pornographic videos to extort victims in sextortion campaign.
Ex-Air Force Members Sentenced to 189 Months for BEC Scams
September 30, 2026
Two former US Air Force members received a combined 189-month federal prison sentence for running a multi-year business email compromise
Times Car Breach Exposes 6.6 Million Japanese Car-Sharing Accounts
September 29, 2026
Times Car confirmed a cyberattack compromised approximately 6.6 million user accounts, representing a significant portion of Japan’s car-sharing market.
Over 16,000 Supabase Databases Exposed Due to Misconfiguration
September 29, 2026
Security researchers found more than 16,000 misconfigured Supabase databases with publicly readable tables exposing PII, passwords, and tokens.
SalesBleed Flaws Enable Zero-Click CRM Data Theft from Salesforce
September 25, 2026
Security researchers disclosed SalesBleed vulnerabilities in Salesforce Agentforce allowing zero-click CRM data theft and anonymous phishing attacks.
Microsoft Seizes 50 EvilTokens Phishing Sites, UK Arrests 2
September 23, 2026
Microsoft announced court-authorized takedown of EvilTokens phishing service on September 22, seizing 50 sites. UK police arrested 2 suspects. 12,000
SideCopy Expands India Targeting to Academic Institutions
September 23, 2026
SideCopy threat actor expanded targeting from Indian government to academic institutions using spear-phishing with ReverseRAT and mshta.exe abuse, per Trellix
Fake LastPass Authenticator Uses Signed Driver to Disable EDR
September 23, 2026
Fake LastPass Authenticator installer distributed via GitHub installs Microsoft-signed kernel driver to disable antivirus and EDR before deploying password stealer.
Attackers Use BYOD Weaknesses to Access M365 via Graph API
September 11, 2026
Threat actors exploit BYOD gaps through vishing to gain M365 access, then use Microsoft Graph API to enumerate corporate structure
Ohio Man Sentenced to 15 Years for AI-Generated Sextortion
September 9, 2026
Federal prosecutors secured a 15-year prison sentence for an Ohio man who created deepfake pornographic videos to extort victims in
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.