The Source for Cyber Insurance News, Insights and Data
Attackers are getting past multi-factor authentication by having employees complete it for them, Ontinue’s first-half threat report shows. Device-code phishing and fake IT support calls on Microsoft Teams both work this way. For underwriters, a yes on the MFA question now says less. The victim signs in on Microsoft’s real page. They pass multi-factor authentication … Read more
Proofpoint says a China-aligned group posed as former White House staff and other AI policy figures to phish US experts. Its kit relays the genuine Microsoft sign-in, so the password and the MFA code both work. Proofpoint recommends phishing-resistant MFA such as passkeys. The first email asks for nothing. It invites an AI policy expert … Read more
A Token For The Pause Button: Social Engineering Losses And The Click Habit It’s 2003. Stage. Steve Jobs. Black turtleneck. Mock turtleneck? And words of digital gospel: buying should be easy. No pause. No friction. Steve didn’t invent impulse. He just helped us lean further into it. Maybe it was even a leap. In 2003, … Read more
In football, or is it soccer, mistakes get a second look with VAR, and referees can issue a card right away. With phishing, there is no review. Once someone clicks a link, the damage is often done before anyone notices. According to new Hoxhunt research, criminals have been watching the World Cup schedule closely. Phishing … Read more
Bitdefender’s Antispam Lab has flagged a ransomware campaign aimed squarely at small businesses. The emails impersonate Interpol. They claim investigators hold evidence of company wrongdoing. The attached “evidence” is malware. The campaign is worth an underwriter’s attention for one reason. The ransomware is basic. The social engineering carrying it is not. How the Scam Works … Read more