This week’s cybersecurity news highlights a growing trend: attackers are relying less on hacking passwords and more on tricking people, exploiting software vulnerabilities, and abusing legitimate services. Security researchers report that vulnerability exploitation has now surpassed stolen passwords as the leading cause of breaches, while ransomware continues to appear in nearly half of all major incidents.
🎣 New Phishing Attack Bypasses MFA
The FBI has warned about a phishing toolkit known as Kali365 that can compromise Microsoft 365 accounts without stealing passwords. Instead, attackers abuse Microsoft’s legitimate OAuth device login process, tricking victims into approving access to their accounts. Once approved, criminals can access Outlook, Teams, OneDrive, and other Microsoft services even when multi-factor authentication (MFA) is enabled.
What you should do:
- Be cautious when asked to enter a Microsoft device code.
- Never approve a login request you did not initiate.
- Regularly review your Microsoft account’s active sessions and connected devices.
⚠️ Browser “Scareware” Campaign Targets Millions
A new scam known as CypherLoc has reportedly affected millions of users. Victims receive a phishing email that opens a malicious webpage which locks the browser into full-screen mode and displays alarming fake security warnings. The page often shows your IP address and urges you to call a fake support number.
Remember: Legitimate security companies will never lock your browser or demand that you call a phone number immediately.
🌐 Major Data Breach Impacts Millions
Carnival Corporation disclosed a breach affecting nearly six million customers. Stolen information may include names, addresses, phone numbers, email addresses, birth dates, and government-issued identification details. The incident appears to have originated from a social engineering attack against an employee account.
What you should do:
- Watch for suspicious emails, texts, and phone calls.
- Consider placing fraud alerts on your credit file if you were affected.
- Enable MFA on all important accounts.
🔄 Patch, Patch, Patch
Security experts continue to stress that unpatched software remains one of the easiest ways for attackers to gain access. Recent reports show organizations are struggling to keep up with critical updates, while attackers are exploiting vulnerabilities faster than ever. Google also recently released Chrome updates addressing multiple security flaws.
Take 5 minutes today to:
- Update Windows, macOS, or Linux.
- Update Chrome, Edge, Firefox, or Safari.
- Update mobile devices and installed apps.
- Remove software you no longer use.
💡 Security Tip of the Day
Treat unexpected urgency as a warning sign.
Whether it’s a phone call claiming your account is locked, an email demanding immediate action, or a pop-up warning of infection, cybercriminals succeed when they create panic. Slow down, verify independently, and never let urgency make security decisions for you.
Stay safe,
Ron’s Daily Security Alert
Helping everyday people stay safe online, one step at a time. 🔒
Sources: FBI phishing warning, Verizon Data Breach Investigations Report findings, Carnival breach disclosures, and current threat intelligence reporting from this week.
Leave a Reply