You click a link. It takes you to a site that looks exactly right. The logo matches, the name checks out, and everything feels familiar. But something’s off. And before you realize what it is, you’ve handed over your login, your credit card, or worse, your network credentials. The trick wasn’t in the layout or the content. It was in the letters.
Cybercriminals are using homoglyphs—lookalike characters from other alphabets—to build fake domains that mimic real ones down to the pixel. A Cyrillic “а” is nearly identical to the Latin “a” your eyes expect to see. To a browser, they’re completely different. To a person, they’re the same. That’s the whole con. [Read more…]
A surveillance app marketed as a stealthy tool for parents has exposed sensitive data from over 62,000 users, raising fresh concerns about the real audience for apps like it.
Email authentication continues to improve, but DMARC is still widely misunderstood and often misused. The number of domains publishing DMARC records has grown steadily since 2023, especially in industries like finance, education, and healthcare. However, a large percentage of those domains are not enforcing any policy, which means spoofing and phishing attacks are still a serious concern.
Security researchers have identified two major exploits in the Secure Boot system, both capable of sidestepping one of the most important protections on modern PCs. Microsoft has issued a patch for one of them. The other remains untouched, even as it offers attackers a nearly universal method to bypass security during the startup process.
Hackers posing as IT support are targeting employees at large companies to sneak into their Salesforce systems and steal data. They start with a phone call, pretending to help with a routine issue. The real goal? To get the employee to connect to a fake version of Salesforce’s Data Loader tool. Once that happens, the attackers can quietly grab sensitive company data.