News and Information

Deepfake, Deep Trouble

In this week’s scam, cybercriminals are using artificial intelligence (AI) to try to trick you into clicking malicious links. You receive a text message or voice call from someone claiming to be a senior United States government official. They will try to establish a friendly relationship with you by sounding genuine, making the official seem trustworthy.

But these messages are fake and were actually created by AI. No matter the message you receive, the “official” will eventually ask you to use a different messaging app to continue the conversation. They will then send you a link that will supposedly take you to the new app. However, the link is actually malicious. If you click it, cybercriminals will be able to access your data and personal information!

Follow these tips to avoid falling victim to a phishing scam:

• Be suspicious when strangers try to become friends quickly through texts or calls. Scammers will often try to become friendly with you so that you will be more likely to fall for their tricks.
• Never click on links sent to you by an unknown person. These links could install malware, steal your data, or take you to fake websites designed to capture your personal information.
• This scam is based in the United States but be careful about messages from anyone claiming to be a government official, even if they act friendly. Scammers could use similar tactics anywhere in the world to try to steal your data!

Don’t Pay This PayPal Invoice

Millions of people use PayPal to make secure payments online, but cybercriminals have figured out a way to use it maliciously. In this week’s scam, you receive a legitimate email from PayPal requesting that you make a payment. The email is actually from PayPal and even contains a real PayPal link. Even though the email is real, it’s part of a clever trick by cybercriminals.

The email that is sent to your email address is also sent to an email address you do not recognize. This unrecognized email address actually belongs to the cybercriminals. If you click the link in the email, their email address will be connected to your PayPal account. Once their email address is linked to your account, the cybercriminals will have full access to your PayPal account. They will be able to view all your account details, including your user credentials and financial information!

Follow these tips to avoid falling victim to a phishing scam:

• While this scam targets PayPal users, never submit payments after receiving an unexpected email. Instead, navigate directly to an organization’s official website or app to submit a secure payment.
• Check the email recipients carefully. Be suspicious of emails sent to multiple addresses, especially ones you don't recognize.
  Remember that emails can be malicious even if the sender’s email address is from a trusted domain. Cybercriminals can gain access to trusted domains to make their scams more believable.

From Jackpot to Jeopardy

If something seems too good to be true, it usually is, and this week's scam is no exception. Cybercriminals send you a message on a platform such as WhatsApp, offering you what sounds like an easy job. Supposedly, you will get paid to perform sets of easy tasks, such as liking videos or rating products online. This type of scam is known as a “task scam.”

The cybercriminals will actually pay you in cryptocurrency for completing your tasks during the early part of this scam to try to make this “job” even more convincing. However, you will eventually be asked to send them a large deposit of cryptocurrency so that you can “unlock” your next set of tasks. The cybercriminals claim you will get your money back and that they will pay you an even larger commission. If you send any money, you won’t receive anything in return. Your money will go straight into the cybercriminals’ bank accounts!

Follow these tips to avoid falling victim to a task scam:

• Never respond to unsolicited texts or direct messages about job opportunities. Real employers will not attempt to contact you this way.
• A real job opportunity won’t ask you for money to get paid. You should always be suspicious if you are asked to deposit money before you can receive your paycheck.
• Trust your instincts. You should always be skeptical of unsolicited job offers, especially if they seem too good to be true!

From Flow Charts to Phishing

You may have used Microsoft Excel, Word, and PowerPoint for work projects, but you might be less familiar with Microsoft Visio. Visio is used to make diagrams and flow charts. However, cybercriminals are using this tool to try to steal your user credentials. In this week’s scam, cybercriminals send you a phishing email that contains a link. The email appears legitimate, and it looks like a proposal or purchase order.

If you click the link, you will be taken to a Microsoft Sharepoint page that contains a Visio file. The Visio file contains another link, and you will be instructed to press your Ctrl key and click the link. If you press this key, it will bypass security features on your computer and allow the link to direct you to a fake Microsoft login page. The cybercriminals can see any information you enter here, and they are trying to trick you into giving them your sensitive information!

Follow these tips to avoid falling victim to a phishing scam:

• If you receive a suspicious email, be cautious. If you have doubts about the email’s legitimacy, follow your organization’s procedure to report it.
• Always be cautious when opening unexpected attachments or files, even if they appear to come from someone you might know.
• Always think before you click. Cyberattacks are designed to catch you off guard and trigger you to act impulsively. 
   

From Tickets to Email Trickery

If you recently bought a ticket to a local event, you may have used Eventbrite’s website or smartphone app. Eventbrite is an online platform that allows you to create, promote, and attend events. But cybercriminals are abusing this platform to steal your personal information and money. In this week’s scam, cybercriminals use Eventbrite to set up a fake event and then email you an invitation.

The Eventbrite email invitation contains realistic logos and brands, and it appears to be legitimate. But if you select the link within the email, you will be taken to a fake webpage that is actually controlled by cybercriminals. The webpage will prompt you to enter personal data such as your login information, tax identification number, and even your credit card number. The cybercriminals are trying to steal your personal details and funds!

Follow these tips to avoid falling victim to a phishing scam:

• Be wary of emails that urge you to take quick action. Phishing emails are designed to catch you off guard and trigger you to act impulsively.
• Never select a link in an unexpected email. In this case, it would be best to navigate to Eventbrite’s official website or smartphone app if you have concerns about tickets you’ve purchased.
• If you aren’t sure if an email you received is legitimate, contact Eventbrite’s customer support directly to verify.

Don't Let This Opportunity Knock

Cybercriminals frequently target people who are looking for opportunities. In this week’s scam, you might receive a text message or email with what looks like real job listings from a cybercriminal posing as a recruiter. The message even includes flexible hours, positions, benefits, and salary. If you reply, the cybercriminal asks you for further information, such as your pay expectations, making this scam convincing.

Then, they direct you to continue the chat through a separate app, such as WhatsApp, Skype, or Telegram. In that separate app, they ask for your personal information. They may ask for your Social Security Number, driver’s license number, or even your credit card number for application fees. The catch is that no real job recruiter will ask you to pay them a fee upfront. The cybercriminals are trying to steal your personal data and money!

Follow these tips to avoid falling victim to this employment scam:

• If you receive a text message from someone claiming to be a job recruiter, be cautious. Real job recruiters never reach out by text messages.
• Scammers will often ask you to reply to them in a separate app so that they can avoid security oversights. Always be cautious if someone asks you to respond to them using a different app or platform.
• Cybercriminals can pose as anyone, including job recruiters. If you receive a job offer that seems too good to be true, it probably is.

Don't Fall for This Blackmail Scam

Cybercriminals are always looking for ways to trick you into acting impulsively, and this scam is no exception. They obtain your personal information through data breaches and then use photos of your home accessed from Google Maps to play on your emotions. They claim that they have videos of you and other personal information that they will release if you don't pay a ransom.

In this scam, you receive an email with an attachment containing a photo of your home and your street address. The scammers claim they know where you live and that they’ve hacked into your home computer to take videos of you using its camera. Then, they threaten to release the footage if you don’t pay them with Bitcoin immediately. The photo of your home makes it seem like they could have actual videos of you, making their scam terrifying and convincing. The catch is that the cybercriminals don’t have any videos of you in your home. They are trying to scare you into giving them your money!

Follow these tips to avoid falling victim to this blackmail scam:

• Never click a link or download an attachment in an unexpected email.
• If you receive a similar email, do not respond or pay the ransom. Attacks like these are designed to catch you off guard and trigger you to act impulsively.
• Be careful with the personal information you share online. Cybercriminals can use this information to target you in phishing attacks.

Hurricane Scams

Scammers will frequently use high-profile events, such as natural disasters, to try to trick you. In the aftermath of Hurricane Helene in the United States, scammers have wasted no time in turning this situation to their advantage. They've been using AI to generate fake images that play on your emotions, to get you to donate your money to help people who have been affected by the disaster. Recently, an image of a scared little girl holding a puppy and being evacuated from a flood area has been circulating on Facebook and other social media.

However, this image is fake. The scammers are trying to trick you into clicking a link to "donate" to a fake relief effort or to steal your personal information. In either case, their goal is to get you to act impulsively. If you donate money or enter any personal information, it will not help any victims who were impacted by the hurricane. However, it will help the scammers steal your money and your data!

Follow these tips to avoid falling victim to a hurricane scam:

• Be wary of AI-generated images. Look for signs that an image might be fake, such as unusual details or inconsistencies.
  Make sure that the charity you’re donating to is legitimate. Only donate through the official websites of well-known charitable organizations.
• Don't act impulsively. Take time to research before donating or clicking on links, especially in the aftermath of a disaster.

The Shopping List Swindle

Walmart’s Lists feature allows you to create an online shopping list and share it with others. In this week's scam, cybercriminals are using Lists and malicious Google ads to steal your personal information and money. This scam begins when you search for Walmart’s customer service page on Google. You’ll see a sponsored ad result that claims to lead to a page that provides Walmart’s customer service information. If you click it, the ad will direct you to a Walmart List page. However, instead of containing normal shopping items, the List contains a phone number that appears to be for Walmart’s customer service team.

However, both the ad and the Walmart List were created by cybercriminals. If you call the number, you’ll be connected directly to a scammer. They will ask for your personal and financial information, and then they will attempt to scare you by saying that your account was used to transfer money illegally. The scammer will then try to pressure you into transferring your money into a Bitcoin account in order to prevent additional transactions. If you do transfer the money, it will go directly to the cybercriminals!

Follow these tips to avoid falling victim to a shopping list swindle:

• Be wary of clicking on Google ads. Anyone can buy a sponsored ad on Google, including cybercriminals.
• Be suspicious of anyone forcing you to act quickly. Scammers frequently attempt to trick you into acting impulsively.
• Always think before clicking on a link or providing your personal information, even on official websites. Trust your instincts and be on the lookout for anything that seems suspicious.
   

The Microsoft Forms Fakeout

Cybercriminals are using a tool called Microsoft Forms to try and trick you into giving them your Microsoft 365 or Adobe login information. Microsoft Forms allows you to create surveys, quizzes, and other documents. Unfortunately, cybercriminals are using this tool to create forms that contain malicious links. These fake forms can easily fool you into thinking they’re official Microsoft documents because they have convincing titles and even use Microsoft icons when viewed in a web browser.

In this scam, you receive an email instructing you to urgently change your password, read messages, or look at sensitive work documents. The email directs you to the form, prompting you to click a link. However, the link is malicious, and if you click it, you will be directed to a fake Microsoft 365 or Adobe login page. This page will prompt you to enter your sign-in details, such as your email address and password. If you enter your login credentials here, cybercriminals can steal them!

Follow these tips to avoid falling victim to a Microsoft Forms scam:

• Be cautious whenever you receive an urgent request, such as changing your password or viewing sensitive documents. Remember that cybercriminals play on your emotions by forcing you to act quickly.
• Before you click a link, always hover your mouse over it. Watch out for spelling mistakes or suspiciously long URLs that can hide a website's true domain.
• If you receive a suspected phishing email, follow your organization’s policies for reporting suspicious emails.
   

Don't Be Fooled By Fake Phone Numbers

Cybercriminals are using Google search results to try to trick you into calling a phone number that they control. If you search for an organization on Google, scammers can manipulate the search results to display a fake phone number for the organization. Don't take a chance of losing your investments on a risky phone call.

If you search on Google and call the fake number from one of these manipulated search results, you will be connected to a scammer. They will attempt to trick you out of your money by saying that your account needs updates or you need to transfer funds. They may ask you for your login information so that they can access your account. Once they gain access to your account, they can quickly transfer your funds to accounts that they control. This is one investment that you don’t want to risk!

Follow these tips to avoid falling victim to a phone number scam:

• Confirm that you are on the organization’s official website if you are going to buy one of their products or use one of their services.
• Double-check that the listed phone number is the same one on the organization’s official website.
• Report any fake listings, ads, or any other type of disinformation through Google’s Report services.

You Don't Want to Win This Phishing Prize

When it comes to staying safe online, it usually helps to remember an old rule: “If it seems too good to be true, it usually is.” In this week’s scam, cybercriminals are trying to trick you into forgetting this simple rule by sending you phishing emails. The phishing emails say that you have an opportunity to win a prize, usually from a major organization or brand, such as Marriott, Costco, Lowes, and more.

The emails vary slightly in their content, but they all offer you the opportunity to win a prize by simply clicking a button and providing some personal information. However, the emails were sent by cybercriminals. If you click the link, you will be directed to a webpage that they control. If you enter any personal or financial information here, the cybercriminals will be able to see it immediately. You won’t win any prize from clicking the links, but the cybercriminals will. They’ll be able to steal your data!

Follow these tips to avoid falling victim to a phishing scam:

• Major companies don’t usually give things away for free.
• Be very cautious of any unsolicited emails that offer something at no cost.
• Be very cautious when entering personal or financial information, especially after clicking a link in an email.
• If you need to enter your information online, make sure that you are on the organization’s official webpage.
• Look for signs of a phishing email. Most will contain a call to action, such as clicking a link in order to win a prize. If you aren’t sure about the legitimacy of an email, follow your organization’s policy for reporting suspicious emails.

Pastejack Attack

In this week’s scam, cybercriminals are trying to trick you into running malicious code using PowerShell, a powerful tool for executing commands on your computer. This technique is known as “pastejacking”, which involves copying and pasting malicious code into your computer and then allowing it to run.

This scam begins when you receive what appears to be an urgent email that contains an attachment. If you try to open the attachment, an error will display that says, “Failed to connect to the ‘OneDrive’ cloud service, to fix the error you need to update the DNS cache manually.” The message also provides a few lines of code and instructions on how to copy and paste it into a Windows PowerShell Terminal. The message urges you to take action, which is exactly what scammers want. If you follow their instructions, you will run a malicious command on your machine. The code will install malware, giving the scammers access to your personal data.

Follow these tips to avoid falling victim to pastejacking:

• You will never receive a legitimate email that tells you to open an attachment using PowerShell. If you receive an email instructing you to use PowerShell, immediately report it to your IT team.
• Be cautious of any emails that prompt you to take urgent action. Creating a sense of urgency is a common technique that scammers use to trick you.
• If you are unsure about the legitimacy of an email or attachment, contact your organization’s IT or security team for further instructions.

CrowdStrike Outage Phishing Scams

Recently, a mass IT outage caused confusion and chaos. A buggy software update deployed by the cybersecurity company CrowdStrike impacted Windows computers worldwide. Systems were affected globally, resulting in delayed flights, business closures, and more. However, what may be bad news for you could be good news for cybercriminals. Cybercriminals often seek to turn major events to their advantage by sending out phishing emails or text messages related to the event. By using a major event that you are familiar with, they hope that they can trick you into clicking on malicious links or attachments.

Shortly after the outage, cybercriminals began creating fake websites. The websites claim to belong to IT workers who can assist with troubleshooting the outage and restoring access to affected computers. There are files on the fake websites that appear to be software updates for Windows computers. However, these files actually contain malware. If you download them, malicious software can be installed on your computer, giving cybercriminals access to your personal data!

Follow these tips to avoid falling victim to any CrowdStrike-related scams:

• This specific scam involves fake websites, but remember that cybercriminals will exploit this event in different ways. Be on the lookout for any suspicious activity related to the CrowdStrike outage.
• Don’t download any files or attachments from websites or emails. Any troubleshooting related to the CrowdStrike outage should be addressed by your organization’s IT team.
• Be cautious of unexpected calls, emails, or text messages that seem urgent to respond to. Cybercriminals will try to use this outage to trick you into acting impulsively.
   

Don't Medal With Olympic Scams!

With the Paris Olympics beginning this week, be on the lookout for phishing emails and text messages pointing you to fake Olympics-branded websites or offering discounted merchandise or tickets. Cybercriminals will take advantage of all the excitement around the Olympics to try to steal your personal information or money.

Billions of cyberattacks were launched during the Tokyo 2020 Olympics, and this year’s event is proving to be just as popular. Online criminal activity has already increased, with fake Olympics tickets being advertised, counterfeit Olympics-branded websites appearing, and stolen personal information being sold online. If you are traveling to Paris to view the Olympic Games, you should also be aware of increased cybersecurity risks in the city - public Wi-Fi networks can be hacked to steal your personal data!

Follow these tips to avoid falling victim to any Olympics-related scams:

• Be cautious of unsolicited emails or messages about tickets or deals.
• If something seems too good to be true, it probably is. Only purchase tickets or souvenirs from official websites or vendors.
• If you are traveling to the event, avoid using public Wi-Fi networks or hotspots. These networks can be compromised by cybercriminals.
   

These Prime Deals Are Too Good to Be Real!

Amazon Prime Day is this week, and there are plenty of deals for you to take advantage of. However, cybercriminals are also looking to turn these deals to their advantage. In this particular scam, cybercriminals have created fake websites that look very similar to the real Amazon website. Then, they send you phishing emails and text messages that contain links to the fake websites they created.

The phishing emails and messages will sound alarming to try to trick you into clicking impulsively. They may say that there’s an urgent problem, that your account has been suspended, or that your payment details need to be updated. They will usually threaten to delete your account if the problem isn’t addressed soon. If you click the link in the email or message, you’ll be directed to a fake website. If you enter your login credentials or payment information, that data will be sent directly to the cybercriminals.

Follow these tips to avoid falling victim to an Amazon Prime Day scam:

• Check the URL of a website very carefully before entering any information. The URL may look very similar to the legitimate Amazon web page but will have subtle differences.
• Be cautious of unexpected emails or text messages, especially if they instruct you to click a link. If you suspect that there may be a problem with your Amazon account, it’s safer to navigate directly to Amazon’s website instead.
• If a deal seems too good to be true, it probably is. Be very skeptical of unrealistic deals and suspicious offers.
   

Is ChatGPT Your Next Financial Advisor?

ChatGPT, an artificial intelligence (AI) chatbot created by OpenAI, has risen in popularity since its release last year. Now, cybercriminals are using ChatGPT’s popularity to lure you into phishing scams. In one of these scams, cybercriminals try to trick you with a fake new ChatGPT feature.

The scam starts with a phishing email informing you that ChatGPT has a new feature to help you invest in the stock market. If you click the link in the email, you’ll be taken to a spoofed ChatGPT website and prompted to enter your contact information. Then, a representative will call you and request that you submit a payment to open your investment account. Unfortunately, if you submit a payment, that money won't help you invest in the stock market. Instead, cybercriminals will steal it to invest in their own malicious pursuits.

Follow the tips below to stay safe from similar scams:

• Before you click a link, hover your mouse over it. Make sure that the link leads to a legitimate, safe website that corresponds with the content in the related email.
• Be cautious of unexpected investment opportunities. Remember, if something seems too good to be true, it probably is!
• Never submit payments to a bank account provided in an email, text message, or phone conversation. Instead, navigate to the organization’s official website to submit a secure payment.

IT or Cybercriminal?

Coinbase, a cryptocurrency platform, was the latest victim of a social engineering attack. Social engineering occurs when cybercriminals manipulate you to try to steal your sensitive information.

In this recent attack, a cybercriminal sent smishing (SMS phishing) messages to Coinbase employees. These messages contained a link directing employees to log in to their company accounts. Shortly after one employee clicked this link, Coinbase saw and prevented the cybercriminal from gaining internal access. Later, the cybercriminal called the same employee and claimed to be from Coinbase’s IT department. The employee thought the call was legitimate, and the cybercriminal stole some sensitive information over the phone.

Follow the tips below to stay safe from similar scams:

• Always be cautious of unexpected text messages.
• Think before you click! Cyberattacks are designed to catch you off guard and make you act impulsively.
• Before you share any sensitive information over the phone, verify that the caller is actually who they say they are.

r/Cybercriminals: Spear Phishing

Reddit, a popular online community, was the latest victim of a spear phishing attack. Spear phishing is a targeted email attack that looks like it’s from a trusted source, but it’s actually from cybercriminals in disguise.

In this recent attack, a cybercriminal set up a fake website designed to steal login credentials. Then, the cybercriminal sent phishing emails to Reddit employees. The emails prompted employees to visit the fake website and enter their credentials. Through this attack, the cybercriminal was able to access sensitive information from Reddit and steal internal company data.

Follow the tips below to stay safe from similar scams:

• Make sure that the sender is actually who they say they are. If the sender claims to be someone you know, reach out to them in person or by phone to verify.
• Remember that spear phishing attacks can happen to anyone. Think before you click, and never click a link in an email that you aren’t expecting.
• Be careful with the information you share about yourself online. Cybercriminals can use this information to target you in phishing attacks.

Scams Related to the Turkey-Syria Earthquake

Last week, two earthquakes occurred in Turkey and Syria. Unfortunately, cybercriminals often use crises to get your attention and manipulate your emotions. Cybercriminals have already begun exploiting this event to try to scam you and steal your sensitive information.

In the coming weeks, we expect to see an influx of phishing attacks referencing this recent event. Cybercriminals may send phishing emails with links asking you to donate money or view “exclusive” videos relating to this news. Clicking these links could allow cybercriminals to steal your sensitive information or install malware on your device.

Follow the tips below to stay safe from these types of scams:

• Avoid making donations to unknown users. If you would like to donate to support a cause, donate directly through a trusted organization's website.
• Think before you click. Cyberattacks are designed to catch you off guard and trigger you to click impulsively.
• Stay informed by following trusted news sources. If you see a sensational headline, research the news story to verify that it’s legitimate.

Watch Out for Scams This Tax Season

In most countries, it’s cybercriminals' favorite time of the year: tax season. Taxes are a sensitive topic that can easily be used to catch your attention or manipulate your emotions. Over the next few months, cybercriminals will likely mention taxes in phishing attacks and disinformation campaigns.

Tax season is also a vulnerable time for your sensitive information. Tax documents from employers, banks, and other organizations typically include personally identifiable information. If cybercriminals get their hands on this information, they can use it to steal your identity, your money, and more.

Follow the tips below to stay safe during tax season:

• Always think before you click. Cyberattacks are designed to catch you off guard and trick you into clicking impulsively.
• Use extra caution when handling tax documents. For digital documents, use password protection. For physical documents, keep paperwork in a secure location and shred anything that is no longer needed.
• Be suspicious of emails, text messages, and social media posts that contain shocking information about taxes in your country. These messages could be disinformation, which is false information designed to mislead you.

Your Password Is Their Prize

In this week’s scam, cybercriminals are trying to steal your X (formerly Twitter) login information. They send you an email claiming that someone tried to log into your account from a new device, and you must log into X immediately to verify your account. In another version of this scam, you might receive a different email claiming your account violated copyright laws and that you must submit an appeal.

Both of these emails direct you to click a link to verify your account, which takes you to what appears to be an X login or password reset page. But these pages are actually fake and controlled by cybercriminals trying to trick you into entering your user credentials. If you enter your login information, they will steal it. Then, they can access your account and use it to post links to crypto or financial scams. The cybercriminals will steal your login details and use your account to scam other X users!

Follow these tips to avoid falling victim to a phishing scam:

• If possible, enable two-factor authentication, or 2FA, for your online accounts. 2FA is more secure because it requires two forms of identification to log in to your account.
• Always hover over links in emails to see if they’re legitimate. If you must reset your password, always navigate to the official X website or mobile app.
• Be suspicious of any urgent requests. Cybercriminals often pressure you to act fast to trick you into falling for their scams.