Recent Reports
Fake texts, emails or websites built to steal logins, card numbers or personal data.
In a post published October 21, 2026, MalwareTips warns of a Best Buy survey scam that uses the retailer's identity to promote a counterfeit reward page. The reported email invites feedback about store promotions andβ¦
MalwareTips reports in a post published October 21, 2026 on a Citi Debit Card Update email scam that claims the recipient's card has been added to a Bitcoin wallet and asks anyone who did not authorize it to review thβ¦
Security firm Huntress reported on 21 October 2026 that it investigated incidents, affecting at least three customers, from an Amazon-themed ClickFix campaign. The top sponsored Google result for theβ¦
The Singapore Police Force warned on 21 October 2026 of an uptick in phishing scams impersonating telco SIMBA that appear among top sponsored results when people search Google for SIMBA top-up services. Since March 20β¦
On 21 October 2026, several Hong Kong banks issued statements about fraudulent websites impersonating their internet banking login pages, which the Hong Kong Monetary Authority (HKMA) listed in its scam alert the sameβ¦
Malwarebytes published research on 21 October 2026 about a phishing campaign aimed at YouTube creators that impersonates Amazon Music. The site amazonyt.com calls itself the 'Amazon Artists Music - Creator Portal', prβ¦
MalwareTips reports in a post published October 20, 2026 on a 'Sample Files for Your Review' email scam aimed at businesses. A message headed 'Quotation Request' approaches recipients as a potential business contact aβ¦
Hackread reported on 20 October 2026 on research by Ocean Security into a campaign it calls 'Phantom Preview', in which attackers abused legitimate Frame.io file-sharing notifications, sent from Frame.io's genuine addβ¦
OCBC Bank (Hong Kong) said in a statement dated 20 October 2026 that it has no connection with fraudulent web pages at carousell.shop-pay.bond/merchant/bank-confirm/ocbc/581561506 and carousell.shop-service.cyou/merchβ¦
The Hong Kong Interbank Clearing Limited (HKICL), in a notice carried by the Hong Kong Monetary Authority's scam alerts on 20 October 2026, warned of fraudulent websites claiming to offer a Faster Payment System (FPS)β¦
Dataminr says riskified-okta.com and shipmonk-servicenow.com hosted fake Okta logins with a YubiKey MFA-downgrade lure; gladly-okta.com, found a day later, matches the theme. Okta, ServiceNow and the named firms are impersonated.
OpenSourceMalware says GhostAction attackers registered my-github.com and sent fake GitHub security alerts from noreply@my-github.com to steal maintainers' passwords, 2FA codes and OAuth tokens, The Hacker News reports. GitHub isn't involved.
Researcher Steven Lim flagged teams-cloud.live, five days old on 18 October 2026, for copying Microsoft Teams' login screen and interface in an apparent phishing attempt. Microsoft is impersonated; the domain isn't a Microsoft service.
Chukwuemeka Victor Amachukwu, 40, of Nigeria was sentenced to eight years in prison for schemes that hacked U.S. tax preparers via spearphishing and sold fake standby letter-of-credit investments, SDNY says.
MalwareTips describes a fake Zoho 'file shared with you' email for 'eTranzact Proposal.pdf' that leads to a password-stealing page on verify.zohoapps.ru. Zoho and eTranzact are impersonated, not the senders.
OCBC Hong Kong warns of a fraudulent 'bank-confirm' page at carousell.shop-pay.lat that uses its name; the bank has no connection with the site and has reported it to the HKMA and police.
Proofpoint tracked about 17,000 domains used by the related CoGUI, CoAceV and CoFish_Ws phishing kits impersonating 66 mostly Japanese brands; indicators include kenandy.shop.
CERT Polska warns of fake DPD 'failed delivery' messages leading to a redelivery-fee page on 96-126-126-164.cprapid.com that steals payment card data.
PhishStats detected a phishing URL on p581488.pro whose path uses the French words 'suivi' and 'livraison', consistent with a fake parcel-tracking page.
Phishunt.io flagged a Roblox-branded login page on the lookalike domain https--www--roblox.com, built to steal Roblox usernames and passwords.
Phishing tracker phishunt.io flagged a DocuSign-branded 'Verify Your Identity' page on bluesoftsdocrks.com that asks for an email address.
Resecurity mapped the infrastructure of "Iron Man System", a phishing kit sold to criminals with 2,360 lure templates impersonating couriers, tax agencies, banks and more across 130 countries.
Hong Kong Interbank Clearing (HKICL) warns that fasterpaymentsystemfps.xyz is a fake "Buyer Online Protection" site for FPS payments that collects ID documents and bank details.
MalwareTips warns of a "Security Center" email claiming your password is about to expire; its "Keep My Current Password" button led to a fake Gmail login on an edgeone.dev subdomain.
Cloudflare and Microsoft disrupted Yam Store, a Chinese-language marketplace selling stolen Microsoft business accounts and phishing kits (CoGui and Iron Man) via Telegram.
Huntress found a phishing campaign, active since September 10, that hides lures on Microsoft's Power BI site and installs rogue ScreenConnect remote-access clients from the hamham27 tenant.
CyberPulse reported a fake SAPO Mail login page at login-sapomail-pt.weebly.com that tries to collect Portuguese users' emails, phone numbers and passwords.
Researcher masaomi346 reported Android malware disguised as Sumitomo Mitsui Card (SMBC Card), linked from a Google Drawings page, on October 13, 2026.
Researcher masaomi346 reported a phishing site at nebuladialogue.top impersonating Sumitomo Mitsui Card (SMBC Card) on October 13, 2026.
Researcher kubotaa reported MUFG Bank phishing sites at mufg-co-jp.digital and mufg-co-jp.best on October 13, 2026.