#social-engineering

Binance's initial findings trace the $6.34 billion theft to a September fake recruiter whose coding assignment infected an engineer's Mac. An internal AI tool let the attacker reach two wallet engineers, and a container deployment token on one laptop opened the signing service.

Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and ended with Active Directory Certificate Services abuse. ESC1 yielded certificates for 11 privileged accounts, ESC8 one for a domain controller, and one account left out of automated containment carried the data out.

ASOS and Dexcom both traced October breaches to people being talked into access, and India will show a network-asserted caller name on calls from November 1. None of it changes the core problem: an MFA reset issues a new credential, so the help desk decides who gets one. How to verify callers with proof instead of knowledge, and why the passkey migration will test it.

Arctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist. Some reached code execution within 15 minutes.

October is Cybersecurity Awareness Month. Instead of another poster, here are seven identity habits for every team, each traced to something that actually happened this month: a phone call to a medical device maker, a fake AI ad portal, a national register allegedly opened with 123456, and a VPN password reused once too often.

A Sapio Research survey of 700 IT and security leaders for Imprivata and the FIDO Alliance finds 95% have seen frontline workers work around authentication, 33% by sharing credentials, and only 15% use passkeys without a password. 60% report social engineering against the service desk.

Glucose monitor maker Dexcom says targeted voice phishing gave an unauthorized party access to limited information in certain internal documents. It reports no impact on products or operations and has brought in an outside forensics firm.

ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third-party data platforms. Snowflake says nothing on its side was at fault. The number of affected customers is undisclosed.

Police in the Netherlands confirmed a 24-year-old Amsterdam man was arrested in September in an investigation into ShinyHunters, the extortion group behind help-desk vishing and PeopleSoft exploitation this year. The group denies any link.

Microsoft detailed a campaign running since May 2026 in which callers posing as IT tell US enterprise users to update their passkey or MFA settings, route them to a fake sign-in page, then add their own authentication method for persistence.

ShinyHunters voice-phished a RingCentral employee out of their password in July, took 623GB, and dumped 280GB after the company refused to pay. Have I Been Pwned confirmed 1.6 million accounts including names, emails, phone numbers and addresses.