Phake phishing: Phundamental or pholly?
Debates over the effectiveness of phishing simulations are widespread. Sophos X-Ops looks at the arguments for and against – and our own phishing philosophy
Similar Posts
Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign
Bys sAn ongoing campaign has been observed targeting Amazon Web Services (AWS) customers using compromised Identity and Access Management (IAM) credentials to enable cryptocurrency mining. The activity, first detected by Amazon’s GuardDuty managed threat detection service and its automated security monitoring systems on November 2, 2025, employs never-before-seen persistence techniques to hamper
Juniper Networks Fixes High-Severity Vulnerabilities in Junos OS
Bys sJuniper Networks has patched multiple high-severity vulnerabilities in Junos OS and its third-party components. The post Juniper Networks Fixes High-Severity Vulnerabilities in Junos OS appeared first on SecurityWeek.
40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials
Bys sCybersecurity researchers have flagged a fresh software supply chain attack targeting the npm registry that has affected more than 40 packages that belong to multiple maintainers. “The compromised versions include a function (NpmModule.updatePackage) that downloads a package tarball, modifies package.json, injects a local script (bundle.js), repacks the archive, and republishes it, enabling
November Patch Tuesday does its chores
Bys sA cleanup month brings 63 patches… wait, no, 68… how about 61?
FIN6 Uses AWS-Hosted Fake Resumes on LinkedIn to Deliver More_eggs Malware
Bys sThe financially motivated threat actor known as FIN6 has been observed leveraging fake resumes hosted on Amazon Web Services (AWS) infrastructure to deliver a malware family called More_eggs. “By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group builds rapport with recruiters before delivering phishing messages that lead to…
SonicWall Investigating Potential SSL VPN Zero-Day After 20+ Targeted Attacks Reported
Bys sSonicWall said it’s actively investigating reports to determine if there is a new zero-day vulnerability following reports of a spike in Akira ransomware actors in late July 2025. “Over the past 72 hours, there has been a notable increase in both internally and externally reported cyber incidents involving Gen 7 SonicWall firewalls where SSLVPN is…