A new phishing scam has surfaced that is showing how sophisticated bad actors are becoming in tricking unsuspecting victims into giving up their personal information.
The latest cyberattack is centered around the job listing website, Indeed. Hackers send out an email spoofing an employment opportunity from the website. Once you click the link, it will send you to a Microsoft 365 login page to enter your credentials. From here you’re not suspecting anything unscrupulous, but the next time you attempt to log into your Microsoft 365 account, you will find that not only are you getting an error message that the information is incorrect, but that your account is no longer available.
Researchers at Menlo Security have observed this phishing scam, which is being targeted at U.S. executives in industries including electronic manufacturing, banking and finance, real estate, insurance, and property management, according to Bleeping Computer.
The cyberattack has been so seamless it has been able to evade multifactor authentication on Microsoft 365 accounts through a method called cookie stealing. This tactic is used to swipe the cookies from well-known websites and mimic their designs. By hacking recent web sessions of programs that are not commonly refreshed, bad actors that replicate pages can look identical to pages of common websites. Cookie stealing was also developed as a bypass for multi-factor authentication. If you have the security feature set up on your account, you would likely input it yourself, having visually deemed the website to be trustworthy.
Researchers began noticing cookie stealing attacks in 2022, targeting several major brands, including Google Chrome, Amazon Web Services (AWS), Azure, Slack, and Electronic Arts.
The hackers in this case used a platform called EvilProxy to execute their cookie stealing and fashion a page that looks like an authentic Microsoft login page. Multifactor authentication is commonplace for Microsoft 365 so users will have some form set up.
The addition of the Indeed email makes this phishing scam especially complex because opening the link triggers an open redirect, which is a weakness that allows the bad actor to direct you to their nefarious website after clicking on a seemingly legitimate link.
This isn’t the only phishing scam plaguing Microsoft services in recent times. Last month, for example, a team of hackers was able to infiltrate Microsoft Teams to execute a phishing scam called “DarkGate Loader.” The scheme centers on a bogus Teams message about “changes to the vacation schedule,” but contains intricate hidden malware when downloaded. Cybersecurity researchers uncovered that hackers were able to access Teams through compromised Office 365 accounts and even found the unsecured email addresses they were able to take over.
Ongoing spam and cybercrime have prompted email providers, including Gmail and Yahoo to set into place requirements for bulk senders as security measures. These requirements include email authentication, the ability to easily unsubscribe, and email assurance, and will be set in place starting February 1, 2024. Google said many of the requirements largely play as basic email hygiene but are being set forth with the aim of making it an industry standard.
Did you think hitting delete on your AI chatbot conversation actually makes it disappear? Georgia Tech researchers just proved that's not entirely true. They have built a forensic tool called ORISA that can dig deleted conversations from your phone and even rebuild them into a working chatbot session you can keep talking to.
How can ORISA bring deleted AI conversations back?
Touchscreen laptops have been around for years. You can get them in all sizes and shapes. Just not from Apple. For years, the Cupertino giant has treated the idea of a touchscreen MacBook the way I treat a meeting that could have been an email: with open contempt. However, Wednesday looks like the day the company could finally change its mind.
The latest Apple invite puts the “Pro and Tell” showcase in Los Angeles at 10 a.m. PT (1 p.m. ET) on October 28, 2026. Instead of a regular live-streamed keynote, it is an invitation-only, hands-on event for a handful of press and creators (similar to what the company did for the MacBook Neo earlier this year).
Two residents of Chicago have filed a lawsuit in the US over claims that robots run by Coco Robotics and Serve Robotics captured their facial and hand measurements without consent, bringing renewed attention to the food delivery robots. The cases raise a troubling question: If a robot delivers food to your door, can it also be gathering sensitive information about you?
According to a report by The Associated Press, the proposed class-action lawsuits were filed in Cook County on Oct. 9 and allege violations of Illinois’ Biometric Information Privacy Act. The complaints claim that the robots’ cameras and LiDAR sensors captured information on customers’ faces and hands as they approached the machines to pick up their orders. Both have denied the allegations.