Loading story…
A sophisticated phishing campaign has emerged in Switzerland, specifically targeting Twint users through fake emails that urge recipients to verify their account details or risk being blocked. These emails direct victims to fraudulent websites designed to steal credit card information and personal data. The attackers exploit moments when users are likely to be distracted, such as early mornings or busy periods, and leverage the automatic nature of Twint payments to increase the scam's credibility. The campaign highlights a trend toward more personalized and behaviorally targeted phishing attacks, with additional concerns raised about the security of emerging technologies like household robots.
Simultaneously, security researchers report a fourfold increase in mobile phishing attacks during the holiday season, with attackers impersonating well-known brands, payment processors, and logistics providers. These campaigns not only target consumers but also pose risks to enterprises, as employees may inadvertently expose corporate credentials or install malware on BYOD or COPE devices. The multi-stage nature of these attacks, which follow users throughout the purchase and delivery process, makes detection challenging and increases the likelihood of financial fraud or data exfiltration. Organizations are advised to remain vigilant and implement robust security awareness and monitoring measures to mitigate these evolving threats.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A Zimperium report warned that mobile phishing attacks are expected to rise sharply during the holiday shopping season, with activity increasing fourfold and campaigns impersonating major retailers, payment services, digital wallets, and shipping providers. The report also highlighted enterprise risks from BYOD and COPE devices, including credential theft, mobile malware infections, financial fraud, and data exfiltration.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are intensifying their efforts to exploit consumers and businesses during the holiday shopping season, leveraging tactics such as SMS scams, phishing emails, and fake websites. Attackers use the urgency of holiday deals and the high volume of online transactions to increase the effectiveness of their campaigns, with AI and automation making fraudulent messages and cloned sites more convincing. Notably, the U.S. Federal Trade Commission reported $470 million in losses from text-based scams in 2024, and researchers have observed a significant rise in both the scale and sophistication of these attacks, including the use of deep-fake voices and realistic phishing lures. Businesses are also being targeted, as seen in a campaign where over 5,000 Facebook advertisers received phishing emails sent from the legitimate facebookmail.com domain, exploiting Meta's business features to bypass security filters and steal credentials. High-profile incidents, such as the attack on Marks & Spencer during a peak shopping period, highlight the financial and operational risks posed by these scams. Security experts recommend measures such as multi-factor authentication, password managers, and the use of virtual cards to mitigate risks, while also warning against trusting unsolicited messages or calls, especially those leveraging AI-driven impersonation techniques.
Jun 29, 2026
Threat actors have intensified their use of phishing campaigns by impersonating well-known brands and trusted online services to deceive victims and steal sensitive credentials. In one campaign identified by the Cofense Phishing Defense Center, attackers targeted individuals in social media and marketing roles by sending fake job application emails that appeared to originate from major companies such as Red Bull, Tesla, Google, and Ferrari. These emails used convincing language and branding, including up-to-date logos and tailored subdomains, to increase their legitimacy and lure recipients into clicking malicious links. The attackers further enhanced the credibility of their messages by spoofing the sender address to appear as if it came from a legitimate domain, such as Xero, which has been abused in previous phishing incidents. The phishing process often began with a CAPTCHA page to create a sense of security before redirecting victims to fraudulent login pages designed to harvest credentials. This approach demonstrates a sophisticated understanding of social engineering tactics and the value of resume and personal information in targeting specific job seekers. In a separate but similarly themed incident, a Malwarebytes employee was targeted by a phishing email that impersonated 1Password, a popular password manager. The email falsely claimed that the recipient's 1Password account had been compromised and urged immediate action, including changing the account password and enabling two-factor authentication. The message mimicked legitimate security alerts, referencing 1Password's Watchtower feature, but included subtle red flags such as a sender address not associated with 1Password and a malicious link disguised as a legitimate action button. The phishing link directed users to a typosquatted domain, onepass-word[.]com, rather than the official 1Password website. Interestingly, the email's 'Contact us' link routed through a legitimate support page but used a redirect service, further complicating detection. The use of Mandrillapp, a transactional email delivery service, added another layer of apparent legitimacy to the phishing attempt. Both campaigns highlight the increasing sophistication of phishing attacks, with threat actors leveraging trusted brands and services to bypass security filters and exploit user trust. The attackers' use of brand-specific subdomains, authentic-looking graphics, and familiar communication styles makes these phishing emails particularly convincing. By targeting individuals with tailored messages, such as job seekers or users of specific online services, the campaigns increase the likelihood of successful credential theft. The abuse of legitimate infrastructure, such as Xero's email services and Mandrillapp, demonstrates how attackers can exploit trusted platforms to evade detection. Security teams are advised to educate users about the signs of phishing, including checking sender addresses, scrutinizing URLs, and being wary of urgent requests for sensitive information. Organizations should also monitor for abuse of their brand in phishing campaigns and work with email providers to block malicious domains. The incidents underscore the need for robust email security solutions and ongoing vigilance against evolving social engineering tactics. As phishing campaigns continue to evolve, both individuals and organizations must remain alert to the latest techniques used by cybercriminals to compromise accounts and steal valuable data.
Jun 29, 2026
Credit unions and financial institutions are facing a surge in sophisticated fraud schemes that leverage social engineering and AI-driven tactics to compromise payment security. Attackers are increasingly using phishing, vishing, and smishing to harvest credentials and one-time passcodes, enabling account takeover and card-not-present fraud. Imposter scams, such as fraudulent calls and urgent messages, pressure victims into making instant, irreversible transfers through crypto ATMs or quick-pay apps. Security leaders emphasize the importance of real-time monitoring, member education, and advanced authentication methods—including tokenization and biometrics—to counter these evolving threats and protect members without degrading user experience. Criminal organizations, including groups operating out of China, have orchestrated large-scale scams by sending deceptive texts about overdue tolls or postal fees to trick individuals into divulging credit card details. Stolen card numbers are then installed in digital wallets like Google and Apple Wallets in Asia and shared with U.S.-based accomplices to make fraudulent purchases. These operations have resulted in over $1 billion in losses over three years, highlighting the global scale and technical ingenuity of modern payment fraud. Early reporting by victims and rapid response by financial institutions are critical to stopping fraudulent transfers and involving law enforcement to mitigate losses.
Jul 12, 2026