Loading story…
TechCrunch warned that scammers are impersonating TechCrunch reporters, editors, and event staff to target companies with convincing “media inquiry” outreach designed to extract sensitive business information. The fraudsters leverage TechCrunch’s brand trust, mimic reporter writing styles, reference current startup trends, and request introductory calls; victims who participate in phone interviews report the impostors use the conversation to solicit additional proprietary details.
The activity includes spoofed identities of real staff and evolving email tactics: some messages contain obvious address discrepancies, while newer attempts claim email address conventions that appear to match TechCrunch’s legitimate patterns, making verification harder. TechCrunch advised recipients to verify purported staff identities via official staff listings and alternate contact methods before sharing information, and noted the broader trend of criminals exploiting established media brands across the industry; SC Media amplified the warning and highlighted the risk of follow-on account takeover and data theft against sectors such as cryptocurrency and cloud/tech firms.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
TechCrunch publicly warned companies that scammers are impersonating its staff and advised recipients to verify identities through its official staff page and alternate contact methods in staff bios. It also shared that it had observed recently created domains not affiliated with the company being used in the activity.
TechCrunch reported that it has recently been receiving more verification inquiries from companies contacted by people posing as its reporters, editors, and event staff, indicating an increase in the scam activity. The impersonators use lookalike email conventions, convincing media-style outreach, and sometimes phone interviews to solicit sensitive business information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are scaling **impersonation-driven fraud** by abusing trust signals—public figures, brands, and platform distribution—to lure victims into handing over money or sensitive information. One documented operation used **celebrity impersonation** tailored to Canadians, selecting locally relevant public figures and using **social media ad targeting** (e.g., geolocation and profile-based targeting) to constrain exposure to the intended country and increase conversion; the campaign also leveraged emotionally manipulative narratives (e.g., injury/misfortune) to accelerate engagement and reduce skepticism. In parallel, **domain-based impersonation (“digital squatting”)** has increased materially, with reporting citing a **68% rise** over five years and **WIPO** recording **6,200 domain disputes in 2025**. Common techniques include `typosquatting`, `combosquatting`, `TLD squatting`, and `homograph` attacks, which route users to phishing or fraudulent payment pages that mimic legitimate brands; the trend is also driving reputational harm when victims receive low-quality or nonexistent services. Recommended mitigations emphasized in reporting include proactively registering defensive domains across multiple TLDs and monitoring for lookalike domains to reduce brand impersonation risk.
Jun 29, 2026
Multiple reports highlighted a surge in **AI-enabled social engineering** that blends convincing pretexts with increasingly effective lures to steal credentials, money, or sensitive data. One account described a near-miss **LinkedIn job/recruiter scam** in which an attacker impersonated a recruiter tied to a well-known tech brand and attempted to draw the target into a fraudulent hiring/workflow process, illustrating how professional networking platforms are being used to seed high-trust approaches and extract personal information. Separately, threat reporting cited a sharp rise in **fake CAPTCHA** lures—up **563% over 2025** per *CrowdStrike’s 2026 Global Threat Report*—as attackers shift away from older “malicious browser update” prompts toward CAPTCHA-themed interactions that can trick users into executing malicious steps or handing over access. ESET also warned that **deepfake voice** has lowered the barrier for **CEO/CFO impersonation**, supplier fraud, and account takeover attempts: attackers can clone a voice from short public audio samples (e.g., interviews, earnings calls, social media) and then target finance or helpdesk staff (often identified via LinkedIn) to pressure wire transfers or bypass authentication and KYC checks.
Jun 29, 2026
Threat actors have intensified their use of phishing campaigns by impersonating well-known brands and trusted online services to deceive victims and steal sensitive credentials. In one campaign identified by the Cofense Phishing Defense Center, attackers targeted individuals in social media and marketing roles by sending fake job application emails that appeared to originate from major companies such as Red Bull, Tesla, Google, and Ferrari. These emails used convincing language and branding, including up-to-date logos and tailored subdomains, to increase their legitimacy and lure recipients into clicking malicious links. The attackers further enhanced the credibility of their messages by spoofing the sender address to appear as if it came from a legitimate domain, such as Xero, which has been abused in previous phishing incidents. The phishing process often began with a CAPTCHA page to create a sense of security before redirecting victims to fraudulent login pages designed to harvest credentials. This approach demonstrates a sophisticated understanding of social engineering tactics and the value of resume and personal information in targeting specific job seekers. In a separate but similarly themed incident, a Malwarebytes employee was targeted by a phishing email that impersonated 1Password, a popular password manager. The email falsely claimed that the recipient's 1Password account had been compromised and urged immediate action, including changing the account password and enabling two-factor authentication. The message mimicked legitimate security alerts, referencing 1Password's Watchtower feature, but included subtle red flags such as a sender address not associated with 1Password and a malicious link disguised as a legitimate action button. The phishing link directed users to a typosquatted domain, onepass-word[.]com, rather than the official 1Password website. Interestingly, the email's 'Contact us' link routed through a legitimate support page but used a redirect service, further complicating detection. The use of Mandrillapp, a transactional email delivery service, added another layer of apparent legitimacy to the phishing attempt. Both campaigns highlight the increasing sophistication of phishing attacks, with threat actors leveraging trusted brands and services to bypass security filters and exploit user trust. The attackers' use of brand-specific subdomains, authentic-looking graphics, and familiar communication styles makes these phishing emails particularly convincing. By targeting individuals with tailored messages, such as job seekers or users of specific online services, the campaigns increase the likelihood of successful credential theft. The abuse of legitimate infrastructure, such as Xero's email services and Mandrillapp, demonstrates how attackers can exploit trusted platforms to evade detection. Security teams are advised to educate users about the signs of phishing, including checking sender addresses, scrutinizing URLs, and being wary of urgent requests for sensitive information. Organizations should also monitor for abuse of their brand in phishing campaigns and work with email providers to block malicious domains. The incidents underscore the need for robust email security solutions and ongoing vigilance against evolving social engineering tactics. As phishing campaigns continue to evolve, both individuals and organizations must remain alert to the latest techniques used by cybercriminals to compromise accounts and steal valuable data.
Jun 29, 2026