Subscribe now

Security and Fraud

The two things fraudsters can’t hide

Every fraud case leaves two fingerprints: intent and infrastructure. Neither requires sophisticated tooling to catch, but they require you to fine-tune the resolution in which you look for fraud. On one hand, zoom-out from individual events so you could spot patterns. On the other hand, watch for it in sub-segments rather than in general.

Fantastic advice from The Saturday Fraud Strategist this week! Someone on your team must be looking at areas of the forest or the whole forest, not just indicators on specific trees. How does your team accomplish this?

Expired credit cards revived by researchers to make unauthorized payments

Credit cards, the authors explain in their paper, have expiration dates, but the way these dates get checked and enforced isn't consistent. Thus, they were able to devise an attack that makes expired contactless cards appear to be valid to payment terminals.

I’ve seen this work as a consumer and on the banking side. So many sites don’t care about many of the security features cards have. Any canceled or reissued card could allow use, or allow an update of an old token to be used in an apple/google wallet.

Fun Zone

The great modern train robbery: Thieves steal US$200 million a year

Train robberies are a trope of cowboy Westerns, but the modern incarnation is largely a product of the pandemic.

Old-timey attacks still work, and Railroads are still targets. Much of what we see in stores is on a train at some point. Criminals can take advantage of that. Unfortunately for the thieves, they were caught by camera systems. Its definitely hard to catch them with people, but they were able to track down the criminals with the camera footage.

Resources

Beyond Zero: For The Rest Of Us

Beyond Zero the practice, or at least a rough approximation of it, is something you can start assembling from parts this quarter. Read the paper, finish your classification programme, gateway your agents, and start getting signals you can use to make delayed decisions with for when the vendors catch up.

The Six-Dimension Scorecard: A proposed framework for assessing cyberfraud risk

The Six-Dimension Scorecard expands on traditional fraud models by considering both human behavior and technical risk when assessing cyberfraud.

Career Links

ISC2 Research: Rethinking AI’s Impact on Cybersecurity Roles

The majority of participants (56%) said that AI has somewhat or significantly reduced the need for entry-level positions over the past year.

How to Maximize Your CFE Credential

Getting the certification is only part of the value. ACFE offers some good advice on actually using the CFE to build your network, demonstrate expertise and move your career forward.

Bonus Links

PayPal and Venmo Expand to Tuition Payments in New Integrations with Illumia, Nelnet Campus Commerce, and TouchNet

Students and families can pay tuition directly through their participating schools’ existing payment portal using PayPal and Venmo.

Love/hate relationship: The AI affair. Young people love AI, but it’s breaking their trust

Seven in ten (70%) 18-to-22-year-olds have experienced an AI-related scam in the last year, compared to half of the general population. And nearly every young person worries AI will be used against them.

Subscribe now

Security and Fraud

How a 21-Year-Old Stole $1 Million in 20 Minutes

The theft is the part people remember. What happened over the next seven years is the part that should change how you think about your phone number. On the afternoon of October 26, 2018, a man in San Francisco looked at his computer screen and watched himself get logged out of his own Gmail account. He looked down at his phone. No signal. No service.

This was a case of sim swapping. A simple social engineering scam against AT&T, NOT the victim caused a $1 million dollar loss in about 30 minutes. And the money isn’t coming back. You don’t have to fall for a scam to be a victim of fraud.

AI fraud is here. So where’s the loss?

Scams weren’t invented in 2024, but before that they took a lot of effort to scale. Each individual victim required a human fraudster to “manage”.

But now, with GenAI, scaling scams is just too cheap.

Personalized phishing, voice cloning, a convincing text that knows your name and your bank - all of it got dramatically less expensive to produce in the last two years.

Cheap production plus a soft target is exactly the trade a rational fraudster takes. It doesn’t require a genius.

Fraud losses at the bank aren’t going up drastically. The fraudsters are still making their money, they just aren’t trying to beat the financial institutions. They are just beating the customers, YOU.

Fun Zone

Mini-Mozart heist blights anniversary tribute as thieves make off with 210 statuettes

The Mozarteum Foundation on July 15 unveiled 320 statuettes, barely 50 centimeters (less than 20 inches) high, showing Mozart with his dog. They were designed by German conceptual artist Ottmar Hörl. Within two weeks, more than 80 of the polymer figures had disappeared. By Wednesday, a total of 210 were missing.

Opportunity (small statues that could fit in your pocket) combined with a bit of rarity/novelty can cause people to do things they otherwise wouldn’t. I don’t think this was organized crime, I think this was tourist taking a “souvenir.”

Resources

The Federal Reserve Scams Mitigation Toolkit

Combating scams starts with all of us. By gaining a better understanding of scams, you can become more vigilant, identify potential scam indicators, stop fraudulent transactions, and better protect your customers and your organization.

Chain Abuse

Report Malicious Crypto Activity. Report your case, maximize your chances of recovery while making web3 safer for all.

Career Links

ISC2 National Security & Critical Infrastructure [Free Virtual Event December 2-3]

Critical infrastructure powers economies, supports essential services and safeguards national security. Join leading experts for practical insights, strategic perspectives and actionable guidance on securing critical infrastructure in an increasingly complex threat landscape.

5 Things to Do When You Feel Overwhelmed by Your Workload

If you have moments of feeling overwhelmed by your workload, start with some deep breathing and healthy self-talk, like saying to yourself, ”Even though I have many things to do, I can only focus on the one thing I’m doing right now.” Then start tracking your time to figure out how much you’re really working, and and how you’re spending your time.

Bonus Links

Least privilege for AI agents: Identity, access, and tool binding

The right mental model is to treat every agent as a first-class principal: give it a lifecycle-managed identity, assign explicit roles, scope its permissions tightly, and scope tool usage to a preconfigured tools manifest or configuration.

August 2026: Beware Cybersecurity Awareness Month

Our Zombie of the month article was sent in by Chris Palmer, and it’s a doozy. Trend Micro has a page that warns people about “IP Address Hacking”. What is, you ask, IP address hacking? I won’t be able to do it justice, so here is what the web site says:

IP address hacking is when someone sneaks into computers or networks without permission by finding weaknesses in their IP addresses, which are like digital home addresses for devices connected to the internet.

Subscribe now

Security and Fraud

Escape The Hack: Countering Cyber Scams with an Immersive Experience for Everyday Indonesians

To strengthen its efforts in combating scams, Indonesia established an Anti-Scam Center (IASC) in 2024 to respond to citizen complaints, block fraudulent transactions, and recover victim funds. IASC data shows an average of 1,300 complaints per day.

Fraud awareness training has officially become an escape room. I’m completely on board with this.

Former Federal Law Enforcement Officer Agrees to Plead Guilty

A former U.S. Postal Inspector – a federal law enforcement officer authorized to carry a firearm, make arrests and execute search warrants – has agreed to plead guilty to allegedly stealing over $330,000 in cash from packages mailed by elderly victims and then laundering the cash and failing to report it to the Internal Revenue Service.

Our communication methods (digitally and physically) are extremely insecure and when we add in insiders or corruption, we get a complete breakdown of a system meant to improve our lives.

Fun Zone

Matt Meis - How Cyber Fraud, Money Mules, and Laundering Work

Cyber fraud moves fast, and victims may unknowingly help criminals move stolen money. Learn how scams, money mules, check fraud, and digital money laundering actually work, plus the warning signs that matter.

I got to sit down with Wil and talk about cyber fraud, what it looks like and how to identify when a fraud is happening in real-time. Check out the Keyboard Samurai to expand your resources and cyber knowledge.

Ad Zone

Monarch

The modern way to manage money. Budget, track your progress, and plan for the future—all in one app.

I love Monarch. If you were a Intuit Mint fan, this is better, and works for individual, families or businesses. Find reoccurring expenses, set your budget, and visualize your goals all in one easy to use app. I can’t recommend this app any more strongly!

Resources

Join Our Upcoming Roundtable on August 27th: Building a Mature CSE Program for Your Institution

Child sexual exploitation leaves a money trail, and a mature CSE program is how financial institutions find it. That takes more than policy on paper. It takes financial crime professionals building programs that move from detection to investigation to real response, together.

The Flashpoint Method: Prioritizing Vulnerabilities in an Era of AI-Accelerated Discovery

With AI models accelerating vulnerability discovery, security teams face unprecedented disclosure volumes. Flashpoint’s new framework offers a practical, intelligence-driven approach to cut through the noise — prioritizing flaws based on real-world exploitability, asset exposure, and business impact rather than static severity scores alone.

Career Links

7 Surprising Habits that Changed My Life in My 30s

Turns out you don’t need a midlife crisis to change your life, just 7 habits I stumbled into somewhere after 30 without even meaning to. I break down all 7 in this video, and I’d bet at least one of them is going to sting a little.

Australian Payments Intelligence Brief

The RBA’s Review of Payments System Regulation, covering mobile wallets, three-party card schemes, BNPL providers and e-commerce platforms, closes for written submissions on 7 August 2026. Evidence gathered will inform whether regulatory action is warranted across these sectors.

Bonus Links

Visa to buy cybersecurity firm BioCatch for $2.4 billion amid surge in AI-powered scams

Under the deal, Visa will get BioCatch’s behavioral biometrics platform, which analyzes data including keystroke timing, touch screen pressure and other signals to distinguish real users from scammers and bots. Visa said it is acquiring the firm from London-based private equity firm Permira and other investors.

Compliance Staff Caught Him Kiting in 2009, 2011, 2014, 2017 and 2020. The Bank Never Let Him Go.

The customer at the center, called Accountholder 1, grew up as the CEO's neighbor. His father was the CEO's friend and business partner, shared real estate investments with him, held EagleBank stock, and even pledged that stock as collateral on a personal loan from the bank.

Subscribe now

Security and Fraud

Anthropic’s Claude breached 3 orgs, uploaded PyPI malware during tests

Anthropic said today that during internal security testing, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it ran on 15 real systems before the registry's automated defenses pulled it.

AI systems are working as fast (or faster) than human hackers to skirt rules and complete tasks in unique ways. I see most AI models as toddler inhibition, with Masters level knowledge. There’s not much they won’t do, but they don’t truly understand the consequences of what they are doing.

AI’s Biggest Beneficiary: Organized Crime

Organized crime has long been a user of technology to further its hideous ends. And by ‘organized crime’ I’m not just referring to the mafia and street gangs. I’m referring to any organized group that routinely commits criminal acts.

We’ve been seeing it for a while, but its absolutely crucial to say it loud. Crime is the winner with new tech. And the new tech companies (through many reasons) don’t put security and accountability first (that’s just too hard when you are “moving fast and breaking things”).

Fun Zone

Satellites spy penguin poop on Danger Islands | Space photo of the day for July 30, 2026

The bright pink color of the penguins' droppings stands out in satellite imagery, allowing researchers to monitor the birds' populations from space. But scientists wanted a closer look, and collected drone imagery as well.

Surveillance we can all get behind right?! Enjoy some adorable penguin news to break up your day today.

Resources

[FREE] The Infosec Survival Guide: TEAL BOOK - Threat Hunting

The TEAL BOOK - THREAT HUNTING of Black Hills Information Security’s The Infosec Survival Guide is built for security professionals who want to proactively hunt threats, uncover adversary activity, and sharpen their investigative skills.

Mitre Attack Flow

Attack Flow helps defenders capture the entire scope of a cyber attack and communicate what matters. By representing actions, conditions, and relationships as a connected flow, teams can move from isolated observations to a shared view of how an event unfolded.

Career Links

The Best-Paying Job In Fraud Right Now Is Reporting It

David Reed doesn’t work for the government. He is a private citizen in North Carolina, and over the past six months, two car dealers have cut checks to the Justice Department for $3.6 million because of him.

Why Resetting Passwords No Longer Stops Attackers

As attackers shift from password theft to session and token theft to bypass multifactor authentication controls, organizations must move beyond login security and protect authenticated sessions.

Bonus Links

Mastercard’s new scam merchant initiative: from monitoring fraud to monitoring trust

Mastercard's latest merchant trust update asks a different question than previous monitoring initiatives. Instead of asking ‘has this merchant already caused harm?’ it increasingly asks ‘can this merchant be trusted before significant harm occurs?’

Persona’s 2026 H1 selfie fraud report

Persona analyzed over 27 million fraudulent selfies to understand how fraudsters are attacking selfie verification flows. They found that the vast majority of attempts were relatively simple presentation attacks. And even within the more complex injection attacks, bad actors were more likely to inject videos of real people than AI selfies.

Subscribe now

Security and Fraud

Prolific Fraudster Got Job In Citibank’s Fraud Department By Stealing An Identity

The customers who called Citibank had already been robbed once. Their cards were lost, stolen, or hit with charges they never made, and Lexus Inez Lewis was the fraud specialist paid to help them. But instead of helping them, she defrauded them again.

What a $545,000 email scam in a South Carolina beach town reveals about municipal coverage gaps

An email chain with a sneaky URL change, a Utah bank account swap and a forged signature have left a small community reeling.

BEC losses are rarely caused by one bad click. They happen when compromised communications, weak verification procedures, payment urgency, and unclear accountability all line up. The fraudster may send the email, but the process determines whether it gets paid.

Fun Zone

This 16-year-old built an autonomous AI-powered robot turtle that finds microplastics in water

Budz won a $50,000 scholarship at the 2026 Regeneron International Science and Engineering Fair for building an underwater 3D holographic camera and combining it with AI models he trained to identify small pieces of plastic in bodies of water. He mounted that tech atop his autonomous turtle. He said it took around 2,000 hours each to build the robot and holographic camera.

Finally, an AI-powered autonomous agent everyone can root for. It looks like a turtle, hunts microplastics, and has probably produced more measurable value than half the AI products announced this year.

Resources

Advancing the NRF Fraud Taxonomy

Today, Target, in partnership with the National Retail Federation (NRF), Chertoff Group, the Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC), and retail industry partners, is releasing Version 2 of the NRF Fraud Taxonomy.

google/mantis

Mantis Skills: Portable Toolkit for Building Security Review Harnesses.

Career Links

Stolen Podcast

Hear from law enforcement, cyberfraud experts, and the survivors who’ve lived through the crimes. These are the voices behind the headlines and the crimes that cross borders and boundaries.

Join the ACFE

The ACFE reduces occupational fraud worldwide by empowering anti-fraud professionals with leading-edge training, resources and professional certification.

Bonus Links

OpenAI’s Bots Break Containment and Hack Hugging Face Autonomously — With Alex Stamos

Alex Stamos is the former chief security officer at Meta and the chief product officer at Corridor. Stamos joins Big Technology to discuss how OpenAI models reportedly escaped a testing environment, accessed the internet, and hacked Hugging Face while attempting to ace a cybersecurity evaluation.

FinCEN Alert on Fraud Schemes Targeting Federal Student Aid

Fraud rings use stolen and fraudulent identities, as well as other tactics, to enroll in educational institutions and unlawfully acquire funds from Federal student aid programs. The schemes not only result in losses to Federal student aid programs, but also, in some cases, real students face difficulties enrolling in classes because of the number of fraudulently enrolled “students.”

Subscribe now

Security and Fraud

Notification: FinCEN Guidance on Voluntary Information Sharing

Among other guidance, FinCEN’s updated Section 314(b) Fact Sheet clarifies how financial institutions can share information with each other about suspected fraud under section 314(b) of the USA PATRIOT Act (section 314(b)), which provides financial institutions with the ability to share information with one another, under a safe harbor that offers protections from liability, to improve the identification and reporting of activities that may involve money laundering or terrorist activities.

Financial institutions need to be able to share information to combat fraud and cybercrime. Happy to see some new clarification around this to help the good guys win.

NFL Players Targeted in E-Commerce Scheme Using Fake Shopify Stores

The alleged scam, organized by a 24-year-old from Philadelphia, offered professional athletes ownership of bogus websites as a place to park cash from their lucrative careers.

Being an NFL player isn’t all fun and games. In this case more money, means more problems. Scams target everyone, and EVERYONE can fall victim to them. If it sounds too good to be true, it is folks!

Fun Zone

NASA’s Photo of the Day | Young Galaxy Cluster

NASA’s James Webb Space Telescope takes us 4.4 billion years in the past with this July 3, 2026, image of a young galaxy cluster, MACS J0553.4-3342. The cluster is composed of two actively merging sub-clusters, roughly equal in mass.

Take a moment to calm down and forget about our small pale blue speck. It’s insane how big the universe is and how little we still know about it and even our own small solar system.

Resources

Soatok’s Informal Guide to Threat Model

While a threat model is a formal cybersecurity process that some infosec folks actually specialize in, you can run informal threat models in the design and architecture phases of developing a new product or service and no one can stop you.

ISC2 Annual Report

Anchored by the CISSP, our most recognized and widely held credential, the ISC2 certification portfolio reflects the growing demand for trusted cybersecurity expertise worldwide.

Career Links

The Office Amenity That Actually Improves Teamwork

High-performing teams deliberately reduce interruptions through focus blocks, meeting-free periods, and systems that minimize constant messaging and check-ins.

ISC2 Secure Canada

Be part of SECURE Canada 2026 on September 17, 2026. Hosted by ISC2, this flagship event brings together cybersecurity professionals and industry leaders for a full day of learning, collaboration and networking at Delta Hotel Toronto.

Bonus Links

Cash App owner to pay $45 million to settle allegations of lax security

“Lax verification standards, a years-long absence of phone support, and deceptive social media promotions left users exposed to scammers,” said Texas Attorney General Ken Paxton.

$293 million seized and 5,811 arrests made in huge anti-scam and fraud action by Interpol and law enforcement agencies across 97 countries

Authorities analyzed 152,808 cases, identified 15,606 suspects, and uncovered scams ranging from BEC to money laundering, with victims exceeding 142,000 globally.

Subscribe now

Security and Fraud

Klarna Seeks Green Light to Become a US-Chartered Bank

We’ve seen firsthand the appetite for a fairer, more transparent approach in the U.S., and our own banking license is the natural next step, giving customers tools to borrow responsibly and build financial confidence, while bringing greater competition, innovation, and choice to consumers and merchants alike.

Fintechs are taking advantage of a soft regulatory environment to expand. Will this be better for consumers? Will they be more open about current short term lending? Will they be able to meet regulatory requirements of the future? We’ll see…

VodafoneThree blocks over 2 million fraud attempts for banking sector

VodafoneThree says a new scam-blocking process built with Barclays, the Mobile Ecosystem Forum, and the Cyber Defence Alliance has blocked more than two million fraudulent banking SMS messages.

This is the kind of fraud collaboration we need more of. The magic is connecting those signals before the victim gets pushed into panic mode.

Fun Zone

What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out

Burst water mains. Evacuated hospitals. In a closed-door simulation, insurers played out their response to a mass disruption by China’s Volt Typhoon hackers—and found a nightmare scenario.

It’s a good reminder that cyber risk is rarely just cyber risk. Eventually, it becomes business risk, public safety risk, and “who actually owns this problem?” risk.

Ad Zone

One Pay

Save more with 3.35% APY and 3% back at Walmart! Join the millions of customers banking through OnePay.

Seriously, OnePay does banking right, I’ve saved over $2,000 on the platform through all their benefits. Plus they have a cool $1 million dollar raffle for new accounts right now. Get $50 for signing up through the link in this newsletter.

Resources

Our [Google’s] latest fraud and scams advisory

Google’s Trust & Safety teams are sharing observations on the most recent online scam trends, along with tips to help you stay safe.

Alloy’s 2026 State of Fraud Report

A data-driven look at today's fraud trends and what financial organizations are doing to keep up

Career Links

FIRST Services Framework

The Services Frameworks are high level documents detailing possible services CSIRTs and PSIRTs may provide.

Cybersecurity Career Pathway

Explore the key jobs within cybersecurity, common transition opportunities between them, and detailed information about the salaries, credentials, and skillsets associated with each role.

Bonus Links

‘Am I losing this battle? Yes’: Martin Lewis on the online scams that steal his identity – and others’ life savings

Trusted by millions, the finance expert has seen his name and face used to mis-sell a string of fake investments. And yet, he says, it would be ‘very simple’ for the government to stop them.

Detection Chokepoints: Starting from Scratch

A better way to think about it is to flip the question. Instead of asking what the attacker is using, ask what part of this they can’t change.

Subscribe now

Also, I get it, we are all overloaded with “AI did it” articles. I’m sorry to inform you, more AI articles exist this week, but trust me, THEY are good ones!

Security and Fraud

Four days to make victims fall in love: How global scammers use US tech to fleece people

The instructions were clear: He had four days to make each victim fall in love. And there were a lot of victims. Online, Safeer Mohammed Koorimannil, who was trafficked to a scam center in Myanmar, impersonated a 28-year-old Singaporean woman named Ella. On a typical shift, he said, he chatted with more than 100 people across dozens of profiles at the same time, as supervisors prowled among the desks with electric batons.

We’ve spent years chasing the scammers. Maybe it’s time to pay more attention to the platforms quietly enabling them.

AI Is Turbocharging the Spamosphere, Amping Up Prolific Text-Message Scams

Google sues swindlers accused in losses totaling $1.9 billion. The company said it is the first case against a defendant employing Google’s Gemini AI model.

Google suing someone for misusing their agent. Who is really at fault here? Yes scammers are doing the bad acting, but shouldn’t Google take some ownership in helping? I don’t think bringing a case against the scammers will do enough to stop the usage of AI in scams.

Fun Love Zone

Do Things You’ll Love Yourself For

The loving relationship with Future Self mostly comes down to how Present Self does things. A task done lovingly is done with an open heart and full attention. You can iron your shirt because you “have ironing to do,” or you can iron it because you love the person who will be wearing it tomorrow.

When you show love to your future self, you actually win in the present too! Love your future self, and a cycle of good decisions follows. You don’t need discipline if you are led by that love of the future you.

Resources

Spearphish General Store Recent Drops!

A new infosec survival guide focused on Threat Hunting, new comics and backdoors and breaches sets all are out now on Black Hills Merch site!

Human Risk Podcast

In 60 minutes, let’s explore the largets risk facing us all… human decision making.

Career Links

5 Lessons Most People Learn Way Too Late in Life

1. Perception is Reality

2. Everything is Temporary

3. The Importance of Being Present

4. Do What You Love

   1. Invest in yourself

5. Being Happy Takes Work

TD Bank tells some employees it ‘will monitor their work with software’

The programme will track the time employees spend on browsers and internal chat and meeting applications, it reported. Reuters added that TD Bank’s use of the software, driven by a desire to improve productivity, has raised questions from employees about consent and privacy in the workplace.

Bonus Links

Anthropic Accuses Alibaba of Largest AI Model Extraction Campaign as US-China AI Race Heats Up

Anthropic Says Alibaba Orchestrated Massive AI Model Extraction Campaign…Anthropic says nearly 28.8 million Claude AI interactions were linked to Alibaba-affiliated operators.

A peek into Reddit’s anti-spam internals

What happened to me back in 2021 was that due to some kind of an error on Reddit’s side, the usual Removed: Auto text had been replaced with the actual removal reason.

Subscribe now

Security and Fraud

Turning America’s Anti-Scam Strategy Into Action

Today, Aspen FSP is launching the Scam Prevention Initiative, a new phase of work focused on turning shared strategy into coordinated action… At the center of the Initiative is the Leadership Group on Scam Prevention, which brings together senior leaders from across the scam prevention ecosystem, including financial services, technology, retail, consumer advocacy, and payments.

Cross industry collaboration is always great to see. I’m hopeful that this helps us find new ways we can work together to fight fraud!

How AI fraud rings are taking on retail

What’s appearing now is something more coordinated, automated, and harder to detect in real time: AI-powered fraud rings that behave less like individual bad actors and more like distributed systems. They test, adapt, and scale in more sophisticated ways that increasingly mirror the technologies retailers themselves are adopting.

So many AI or rule based fraud engines look at past attacks to detect new ones. When the new trend changes every 5 minutes, that gets increasingly hard to detect and stop.

Fun Zone

Get-a-Waymo: How a burglar used a robotaxi to flee the scene in a first-of-its kind S.F. case

In under three minutes, the burglar was in and out of Hot 8 Yoga with an armload of activewear. He stuffed the loot in the car’s trunk, hopped inside and disappeared down the street, comfortably carried away by an autonomous Waymo vehicle.

Matt, why all the AI and robotics stories lately? They are fascinating and fun, don’t ruin this for me!

Ad Zone

Fastmail | Host your own domain email securely

Try Fastmail free for up to 30 days. No obligation, no credit card required. Plus get 10% off for your first year with the referral link in this newsletter!

Resources

Deception warns your teams at the speed of an AI attacker

Across 951 attack runs, AI achieved admin privilege escalation in 162 cases within an average time of 14 minutes across successful runs. Of those compromising runs, canaries provided advance warning before the attacker's first critical action in 95.9% of runs. Across attack paths, canaries are hit on average 8 minutes ahead of any critical action. In a surprise finding, simply telling models to expect deception reduced the number of accounts fully compromised (admin + persistence) from 20% to 3%.

Fraud Hero Newsletter | Stop the Scam Before It Starts

Education and Training to Protect You From Scams.

Career Links

Ycombinator.FYI | Fraud, Scandals and Copycats

Must read of some of the craziest shenanigans pulled by individuals in YCombinator.

The Fraud Practice

A practical resource focused entirely on fraud operations, payments, scams, AML, and financial crime careers. They regularly publish interviews, hiring trends, and industry insights.

Bonus Links

Meta pauses controversial employee-tracking program after security review

According to reporting based on internal documents and employee accounts, the data wasn’t just collected. It was left accessible across thousands of internal data tables, including AI prompts, transcriptions, private conversations, and performance‑related information.

Fortibleed: Anatomy of the FortiBleed campaign based on the server that the attackers themselves left exposed.

In June 19 2026 we received access to the contents of an internet-exposed directory, left open by the operators themselves of a campaign the press named FortiBleed. It was not a victim leak. It was the attacker command post: roughly 318 files containing the tooling, scripts, target lists, operational logs, and stolen data of a global-scale credential theft operation against Fortinet FortiGate firewalls.

Subscribe now

Security and Fraud

AI Shopping Agents Are Manipulating Consumers, Study Finds

The bots promise to get the best deals. Instead, they push pricier, sponsored options…

We are seeing chat bots everywhere, but they are abusing customers, while customers fight back and abuse them to get more information. This is a two sided fail for AI.

International law enforcement initiate hunt on malware group SocGholish

In Operation Endgame, a major operation this week disrupted a key infection chain used by cybercriminals. Within an international cooperation, 14.971 websites infected with SocGholish malware were remediated. This malware is used by a criminal group that plays a pivotal role in international cybercrime, namely: Evil Corp.

Another win for the good guys. We need to strike back against criminal infrastructure and individuals. With this malware disrupted, remote access attacks will have to pivot to another malware family.

Fun Zone

Quick awareness campaign will sort it out.

Awareness campaigns reduce some fraud. Knowing about specific scams helps some people catch a scam in progress. That said, its not a magic wand.

Resources

How Android helps keep you safe from impersonation scams with fake call detection

To help protect you from the growing threat of impersonation scams, Android is introducing fake call detection, an industry-first protection that can detect and flag suspected spoofed calls when your contact and you are both using Phone by Google.

Identity Is the New Attack Surface: A Guide to Infostealers and Proactive Defense

How to build an infostealer defense program across the identity layer — grounded in Flashpoint’s proprietary data and insights. Download your e-book now!

Career Links

ATT&CKcon Call For Papers!

We are looking forward to ATT&CKcon October 27-28, 2026 in McLean, VA. Our CFP is open until Thursday, July 2nd at 8pm ET/0:00 UTC sharp.

20 Years of Therapy Summarized in 13 Minutes

I've spent 20 years and an embarrassing amount of money sitting on various therapists' couches and I'm here to save you at least some of that pain (and your wallet will be thankful).

Bonus Links

Wausau man pleads guilty to defrauding investors out of $14.25 million

Between May 2019 and June 2025, Pophal used his business name ‘Bright and Silver, Inc.’ to offer investment opportunities. Pophal convinced most investors to sign investment contracts, which he styled as promissory notes, guaranteeing investors a rate of return of at least 20%.

Enhancing Know-Your-Customer Requirements [FCC] | ID required to get a phone number!

Specifically, we seek comment on requiring originating providers to, at a minimum, obtain and retain the name, physical address, government issued identification number, and an alternate telephone number of any new and renewing customer before granting access to its services.

Subscribe now

Security and Fraud

Should Fraud and Cybersecurity Teams Converge?

Credential stuffing became account takeover. Account takeover became fraud. Fraud became phishing. Phishing became invoice fraud and ACH fraud. And suddenly the same security telemetry that detects compromised infrastructure also helps identify fraudulent users before they ever reach checkout.

This debate is exactly why we have Cyber Fraud teams now. I started a cyber fraud team at my financial institution, and we took on work from both cybersecurity, fraud operations, the call center and filled many cracks in the organization. Its crucial to find what works in your organization. Sometimes its a cyber fraud team, sometimes its having the same analysts work on fraud and security issues and sometimes its a center of excellence where collaboration happens as needed, through partnerships that go all the way to the top of the organization!

Blame AI: Patch Tuesday Hits Record 206 CVEs

Voluminous patch updates could soon be the norm, as artificial intelligence accelerates the speed and scale of vulnerability discovery.

Read this title as: “Creating tomorrows bugs: now at a faster pace!” I get that Microsoft needs more patches, but how are they fixing things faster? What does this look like long term? And when do these bugs slow down? Our code pipelines should be running AI attacks before they hit the wild as a CVE at some point right…?

Fun Zone

The Virtual OS Museum lets you relive over 600 operating systems right on your desktop

The Virtual OS Museum isn’t a physical place, it’s a collection of over 1,700 distinct installations of over 600 operating systems for over 250 platforms that you can download and run via emulation right on your computer. It’s largely the work of one man, Andrew Warkentin, a developer and OS historian who has been slowly building his collection of OS images since 2003.

Have you had an itch to crash Windows Me recently (ok, this shouldn’t be difficult)? Or try out some old DOS software (why?)? Now is your chance! Go check out all the OSs you didn’t even know existed!

Security Resources

AI Workflow Automation to Identify Vulnerable Drivers, Because Why Not?

Welcome to BYOVD: Bring Your Own Vulnerable Driver. What is BYOVD? A kernel driver runs in ring 0, the same privilege level as Windows itself. If an attacker can load a vulnerable driver and communicate with it…

BigQuery threat model report

This document identifies potential attack vectors and mitigation strategies for data confidentiality, integrity, and availability for BigQuery.

Career Links

We get paid to break into buildings for a living. Ask us anything!

My job is to help organizations find and fix security weaknesses before real attackers do — except my attack surface isn't code or networks, it's people, doors, badges, cameras, and locks.

Association of Certified Financial Crime Specialists (ACFCS) Membership

With an ACFCS membership, you are actively investing in your career through learning resources that build your skills, expand your knowledge, and enhance your professional network.

Bonus Links

IRS and Security Summit partners announce new framework to better protect taxpayers and tax revenue from fraud

The Security Summit is a unique public-private partnership comprised of the IRS, state tax administrators, tax software companies, the tax professional community and the larger tax community. The goal of the Security Summit is to combat tax-related identity theft as a united front.

Cyware Daily Threat Intelligence - June 12, 2026

Attackers are turning trusted campus systems into covert entry points, as a zero-day in Oracle PeopleSoft let intruders run administrative commands and plant disguised MeshCentral agents before a patch landed. Cyware tracked over 100 organizations exposed in this campaign, with 68% of victims in higher education—putting HR, finance, and supply-chain workflows at risk of operational disruption.

Subscribe now

Security and Fraud

‘Fraud won’t be tolerated in this country any longer’: FBI releases Most Wanted Fraudsters list to help fight the crime that ‘costs Americans tens of billions of dollars every year’

Earlier this week, the Bureau launched the Most Wanted Fraudsters list, a list of individuals who allegedly defrauded US citizens one way or another, and then decided to flee rather than face accountability.

This really signals that fraud is being elevated to the same public-awareness level as terrorism, organized crime, and other major cyber threats.

Telecom Executives Plead Guilty to Tech Support Fraud

The US Department of Justice accuses the defendants of knowingly providing telecommunications services to customers engaged in fraudulent tech-support schemes for years.

When businesses profit from fraud, its hard to stop doing it! It isn’t just the social media companies though, even telco companies can have issues..

Fun Zone

Meta steals a tactic from Tesla and builds data centers in tents

In a bid to cut construction time in half, Meta has built six tents — or “rapid deployment structures” as the company describes them — outside of New Albany, Ohio, according to Michael Thomas, founder of Cleanview, which tracks data center deployments.

Bold and startup like, Meta is trying something ambitious, before judging, lets see how this works out for them…

Resources

Confidence sabotages your fraud investigation

Instead of collecting evidence, I try to disprove a theory. I first make a hypothesis and then ask specific questions that would try to knock it down. All in the first 60 seconds.

Our Data Security Policy Is Transparent in That It Doesn’t Exist

In this episode:
• The weight of old controls
• Data you can actually see
• 68 vendors and counting
• Authority you never had to claim

Career Links

How Making More Money Affects Your Life

Just check out this 5 minute video.

Microsoft under fire for threatening security researcher with criminal investigation

In a series of blogs published in the last couple of weeks — without providing many specific details — Nightmare Eclipse claimed to have been in contact with Microsoft, but the company allegedly mistreated them, including revoking access to their Microsoft Security Response Center account, the portal where researchers can report vulnerabilities to the tech giant. Nightmare Eclipse’s implication was that they had no choice but to release the vulnerabilities publicly.

Bonus Links

When AI Builds Itself

Taken far enough, and given enough compute, that trend points to an AI system capable of fully autonomously designing and developing its own successor. This is called recursive self-improvement. We are not there yet…

Judge orders detention of ex-CIA official found with $40 million in gold bars

The court papers do not indicate why Mr. Rush appears to have kept so much gold, and $2 million in U.S. currency, in his home, or what work project would have required him to amass such wealth.

Subscribe now

Security and Fraud

Edmonton police, U.S. Secret Service partner with ‘ethical hackers’ to stop $42M in fraud

Between July 2025 and May 2026 EPS says it developed a relationship with an ethical hacking network, also known as scam baiters, to gather intelligence related to in-progress scams. The group intercepted the victim’s information and shared it with police.

I don’t see this as very different than the hack back approach the Australian government has started using against criminals. In this case, the good guys win and save many victims from losing money!

Beyond the Claim: How Leading Financial Institutions Are Reimagining Scam Risk Management

Authorized payment fraud has emerged as one of the most significant challenges facing financial institutions worldwide.

I really love the visual of areas we need to focus on internally to make sure we are stopping “all the fraud”. It’s not just models, tools and our processes, its the organization as a whole!

Fun Zone

Where the goblins came from

Starting with GPT‑5.1, our models began developing a strange habit: they increasingly mentioned goblins, gremlins, and other creatures in their metaphors. Unlike model bugs that show up through a tanking eval or a spiking training metric and point back to a specific change, this one crept in subtly. A single “little goblin” in an answer could be harmless, even charming. Across model generations, though, the habit became hard to miss: the goblins kept multiplying, and we needed to figure out where they came from.

The best part about this bug/feature is that it wasn’t AI poisoning, it wasn’t a hallucination, it was just human whimsy seeping into a model’s “personality” due to incentives around the creature metaphors during training.

Ad Zone

Google FI - Phone Service!

I love this service from Google, and it works for any iphone or Android devices! With a party of 4 or more you can get plans as low as $20 a month. I current pay $27 per line for unlimited data in the US, Canada and Mexico!

Plus, when you sign up using this link, you can save $60 off your bill! What’s there to lose?!

Resources

Naomi Brockwell | Data Privacy!

NBTV is a project of the Ludlow Institute, a research and media institute dedicated to helping you reclaim control of your digital life. Created and hosted by Naomi Brockwell.

NSA MCP Security Design

MCP’s rapid proliferation has outpaced the development of its security model. Much like early web protocols, MCP was released with a flexible and underspecified design, allowing implementers freedom of design but also introducing ambiguity for safe usage.

Career Links

Financial Crime and Cybersecurity Forum 9/15 - 9/16

Datos Insights brings you a premier gathering of financial and cyber crime fighters who are actively transforming how financial services institutions protect customers from escalating threats.

Stop Complaining About Your Colleagues Behind Their Backs

Many of us believe that we’re above workplace gossip, and that we never engage in it. But, if you’ve ever participated in a “confirmation expedition” — whereby you 1) ask a colleague to confirm their own negative or challenging experience with a third colleague who is not present, or 2) welcome a similar line of confirmation inquiry from another colleague about a third colleague who is not present, you are in fact engaging in gossip.

Bonus Links

The Polymarket-Google Case, And How Prediction Markets Manufacture Insider Trading Incentives

A Google employee faces charges for trading on Polymarket, the latest scandal to dominate the industry’s news cycle. Roundup: White House is reviewing CFTC’s prediction market plan.

Trust Under Pressure <packt>

Employees are no longer only defending against malicious software; they are defending against synthetic identities and manipulated reality.

Subscribe now

Security and Fraud

Physical attacks on cryptocurrency holders keep ticking up

Physical crimes against crypto holders (or “wrench attacks”) continue to rise around the world. According to 2025 data from blockchain security company CertiK, cited by Bloomberg, the number of physical attacks related to crypto rose 75% last year to 72 verified incidents.

Just as CEO’s kids could be the downfall to a major corporation (kidnapping or cyber incidents), crypto has an odd Achilles heel too: threats or acts of physical violence.

Risky Business -They’re Buying American Front Men

What the three anonymous founders are selling, though, is laid out in plain English. For $1,999 down and $4,499 a month, a buyer in any country can walk away with a real American to front their e-commerce business. The American they hire comes with paperwork – a functioning LLC in their name, a working bank account, and a residential US internet address, so every login looks like it comes from the US.

Shell companies for sale, and an American identity as the front man… How are you doing your Business KYC? More importantly, how are you screening your online purchases, when risky businesses like this are popping up everywhere?

Fun Attack Back Zone

Capital One takes action to disrupt robocaller scam networks

Capital One’s lawsuit is focused on trademark infringement and counterfeiting with respect to its logo and brand. This lawsuit is not aimed at a single entity – it’s targeting multiple individuals and entities that are exploiting the legal and physical gaps, hiding behind jurisdictional complexity, and relying on a digital border to evade accountability for their misconduct.

I’ve heard this for far too long: “Can’t we just take down these bad actors?”. Capital One is working to identify them! Taking the fight to the anonymous onslaught of financial crime miscreants is a noble and enormous undertaking! Thank you Capital One for working on breaking down these fraud networks.

Ad Zone

Wowie!

The following ad supports this newsletter. Thank you for reading and check out a truly amazing brand. I love their shorts, pants and shirts for the summer months! They have everything from a casual swim short, to 5 pocket dress pants. All feel great and look even better!

Plus, when you use the link in this article, you get $20 off your purchase!

Resources

Suricata

Suricata is a high performance, open source network analysis and threat detection software used by most private and public organizations, and embedded by major vendors to protect their assets.

Dark Reading

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Career Links

Organizational Politics & The Security Program

In any organization there are finite resources and many competing factions seeking to apply those resources to their objectives. Getting what you need in the face of this is the stuff of organizational politics.

Scott Galloway: AI Wasn’t Built For You. The Rich Don’t Need You Anymore!

AI CEOs are selling us the dream of ‘freedom’, making billions off the fear of mass job loss! Scott Galloway reveals the truth is more complicated and far more deceptive.

Bonus Links

Crypto ATM Operator Bitcoin Depot Files for Chapter 11 Bankruptcy

CEO Alex Holmes blamed an increasingly hostile regulatory landscape for the publicly-traded company's collapse in a statement, arguing that the regulatory environment for Bitcoin ATM operators operators has “shifted significantly,” rendering Bitcoin Depot’s business model “unsustainable.”

CISA Admin Leaked AWS GovCloud Keys on Github

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.

Subscribe now

Security and Fraud

Android 17 to expand banking scam call and privacy protections

Android will work with banking apps to detect spoofed calls and automatically terminate the connection when a scam is identified.

Other cool features include easier ways to mark your device lost and reducing app permissions around accessibility to reduce malware effectiveness.

Exclusive: Hackers have breached tank readers at US gas stations; officials suspect Iran is responsible

The hackers responsible have exploited automatic tank gauge (ATG) systems that were sitting online and unprotected by passwords, allowing them in some cases to tinker with display readings on the tanks but not the actual levels of fuel in them, the sources said.

No know physical threat has been detected, but access to these systems could mean the attackers could make a leak undetectable. This could lead to a huge issue for US gas stations.

Fun Job Hopping Zone

Millennials may not have been the real job-hoppers after all

Before Gen Z’s blank stare took over the workplace discourse, millennials were the generation everyone had a theory about: entitled, purpose-seeking, allergic to office life, and, perhaps above all, job-hoppy — the idea that they were less willing to commit, bouncing from employer to employer in search of better pay, faster growth… or maybe just a fun office with sleep pods and balance balls.

Turns out Boomers switched jobs at a rate of 10.4 jobs before age 38, where Millennials only switched 9.4 times. Most of this difference can be explained by the economy each had before the age of 38. A better economy, with more benefit for jumping ship, will lead to more job changes.

Resources

Mechanistic Interpretability 101

At the heart of MI are two key concepts: features and circuits. These elements play pivotal roles in deciphering the operations of neural networks and understanding how information is processed within these systems.

A Beginners Guide: Cross-Device Passkeys

This post focuses on how passkeys can be used across devices using a mechanism called Hybrid transport. This is an important piece of the puzzle to make passkeys available everywhere.

Career Links

Are You Meeting the Needs of the People You Lead?

Organizations have never invested more in leadership—and yet employees trust their leaders less than ever. Engagement scores among workers and managers are dropping worldwide, burnout is rising, and many leadership programs produce impressive frameworks but disappointing results.

These 3 Personality Traits Affect What You Earn — but Only After Age 40

But it is less clear when these personality traits matter most for our careers — are they more important earlier on, or in the middle? — and who benefits most from them.

Bonus Links

The FBI Is Now Tracking AI Scams, and the Losses Are Huge

Americans reported nearly $21 billion in cyber crime losses in 2025, and within that, more than 22,000 complaints were tied to artificial intelligence, totaling about $893 million in losses.

The Forensic Trail On GitHub: Hunting For Supply Chain Activity

We’ll expose the wealth of intelligence available directly from both GitHub and the underlying Git plane. Through concrete demos, we’ll show how to effectively pivot on user metadata and behavioral heuristics, uncover attacker forks, and recover deleted gists and commits.

Subscribe now

Security and Fraud

Attack of the killer script kiddies

In the aftermath of Mythos, AI-assisted amateur hackers are waiting to strike.

We spent 20 years worrying about elite hackers. Turns out the real threat might be Chad with a prompt window and too much Mountain Dew.

Firm fined after failing to stop customers losing $45k to scammers

A telecommunications firm has been sanctioned by regulators after failing to stop scammers swindling its customers out of more than $45,000.

The fine was due to the telco company having flaws that allowed a ‘take over’ of a phone number. Honestly, I’d love to see some stricter law around phone security in the US. The amount of spoofing and call forwarding on that channel that result in losses is massive!

Fun Scam Zone

Cybersecurity experts warn of new CAPTCHA scam

If the CAPTCHA is asking you to put something on your device, to do a shortcut, it shouldn’t be the case. Also, CAPTCHA doesn’t require you to insert your name or password. And it doesn’t require you to download software on your device.

We trained humans to click boxes until they stopped reading, now “verify you are a human” is another angle for an attack.

Resources

Mitre Secure AI

A collaboration with MITRE ATLAS™ to advance security for AI–enabled systems that takes a threat-informed approach, enables rapid exchange of new threat information, and provides mitigation strategies.

The Signal by SentiLink Newsletter

Field notes and intelligence from the fight against identity fraud.

Career Links

How AI is turning every job interview into a coding interview

Live coding tests used to be a thing that happened mostly in engineers’ job interviews. Now recruiters are asking even non-coders to spin up Claude Code and build something while they share their screens.

5 Reasons Why You Need To Hire A Great Fraud Manager

A great fraud manager is worth their weight in gold to an organization. Actually, they are probably worth 18 times their weight in gold! I am totally serious about this.

Bonus Links

Minnesota bans cryptocurrency ATMs in response to growing fraud cases

Some users were duped into wiring thousands of dollars to scammers, according to police and local officials.

‘We’ve never seen anything like it’ – fraud surge is now INTERPOL’s top priority, chief tells #EAFCS2026

FRAUD is now a ‘top global priority’ for INTERPOL amid surging numbers of scams, according to agency boss Valdecy Urquiza.

Subscribe now

Security and Fraud

Lawsuit Accuses Meta of Profiting From Widespread Fraud On Its Platforms

Consumers lost at least $2.7 billion to scams originating on social media platforms between 2021 and 2023, according to a newly filed lawsuit that alleges Meta Platforms, Inc. played a central role in enabling the activity.

Social Media is a free way to access sooo many people, its also a cheap way to scam many. While it can be hard to tell if an ad is malicious or not, this comes down to how much any site should be able to or have to police its platform. When it costs consumers 2.7 billion… maybe its time this is a true cost of doing business for Meta and other social media giants.

Tracking Adversaries: EvilCorp, the RansomHub affiliate

On 15 July 2024, Microsoft shared a post on X stating that RansomHub was observed being deployed in post-compromise activity by Manatee Tempest (which is Microsoft’s name for EvilCorp) following initial access via SocGholish (aka FakeUpdates) infections (which Microsoft tracks as Mustard Tempest).

Oh Russia… Blue teams looking at TTPs are going to connect the dots, this time they did it in a big way.

Fun Zone

Americans Think Kindness Prevails in the U.S.

Solid majorities of Americans observe kindness being practiced in society as well as toward them, personally. And while slightly more than half of Americans say they are very comfortable initiating acts of kindness toward strangers, younger adults are much less likely to be comfortable doing so than older adults.

It’s about that time to perform an act of kindness in the world. Spread some joy!

Resources

The Priority Intelligence Requirements (PIR) Starter Kit

A practical playbook for building and operationalizing requirements-driven intelligence.

Financial crime prevention hub

Financial crime is coordinated. Most institutional defenses are not. When fraud and AML controls operate in silos, criminal networks exploit the gaps between them — and the consequences spread across losses, regulatory exposure, and competitive position.

Career Link

Security Rulez: Should AppSec Engineers Still Learn AppSec? - May 20th Event

AI tools can now scan code, review pull requests, generate fixes, and even write security tooling. And that raises an uncomfortable question: If machines can do most of the security work, what should future AppSec engineers actually learn?

Bonus Links

Study Finds A Third of New Websites are AI-Generated

The research also found that all this AI-generated text is making the web more cheery and less verbose.

Vercel says some of its customers’ data was stolen prior to its recent hack

Vercel also said it discovered more customer accounts compromised by the April incident, but did not disclose details, only saying that it had notified customers known to be affected so far.

Coordinated Takedown of Scam Centers Leads to at Least 276 Arrests; Alleged Managers and Recruiters Charged in San Diego

Unprecedented cooperation between the FBI, Dubai Police Department, and Chinese Ministry of Public Security has resulted in the arrest of at least 276 individuals and the dismantlement of at least nine scam centers used for cryptocurrency investment fraud schemes.

Subscribe now

Security and Fraud

AI voice fraud draws new congressional scrutiny

Lawmakers are zeroing in on how synthetic voices are used in scams as multiple bills target deepfakes, impersonation, and fraud

I agree that large companies creating tools and models should try to curb malicious use of their products. If a binky kills a baby, the manufacture is at risk of a lawsuit. This same logic should apply to AI companies. That said, the cat is out of the bag, and there are open source alternatives to these companies that make this a hard problem for lawmakers alone to combat.

How A Roblox Cheat Download Triggered A $2 Million Hack At Vercel

On April 19, 2026, Vercel confirmed that an attacker had used those credentials to breach Context.ai, steal the OAuth tokens of its customers, and pivot into the Google Workspace of a Vercel employee who had signed up for Context.ai's product and granted it "Allow All" permissions on their enterprise account.

What are your employees prompting, or allowing AI to access? Better yet, which tools are they using that may be giving away the keys to your kingdom without you knowing it?

Fun Zone

A majority of Americans support legalizing marijuana use. Support is highest among middle-aged Americans

Why are Americans ages 45 to 64 more likely to support marijuana legalization? Part of the explanation may be that members of this group — which we’ll call middle-aged, though you can also think of it as largely Gen X — are most likely to have used marijuana and most likely to know marijuana users.

Almost half the people in the US have tried marijuana in some form and most know someone who have. With 80%+ support across the board for medicinal marijuana, it seems about time to legalize nationally.

Resources

The $0 security stack

We just completed our first SOC2 audit period, and as part of that, we set up our initial security stack. We’ve set up literally world-class security tools, without it costing us a cent.

Measuring What We’re Missing

This one focuses on a way forward: test assumptions, observe where they break, and make that measurable.

Career Links

The Little Things That Make Employees Feel Appreciated

Most companies run some kind of employee-recognition programs, but often they fall flat, wasting resources. Many become just another box for managers to check or are seen as elite opportunities for a favored few, leaving the rest of the workforce feeling left out.

Detecting Scams & Human Trafficking Risks Ahead of World Cup 2026

As the world’s largest sporting event approaches, global attention, travel, and economic activity surge. Unfortunately, so do the risks. Major international events like the World Cup present opportunities to better detect human trafficking, forced labor, and scams activity.

Bonus Links

Researchers find cyber-sabotage malware that may predate Stuxnet by five years

FAST16 could be the first cyberweapon, and its effects could be with us today

U.S. launches sweeping crackdown on Southeast Asia cyberscams and sanctions Cambodian senator

The crackdown, led by a U.S. government Scam Center Strike Force, includes the Treasury Department's sanctioning of a prominent lawmaker and 28 other people and companies accused of operating from Cambodia. Criminal charges also were filed against two Chinese nationals involved in a similar operation in Myanmar.

Subscribe now

Security and fraud

KYA is overhyped

KYA - or Know Your Agent - is a loose term that should describe agent authentication… Think about it - every serious fraud scenario in agentic commerce passes right through KYA. Stolen card fraud: An authorized agent running a stolen card passes every KYA check. The agent is exactly what it says it is. The fraud is upstream and invisible to the protocol.

Financial institutions definitely need a Know Your Agent solution, but just because you can authenticate an agent doesn’t mean you can verify if fraud is happening. You still have to treat the agent like its doing something malicious, or being directed to do so to detect our normal fraud risks we have with humans who authenticate.

‘It reads like a spy novel’: $280 million theft from Drift involved North Korean fake companies, cutouts

“The investigation has shown so far that the profiles used in this third party targeted operation had fully constructed identities including employment histories, public-facing credentials and professional networks,” Drift said.

Patient threat actors can gain trust of months or even years. In this case, the threat actors had duped 2 of 3 third parties into doing malicious actions against Drift. The separation from North Korean actors and the time it took for the actions to turn malicious really speak to the forethought of the North Korean threat actors in this case.

Fun Privacy Zone

FBI Recovers Deleted Signal Messages Through iPhone Notifications

Signal messages may persist in iPhone notification data, enabling FBI access even after deletion, a court case reveals.

We’ve seen notifications as a weak point repeatedly in the news, here’s more proof that nonfictions can betray you and lead to a less private and secure life. For some devices, removing the text from motivations helps remove that sensitive data from being saved, for others, its just a UI feature, but not backed by privacy under the hood.

Resources

Cyware Threat Briefings

Stay updated with the latest news, insights, and trends in threat intelligence.

Context to Confidence: The Next Phase of Ambiguous Techniques Research

An ambiguous technique is a MITRE ATT&CK® technique whose observable characteristics are insufficient to determine intent. Typical observable data does not allow us to confidently ascertain whether the intent behind the activity is malicious or benign.

Career Link

Claude: Automate work with routines

Put Claude Code on autopilot. Define routines that run on a schedule, trigger on API calls, or react to GitHub events from Anthropic-managed cloud infrastructure.

Bonus Links

Dozens of property tax checks in Napa Co. were stolen through mail, officials say

Dozens of checks mailed to the office, totaling millions of dollars, have been stolen and altered through a fraud called "check washing," officials said. An investigation is underway.

Cyware Daily Threat Intelligence, April 14, 2026

The Latin American financial sector is under a massive offensive from JanelaRAT, a BX RAT variant that has already clocked over 14,000 attacks in Brazil this year alone.

Subscribe now

Security and Fraud

Operation Atlantic: Protecting Victims Against Crypto Fraud

Operation Atlantic focuses on identifying victims who may have lost - or are at risk of losing - crypto assets through "approval phishing." This tactic is often used in online investment fraud, often referred to as "pig butchering," to lure victims into handing over ever-increasing amounts to scammers.

Approval phishing, granting full access to your crypto wallet and then funds being drained… This is an international scam and increasing in popularity among criminals as less technical people get in on the crypto madness.

Wall Street CEOs reportedly “summoned” to DC by Scott Bessent and Jay Powell to discuss AI cyber risks after Anthropic’s warning

Top officials are worried about left-tail cybersecurity risks from new AI tools, and are making sure the most important American bankers are taking the threat seriously.

The primary catalyst for this "urgent meeting" is the release of Anthropic’s new model, Mythos. The model marks a threshold where AI coding capability now matches or exceeds elite human hackers. With new vulnerabilities potentially being discovered faster through the aid of AI, how businesses respond in this moment matters.

Fun Privacy Zone

One Tech Tip: Modern cars are spying on you. Here’s what you can do about it

Modern cars are computers on wheels that are becoming increasingly connected, enabling innovative new features that make driving safer and more convenient. But these systems are also collecting reams of data on our driving habits and other personal information, raising concerns about data privacy.

You can turn off many of the privacy invading features and tracking. It took me a minute to find the settings in my Toyota app. Look at what your vehicle is collecting, if you aren’t using that data, your car manufacturer doesn’t need it either.

Resources

MIRTE Fight Financial Fraud | [This is so cool!]

The Fight Fraud Framework strengthens fraud analysis by giving teams a clear behavioral structure to identify risks, focus investigations, and stop fraud before the threat actor cashes out.

“Are we exposed?” The CTI Fusion Playbook for end-to-end exposure validation

A five-phase operational framework for translating adversary intelligence into validated exposure confidence across Threat Hunting, Detection Engineering, Red Team, and SOC operations.

Career Links

Tailor CTI prompts to your industry: Build for your workflow and stakeholders

In this hands-on session, you'll learn how to identify friction in your CTI workflow, define the outputs your stakeholders actually need, and work backward to craft prompts tuned to your industry's threats, terminology, and regulatory environment.

Switch to Claude without starting over

Bring your preferences and context from other AI providers to Claude. With one copy-paste, Claude updates its memory and picks up right where you left off.

Bonus Links

Behavioral Biometrics

There is one thing a fraudster cannot easily clone: the subconscious way a human interacts with a screen.

Don’t just fight fraud, hunt it

As traditional fraud markers become obsolete, we must treat digital identity as critical infrastructure and adopt a layered, real-time defense to neutralize sophisticated crime rings.