Cofense Blog

Phish Found in Proofpoint-Protected Environments – Week ending October 23, 2020

Phish Found in Proofpoint-Protected Environments – Week Ending October 16, 2020

Threat Actors Use Canva Templates for Credential Phishing

Security Awareness: Choosing Methods and Content that Work

Trump COVID-19 Diagnosis Leveraged in Campaigns

Phish Found in Proofpoint-Protected Environments – Week Ending October 4, 2020

Building a Security Awareness Program? Start with Strategy and Goals

Phish Found in Environments Protected by Proofpoint, Microsoft, Cisco, Mimecast and Symantec

Twelve Flavors of Phish: Canadian Workers Targeted With Fake Covid-19 Relief Deposits

Cofense PhishMe Achieves Agency ATO

Today, we are delighted to announce that Cofense PhishMe has received Agency Authority to Operate (ATO) from the US Department of Health and Human Services (HHS). This is an important milestone in the Authorization Process of the Federal Risk and Authorization Management Program (FedRAMP) Agency Authorization Process. Now the FedRAMP PMO will begin their review of our ATO package. We are getting closer to completing Phase 3 (Authorization Process) in pursuit of our FedRAMP ATO. Check back for any updates on our FedRAMP Authorization journey. Learn More All third-party trademarks referenced by Cofense whether in logo form, name form or...

Coronavirus-Themed Phish Continue to Surge

Coronavirus Redefines the Phishing Threat Landscape

This Employee Satisfaction Survey is Not so Satisfying… Except for the Credential Phishing Actors Behind It.

Threat Actors Innovate to Exploit COVID-19, Delivering OpenOffice .ODP Attachments on a Shoestring Budget

Threat Actor Uses OneNote to Learn Credential Phishing and Evade Microsoft and FireEye Detection

Phishers Are Using Google Forms to Bypass Popular Email Gateways

Emotet Gears Up to File (Your) Taxes

Hot Off the Press: Cofense Q4 2019 Malware Trends Report

5 Cybersecurity Trends that Will Dominate 2020

By Aaron Higbee, CTO, Cofense The threat landscape continues to evolve at a rapid pace, with new threat vectors emerging and increasing in sophistication. Which ones should you watch most closely as 2020 unfolds? Based on insights collected from our Cofense research teams, here are five trends we see dominating next year. Ransomware will continue becoming more targeted to reap more sizeable payouts. Many people are under the impression that ransomware is slowing down, but in reality it’s simply being used in a more targeted fashion. So many private and public organizations, as well as government entities, have been infiltrated...

This Advanced Keylogger Delivers a Cryptocurrency Miner

Phish Found in Proofpoint-Protected Environments – Week ending October 23, 2020

Phish Found in Proofpoint-Protected Environments – Week Ending October 16, 2020

Threat Actors Use Canva Templates for Credential Phishing

Security Awareness: Choosing Methods and Content that Work

Trump COVID-19 Diagnosis Leveraged in Campaigns

Phish Found in Proofpoint-Protected Environments – Week Ending October 4, 2020

Building a Security Awareness Program? Start with Strategy and Goals

Phish Found in Environments Protected by Proofpoint, Microsoft, Cisco, Mimecast and Symantec

Twelve Flavors of Phish: Canadian Workers Targeted With Fake Covid-19 Relief Deposits

Cofense PhishMe Achieves Agency ATO

Today, we are delighted to announce that Cofense PhishMe has received Agency Authority to Operate (ATO) from the US Department of Health and Human Services (HHS). This is an important milestone in the Authorization Process of the Federal Risk and Authorization Management Program (FedRAMP) Agency Authorization Process. Now the FedRAMP PMO will begin their review of our ATO package. We are getting closer to completing Phase 3 (Authorization Process) in pursuit of our FedRAMP ATO. Check back for any updates on our FedRAMP Authorization journey. Learn More All third-party trademarks referenced by Cofense whether in logo form, name form or...

Phishing Attackers Are Abusing WeTransfer to Evade Email Gateways

This Phishing Attacker Takes American Express—and Victims’ Credentials

Recently, the CofenseTM Phishing Defense CenterTM observed a phishing attack against American Express customers, both merchant and corporate card holders. Seeking to harvest account credentials, the phishing emails use a relatively new exploit to bypass conventional email gateway URL filtering services.

UK Banking Phish Targets 2-Factor Information

Under the Radar – Phishing Using QR Codes to Evade URL Analysis

Phishing Attacks on High Street Target Major Retailer

Houdini Worm Transformed in New Phishing Attack

By Nick Guarino and Aaron Riley The Cofense Phishing Defense Center™ (PDC)  and Cofense Intelligence™ have identified a new variant of Houdini Worm targeting commercial banking customers with campaigns containing either URLs, .zip, or .mht files. This new variant is named WSH Remote Access Tool (RAT) by the malware’s author and was released on June 2, 2019. Within five days, WSH RAT was observed being actively distributed via phishing. Figure 1 shows an example message from this campaign.

This ‘Voice Mail’ Is a Phish—and an Email Gateway Fail

The Zombie Phish Is Back with a Vengeance

Keep a close on your inboxes—the Zombie Phish is back and it’s hitting hard. Last October, on the eve of Halloween, the CofenseTM Phishing Defense CenterTM reported on a new phishing threat dubbed the Zombie Phish. This phish spreads much like a traditional worm. Once a mailbox’s credentials have been compromised, the bot will reply to long-dead emails (hence, Zombie) in the inbox of the infected account, sending a generic phishing email intended to harvest more victims for the Zombie hoard.

Got a Blockchain Wallet? Be Alert for These Phishing Emails

Jigsaw Ransomware Returns With Extortion Scam Ploys

By Lucas Ashbaugh Want to play a game? Jigsaw ransomware does, and it’s going to run you $400… or you could just download the free decrypter online. Jigsaw, featuring Billy The Puppet from Saw, was first released in 2016. It not only encrypts the victim’s files but deletes them at a continuously increasing rate until a payment in bitcoin can be confirmed against the bitcoin blockchain. Now, Jigsaw has been observed again, this time delivered through scam tactics. The Delivery Each email starts off with a ploy about how the threat actor somehow compromised the victim’s financial accounts. After shocking and...