Critical

Trust Is Not What It Seems — And Fraudsters Are Counting on It

darkreading
Actively Exploited

Overview

Recent reports indicate that fraudsters are increasingly using social engineering tactics rather than sophisticated malware to compromise organizations. They are calling help desks and posing as legitimate users to gain unauthorized access, often employing artificial intelligence tools to improve their chances of success. This shift in tactics highlights a growing vulnerability in corporate security protocols, where trust is exploited to bypass technical defenses. Organizations that rely heavily on help desk verification without additional safeguards are particularly at risk. As these tactics become more prevalent, companies need to reassess their security measures and train staff to recognize and respond to these types of social engineering attacks.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Help desk systems, corporate IT security protocols
  • Action Required: Enhance help desk verification processes, implement multi-factor authentication, provide training on social engineering threats.
  • Timeline: Ongoing since recent months

Original Article Summary

Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.

Impact

Help desk systems, corporate IT security protocols

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since recent months

Remediation

Enhance help desk verification processes, implement multi-factor authentication, provide training on social engineering threats

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Malware.

Related Coverage

Forgotten AI agents may still access sensitive company data

Help Net Security

A recent report from Arrakis Security reveals a concerning issue with AI agents in corporate environments. It found that about 76% of these agents had not been active for over 60 days, yet they still maintained access to sensitive company data through retained credentials and connections. This situation poses a significant risk, as these inactive agents can perform various actions, including reading and writing data or initiating workflows. Companies that utilize AI agents need to be aware of this vulnerability and take steps to manage and disable agents that are no longer in use, to prevent potential unauthorized access to their systems and data. The implications are serious, especially for organizations handling sensitive information.

Oct 26, 2026

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Help Net Security

Criminals are increasingly using synthetic identities to exploit established customer accounts, resulting in an estimated $2.4 billion in potential fraud exposure for U.S. lenders, according to a report by TransUnion. During the first half of 2026, a staggering 81% of suspected digital fraud incidents occurred during account logins and financial transactions. This indicates that simply verifying a person's identity at the start of a relationship does not guarantee trust in future interactions. Scammers are adept at manipulating legitimate customers, making it crucial for companies to enhance their fraud detection and prevention measures to protect sensitive information and financial assets. The report serves as a wake-up call for financial institutions to reassess their security protocols in light of these evolving tactics.

Oct 26, 2026

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken

Help Net Security

The OpenSSL project has released version 4.1.0, which introduces support for DTLS 1.3, a protocol variant designed for datagram transport over networks like UDP. However, this new version comes with four known bugs in the DTLS code, which could lead to applications misinterpreting connection data. Developers using DTLS 1.3 or the recently added DTLS support in OpenSSL’s SSL listener API are particularly at risk. This situation is concerning as it could affect the reliability and security of applications that rely on these protocols, potentially leading to data miscommunication. Users and developers should stay alert for updates or patches that address these issues.

Oct 25, 2026

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

The Hacker News

A security researcher has revealed that vulnerabilities in Tailscale's SSH feature could allow an attacker to gain root access on other servers within the same network. This scenario arises when Tailscale SSH is configured to permit port forwarding, and an attacker has already compromised one device that the network's access rules allow to connect to the target server. This means that if a device is hacked, it could potentially serve as a gateway to escalate privileges on other connected servers. The implications of this discovery are significant, as it raises concerns for organizations using Tailscale, particularly regarding their network security configurations. Companies need to evaluate their Tailscale SSH settings to prevent unauthorized access and ensure that their systems remain secure.

Oct 25, 2026

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

The Hacker News

Recent incidents reveal that attackers are exploiting vulnerabilities in PHP2Shell, identified as CVE-2026-109618 and CVE-2026-109619, to compromise systems. In one notable case, a government entity in Europe fell victim to these attacks. Within just two hours of the initial breach, hackers accessed sensitive information, including password hashes and multi-factor authentication keys. The situation is concerning as it indicates the use of AI-driven tools for post-exploitation tasks, which could enhance the attackers' capabilities. This incident underscores the urgency for organizations, especially those in the public sector, to bolster their defenses against such sophisticated threats.

Oct 25, 2026

AI coding agents hijacked using AGENTS.md file in Downloads folder

BleepingComputer

Researchers discovered a malicious file named AGENTS.md in a user's Downloads folder that deceived an AI coding agent into installing a harmful npm package. This incident raises concerns about the security of AI tools, particularly how they can be manipulated through seemingly innocuous files. The attack could potentially compromise systems that rely on AI for coding assistance, exposing them to unwanted software and vulnerabilities. Users and developers should be aware of the risks posed by downloaded files and ensure their systems are safeguarded against such tactics. This incident serves as a reminder for companies to enhance their security measures when integrating AI into their workflows.

Oct 25, 2026