Be cautious of unexpected emails that include attachments or links, even if they appear to come from trusted sources. Always verify the sender and the legitimacy of any link or file before opening, and avoid downloading or clicking on anything suspicious. Adopt a Zero Trust mindset—treat every attachment or link as potentially harmful until verified—to strengthen your protection against phishing attacks.

Do you have a question? Submit a ticket at [PB8324.3] Data Security Support

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are increasingly targeting people who use popular mobile messaging apps, such as Signal, WhatsApp, and Telegram.

According to CISA, cybercriminals are using sneaky tricks and fake apps to gain access to users’ accounts and steal sensitive information. The attacks are aimed at high-profile individuals, including government officials, military personnel, and leaders of civil society organizations, in the U.S., Europe, and the Middle East.

Some recent examples include:

• Hackers taking over Signal accounts by exploiting its “linked devices” feature.
• Fake apps targeting users in the Middle East to steal data from Android phones.
• Scams in Russia using fake versions of popular apps like WhatsApp and TikTok.
• Small-scale attacks on iPhones and WhatsApp users through security flaws.
• Malware targeting Samsung Galaxy phones in the Middle...

  ---

  November 27, 2025 15:44 (on 11/27/25) |  0 | 2 minutes read

Never trust password reset prompts you didn’t initiate. Unexpected reset messages are often signs of phishing or account-takeover attempts. Always check your account directly through the official website or app instead of clicking links in the message. When in doubt, ignore the prompt and secure your account by updating your password yourself. 

Do you have a question? Submit a ticket at [PB8324.3] Data Security Support. 

Automatic updates protect your devices by fixing security vulnerabilities that hackers exploit. Running updates in the background keeps you safe effortlessly.

To Do:

• Enable automatic updates for your OS and all apps
• Restart devices when updates require it
• Check regularly that auto-updates are still active
• Update all devices on your network

Avoid:

• Ignoring update prompts or postponing updates
• Downloading updates from unofficial sources
• Leaving any device outdated, even rarely used ones

“Keep it fresh, keep it safe—update without delay!”

Do you have a question? Submit a ticket at [PB8324.3] Data Security...

QR codes are everywhere—malls, menus, emails—but they can hide phishing links or malware. Scammers may cover real codes with fake ones or send deceptive digital versions. Always check the source, look for tampering, and verify the URL before scanning.

QR Code Myths vs. Facts

MYTHS
• All QR codes are safe.
• They can’t be tampered with.
• Professional-looking codes are legit.
• You’ll be able to spot a dangerous code.

FACTS
• QR codes can lead to phishing sites or malware.
• Scammers can replace real codes with fake ones.
• Even polished designs can be malicious.
• Verifying the source is essential.
• Harmful codes often look normal unless you check...

Be extra cautious of unexpected messages claiming to be from your bank, especially now that Christmas is near and scammers take advantage of the busy holiday season. Always verify the sender, keep an eye out for any odd or unfamiliar transactions, and never share sensitive information like passwords or one-time codes through email, text, or phone calls. When in doubt, contact your bank directly using the official website or phone number to confirm any request.

Do you have a question? Submit a ticket at [PB8324.3] Data Security Support.

Remember that cybercriminals often imitate trusted brands to trick you into letting your guard down. Always inspect emails, messages, and websites carefully for subtle signs of fakery. When in doubt, go directly to the company’s official site instead of clicking provided links. Staying alert to brand impersonation helps you avoid phishing scams and protect your personal information. 

Do you have a question? Submit a ticket at [PB8324.3] Data Security Support.

Sharing passwords in plain text is very risky, as they can be easily seen, copied, or stored in unsafe places without your knowledge. Credentials sent via email, messaging apps, or notes are especially at risk of being accessed by others. Always keep your passwords secure by avoiding plain-text sharing and using trusted, approved methods whenever access is needed.

Do you have a question? Submit a ticket at [PB8324.3] Data Security Support

Security begins with awareness, and even the smallest habits can strengthen your protection. Simple actions—like verifying senders or updating software—add up quickly. When you stay mindful of potential risks, you’re less likely to fall for common threats. Make awareness part of your routine to keep yourself and your data safe. 

Do you have a question? Submit a ticket at [PB8324.3] Data Security Support.

Attackers using a Phishing-as-a-Service kit called Sneaky 2FA have added Browser-in-the-Browser (BitB) attacks to their tools. This method creates fake pop-up login windows that look real, helping criminals steal Microsoft account credentials. BitB works by copying the look of a normal login pop-up and showing what appears to be a legitimate URL, even though the page is fake.

In one example, victims visited a suspicious site, passed a bot check, and then clicked a “Sign in with Microsoft” button to view a fake PDF. A false Microsoft login window then appeared, stealing their login and session information.

Attackers also use CAPTCHAs, conditional loading, and fast-changing domains to hide from security systems. Sneaky 2FA further blocks code inspection and makes its phishing pages hard to analyze.

Researchers also found that malicious browser extensions can hijack the WebAuthn process, letting attackers fake...