CyberheistNews Vol 15 #51 [Heads Up] Artful New Phishing Assaults Abuse Free Cloudflare Pages

[Heads Up] Artful New Phishing Assaults Abuse Free Cloudflare Pages

Malwarebytes warns that menace actors are abusing the free Cloudflare Pages service to host phishing portals, serving to the phishing websites keep away from detection by safety scanners.

The attackers are constructing faux login pages impersonating banking, insurance coverage and healthcare entities. The pages are designed to reap credentials in addition to safety questions and multifactor authentication codes.

“From the sufferer’s standpoint, nothing appears uncommon past an odd-looking hyperlink and a failed sign-in,” the researchers write. “For the attackers, the combo of free internet hosting, compromised redirectors and Telegram-based exfiltration offers them velocity, scale and resilience.

“The larger pattern behind this marketing campaign is evident: by leaning on free website hosting and mainstream messaging platforms, phishing actors keep away from most of the choke factors defenders used to depend on, like single malicious IPs or clearly shady domains. Spinning up new infrastructure is affordable, quick and largely invisible to victims.”

Malwarebytes presents the next recommendation to assist customers keep away from falling for these assaults:

• At all times verify the complete area title, not simply the brand or web page design. Banks and well being insurers do not host sign-in pages on generic developer domains like *.pages[.]dev, *.netlify[.]app, or on unusual paths on unrelated websites.
• Do not click on sign-in or profit hyperlinks in unsolicited emails or texts. As an alternative, go to the establishment’s web site by way of a bookmark or by typing the tackle your self.
• Deal with shock ‘further safety’ prompts after a failed login with warning, particularly in the event that they ask for solutions to safety questions, card numbers or electronic mail passwords.
• If something concerning the hyperlink, timing or requested data feels incorrect, cease and phone the supplier utilizing trusted contact data from their official web site.

Maintain coaching these customers. They want a wholesome sense of skepticism. Particularly with deepfakes now being on the market rather more. Over 70,000 of your friends belief the KnowBe4 HRM+ platform to strengthen their safety tradition and scale back human threat. You need to actually see the webinar under, the brand new deepfake coaching is highly effective and surprisingly straightforward to make use of.

Weblog put up with hyperlinks:
https://weblog.knowbe4.com/warning-phishing-attacks-abuse-free-cloudflare-pages

[Live Demo] Ridiculously Simple AI-Powered Safety Consciousness Coaching and Phishing

Phishing and social engineering stay the #1 cyber menace to your org, with 68% of information breaches brought on by human error. Your safety crew wants a simple solution to ship personalised coaching—that is exactly what our AI Protection Brokers present.

Be a part of us for a demo showcasing KnowBe4’s modern strategy to human threat administration with agentic AI that delivers personalised, related and adaptive safety consciousness coaching with minimal admin effort.

See how straightforward it’s to coach and phish your customers with KnowBe4′ HRM+ platform:

• NEW! Deepfake Coaching Content material – Generate hyperrealistic deepfakes of your individual executives to arrange customers to identify AI-driven manipulation and deepfakes
• SmartRisk Agent™ – Generate actionable knowledge and metrics that will help you decrease your group’s human threat rating
• Template Generator Agent – Create convincing phishing simulations, together with Callback Phishing, that mimic actual threats. The Advisable Touchdown Pages Agent then suggests applicable touchdown pages primarily based on AI-generated templates
• Automated Coaching Agent – Robotically determine high-risk customers and assign personalised coaching
• Data Refresher Agent and Coverage Quizzes Agent – Reinforce your safety program and organizational insurance policies

See how these highly effective AI-driven options work collectively to dramatically scale back your group’s threat whereas saving your crew beneficial time.

Date/Time: Wednesday, January 7 @ 2:00 PM (ET)

Save My Spot:
https://data.knowbe4.com/kmsat-demo-1?partnerref=CHN

WeChat Phishing Assaults a Rising Risk Outdoors China

By The KnowBe4 Risk Lab

“Tremendous-app” WeChat presents a wealth of performance—from prompt messaging, textual content and voice messaging, and video calls to cell funds, journey reserving, ordering meals deliveries, paying payments and even accessing authorities providers.

Supplied by Chinese language know-how conglomerate Tencent, WeChat has grow to be deeply built-in into every day life in China and utilization has been spreading globally. The app now boasts over 1.4 billion lively customers (24.8% of whole web customers).

In addition to interesting to respectable customers, the breadth of performance (notably WeChat’s cell fee functionality) additionally makes it enticing to cybercriminals. An preliminary phishing electronic mail is used to maneuver victims into WeChat the place social engineering assaults and fee fraud can happen in an surroundings that it is harder to watch and safe.

Very like WeChat utilization, these assaults are on the rise exterior of China.

In 2024, solely 0.04% of phishing emails detected by KnowBe4 Defend within the U.S. and EMEA (together with the UK) contained WeChat “Add Contact” QR codes. Because the begin of 2025, this has risen to 1.43%, spiking in November at 5.1%.

Whereas the general quantity stays comparatively low, this represents a 3,475% enhance throughout these areas. Moreover, 61.7% of those phishing emails had been written in English and an additional 6.5% had been in languages apart from Chinese language or English, indicating a rising and focused diversification.

This transfer displays regulation enforcement crackdowns on home and near-border fraud networks in China, pushing rip-off operators to department out. GenAI has been a key accelerator of this shift, eradicating the necessity for language proficiency to ship a convincing phishing electronic mail or prompt message.

Each international techniques and home Chinese language LLMs (comparable to Baidu’s ERNIE Bot) make it straightforward for cybercriminals to create pure, high-quality phishing emails in non-Chinese language languages.

[CONTINUED] Weblog put up with hyperlinks and graphics;
https://weblog.knowbe4.com/wechat-phishing-attacks-a-growing-threat-outside-china

The Excellent ROI of KnowBe4’s Human Danger Administration Platform

Lowering the danger of a knowledge breach is paramount, and the overwhelming majority of information breaches are resulting from human error. In accordance with Verizon’s Information Breach Investigations Report, 74% of all knowledge breaches concerned the human ingredient.

It is why safety consciousness coaching and safety orchestration platforms are crucial at decreasing threat, defending knowledge and making certain regulatory compliance. They now symbolize the most effective return on investments to your group’s infosec finances.

Obtain this information to grasp:

• The fee financial savings and productiveness features of KnowBe4’s SAT, Compliance Plus and PhishER Plus merchandise
• The general threat discount of a knowledge breach or ransomware assault
• How one can lower your cyber insurance coverage premiums
• The three-year ROI and annual advantages

Obtain Now:
https://data.knowbe4.com/hobson-outstanding-roi-knowbe4-hrm-platform-chn

Unmasking the Deepfake Risk: A Sport-Changer for Lowering Human Danger

By Roger Grimes

Immediately, anybody can discover a image of completely anyone and it is usually not tough to discover a pattern of their voice. By combining these it’s shockingly straightforward to create a practical AI deepfake video of that particular person.

The video is probably not good, and an skilled AI deepfake fanatic may be capable to see indicators of it not being actual, however will probably be adequate to idiot 99% of individuals. Cybercriminals have been creating and utilizing AI-enabled deepfake applied sciences since early 2024 to socially engineer folks.

Though early on it was a lot more durable to do and scammers solely used it on chosen, high-value targets, like on this $25 million heist.

These days are gone and AI deepfake instruments and providers are actually rather more accessible. There are actually a whole bunch on the web and most of them have free variations accessible. It’s going to take the common particular person longer to join the free account than to make their first AI-enabled, lifelike deepfake.

AI deepfakes are more and more being deployed by cybercriminals. A 2025 Gartner survey of cybersecurity leaders revealed a major menace: 62% of orgs reported experiencing a deepfake assault involving social engineering or automated course of exploitation, whereas 32% confronted assaults towards AI apps leveraging malicious utility prompts.

As well as, chatbot assistants are prone to varied adversarial prompting strategies the place attackers manipulate Massive Language Fashions (LLMs) or multimodal fashions to provide biased or dangerous output. Consultants count on that by the top of 2026, these ways will grow to be commonplace towards conventional, on a regular basis targets.

Due to this fact, it is important that all of us get educated about AI-enabled deepfakes. KnowBe4 has already created a ton of fine instructional content material on the subject to coach workers, however we went one HUGE step additional!

We now have deepfake coaching content material which permits KnowBe4 Diamond-level prospects with AIDA to simply and safely create and deploy simulated deepfake coaching movies to their groups, identical to every other sort of KnowBe4 coaching marketing campaign.

All you must do is observe a handful of step-by-step directions, together with importing a brief video and audio pattern of the particular person you need to create a deepfake video of (e.g., your self, CEO, CISO, CFO, and so on.), choose one of many predefined eventualities or scripts, preview and approve the simulated voice, preview and approve the simulated video, and run a coaching marketing campaign.

With this characteristic, your customers can expertise firsthand how convincing deepfakes have grow to be. They will even discover ways to acknowledge manipulated media with sensible cues on what to look out for when evaluating video or audio that seems to be from somebody they know and belief.

It is a actual game-changer in your plan to scale back human threat in your surroundings. You do not simply have to speak about deepfakes, you may present workers one in all somebody they know and belief. Here’s a screenshot of the present outlined eventualities:

[CONTINUED] weblog put up with screenshots and webinar invite:
https://weblog.knowbe4.com/unmasking-the-deepfake-threat-a-game-changer-for-reducing-human-risk

Large Information: Cybersecurity tips about TikTok, Instagram, and YouTube Shorts!

Everybody deserves cybersecurity data that is fast, clear and straightforward to use. That is why we have launched bite-sized content material on TikTok, Instagram and YouTube Shorts.

Why this issues to you:
Get fast, actionable cybersecurity ideas you may truly use, whether or not you are defending your self at work, maintaining your loved ones secure on-line, or serving to mates keep away from expensive scams.

What you may study:

• The best way to spot romance scams
• What to do when your password will get compromised
• How hackers deepfake voices to focus on your family members
• Why that “unpaid toll” textual content might be a lure
• And rather more sensible safety ideas and finest practices

One of the best half? Every tip takes lower than 60 seconds to observe and is designed for everybody, from tech-savvy professionals to your dad and mom who “simply need their cellphone to work.”

Comply with us for safety data that truly sticks:

TikTok
@KnowBe4Inc

Instagram
@KnowBe4Inc

YouTube
@KnowBe4

P.S. For in-depth cybersecurity tendencies and business information, subscribe to the KnowBe4 weblog at
https://weblog.knowbe4.com/

[HRM+ ENHANCEMENTS] Redesigned Danger Rating and Up to date Thresholds

What’s Altering: A New Search for Danger Rating – We have redesigned the interface with a contemporary, intuitive format that makes it simpler to grasp organizational human threat. The improved knowledge visualizations will assist shortly spot tendencies and priorities that want consideration.

Up to date Danger Stage Thresholds – We’re refining how we classify threat ranges primarily based on complete evaluation throughout our buyer base. This implies the label related to a buyer’s Danger Rating (comparable to Yellow-Medium or Orange-Excessive) might shift to raised mirror business benchmarks and provides a extra correct image of the place they stand.

What Prospects Must Do:

The brand new look is out there as an opt-in expertise, so prospects can discover the up to date interface every time they’re prepared. The edge updates took impact on December 15, and solely have an effect on the labels, not the precise Danger Rating quantity.

Assets

Study extra about these design adjustments right here:
https://help.knowbe4.com/hc/en-us/articles/204218028-Dashboard-Overview#h_01HDSAGC9WSS2SC3CANFY27X7M

Study extra about new vary thresholds right here:
https://help.knowbe4.com/hc/en-us/articles/40003728753171-FAQ-SmartRisk-Agent-and-Danger-Rating-Information#h_01JQY7FXMVVCHNE0K00XJQDGEG:~:textual content=concerningpercent20physicalpercent20security.-,Whatpercent20ispercent20thepercent20availablepercent20rangepercent20forpercent20Riskpercent20Scorepercent3F,-Thepercent20Riskpercent20Score

Let’s keep secure on the market.

Heat regards,

Stu Sjouwerman, SACP
Government Chairman
KnowBe4, Inc.

PS: Now you can pre-order my new e-book: Agent-Powered Progress, or… ahead to your Advertising and Progress crew!:
https://stu-sjouwerman.multiscreensite.com/

PPS: President Trump indicators $901B 2026 Nationwide Protection Authorization Act:
https://therecord.media/trump-signs-ndaa-cyber-command

You may learn CyberheistNews on-line at our Weblog
https://weblog.knowbe4.com/cyberheistnews-vol-15-51-heads-up-crafty-new-phishing-attacks-abuse-free-cloudflare-pages

Comfortable Holidays! CHN will probably be again January sixth, 2026

Social Engineering and Ransomware Had been Prime Threats in H2 2025

ESET has revealed its Risk Report for the second half of 2025, discovering that each one sorts of menace actors are actually utilizing AI instruments in various levels to help of their campaigns.

The usage of AI to enhance social engineering assaults stays the commonest utility of those instruments.

Juraj Jánošík, ESET’s Director of Automated Methods and Clever Options, said, “We count on direct use of AI for producing malware and scripts to stay restricted and particular, with the true transformation within the menace panorama taking place within the space of social engineering.

“Essentially the most vital problem would be the steady surge in high-quality, AI-generated assault vectors, comparable to convincing deepfakes, emails and advertisements, allow even low-skilled attackers to orchestrate subtle scams at scale and low value.

“As demonstrated by 2025’s funding scams, attackers more and more depend on the looks of trustworthiness moderately than real performance, leveraging AI to imitate professional-grade shows and interactions – making social engineering one of many main battlegrounds in cyberdefense.”

Attackers are additionally utilizing deepfakes in rip-off advertisements, which function lures for phishing operations. “Wanting nearer on the rip-off advertisements, there have been notable upgrades over the past 12 months,” ESET says. “Deepfakes of widespread personalities, used as preliminary hooks for phishing kinds or web sites, now use increased decision, have considerably diminished unnatural actions and respiratory, and have additionally improved their A/V sync. All of those adjustments make it harder for potential victims to identify the deception”

The researchers additionally noticed a major enhance in ransomware assaults, as menace actors proceed to refine their ways. “On the ransomware scene, sufferer numbers surpassed 2024 totals properly earlier than 12 months’s finish, with ESET Analysis projections pointing to a 40% year-over-year enhance,” they write.

“Akira and Qilin now dominate the ransomware-as-a-service market, whereas low-profile newcomer Warlock launched modern evasion methods. EDR killers continued to proliferate, highlighting that endpoint detection and response instruments stay a major impediment for ransomware operators.”

KnowBe4 empowers your workforce to make smarter safety selections daily. Over 70,000 organizations worldwide belief the KnowBe4 HRM+ platform to strengthen their safety tradition and scale back human threat.

ESET has the story:
https://www.welivesecurity.com/en/eset-research/eset-threat-report-h2-2025/

81% of Small Companies Sustained a Cyber Incident Over the Previous 12 months

81% of small companies suffered a safety or knowledge breach over the previous 12 months, and 38% of those companies had been pressured to boost their costs in consequence, a report from the Id Theft Useful resource Middle (ITRC) has discovered.

The report notes that exterior hackers have overtaken malicious insiders as the commonest root trigger of those incidents. This pattern is partially pushed by AI-assisted social engineering assaults, which had been cited as a root trigger by greater than 41% of victims.

“The emergence of AI as a main assault vector aligns with intensive business evaluation on the weaponization of generative AI for creating hyper-realistic phishing emails, deepfake audio and video, and adaptive malware,” the report says.

“These instruments are successfully democratizing superior assault capabilities that had been as soon as the area of extremely expert actors. The first benefit of a malicious insider has all the time been their intimate data of inner processes, communication kinds and organizational hierarchies, permitting them to bypass defenses by belief and familiarity.

“AI instruments now permit exterior actors to copy this benefit at scale.” Customers ought to concentrate on this pattern, as many pink flags related to social engineering, comparable to typos or odd grammar, will not be current.

“Worker safety coaching have to be up to date to deal with these new threats,” the report says. “Workers ought to be educated on the tell-tale indicators of AI generated content material, comparable to refined visible artifacts in deepfake movies, the shortage of emotional nuance in a cloned voice, or the unnaturally good grammar of an AI-crafted electronic mail.

“Fostering a tradition of wholesome skepticism, the place workers really feel empowered to query and confirm uncommon or pressing requests, is vitally essential.”

AI-powered safety consciousness coaching offers your group a vital layer of protection towards evolving social engineering assaults. KnowBe4 empowers your workforce to make smarter safety selections daily.

Infosecurity Journal has the story:
https://www.infosecurity-magazine.com/information/twofifths-smbs-raise-prices-after/

What KnowBe4 Prospects Say

“Howdy Bryan, every thing goes properly. I believe the platform is fairly helpful for us. Our success managers (Jara Ok. and Alexandre D.) have been fantastic giving help and serving to us to resolve our issues and get the complete worth of the device.”

– N.A., Ciberseguridad

“Hello Bryan, Thanks for reaching out and for the private message, it actually means so much. Thus far very pleased right here. The onboarding help that I acquired from Bruna L. from KnowBe4 was actually actually beneficial and assisted majorly in getting us up and working.”

– B.T., IT Director

“Hello Bryan, Thanks a lot for reaching out and ensuring every thing goes easily. I am pleased to report that we’re certainly very happy with KnowBe4. We formally launched the platform final month, and the suggestions from each our Senior Management Workforce (SLT) and finish customers has been very constructive.

“I additionally wished to take this chance to spotlight the distinctive job Mia has carried out in making certain a easy onboarding course of. Her efforts have made a major distinction, and we actually recognize her dedication and help. Thanks once more for following up, it means so much to us!”

– P.H., Senior Supervisor, Info Expertise