Tag: social engineering

  • Apple’s iOS 27 Introduces Impersonation Risk Detection to Combat iPhone Scams

    Apple’s iOS 27 Introduces Impersonation Risk Detection to Combat iPhone Scams

    Apple has unveiled a new security feature in iOS 27 designed to shield iPhone users from impersonation-based scams. Dubbed Impersonation Risk Detection, the tool identifies signs that a user may be caught in an active social engineering attack, particularly when they are about to make a payment or modify sensitive account information.

    Scams involving fake banks, government agencies, delivery services, and even impersonation of known contacts have become increasingly prevalent. Apple says the feature is engineered to detect suspicious activity and alert users before they complete potentially harmful actions.

    How Apple’s Impersonation Risk Detection Works

    According to Apple, the feature protects users from active social engineering scams where an attacker impersonates a trusted entity—such as a bank, government agency, or a familiar person—and pressures the victim into making a payment or altering account details.

    Impersonation Risk Detection analyzes information about the iPhone or iPad and the user’s Apple Account to identify signs of suspicious activity. When a supported app requests an assessment during a potentially risky action, the system generates a risk level that the app can use to determine subsequent steps.

    There are three risk levels: Unknown, Medium, and High. Unknown means no evidence of suspicious activity was detected, though Apple notes this does not confirm an action is safe. Medium indicates some signs of suspicious activity, while High means significant signs were detected.

    Importantly, the app does not receive the underlying information used to generate the assessment. It only receives the resulting risk level and can decide how to respond.

    How to Enable the Feature

    Users can turn on Impersonation Risk Detection by opening Settings, tapping Privacy & Security, scrolling down, and selecting Impersonation Risk Detection. They then need to toggle on Share with App Developers. Users may also need to sign in to the App Store with their Apple Account.

    The feature can be controlled on an app-by-app basis. However, Apple warns that it depends on supported apps and that its risk assessment does not guarantee an action is safe. The company emphasizes that this feature is not designed to replace other security measures or user caution.

  • How Criminals Stole $240M in Bitcoin Using Only Deception

    In August 2024, a cryptocurrency investor in Washington, D.C., lost more than $240 million in Bitcoin — without a single breach of an exchange or any malware. The scheme was a carefully orchestrated social engineering attack that netted over 4,100 BTC and led to charges against 18 people.

    Impersonating Google and Gemini

    The scammers reportedly posed as employees of Google and Gemini, a major cryptocurrency exchange. They convinced the victim that something was wrong with his accounts and needed urgent fixing. By building false trust, they gained access to his Google Drive and security codes, unlocking the crypto wallet.

    A 22-Year-Old Mastermind?

    Malone Lam, a 22-year-old school dropout from Singapore, was found guilty for his role, marking the 11th conviction among 18 people tied to the case. The stolen Bitcoin was laundered through multiple crypto exchanges in an attempt to cover the group’s tracks.

    The case cracked open when another suspect, Jeandiel Serrano, failed to hide his IP address while creating an exchange account intended to hold nearly $30 million in stolen cryptocurrency. Serrano was later arrested on September 18, 2024, at Los Angeles International Airport wearing a watch worth about $500,000. He initially denied involvement but ultimately admitted to the scheme.

    No Hacking Required

    The group didn’t rely on advanced software or brute-force techniques. Instead, they created a fake security emergency and manipulated the victim into voluntarily handing over sensitive information. This ‘simple trick’ continues to prove effective as crypto scams grow more sophisticated on the human side.

    Lavish Spending and Other Crimes

    Prosecutors noted the group used similar scams in other crypto thefts, with some members meeting through online gaming forums. Proceeds were spent on luxury vehicles, high-end homes, and pricey nights out. Lam allegedly purchased more than 30 luxury cars and was known for heavy nightclub spending.

    Authorities are also warning that crypto theft is increasingly physical. In a separate U.S. case, criminals kidnapped the parents of a Bitcoin holder to pressure him into revealing his wallet access. In another New York case, a crypto holder was reportedly kidnapped and tortured for his password.

  • Fake IT Support Scams Target Blackstone, KKR, and CME: How Voice Phishing Works

    Fake IT Support Scams Target Blackstone, KKR, and CME: How Voice Phishing Works

    Major US financial firms, including Blackstone, KKR, Apollo Global Management, Bridgewater Associates, Bain Capital, TPG, and CME Group, have been targeted by a sophisticated cyberattack campaign using fake IT support calls and fraudulent websites to steal employee credentials and authentication codes.

    According to data from Google and internet intelligence reviewed by Reuters, the campaign was orchestrated by a threat actor tracked as UNC6671, linked to extortion brands such as Redact, Pink, Helix, and Falcon. Google’s Threat Intelligence Group (GTIG) is monitoring the activity, noting that the group continues to compromise organizations despite the reported shutdown of its earlier BlackFile operation.

    Voice Phishing Tactics

    Attackers employed voice phishing, or vishing, to contact employees while posing as company IT helpdesk staff. They created a sense of urgency around security-related tasks, such as updating authentication methods or enabling passkeys. Employees were then directed to websites designed to mimic legitimate company login and authentication pages, which were used to harvest passwords and other credentials.

    Google reported that the attackers also used adversary-in-the-middle techniques to intercept authentication sessions and MFA tokens, further compromising security.

    Targeted Firms and Scope

    The identified targets include Blackstone, Apollo Global Management, Bridgewater Associates, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody’s. Other businesses and professional services firms were also targeted. However, being targeted does not necessarily mean a breach was successful; the attackers created infrastructure and attempted to compromise organizations, with varying outcomes.

    Google’s analysis revealed that UNC6671’s focus shifted during 2026. Earlier activity involved manufacturing, real estate, healthcare, and insurance. By July, the group increasingly targeted financial and legal organizations, including private equity firms, law firms, and financial ratings agencies.

    Potential Impact and Extortion

    After obtaining credentials, attackers can attempt to access corporate cloud services such as Microsoft 365 and Okta. The broader objective is to steal data and extort victims. Google’s analysis of cryptocurrency wallets linked to the earlier BlackFile operation found that 18 Bitcoin addresses received a combined 141.65 BTC, worth approximately $10.69 million at the time. Initial ransom demands typically ranged from $1 million to over $3 million, though negotiations often resulted in lower payments.

    This campaign underscores the risks of social engineering, where convincing phone calls and fake login pages bypass security measures by targeting employees directly. Organizations must remain vigilant and educate staff on recognizing such tactics.