Scammers have found a way to abuse legitimate Apple account notification emails to trick targets into calling fake tech support numbers.

According to a report from BleepingComputer, scammers create an Apple account and insert a phishing message into the personal information fields, then modify the account so that Apple sends a genuine security alert about the change to the target.

BleepingComputer was able to replicate the attack.

The attacker creates an Apple ID they control, then stuffs the phishing message into the personal information fields (first name, last name, possibly address), splitting it across fields because they will not fit into just one.

To launch the phish, the attacker changes something benign on their specially created Apple account, such as shipping information, which causes Apple’s systems to send a “Your Apple account was updated” security email.

While the original alert is addressed to the attacker’s iCloud email, they are then able to redistribute it to a wider victim list, for example through a mailing list.

In the copy the targets receive, the email headers still show a legitimate Apple sender, and the presence of the attacker’s iCloud address can even make it look like “someone else” has gained access to the account.

Because Apple includes those user-supplied fields in the security email, the phishing text is delivered inside a legitimate message sent from Apple’s own infrastructure.

This method, called call-back phishing, filters out suspicious users, so the scammers can focus on the people who fell for the first part.

The emails come from a legitimate source, sail through every security filter because of that, and look convincing enough to scare the receiver into thinking someone spent $899 from their PayPal account.

But the structure of the email does not make sense.

“Dear User” is immediately followed by the scam message where your name should have been. The header says it’s about account information rather than a purchase. And the iCloud account does not belong to the recipient. So, once you know how it’s done, they’re not impossible to spot. Which is why we wrote this blog.

And when in doubt, you can always ask Malwarebytes Scam Guard.

---

---

Scam Guard identified the screenshot as a scam and guides users through the next steps.

Scams like these work, because many users still view phone calls as more trustworthy than email, especially if the email itself passed all the usual technical authenticity checks and they initiated the call themselves.

How to stay safe

Tech support scammers will try to convince callers to install some kind of remote desktop application to steal data from your computer, or ask for financial details so they can steal your money.

To stay safe from these scammers:

• Be wary of unexpected alerts about high‑value purchases you do not recognize. They are suspicious even if they come from a real domain.
• Never call a number sent to you by unsolicited means or even found in sponsored search results.
• Carefully read emails and text messages, even if they come form trustworthy addresses. Does the email make sense from a structural and linguistic point of view?
• If someone claiming to be support for a legitimate company asks for remote access or payment details during a call, hang up and contact the company through official channels.
• Use Malwarebytes Scam Guard to analyze any kind of message that alarms you or urges you to take immediate action.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Have you ever taken a look at your Microsoft 365 mailbox rules? If not, it might be worth a few minutes of your time. Because newly released research reveals that hackers may already have beaten you to it. Read more in my article on the Fortra blog.

Content. a number of malware samples including phishing, web shell, droppers, backdoor malware, downloaders, Infostealer, and CoinMiner targeting the financial sector have been distributed. we observed a number of cases where Korean disguised attachment names and HTML/JS execution methods were utilized to propagate phishing. account compromise campaigns through the Telegram API were confirmed, with approximately […]

The post How to Finally Change Your Gmail Address Without Losing Your Data appeared first on Daily CyberSecurity.

Gmail users in the US can now change their email address without losing data. Here’s how the long-awaited Google feature works and its key limits.

The post Gmail Finally Lets You Change Your Email Address Without Losing Anything appeared first on TechRepublic.

The post The Anonymity Myth: How the FBI Unmasked a “Hide My Email” User in Under 48 Hours appeared first on Daily CyberSecurity.

404 Media has a story about Proton Mail giving subscriber data to the Swiss government, who passed the information to the FBI.

It’s metadata—payment information related to a particular account—but still important knowledge. This sort of thing happens, even to privacy-centric companies like Proton Mail.

This report comprehensively covers actual cyber threats and related security issues targeting financial institutions in South Korea and abroad. It includes analysis of malware and phishing cases distributed targeting the financial sector, presents the Top 10 major malware targeting the financial sector, and provides statistics on the industry sectors of South Korean accounts leaked via […]

Statistics on Attachment Threats Types in February 2026, the highest percentage of phishing email attachment threats is FakePage (42%). threat actors sophisticatedly mimic login pages and advertisement pages with HTML and other scripts to trick users into entering data and sending it to a C2 server or to a fake site. another popular method is […]

Investigando Endereços de E-mail: 

Um endereço de e-mail parece simples — uma sequência de caracteres antes e depois de um "@" — mas para um investigador experiente, ele representa muito mais do que isso. É frequentemente o ponto de entrada de toda uma investigação, capaz de revelar identidades, padrões de comportamento, vínculos organizacionais e até localização geográfica aproximada.

Este guia reúne princípios e técnicas fundamentais para quem deseja investigar e-mails com ferramentas predominantemente gratuitas, sem abrir mão do rigor metodológico.

---

O Ponto de Partida: O Que um E-mail Revela por Si Só

Antes de qualquer busca, o próprio endereço já comunica informações valiosas. O domínio indica se estamos diante de um provedor comercial genérico (Gmail, Outlook, Yahoo), um serviço focado em privacidade (ProtonMail, Tutanota) ou um domínio corporativo/institucional próprio. Cada uma dessas categorias sugere um perfil diferente de usuário e abre caminhos distintos de investigação.

O prefixo — a parte antes do "@" — frequentemente segue padrões reconhecíveis. Nomes completos, iniciais combinadas com sobrenomes, apelidos ou números sequenciais são comuns. Identificar o padrão pode ajudar a inferir outros endereços pertencentes à mesma pessoa ou organização.

---

Técnicas Fundamentais

Busca reversa e cruzamento de dados. O primeiro passo é inserir o endereço entre aspas nos principais mecanismos de busca — Google, Bing e DuckDuckGo — e também em plataformas especializadas como o Have I Been Pwned, que verifica se o e-mail aparece em vazamentos conhecidos. Esse cruzamento revela cadastros em fóruns, redes sociais, plataformas de código aberto como o GitHub, e outros serviços públicos onde o endereço foi utilizado.

Análise do domínio. Quando o e-mail pertence a um domínio próprio, ferramentas como WHOIS, DNSlytics e ViewDNS permitem verificar registros de domínio, histórico de DNS e servidores associados. Mesmo que o registrante use privacidade, o histórico de registros e os servidores de e-mail configurados (registros MX) podem revelar informações relevantes sobre a infraestrutura utilizada.

Redes sociais e plataformas abertas. Muitas plataformas permitem pesquisar por e-mail diretamente ou inferir vínculos por meio da função "encontrar amigos". Além disso, o LinkedIn frequentemente exibe perfis associados a endereços corporativos. O Gravatar — serviço de avatar universal — pode associar uma imagem de perfil a um endereço, revelando nome e foto pública.

Cabeçalhos de e-mail. Se você recebeu uma mensagem da pessoa investigada, os cabeçalhos do e-mail são uma mina de ouro. Eles podem revelar o IP de origem (especialmente em provedores que não ocultam esse dado), o cliente de e-mail utilizado, o fuso horário e o caminho percorrido pela mensagem entre servidores.

---

O Papel da Inteligência Artificial na Investigação

A IA transformou a forma como analistas processam grandes volumes de dados não estruturados, e sua aplicação em investigações OSINT de e-mail é cada vez mais relevante.

Ferramentas como ChatGPT, Claude e Gemini podem ser utilizadas para sintetizar rapidamente informações coletadas de múltiplas fontes, identificar padrões em conjuntos de dados textuais, sugerir variações de um endereço para ampliar buscas e ajudar a estruturar hipóteses investigativas a partir de fragmentos dispersos. O uso da IA não substitui o julgamento do investigador, mas acelera significativamente a fase de análise.

Há também ferramentas especializadas que integram IA à investigação OSINT, como o Maltego com seus transformadores automatizados, o SpiderFoot (gratuito e de código aberto), que automatiza a coleta de dados sobre e-mails e domínios, e o TheHarvester, amplamente utilizado para enumeração de endereços e metadados associados a um domínio.

---

Ferramentas Recomendadas

Para uma investigação completa com foco em ferramentas gratuitas, o fluxo recomendado contempla: Hunter.io (verificação e padrões de e-mail corporativo), EmailRep.io (reputação e histórico do endereço), Have I Been Pwned (presença em vazamentos), Epieos (busca reversa com retorno de perfis vinculados), Holehe (verifica em quais serviços o e-mail está cadastrado) e OSINT Industries para correlação ampla de identidade digital.

---

Princípio Essencial: Documentar Cada Passo

Independentemente das ferramentas utilizadas, a disciplina investigativa exige registro rigoroso de cada fonte consultada, cada dado coletado e cada inferência realizada. Uma investigação OSINT bem conduzida precisa ser reproduzível, auditável e eticamente responsável — especialmente quando seus resultados podem embasar decisões legais ou de segurança.

O endereço de e-mail é apenas o início. Com método, paciência e as ferramentas certas, ele pode se tornar o fio que desvenda uma identidade inteira.

This report comprehensively addresses actual cyber threats and related security issues that have occurred in domestic and international financial sector companies. It includes an analysis of malware and phishing cases disseminated targeting the financial sector, presents the top 10 major malware aimed at the financial sector, and provides statistics on industries of domestic accounts leaked […]

Once. Someone named “Vincenzo lozzo” wrote to Epstein in email, in 2016: “I wouldn’t pay too much attention to this, Schneier has a long tradition of dramatizing and misunderstanding things.” The topic of the email is DDoS attacks, and it is unclear what I am dramatizing and misunderstanding.

Rabbi Schneier is also mentioned, also incidentally, also once. As far as either of us know, we are not related.

EDITED TO ADD (2/7): There is more context on the Justice.gov website version.

The LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team has published a warning about an active phishing campaign in which fake “maintenance” emails pressure users to back up their vaults within 24 hours. The emails lead to credential-stealing phishing sites rather than any legitimate LastPass page.

The phishing campaign that started around January 19, 2026, uses emails that falsely claim upcoming infrastructure maintenance and urge users to “backup your vault in the next 24 hours.”

“Scheduled Maintenance: Backup Recommended

As part of our ongoing commitment to security and performance, we will be conducting scheduled infrastructure maintenance on our servers.
Why are we asking you to create a backup?
While your data remains protected at all times, creating a local backup ensures you have access to your credentials during the maintenance window. In the unlikely event of any unforeseen technical difficulties or data discrepancies, having a recent backup guarantees your information remains secure and recoverable. We recommend this precautionary measure to all users to ensure complete peace of mind and seamless continuity of service.

Create Backup Now (link)

How to create your backup
1 Click the “Create Backup Now” button above
2 Select “Export Vault” from you account settings
3 Download and store your encrypted backup file securely”

The link in the email points to mail-lastpass[.]com, a domain that doesn’t belong to LastPass and has now been taken down.

Note that there are different subject lines in use. Here is a selection:

• LastPass Infrastructure Update: Secure Your Vault Now
• Your Data, Your Protection: Create a Backup Before Maintenance
• Don’t Miss Out: Backup Your Vault Before Maintenance
• Important: LastPass Maintenance & Your Vault Security
• Protect Your Passwords: Backup Your Vault (24-Hour Window)

It is imperative for users to ignore instructions in emails like these. Giving away the login details for your password manager can be disastrous. For most users, it would provide access to enough information to carry out identity theft.

Stay safe

First and foremost, it’s important to understand that LastPass will never ask for your master password or demand immediate action under a tight deadline. Generally speaking, there are more guidelines that can help you stay safe.

• Don’t click on links in unsolicited emails without verifying with the trusted sender that they’re legitimate.
• Always log in directly on the platform that you are trying to access, rather than through a link.
• Use a real-time, up-to-date anti-malware solution with a web protection module to block malicious sites.
• Report phishing emails to the company that’s being impersonated, so they can alert other customers. In this case emails were forwarded to abuse@lastpass.com.

Pro tip: Malwarebytes Scam Guard  would have recognized this email as a scam and advised you how to proceed.

---

We don’t just report on threats—we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your, and your family’s, personal information by using identity protection.

This report comprehensively covers real-world cyber threats and security issues that have occurred in the financial industry in Korea and worldwide. It includes an analysis of malware and phishing cases targeting the financial industry, a list of the top 10 malware strains targeting the industry, and statistics on the sectors of Korean accounts leaked on […]

Em meio à penumbra azulada de uma sala de comando futurista, a equipe da OSINTBRASIL se debruçava sobre telas holográficas e computadores quanticos. 

O ar crepitava com a energia dos dados, mas a atmosfera era de crescente satisfação. 

Naquela noite, eles não estavam desvendando um crime, mas sim as falhas colossais de uma investigação com falhas.

"Metadados inconsistente aqui," apontou um dos analistas, deslizando um dedo por uma projeção que mostrava fluxos de dados embaralhados. 

"A coleta foi negligente, muitos campos vazios, outros com informações conflitantes."

"E a cadeia de custódia?" questionou outro, ampliando um gráfico que deveria demonstrar a integridade das provas digitais. 

Totalmente comprometida. 

Não há registros claros de quem manuseou o quê, nem quando. 

A autenticidade está em xeque."

As telas exibiam mapas de IPs sem rastreamento precisos, linhas do tempo forenses repletas de lacunas e relatórios de integridade de dados que gritavam "nulidade". 

Um por um, os pilares da operação anterior desmoronavam diante de seus olhos, sendo assim possível pedir um HC ou trancamentovia judicial do caso.

"Sem provas sólidas de autoria, sem evidências digitais que resistam a um escrutínio legal," concluiu a líder da equipe, a silhueta emoldurada pela luz das projeções, a voz carregada de sucesso. 

"Toda a operação está comprometida por estas falhas. As provas digitais não passariam pelo crivo de um tribunal."

Na OSINTBRASIL, eles compreendiam que, em casos criminais, a precisão e a validade das provas digitais eram a linha entre a justiça e o erro. 

A cena em seu centro de comando era um lembrete vívido da importância de uma análise forense digital impecável e uma inteligência de código aberto bem executada.

É por isso que a OSINTBRASIL | OPEN SOURCE INTELLIGENCE BRASIL oferece análises detalhadas e relatórios robustos para a advocacia criminal, garantindo que a verdade digital seja inquestionável.

Entre em contato conosco 

 Whatsapp: 47 988618255

https://www.facebook.com/osintbrasil

This report provides the distribution quantity, statistics, trends, and case information on phishing emails, which were collected and analyzed for one month in December 2025. The following statistics and cases are included in the original report. 1) Statistics of phishing email threats In December 2025, the most common type of threat among phishing emails was […]