Employee advocacy has existed as a concept for over a decade. But what began as a well-intentioned way to enhance corporate profile, thought leadership, and marketing also has some unintended consequences. When professionals post about their work, their company, and their role, they expect to reach like-minded professionals, as well as potential clients, allies, and partners. ESET, a leading company in proactive threat detection, warns that malicious actors are also paying attention and that the more information there is, the more opportunities there are to carry out malicious activities that could seriously affect an organization. Once that information is publicly available, it is often used to help create convincing spearphishing or business email compromise (BEC) attacks.

“The first stage of a typical social engineering attack is information gathering. The next is to weaponize that information in a spearphishing attack designed to trick the recipient into unknowingly installing malware on their device. Or, potentially, into sharing their corporate credentials to gain initial access. This could be achieved through an email, a text message, or even a phone call. Alternatively, they could use the information to impersonate a high-level executive or supplier in an email, phone call, or video call requesting an urgent bank transfer,” reveals Martina Lopez, Cybersecurity Researcher at ESET Latin America.

“The first stage of a typical social engineering attack is information gathering.” The main platforms for sharing this type of information are the usual ones. LinkedIn is perhaps the most widely used. It could be described as the world’s largest open database of corporate information: a veritable treasure trove of job titles, roles, responsibilities, and internal relationships. It’s also where recruiters post job openings, which can reveal too many technical details that can then be exploited in spearphishing attacks.

GitHub is perhaps best known in the cybersecurity context as a place where careless developers post hardcoded secrets, IP addresses, and customer data. But they can also share more innocuous information about project names, CI/CD pipeline names, and details about the technology stacks and open-source libraries they use. They can also share corporate email addresses in Git commit configurations.

Then there are the classic end-user-oriented social platforms, such as Instagram and X. This is where employees often share details about their travel plans to conferences and other events, which could be used against them and their organization. Even information on your company’s website could be useful to a potential scammer or hacker. Think about details on technical platforms, suppliers and partners, or important corporate announcements, such as mergers and acquisitions. All of this could serve as a pretext for sophisticated phishing.

The attacks mentioned above typically require a combination of impersonation, urgency, and relevance. Here are some hypothetical examples:

• An attacker finds information on LinkedIn about a new employee in the IT department of Company A, including their main duties and responsibilities. They impersonate a key technology vendor and claim an urgent security update is needed, referencing the target’s name, contact information, and job title. The update link is malicious.
• A malicious actor finds information about two colleagues on GitHub, including the project they are working on. They impersonate one of them in an email asking the other to review an attached document, which contains malware.
• A scammer finds a video of an executive on LinkedIn or a company website. They see on the person’s Instagram feed that they are giving a presentation and will be out of the office. Knowing that the executive may be difficult to contact, they launch a BEC deepfake attack using video or audio to trick a member of the finance team into transferring urgent funds to a new vendor.

ESET describes real-world examples of malicious actors using open-source intelligence (OSINT) techniques in the early stages of attacks. These include:

• A business email (BEC) attack that cost Children’s Healthcare of Atlanta (CHOA) $3.6 million: Malicious actors likely reviewed press releases about a newly announced campus to gather details, including the hospital’s construction partner. They then used LinkedIn and/or the company’s website to identify key executives and finance team members at the construction firm involved (JE Dunn). Finally, they impersonated the chief financial officer in an email to CHOA’s finance team requesting that they update their payment information for JE Dunn.
• The Russia-based SEABORGIUM and Iranian-aligned TA453 groups use OSINT for reconnaissance before launching spearphishing attacks against pre-selected targets. According to the UK’s NCSC, cybercriminals use social media and professional networking platforms to “research the interests [of their targets] and identify their real-world social or professional contacts.” Once they have established trust and a relationship via email, they send a link to collect the victims’ credentials.

Education: the most powerful preventive weapon

“While the risks of oversharing are real, the solutions are simple. The most powerful weapon is education. Updating security awareness programs is crucial to ensuring that everyone in a company understands the importance of not oversharing on social media. Ask staff to avoid sharing information through unsolicited direct messages, even if they recognize the sender (as their account could have been spoofed), and ensure they are able to detect phishing, BEC, and deepfake attempts,” advises Lopez from ESET Latin America.

” Furthermore, among ESET Latin America’s security recommendations is the need to support this with a strict social media policy, defining clear limits on what can and cannot be shared, and establishing clear boundaries between personal and professional/official accounts. It may also be necessary to review and update corporate websites and accounts to remove any information that could be used as a weapon.

Checking multifactor authentication (MFA) and strong passwords (stored in a password manager) should also be standard practice for all social media accounts, in case professional accounts are compromised to attack colleagues.

Finally, monitor publicly accessible accounts whenever possible to detect any information that could be used for spearphishing and business email marketing (BEC), and conduct red team exercises with employees to test their awareness.

“AI is making it faster and easier than ever for malicious actors to profile their targets, gather OSINT, and then draft convincing emails/messages in perfect natural language. AI-powered deepfakes further increase their options. The takeaway should be that if something is in the public domain, you can expect a cybercriminal to know it too and soon come knocking,” concludes Martina Lopez of ESET.

ESET invites you to learn more about cybersecurity by visiting: https://www.welivesecurity.com/es/.

For other useful preventative information, also available in Venezuela:  https://www.eset.com/ve/, and on their social media channels @eset_ve. Also on Instagram (@esetla) and Facebook (ESET).

With information and reference image provided by ESET and Comstat Rowland

Follow our news on Google! For current, interesting, and accurate information, click here to see all the content on Bitfinance.news. You can also find us on X/Twitter and Instagram

La entrada Oversharing and Cybersecurity: Dangers when employees share too much online apareció primero en Bitfinance.

Cybercriminals have found that using artificial intelligence allows them to enhance their scams, making their deceptions more realistic and harder to detect. Recently, fake videos have surfaced impersonating internationally renowned figures, such as Lionel Messi or the CEO of a major organization.  However, these scams also occur on a smaller scale, such as targeting a school principal in the United States. ESET, a leading proactive threat detection company, reviews some of the cases where deepfakes were the main tool used in scams that resulted in millions of dollars in losses or the compromise of sensitive information.

Deepfake is an artificial intelligence-based technique for synthesizing human images to create fake content from scratch, using existing videos or even just a still image. They are designed to replicate the appearance and voice of a real person.

“With the evolution of Artificial Intelligence, these videos and audio recordings seem increasingly real. Many exploit the image of public figures or well-known entities to say something false, as part of a scam that aims to obtain money or sensitive information,” says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Lab.

ESET compiled amazing, truly real, and recent cases

Lionel Messi: The Argentine football player is one of the most recognized personalities worldwide. In this case, cybercriminals exploited his popularity to carry out a deepfake scam, promoting an app that promised suspiciously high and irresistible earnings. The app in question was called “Wildcat Dive,” and in the fake video, Messi claimed it was one of his main sources of income and that it had helped many people earn money. Through advertisements on the social network Instagram, the cybercriminals distributed snippets of a fabricated interview, which was based on a real interview the footballer had given to a well-known Argentine streaming program.

Arup: In early 2024, the architectural firm that designed the Sydney Opera House and the Etihad Stadium, Arup, made headlines when a financial employee at the company’s Hong Kong office received a video call from (allegedly) the company’s CFO. The result of the meeting was 15 transfers totaling over $25 million. The bad news is that it was actually a deepfake, so the transfers had not been approved by anyone in the company.

Ferrari: In this case, cybercriminals attempted a deepfake voice scam, impersonating Benedetto Vigna, the CEO of the automotive company. In July 2024, using voice imitation, they tried to convince the company’s finance executives to make a large money transfer. One of the employees became suspicious and asked a question that the AI ​​used in the scam could not answer correctly. Not only did this attack fail, but it prompted Ferrari to reinforce its employee training to prevent similar scams in the future.

WPP: One of the world’s largest advertising companies was also the target of a scam attempt involving a deepfake. In mid-2024, cybercriminals used a fake WhatsApp account, a voice recording, and YouTube footage of a virtual meeting to impersonate the company’s CFO, Mark Read. The malicious actors organized a meeting via Microsoft Teams, under the pretext of creating a new company, and used this as a lure to obtain money and sensitive personal data from the company. According to WPP, this attack was unsuccessful thanks to the company’s vigilance and the training its employees received to detect these scams.

School in Baltimore: Not only high-profile companies are targeted by deepfakes. In this case, a school principal was heard making racist and antisemitic comments. The incident went viral (over 2 million views) and resulted in death threats against the educator. After an investigation, local police confirmed that the audio was a fake, manipulated with AI.

Elon Musk: A cryptocurrency investment scam used Elon Musk’s image to spread ads on X and YouTube, promoting supposed investment opportunities that promised high returns on Bitcoin. The ads included a link to a fraudulent website where unsuspecting users were asked to make initial deposits to participate in the alleged investment. According to the US Federal Trade Commission, the scam, which included deepfakes, resulted in losses of over $80 million for more than 7,000 victims who believed in the supposed investment.

President Zelensky: Politics was also affected by deepfake scams. In March 2022, during the conflict between Russia and Ukraine, a fake video circulated showing Ukrainian President Volodymyr Zelensky urging his troops to surrender. The president responded almost immediately with a genuine video posted on his official channels.

While deepfake scams are becoming increasingly realistic and difficult to detect, ESET shares some best practices to reduce the risk of falling victim to these types of scams

• Be wary of eye-catching advertisements that offer an opportunity for easy and unrealistic gains. Also be suspicious of those that feature well-known celebrities.
• Pay attention to the video quality: if there are visual glitches, poor synchronization, or low resolution, it is likely a deepfake.
• Use security software on all devices to help block fake websites and emails containing malicious content.
• For businesses, it is important to not authorize payments solely based on a phone call or video call. Consider using keywords or internal codes as an additional verification method.
• Continuous training is essential: being trained to recognize the warning signs of deepfakes and scams is another key practice.
• Take advantage of the tools currently available to detect deepfakes and combat misinformation.

ESET invites you to learn more about cybersecurity by visiting: https://www.welivesecurity.com/es/.

For additional useful preventative information, visit ESET’s website in Venezuela: https://www.eset.com/ve/, and follow them on social media @eset_ve. Also on Instagram (@esetla) and Facebook (ESET).

Information and images courtesy of ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada ESET reports and summarizes 7 shocking real-life cases of scams using deepfakes apareció primero en Bitfinance.

Faced with financial doubts and concerns, it’s no surprise that people are looking for alternatives to make their money go further. This leads users with little investment experience to become interested and take their first steps. ESET, a leading company in proactive threat detection, warns that scammers are taking advantage of this curiosity or need with increasingly sophisticated scams on social media. It also warns that AI-powered scams produce fake ads, deepfakes, and promises of profits that seek to deceive even the most cautious users.

“Could you distinguish between a real investment ad and a fake one? It’s becoming increasingly difficult to do so. Threat actors today have various tactics to make their scams more credible, including deepfake videos generated with artificial intelligence. While there are many tactics, techniques, and procedures (TTPs) associated with this type of fraud, most begin with malicious or deceptive ads circulating on social media. They are often used as a lure to trick the victim, either into providing personal information or directly directing them to an investment scam,” says Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Lab.

According to the FBI, investment scams have been the main source of income for cybercriminals for several years. At last count, they earned nearly $6.6 billion, and that’s just from crimes reported to the federal government. This figure dwarfs the $2.8 billion earned by the second-largest scam, business email compromise (BEC).

An example of this type of campaign was identified in June 2025, when Instagram ads impersonated legitimate banks. Some used tempting offers, such as high-interest accounts, in an attempt to persuade the victim to click and enter their banking information. In other cases, they used deepfake Instagram stories featuring banking investment strategists to collect personal information and/or lure them into WhatsApp groups about investment scams. A 2024 campaign spread a fake video of Lionel Messi to promote supposed investments through an app that promised high returns.

Also in 2024, ESET observed the Nomani Trojan campaign. The ad content and the phishing websites they linked to were designed to impersonate local news outlets and other organizations. Or, it could be a generic financial-themed visual with frequently changing names like “Quantum Bumex, Immediate Mator, or Bitcoin Trader.” Some of the characteristics of the Nomani campaign (and other similar campaigns) include:

• Highly localized content to attract specific regional victims.
• Distribution via fake ads on Facebook, Instagram, X, YouTube, as well as Messenger and Threads.
• Deepfake video testimonials potentially using celebrities, often displayed in low-quality videos and with unnatural keyword repetition.
• Use of fake and hacked accounts to run the ads (including, in one case, an actor with 300,000 followers).
• Shared templates and callbacks pointing to the same hosting infrastructure.

In this campaign, according to ESET, the intended objective is to persuade the victim to provide their personal information, which the scammers use to contact them directly. They use this method to trick them into signing up for an investment scam, taking out a loan, or even installing remote access software on their device. ESET observed a 335% increase in Nomani threats between H1 and H2 2024, and blocked more than 8,500 related domains.

While these techniques seem like clear indicators of fraud, they can be much more difficult to detect, especially if you are looking for opportunities to alleviate financial pressures. ESET states that the continued effectiveness of these types of scams, such as fraudulent financial ads, is due to the following:

• Times are tough, and the prospect of quick and easy financial gain is attractive.
• Attention spans are decreasing, especially on mobile devices, so warning signs may not be detected in time.
• Many people are unfamiliar with the latest threat TTPs, such as the use of deepfake videos, which makes them more vulnerable.
• Many of these threats are localized, use legitimate (hijacked) accounts, and can appear at the top of search results.
• Banks’ traditional anti-fraud mechanisms often don’t work if the manipulation is also carried out socially via telephone to invest in a fraudulent scheme.

Investment scams are very common, and ESET points out that it’s necessary to pay attention to these warning signs

• Flashy ads (which may leverage legitimate brands) offering returns that are too good to be true or unusually high interest rates.
• Celebrity endorsements are often the hook to give the product a certain legitimacy. Always check if the endorsement is legitimate.
• Videos that don’t look entirely right, for example, with visual glitches, poor audio and video synchronization, low resolution, or robotic or overly polished voices.
• Pressure to act quickly and secure the investment.
• Guaranteed return on investment.

They also advise staying alert to warning signs, resisting the temptation to click on ads about finance or investments, even if they appear to be promoted by legitimate brands and individuals, searching online for reviews of a specific investment plan or group to verify their authenticity, not investing in financial products without having thoroughly researched them and understanding how they work, ignoring any unsolicited third-party offers, never sharing personal and/or financial information after clicking on an online ad, and always checking the information circulated with the supposedly issuing entity through official channels. Finally, use security software on all your devices from a trusted provider like ESET, which will help block scams.

“In times of economic uncertainty, it’s understandable that we look for alternatives to improve our financial situation. But scammers are exploiting this very need with increasingly sophisticated tactics. Therefore, being wary of what’s easy, recognizing the warning signs, and protecting your personal data is essential to avoid falling for this type of scam,” concludes the ESET researcher. ESET invites you to learn more about cybersecurity by visiting:  https://www.welivesecurity.com/es/.

For other useful preventive information, it is also available in Venezuela:  https://www.eset.com/ve/, and on its social media channels @eset_ve. Also, available on Instagram (@esetla) and Facebook (ESET).

Bitfinance.News

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada Investor scams on social media are on the rise with the help of artificial intelligence apareció primero en Bitfinance.

The Superintendency of Banking Institutions (Sudeban) of Venezuela warned citizens about the increase in digital fraud, urging users to remain vigilant and implement appropriate safeguards to avoid falling victim to scams.

Through an alert on its social media, Sudeban reported on cybercriminals’ strategies to obtain citizens’ personal and banking information and thus carry out their criminal acts.

The agency mentioned fraudulent phone calls, deceptive text messages, as well as the receipt of links via email or social media that impersonate financial institutions and fake promotions through Telegram or WhatsApp intended to attract victims with attractive offers.

 

Ver esta publicación en Instagram

 

Una publicación compartida por SUDEBAN (@sudebaninforma)

Sudeban warned online banking users and urged them to follow the advice of cybersecurity experts to avoid placing their data in the hands of digital criminals. In this regard, it emphasized the importance of not sharing financial information through any of the aforementioned means. It also emphasized the importance of verifying the authenticity of any messages received and making inquiries only through official channels of banking institutions and similar entities.

M.Pino

With information from national media and social media

(Reference image source: FlyD on Unsplash

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada Sudeban issued alert on new fraud schemes apareció primero en Bitfinance.

The Pan American Health Organization (PAHO) has issued an alert to countries in the region to strengthen their surveillance mechanisms in the face of the risk of dengue outbreaks due to the increase in the circulation of the DENV-3 serotype.

The epidemiological alert for the Americas is aimed at preventing cases of dengue in the most vulnerable areas and avoiding severe forms of the disease.

PAHO noted that the DENV-3 serotype was “identified in several countries in the Americas, including Brazil, Colombia, Costa Rica, Guatemala, Mexico and Peru. In 2024, Argentina reported its circulation, marking the introduction of this serotype in the country. That same year, Brazil and Colombia reported an increase in cases associated with DENV-3, especially among children, and it has been detected in other nations in Central America and the Caribbean.”

With the reappearance of this serotype, the risk for the most vulnerable populations increases. In this sense, the organization recommends that countries in the region reinforce vector control measures, in addition to strengthening diagnostic capacity in health systems and providing patients with early and adequate care to prevent serious complications. Information and awareness campaigns to reduce exposure to mosquitoes that transmit the virus and eliminate breeding sites are also crucial. This is accompanied by monitoring by health authorities and timely vaccination.

M.Pino

Source: paho.org

(Reference image source: engin akyurt on Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada PAHO issues alert due to increase in dengue cases in the Americas apareció primero en Bitfinance.

Internet users need to download files with information of interest every day. Google Chrome will change the warning about dangerous downloads in the dialog box known until now to full screen, in red.

The multiple dangers and damages caused by harmful files can affect not only your computer but also result in cybercrime.

Google is looking for ways to reduce cases of harmful downloads with this change to security advisories. The dialog in this case will be the same, to indicate that the file contains malware, is of dubious origin or may be dangerous.

If this change becomes official in the next Google Chrome update, users will enjoy the advancement in security measures.

M.Pino

Source: computerhoy

(Reference image source: Unsplash+, in collaboration with Mariia Shalabaieva)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Chrome will warn about dangerous downloads with a full screen in red apareció primero en Bitfinance.

In an alert launched by the Chinese Ministry of Information Technology, citizens were warned about a fake digital yuan application that steals money and confidential data from users.

On social networks, the Chinese authority gave details of the malicious application, which uses a false logo of the digital yuan, causing confusion among users.

At the moment, it has been indicated that the app promises dividends, “it provides false customer service that directs the user to unusual social tools to facilitate the confiscation of the user’s funds.”

Another aspect to take into account is that the user interface of the fake application has a different name than the real one, so it is essential not to use it automatically, but to detail its appearance so as not to be a victim of fraud.

Furthermore, the Ministry has revealed that the version number and MD5 message digest identity are different.

At the moment, there are no details available about the measures that the Chinese government would be taking to stop this scam. Apparently, this malicious app could not be found in the Apple or Google application stores either.

M.Pino

Source: cointelegraph

(Reference image source: Unsplash+, in collaboration with Getty Images)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Fake digital yuan application triggers alarms in China apareció primero en Bitfinance.

This Monday, January 11, the price of bitcoin suffered a 20% collapse, after its meteoric rises at the beginning of 2021, which boosted the value of the reference cryptocurrency by 14% so far this year and more than 300% in twelve months, after the UK financial organizer warned of the risk of monetary loss for those who invested in crypto assets, which are offered for their “great profitability”.

According to data from CoinDesk, bitcoin would change for $ 30,862 this Monday, after settling last Friday with a new record of $ 41,962.

Thus, and according to this criterion, the market capitalization of bitcoin would fall to 588,330 million dollars, equivalent to 483,976 million euros, with a decline of at least 192,000 million dollars, that is, 157,944 million euros.

From Europe they invite you to consider risks

The Financial Conduct Authority (FCA) said this Monday through a statement noting that some companies were offering investments in crypto assets, loans and investments and related or linked financing that promised high returns, which certainly “implies taking very high risks with investors’ money ”.

“If consumers invest in these types of products, they must be prepared to lose all their money,” warned the British regulator.

In this way, the FCA recalled that all investments must be studied to understand what is being invested, especially those related to crypto assets, which are unlikely regarding consumers being able to access the services of the investor ombudsman or the compensation fund for services. financial, this in case things do not go as planned.

The regulator insisted that some of these investments in crypto assets that are promoted could not be subject to the rules of anti-blocking regulation, also their high volatility and the difficulty of fixing and stabilizing prices, are one more reason to be considered as possible “high losses” in in terms of risk levels.

G. Febres

With information from dpa

La entrada Bitcoin falls more than 20% and loses 158 million euros since Friday apareció primero en Bitfinance.