These findings are part of the Kaspersky Security Bulletin series where we review the key cybersecurity trends of the past year.

Windows remains the primary target for cyberattacks. 48% of users on Windows were targeted by different types of threats throughout 2025. For Mac users, this figure stands at 29%.

Web threats

Globally, 27% of users were attacked with web threats – these refer to malware that targets users when they are online. Web threats are not limited to online activity, but ultimately involve the Internet at some stage for inflicted harm. In Latin America, 26% of users were attacked by web threats in 2025, while this share reached 25% in Africa, 21% in Europe and 19% in the Middle East.

On-device threats

33% of users were attacked with on-device threats. These include malware that is spread via removable USB drives, CDs and DVDs, or that initially makes its way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.). Africa headed the rating with 41% of users attacked with this type of threat; APAC reached 33%, Middle East – 32%, Latin America – 30%, and Europe 20%.

“The current cyberthreat landscape is defined by increasingly sophisticated attacks on organisations and individuals around the world. One of the most significant revelations made by Kaspersky this year was the resurgence of the Hacking Team after its 2019 rebranding, with its commercial spyware Dante used in the ForumTroll APT campaign, incorporating zero-day exploits in Chrome and Firefox browsers. Vulnerabilities remain the most popular way for attackers to get into corporate networks, followed by using stolen credentials – hence the rise in password stealers and spyware we see this year. Supply chain attacks are also common, including attacks on open-source software. This year the number of such attacks increased significantly, and we even saw the first widespread NPM worm Shai-Hulud,” commented Alexander Liskin, Head of Threat Research at Kaspersky.

“This increasingly complex threat landscape makes implementing robust cybersecurity strategies vital for organisations, as failure to do so can lead to months of downtime in the event of attacks. Individual users should also always use reliable security solutions, otherwise they put not only their data and money at risk, but also those of the organisations where they work.”

The post Kaspersky detected half a million malicious files daily in 2025 appeared first on ProtectionWeb.

Overall, in 2025, résumés outnumber vacancies 55% to 45%, driven by global layoffs and an influx of younger candidates. Age distribution among the candidates shows a median seeker age of just 24, with a marked teenager presence.

Jobs found on the dark web are predominantly related to cybercrime or other illegal activities, although some legitimate positions are present as well. Kaspersky findings show a shadow economy where 69% of job seekers did not specify a preferred field, openly signaling they’d take any paid opportunity – from programming to running scams or high-stakes cyber operations. The most in-demand IT roles posted by employers on the dark web reflect a mature criminal ecosystem:

Developers (accounted for 17% of vacancies) create attack tools;
Penetration testers (12%) probe networks for weaknesses;
Money launderers (11%) clean illicit funds through layered transactions;
Carders (6%) steal and monetise payment data;
Traffers (5%) drive victims to phishing sites or infected downloads.

Gender-specific patterns emerged in specialised applications. Female applicants predominantly sought interpersonal roles, including support, call-centre, and technical-assistance positions. Male applicants, by contrast, more frequently targeted technical and financial-crime roles – developers, money mules, or mule handlers.

Salary expectations varied sharply by specialisation. Reverse engineers commanded the highest compensation, averaging over $5,000 monthly, followed by penetration testers at $4,000 monthly and developers at $2,000. Fraudsters tended to receive a fixed percentage of a team’s income. Money launderers average 20%, while carders and traffers earn approximately 30% and 50% of the full income, respectively. These figures reflect a premium on scarce, high-impact skills within the shadow ecosystem.

“The shadow job market is no longer peripheral; it’s absorbing the unemployed, the underage, and the overqualified. Many arrive thinking that the dark web and the legal market are fundamentally alike, rewarding proven skills over diplomas, with the dark web even offering some benefits – like offers landing within 48 hours and no HR interviews. However, not many realise that working on the dark web can lead to prison,” comments Alexandra Fedosimova, Digital Footprint Analyst at Kaspersky.

Young individuals contemplating dark web employment must recognise that short-term earnings carry irreversible legal and reputational consequences. Parents, educators, and the community are urged to report suspicious online solicitations immediately. Children should be shown that there are multiple skill-building and career pathways in legitimate technology sectors, such as cybersecurity, Kaspersky said.

The Kaspersky analysis was based on 2,225 job-related posts – vacancies and resumes – published on dark web forums between January 2023 and June 2025. Some of the forums and resources reviewed may no longer be accessible at the time of publication.

The post Dark web attracts laid-off workers, teenagers, and elite talent appeared first on ProtectionWeb.

Black Friday, Festive and Back to School trading holidays have merged into a three-month peak that has placed a growing strain on local retailers, many of which also have less administrative support as employees take their annual leave over the summer holidays. What’s more, landmark retail breaches in the UK should be giving local retailers cause for concern.

“Ransomware attacks at UK retailers like Marks & Spencer, Co-op, and Harrods have made headlines across the globe. While the circumstances of each incident may have varied, each case highlighted the fact that human error is still one of the most exploited vulnerabilities,” says Heino Gevers, Senior Director of Technical Support at Mimecast SA. “Rather than deploying groundbreaking malware or sophisticated technical exploits, criminals manipulated employees, impersonated IT staff and bypassed trust-based systems designed for convenience and speed.”

Odds stacked against local retailers

The effects of ransomware attacks are a growing threat to local businesses. According to 2025 research by Sophos, 60% of local companies hit by a ransomware attack had data encrypted. The median payment to retrieve their data came in at around R7.8 million, while the cost to recover from an attack averaged around R23 million.

The research further shows that email remains a major attack vector, with 23% of global retailers reporting phishing as the root cause, and a further 14% citing malicious email.

Human-factor still the biggest weakness

The UK retail breaches were a case study in how cyber attacks target an organisation’s weakest links.

The Marks & Spencer attackers reportedly gained access using stolen credentials obtained via social engineering, allowing them to disrupt operations, with the damage expected to result in a 30% hit to profits. Co-op suffered a similar breach when IT staff were tricked into resetting a legitimate user’s password, giving criminals access to their network. The breach is alleged to have cost the retailer £206 million in lost sales. Harrods also fell victim to social engineering tactics with 403 000 customer records compromised.

“The amount of damage done to these retail juggernauts must be a cautionary tale for local retailers. Particularly since South African companies face additional challenges. While shop floors may be fully staffed, many administrative roles may be away on leave. The additional strain on overworked employees who are at the office can lead to very expensive errors,” Gevers says.

Gevers goes on to explain that the public visibility of the successful UK attacks is likely to have a copycat effect. What’s more, he points out that even less technically skilled attackers can now quickly and cheaply access tools and tactics (often enabled by AI), that allow them to build highly effective phishing campaigns or impersonate support teams at scale.

Gevers says the threat intelligence team at Mimecast has tracked over 150 000 phishing campaigns since February this year, all bearing the hallmarks of these tactics. While many seem simple in nature, such as fake CAPTCHAs, spoofed portals, and MFA prompts, they remain effective because they exploit trust, not code.

Keeping customers happy adds layers of threat

To further complicate things, local retailers will be facing a particularly challenging time this peak as overburdened support teams struggle to deal with increased customer support demands. This will be the case both on the shop floor and online as ecommerce continues to surge.

“Great customer support lies at the heart of ecommerce growth. Unfortunately attackers know this, and they are now increasingly targeting support desks, managed service providers, and third-party vendors. These teams are trained to solve problems quickly, reset credentials and keep operations moving. And it’s precisely these qualities that make them attractive entry points for social engineers,” Gevers shares.

Gevers also warns that business email compromise (BEC) remains one of the most successful forms of attack today, because it bypasses technology altogether. “A well-crafted email from a ‘colleague’ asking for an invoice payment or password reset can be all it takes,” he says.

Identify the areas of weakness and help shore up the gaps

Gevers says recent research from Mimecast reveals that 95% of data breaches are caused by human error but that just 8% of employees account for 80% of security incidents.

He says organisations must prioritise identifying high-risk individuals and implementing targeted training to mitigate these vulnerabilities. Additionally, with over 90% of threats delivered via email, he says it’s crucial to focus on blocking these entry points to prevent attackers from gaining access to credentials and moving laterally within systems.

“As cybercriminals evolve, the battle has moved into inboxes, helpdesks and chat windows. South African retailers must act now to ensure their teams have all the necessary support to get through their busiest time of the year. Retailers can make anything from 20% to 50% of their revenue during peak season and, while they must remain laser-focused on making the most of this time, this past year in the UK has shown us just how devastating a ransomware attack can be,” Gevers says.

Online brand protection is everyone’s responsibility

To keep consumers safe over the peak, Mimecast teams devised a list of tips for retailers:
1. Deploy Domain-based Message Authentication, Reporting and Conformance (DMARC), as a first step. The DMARC protocol prevents cybercriminals from sending harmful emails that appear to come from the business’s domain and is one of the ploys often used by cybercriminals during busy sale days when consumers are expecting communications from stores they have purchased from.
2. Monitor and analyse email activity to identify illegitimate senders, then quarantine or reject suspicious emails before they reach consumers
3. Deploy third-party brand protection services that use advanced scanning and ML to detect and neutralise imitation or spoofed websites and actively block brand impersonation attempts.
4. Establish strong collaboration between marketing and cybersecurity teams to ensure brand protection is addressed from both a reputation and a technical security perspective.
5. Be transparent and communicate with customers, especially regarding incidents, proactive protection steps, and general information security advice.
6. Respond swiftly to attacks by investigating, remediating, and compensating affected customers to maintain the trust that has often taken years to build.
7. Treat online brand protection (including defense against domain spoofing and fake websites) as integral to overall brand management and consumer trust.

The post Vulnerable SA retailers in for brutal peak as cyber criminals gear up for attack appeared first on ProtectionWeb.

In line with the Cybercrimes Act, 2020 (Act 19 of 2020), a Cybercrimes Designated Point of Contact has been established through a collaboration between the CSIR and SAPS. The facility is located at the CSIR in Pretoria. The Act requires all financial and electronic communications service providers to report cybercrimes directly to this designated point of contact, the CSIR said in its 2024/25 annual report.

“As the use of digital systems for communication and online transactions becomes increasingly widespread, so do the risks to the safety and security of user’s personal information. Previously, there was no dedicated mechanism or platform to report cybercrimes. In response, the CSIR developed a secure, web-based reporting platform that allows service providers to report cybercrimes directly to the SAPS Designated Point of Contact, hereby supporting cybercrime investigation and response efforts.”

The tool has been fully developed over the past two years and is ready for deployment in a live environment. It will undergo final testing, security assessments and penetration testing before being rolled out nationally for use by all financial and electronic communications service providers in South Africa, the CSIR said.

The post CSIR develops web-based reporting tool for cybercrimes appeared first on ProtectionWeb.

To support this effort, the Limpopo ICT Forum, Department of Communications and Digital Technologies (DCDT) and the Council for Scientific and Industrial Research (CSIR) are jointly host a three-day Cybersecurity Awareness Webinar Series under the theme “Your Data, Your Power: Hlayiseka!” The phrase Hlayiseka!, meaning “Be Safe”, is a call to action for all citizens to take ownership of their digital safety. The theme serves as a reminder that personal data is power and protecting it is not only a technical responsibility but also a personal and social one, the CSIR said.

This initiative forms part of Cybersecurity Awareness Month (October), which is celebrated globally to promote safer online practices and to build a culture of digital responsibility. The webinars bring together cybersecurity experts, educators, parents and members of the public to learn and engage on practical ways to stay safe online and safeguard their digital identities.

The Cybersecurity Awareness Webinar Series aims to:

Promote awareness of personal data protection and responsible digital behaviour;

Educate citizens on how to identify and respond to common online threats;

Strengthen child online protection and digital rights awareness; and

Foster collaboration between government, industry, academia and communities to enhance national cyber resilience.

Day three (30 October 2025 from 18:00 – 19:00) will focus on romance scams and online relationship fraud (phishing and catfishing). It will be hosted by Siphokazi Novukuza, Director, Cybersecurity Operations, DCDT. Presenters will include Thuli Mkhwanazi: Senior Cybersecurity Researcher, CSIR; Danielle Badenhorst: Cybersecurity Specialist, CSIR; and Matsebe Phasha, Committee Member, Secretary, Limpopo ICT Forum.

To join, participants can click on this Teams link.

The post Limpopo ICT Forum, DCDT and CSIR hosting three-day Cybersecurity Awareness Webinar appeared first on ProtectionWeb.

By exploiting a zero-day vulnerability in a contractor’s publicly accessible application, it was possible to gain control over the vehicle telematics system, compromising the physical safety of drivers and passengers. For instance, attackers could force gear shifts or turn off the engine when the vehicle is driving. The findings highlight potential cybersecurity weaknesses in the automotive industry, prompting calls for enhanced security measures, Kaspersky said.

The security audit was conducted remotely and targeted the manufacturer’s publicly accessible services and the contractor’s infrastructure. Kaspersky identified several exposed web services. First, through a zero-day SQL injection vulnerability in the wiki application (a web-based platform that allows users to collaboratively create, edit, and manage content), the researchers were able to extract a list of users on the contractor’s side with password hashes, some of which were guessed due to a weak password policy. This breach provided access to the contractor’s issue tracking system (a software tool used to manage and track tasks, bugs, or issues within a project), which contained sensitive configuration details about the manufacturer’s telematics infrastructure, including a file with hashed passwords of users of one of the manufacturer’s vehicle telematics servers. In a modern car, telematics enables the collection, transmission, analysis, and utilisation of various data (e.g., speed, geolocation, etc.) from connected vehicles.

On the connected vehicle side, Kaspersky discovered a misconfigured firewall exposing internal servers. Using a previously acquired service account password, the researchers accessed the server’s file system and uncovered credentials for another contractor, granting full control over the telematics infrastructure. Most alarmingly, the researchers discovered a firmware update command that allowed them to upload modified firmware to the Telematics Control Unit (TCU), Kaspersky said. This provided access to the vehicle’s CAN (Controller Area Network) bus – a system that connects different parts of the vehicle, like the engine and sensors. Afterwards, various other systems were accessed, including the engine, transmission, etc. This enabled potential manipulation of a range of critical vehicle functions, which could endanger driver and passenger safety.

“The security flaws stem from issues that are quite common in the automotive industry: publicly accessible web services, weak passwords, lack of two-factor authentication (2FA), and unencrypted sensitive data storage. This breach demonstrates how a single weak link in a contractor’s infrastructure can cascade into a full compromise of all of the connected vehicles. The automotive industry must prioritise robust cybersecurity practices, especially for third-party systems, to protect drivers and maintain trust in connected vehicle technologies,” said Artem Zinenko, Head of Kaspersky ICS CERT Vulnerability Research and Assessment.

Kaspersky recommends that contractors restrict Internet access to web services via VPN, isolate services from corporate networks, enforce strict password policies, implement 2FA, encrypt sensitive data, and integrate logging with a SIEM system for real-time monitoring.

For the automotive manufacturer, Kaspersky advises restricting telematics platform access from the vehicle network segment, using allowlists for network interactions, disabling SSH password authentication, running services with minimal privileges, and ensuring command authenticity in TCUs, alongside SIEM integration.

The post Kaspersky finds security flaws that threaten vehicle safety appeared first on ProtectionWeb.

Biometric IDs and automated decision systems can speed verification and cut obvious fraud. But they also shift crucial decisions from people to opaque systems. Practical harms are already visible: failed enrolments blocking grant access, incorrect automated de‑duplication removing legitimate beneficiaries, and weak appeal routes when a machine says “no”. Biometric data is uniquely sensitive – if compromised it cannot be reissued like a password – and the administrative use of such data often proceeds without clear limits on retention, sharing, or independent oversight. In a country with high poverty, spatial inequality and heavy reliance on social grants, these failures risk converting technical glitches into violations of fundamental socio‑economic rights.

POPIA (the Protection of Personal Information Act) establishes important principles for processing personal data, but it is broad and primarily oriented to private‑sector compliance. Administrative uses of biometric and algorithmic systems raise distinct concerns:

Decisions taken by public agencies affect access to entitlements and liberty; they therefore require stronger procedural safeguards than commercial profiling.
There is often no meaningful right-of‑review or quick remedy when an automated process wrongly denies a benefit.
National rollout decisions (for ID cards, biometric enrolment or facial recognition) are framed as technical upgrades, leaving democratic debate and parliamentary scrutiny behind.

South Africa should enact a narrow ADPA that sits alongside POPIA, designed specifically to govern government use of biometric, identity and algorithmic systems. Its core features should be minimalist but enforceable:

Biometrics and identity data may be collected only where strictly necessary to achieve a specified administrative purpose (e.g., fraud prevention in grant payments), and only after less intrusive alternatives are exhausted. Mandatory impact assessments (pre‑deployment) must show proportionality and non‑discriminatory effect.

Default retention periods for biometric templates must be short and justified; continuous retention requires strong legal basis and periodic review.

Technical standards for secure storage and breach notification are mandatory; irreversible hashing or template techniques must be preferred over raw image storage.

An independent Administrative Appeals Office (AAO) with powers to conduct expedited reviews of ID‑related denials (temporary relief within days) must be established, with specialist technical capacity to audit algorithms and biometric matches.

Citizens must be given clear, accessible notice when a decision relied on automated processing, and a human‑review right on request.

All public algorithms used for eligibility or exclusion must publish a non‑proprietary “decision manifesto”: data sources, key variables, error‑rates, and known biases. This balances security with public accountability.

Regular, machine‑readable disclosure of aggregated failure/appeal statistics (by region and programme) enables civic monitoring and targeted fixes.

The ADPA should create enforceable penalties for agencies that negligently deny benefits through untested automated systems and mandate remediation for affected individuals, including expedited payments and reputational remedies.

An ADPA targeted at administrative uses preserves the gains from digital IDs – reduced fraud, faster processing, possible cost savings – while protecting the most vulnerable. It reframes the problem: not “stop digitisation” but “design government systems so that technology augments, not substitutes, accountable public administration.” The emphasis on short retention, independent review and transparency speaks directly to South Africa’s context where exclusion from grants or ID verification failures can mean loss of shelter, food or school fees.

• Require parliamentary scrutiny of major ID/biometric programmes with mandatory public impact statements.
• Pilot biometric measures in defined districts with external evaluation before national rollout.
• Fund and staff an Administrative Appeals Office with clear timelines for emergency relief in benefits cases.

The rapid adoption of biometric and algorithmic tools in South Africa’s public sector, aimed at enhancing service delivery, often overlooks critical civil liberties, raising concerns about potential governmental misuse for political or ideological ends. As these technologies concentrate administrative power, they create opportunities for abuse, such as discriminatory targeting or the manipulation of data to marginalise specific groups. The absence of stringent oversight not only threatens the rights of individuals but also undermines the very principles of democracy and accountability. If implemented without robust legal frameworks, there is a risk that these systems could be weaponised, where the government might exploit data to stifle dissent or bolster its authority, ultimately eroding the trust citizens place in public institutions. This dual threat of exclusion and authoritarianism underscores the urgent need for a legal framework, like the proposed Administrative Data Protection Act (ADPA), that enshrines the values of proportionality, transparency, and accountability in the deployment of such powerful technologies.

South Africa need not choose between modernising public services and protecting citizens’ rights. A tightly scoped Administrative Data Protection Act would anchor biometric and algorithmic deployments in rule‑of‑law principles: necessity, proportionality, transparency and remedy. That modest legal intervention would allow the state to use powerful identification tools without turning administrative efficiency into a new source of exclusion and arbitrary power.

About the author: Mukundi Budeli is a final year LLB student at the University of Witwatersrand and an Associate of the Free Market Foundation.

The post Legal guardrails needed for smart ID roll-out in South Africa appeared first on ProtectionWeb.

“This Cybersecurity Awareness Month, we’re raising awareness around unregulated use of social media platforms in the office,” said Carey van Vlaanderen, Group CEO at ESET Southern Africa. “There are two main risks when it comes to employees using social media at work. The first is sharing sensitive data – like client details, financial figures, and even login credentials – on platforms that weren’t designed with corporate cybersecurity in mind, and the second is being tricked into clicking on malicious links via fraudulent ads or direct messages.”

South Africans are among the most exposed to high-risk and fraudulent financial ads online, according to research by forex broker analysts at BrokerChooser. Each time employees access social platforms on corporate devices, a single click can introduce malware, trigger phishing attacks, or compromise sensitive information. “What starts as an individual mistake can rapidly escalate into a company-wide vulnerability,” says van Vlaanderen.

In 2024, analysts estimated that the average cost of recovering from a data breach in South Africa reached R53-million – up roughly R4-million from the previous year; “The cost of human error can be extremely high. Without reliable safeguards and an understanding of what to look out for, employees face the constant challenge of distinguishing what’s legitimate from what’s not. With AI boosting the social engineering capacity of cybercriminals, this is getting harder and harder to do,” said van Vlaanderen.

Rising security concerns have prompted action from the platforms themselves. Earlier this year, Meta removed more than six million scam-linked WhatsApp accounts globally. Instead of retreating, attackers doubled down – most recently exploiting a glitch in the platform to infiltrate victims’ phones and steal data. This creates a perfect storm: WhatsApp is the go-to tool for workplace communication, with more than 90% of employees across Africa using it daily – surpassing both email and Microsoft Teams.

“These platforms were built for consumers, not corporations – so they don’t offer the same level of security and privacy protection that purpose-designed systems guarantee. Operating outside formal safety controls, risky cyber activity can easily bypass protections and go unnoticed,” said van Vlaanderen.

“Even just sharing details about work, clients, and colleagues online can be risky, since it provides cybercriminals with all the information they need to impersonate managers in business phishing emails. From employee through to CEO, everyone needs to remain vigilant and be thoughtful about what they are posting online,” said van Vlaanderen. “These are all things that can be included in a business’s social media policy.”

From a business perspective, the biggest vulnerability isn’t unsecure platforms – it’s people; “Equipping your team with the tools to identify risks on their own is critical to keeping up with rapidly evolving threats. Speak to your provider about cybersecurity awareness training that can help build practical, real-world skills through immersive, scenario-based programmes,” said van Vlaanderen. “This kind of investment not only protects your assets but also strengthens the resilience of the entire corporation.”

The post Employees’ social media habits create costly security gaps for SA businesses appeared first on ProtectionWeb.

“The OTO hereby invites written comments on the eFiling profile hijacking draft report. By inviting public participation, the OTO aims to develop a robust and effective response to eFiling profile hijacking, thereby ensuring protection of taxpayers’ rights and enhancing trust in South Africa’s tax administration system,” the OTO said in a statement on Wednesday 1 October 2025.

The draft report was drafted by the ombud following its investigation into alleged eFiling profile hijacking.

“Between 3 February and 5 March 2025, the OTO conducted the eFiling Profile Hijacking Survey to capture taxpayers’ experiences and challenges related to eFiling profile hijacking. Preliminary findings from the survey were presented during a public workshop held on 28 May 2025.

“Initially, the OTO planned to publish the draft report for public comment in July 2025. However, SARS formally requested additional time to respond to the draft report and its recommendations. Consequently, on 2 July 2025, the OTO announced that the publication of the draft report would be postponed to 31 August 2025. Due to ongoing and extensive engagements with SARS, the publication was further delayed,” the statement read.

The report’s key findings include:
• eFiling profile hijacking is most prevalent among tax practitioners and individual taxpayers.
• The majority of cases involve Personal Income Tax and Value-Added Tax (VAT).
• Fraudulent transactions typically involve amounts under R10 000 but can reach up to R100 000.
• Vulnerabilities include inadequate authentication processes, challenges in fraud detection, delayed SARS response times, insider threats, and low digital security awareness among taxpayers.

The key recommendations include:
• South African Revenue Service (SARS): Enhance authentication protocols, improve fraud detection and refund verification systems, boost taxpayer education, and strengthen collaboration with banks, the Companies and Intellectual Property Commission (CIPC), and the South African Police Service (SAPS).
• Tax Practitioners: Implement stricter controls on third-party access and uphold high professional conduct standards.
• Taxpayers: Use strong passwords, activate two-factor authentication, and regularly monitor eFiling profile activities.
• National Treasury: Amend certain provisions in the Tax Administration Act and establish an Inspector-General as recommended by the Nugent Commission of inquiry.
• South African Reserve Bank: Investigate banking irregularities linked to eFiling profile hijacking.

The draft report can be accessed at https://www.taxombud.gov.za/oto-draft-report-on-the-investigation-into-alleged-efiling-profile-hijacking/

Written comments can be sent via: communications@taxombud.gov.za and for more information, visit www.taxombud.gov.za before the deadline on 31 October 2025.

The post Office of the Tax Ombud invites public comment on eFiling Profile Hijacking appeared first on ProtectionWeb.

This is according to cybersecurity and digital privacy company Kaspersky, which said it detected and blocked over 142 million phishing link clicks in Q2 2025, a 3.3% increase globally and a 25.7% increase in Africa from Q1.

AI has elevated phishing into a highly personalised threat, Kaspersky said. Large language models (LLMs) enable attackers to craft convincing emails, messages and websites that mimic legitimate sources, eliminating grammatical errors that once exposed scams. AI-driven bots on social media and messaging apps impersonate real users, engaging victims in prolonged conversations to build trust. These bots often fuel romantic or investment scams, luring victims into fake opportunities with AI-generated audio messages or deepfake videos.

Attackers also create realistic audio and video deepfake impersonations of trusted figures — colleagues, celebrities or even bank officials — to promote fake giveaways or extract sensitive information. For instance, automated calls mimicking bank security teams use AI-generated voices to trick users into sharing two-factor authentication (2FA) codes, enabling account access or fraudulent transactions. Additionally, AI-powered tools analyse public data from social media or corporate websites to launch targeted attacks, such as HR-themed emails or fake calls referencing personal details.

Employing new tactics to bypass detection

Phishers are deploying sophisticated methods to gain trust, exploiting legitimate services to prolong their campaigns. For instance, Telegram’s Telegraph platform, a tool to publish long texts, is used to host phishing content. Google Translate’s page translation feature generates links that look like https://site-to-translate-com.translate.goog/… and are used by attackers to bypass security solutions’ filters.

Attackers now also integrate CAPTCHA, a common anti-bot mechanism, into phishing sites before directing users to the malicious page itself. By using CAPTCHA, these fraudulent pages deflect anti-phishing algorithms, as the presence of CAPTCHA is often associated with trusted platforms, lowering the likelihood of detection.

A switch in hunting: From logins and passwords to biometrics and signatures

The focus has shifted from passwords to immutable data. Attackers target biometric data through fraudulent sites that request smartphone camera access under pretexts like account verification, capturing facial or other biometric identifiers that cannot be changed. These are used for unauthorised access to sensitive accounts or sold on the dark web. Similarly, electronic and handwritten signatures, critical for legal and financial transactions, are stolen via phishing campaigns impersonating platforms like DocuSign or prompting users to upload signatures to fraudulent sites, posing significant reputational and financial risks to businesses.

“The convergence of AI and evasive tactics has turned phishing into a near-native mimic of legitimate communication, challenging even the most vigilant users. Attackers are no longer satisfied with stealing passwords — they’re targeting biometric data, electronic and handwritten signatures, potentially creating devastating, long-term consequences. By exploiting trusted platforms like Telegram and Google Translate, and co-opting tools like CAPTCHA, attackers are outpacing traditional defences. Users must stay increasingly sceptical and proactive to avoid falling victim,” said Olga Altukhova, security expert at Kaspersky.

Earlier in 2025 Kaspersky detected a sophisticated targeted phishing campaign which was dubbed Operation ForumTroll, as attackers sent personalised phishing emails inviting recipients to the “Primakov Readings” forum. These lures targeted media outlets, educational institutions and government organisations in Russia. After clicking on the link in the email, no additional action was needed to compromise their systems: the exploit leveraged a previously unknown vulnerability in the latest version of Google Chrome. The malicious links were extremely short-lived to evade detection and in most cases ultimately redirected to the legitimate website for “Primakov Readings” once the exploit was taken down.

To be protected from phishing, Kaspersky recommends:

Verify unsolicited messages, calls, or links, even if they appear legitimate. Never share 2FA codes.
Scrutinise videos for unnatural movements or overly generous offers, which may indicate deepfakes.
Deny camera access requests from unverified sites and avoid uploading signatures to unknown platforms.
Limit sharing sensitive details online, such as document photos or sensitive work information.

The post Phishing evolves with AI and stealth appeared first on ProtectionWeb.