Phishing & smishing incidents
Phishing & smishing incidents, most recently reported first.
Childcare facility employee in Japan’s Tamura City falls victim to remote support scam
Impact: Possible exposure of personal information, including photos of childcare activities and survey respondents’ names
On October 24, 2026, an employee at a childcare facility in Tamura City, Japan, was deceived by a fake malware infection warning and downloaded remote control software from a fraudulent website. The city said personal information stored on the PC, including photos of childcare activities and the names of respondents to a post-event survey, may have been leaked.
Read on Security NEXT ↗Across Protocol domain hijack causes about $350,000 in losses
Impact: Estimated cryptocurrency losses of approximately $350,000
A social engineering attack targeting domain registrar Namecheap led to the hijacking of Across Protocol's official domain, redirecting visitors to a phishing site. Users were tricked into granting malicious token approvals, causing an estimated $350,000 in asset losses across six blockchains. The team said it had regained control of the domain, restored the service and would compensate affected users.
Related reports: 5 →Vendor breach triggers mass phishing messages impersonating Modu Parking
Impact: Mass distribution of phishing messages impersonating the service
A compromise of an external Alimtalk messaging intermediary’s system led to the mass distribution of phishing messages impersonating Modu Parking. The company said it had revoked the sending key and blocked further messages, and that its own member database and personal data systems had not been compromised.
Read on 보안뉴스 ↗Australian minister Anne Aly’s WhatsApp account hijacked through scam link
Impact: Hijacking of the minister’s personal WhatsApp account and unauthorized messages sent to her contacts
Australian minister Anne Aly had her personal WhatsApp account hijacked after opening a scam link that appeared to have come from someone she knew. Following the takeover, unauthorized messages asking contacts to vote were sent from the account, and the incident was reported to the relevant authorities.
Read on SBS News ↗Fake base station smishing affects 10,000 phones in Tokyo’s Ginza
Impact: More than 10,000 mobile phones affected
A Chinese national was arrested on suspicion of using a vehicle-mounted fake base station in Tokyo’s Ginza district to disrupt NTT Docomo communications and send Chinese-language smishing messages to tourists. Police estimated that more than 10,000 mobile phones were affected over approximately two hours. They are investigating links to 18 reported cases involving losses of approximately ¥4 million.
Read on Commsrisk ↗Phishing posing as X notices harvests login details and authentication codes
Impact: 40 phishing-related domains identified and user accounts taken over
A phishing campaign was identified that impersonated X notices about policy violations, copyright, and appeals to collect users' login credentials and one-time two-factor authentication codes and take over their accounts. X won a dispute over 40 related domains and obtained an order for their transfer.
Read on Domain Name Wire ↗Danish hotel guests targeted by advance-payment scam after booking provider hack
Impact: Fraudulent advance-payment messages sent to guests with upcoming stays
Fraudulent messages demanding advance payment were sent to guests with upcoming stays at Denmark's Hotel Tønderhus after its booking service provider was hacked. The hotel said it does not send WhatsApp messages or requests for advance payment and advised guests not to open the links.
Related reports: 2 →Staff impersonation phishing diverts pay at UK's Highland Council
2Impact: £3,321.41 in pay and two pay stubs
Phishing involving staff impersonation at the UK's Highland Council led to £3,321.41 in pay being transferred to an attacker's account. The attacker requested payroll bank account changes at 12 schools and obtained two pay stubs, also acquiring employees' personal and financial information. The incident was revealed in a council audit report.
Read on The Press and Journal ↗1shop customers targeted with phishing emails using real order details
Fraudulent emails using real order details were sent to 1shop customers. Under the pretext of canceling subscription payments, the attackers directed customers to a fake LINE customer support service and links. The company raised the possibility that order confirmation emails had been stolen and took steps to respond.
Read on iThome ↗Arcadia disaster alert server breach used to send 1.42 million phishing emails
Impact: Over 1.42 million phishing emails sent; up to approximately 3.136 million email addresses potentially exposed
A server belonging to Arcadia, which operates disaster alert services for Japanese local governments, was compromised and used to send over 1.42 million phishing emails. Up to approximately 3.136 million email addresses may have been exposed, and further intrusions using stolen API accounts and other means were also confirmed. Arcadia submitted evidence of the damage to Osaka police, who launched an investigation and began analyzing communication logs from the start of the attack.
Related reports: 4 · last report →App demanding wallet recovery phrase appears in Solana Mobile official store
Impact: Malicious app shown in the official store's featured area for about an hour; number of installs and scale of asset losses not disclosed
An attacker who gained unauthorized access to Solana Mobile's app publishing portal altered the official store's featured screen to show a fake SKR Claim app. The app demanded wallet recovery phrases and was removed after about an hour. The company fixed the related flaw and did not disclose the number of installs or the scale of asset losses.
Related reports: 2 →Singapore petrochemical firm loses $12.8 million to impersonation email scam
Impact: $12.8 million lost in wire transfer, funds recovered
A Singapore petrochemical company was deceived by an email impersonating a business partner and a forged approval document, and wired $12.8 million to a Cambodian account. Singapore police worked with banks and Cambodian police to recover the funds.
Read on The Independent Singapore ↗DNS hijacking of 12 DeFi sites leads to about $200,000 in crypto losses
Impact: About $202,386 in crypto stolen from 32 wallets
The DNS of at least 12 DeFi websites registered with Name.com was tampered with, redirecting visitors to fake sites loaded with the Step Drainer wallet-draining tool. Attackers tricked users into approving asset transfers, and a follow-up tally found about $202,386 stolen from 32 wallets. Unauthorized redirection of the domains was confirmed, but the initial intrusion route has not been identified, and the smart contracts themselves were not compromised.
Related reports: 8 · last report →Flap and Kintsu domain hijacking redirects users to crypto-draining sites
The DNS of Flap and Kintsu was hijacked, redirecting visitors to fake sites and crypto wallet-draining pages. Both services recovered their domains. Blockaid said the same StepDrainer attack was found on 10 additional DeFi sites, and the total amount of losses has not been determined.
Related reports: 2 →Phishing Impersonating Wisconsin Health Officials Harvests Credentials
Impact: Attack impact confirmed in some mailboxes
Phishing emails impersonating Wisconsin state health department employees were circulated. The attackers lured recipients into reviewing a bid proposal and collected credentials on a fake Microsoft login page. The department found rules hiding activity in some mailboxes affected by the attack and urged partner organizations to be cautious.
Read on Wisconsin Department of Health Services ↗Staff at major law firm tricked into sending client documents to hackers
Impact: Client documents
An employee at a major law firm sent client documents to a hacker. The firm explained that the employee was tricked into sending the documents, and the firm's name, the scale of damage, when it happened and the response measures have not been confirmed.
Read on Above the Law ↗Phishing email causes data breach in Roanoke
A data breach occurred in Roanoke. The cause of the breach was confirmed to be a phishing email.
Read on Cardinal News ↗West Frankfort superintendent's account sends 1,700 phishing emails
1.7KImpact: 1,700 phishing emails sent
The West Frankfort superintendent's email account was hacked and used to send 1,700 phishing emails. The superintendent disclosed the account hack and the sending of the phishing emails.
Read on KBSI Fox 23 Cape Girardeau News | Paducah News ↗Health data of North Dakota developmental disability services users possibly exposed
Impact: Possible exposure of health information of developmental disability services users
It was raised that a phishing attack in North Dakota, in the U.S., may have exposed the health information of users of developmental disability services. The North Dakota Department of Health and Human Services warned users about the data leak.
Related reports: 2 · last report →Iranian intelligence attempts to hack Israeli journalists' phones and accounts
Shin Bet, Israel's domestic security agency, said Iranian intelligence is attempting to hack the phones and accounts of Israeli journalists. The attacks were carried out through phishing to obtain information.
Read on Haaretz ↗