In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.

A coordinated international operation has disrupted transnational scam networks operating from West Africa, leading to 28 arrests, the removal of more than 3.7 million fraudulent accounts, and the identification of over $11 million in potentially freezable funds.

The action, called “Joint Disruption Week,” was announced by the U.S. Department of Justice and hosted by the UK’s National Crime Agency (NCA).

The operation targeted scam centers in Nigeria, Ghana, and other African countries. These networks used fake identities, social media platforms, and cryptocurrency-based schemes to defraud victims in the United States, the United Kingdom, and other countries.

Global Crackdown Targets Scam Centers

During the week beginning October 6, law enforcement agencies and private companies shared real-time intelligence to locate and disrupt scam operations.

The companies involved removed more than 3.7 million accounts, Pages, and Groups used to target people across multiple countries. They also shared leads on more than 30 suspected scam centers with investigators.

In Ghana, authorities arrested 19 people in the Accra suburb of Sasaabi and seized 303 electronic devices. Investigators identified 117 victims of human trafficking who are now awaiting repatriation to Nigeria. They also identified 89 scam victims with estimated losses of about $8.3 million.

In Nigeria, authorities arrested nine individuals and seized 53 electronic devices. The seized devices may contain evidence linking suspects to fraud campaigns, victim lists, fake profiles, and cryptocurrency transactions.

The crackdown also targeted several common fraud types, including law enforcement impersonation scams, digital “arrest” extortion schemes, and cryptocurrency investment fraud, often called “pig butchering.” In these scams, criminals build trust with victims over time before persuading them to invest money in fake trading platforms.

The operation brought together agencies from the United States, United Kingdom, Ghana, Nigeria, Australia, Canada, India, and New Zealand, along with INTERPOL and cybercrime units. U.S. participants included the FBI, Secret Service, Homeland Security Investigations, Treasury Department, and the Justice Department’s Cyber-Enabled Scam Initiative.

Technology and financial companies also played an important role. Meta, Google, Microsoft, Adobe, OpenAI, Binance, Coinbase, Chainalysis, Elliptic, TRM Labs, Flashpoint, Silent Push, Starlink, and Cyjax voluntarily acted against scam infrastructure on their platforms.

Meta helped coordinate the private-sector participation. The companies’ actions show that online platforms can quickly remove fraudulent accounts while law enforcement pursues arrests, seizures, and financial disruption.

The scale of the problem remains significant. The FBI’s Internet Crime Complaint Center reported 72,984 investment scams in 2025, with cryptocurrency investment fraud making up 72 percent of those reports.

Reported losses from investment scams increased from $3.96 billion in 2023 to $5.8 billion in 2024. Reported cryptocurrency-linked investment scam losses rose 24 percent in 2025 to more than $7.2 billion.

Officials said the latest operation is only the beginning. The Justice Department’s Cyber-Enabled Scam Initiative and the Scam Center Strike Force plan to continue working with international partners and private companies to dismantle scam networks, disrupt their funding, and protect victims.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post Global Scam Crackdown Removes 3.7 Million Accounts and Targets 30+ Scam Centers appeared first on Cyber Security News.

Microsoft Teams was a recurring initial access vector in the first half of 2026. 

Cybersecurity researchers have uncovered a phishing campaign that tricks users into revealing their WatchGuard VPN credentials through a fake software download website.

The attack uses a lookalike domain to impersonate the official WatchGuard website and collect sensitive information, including the VPN server address, username, and password.

Unlike traditional malware campaigns, this attack delivers the genuine, digitally signed WatchGuard VPN installer after collecting credentials.

This makes the operation more difficult to detect because victims receive the software they expected to download.

The Huntress security team investigated the incident after suspicious activity was detected on October 7, 2026. The findings show how attackers can steal valuable credentials without modifying legitimate software or installing malware on the victim’s computer.

WatchGuard VPN Phishing Steals Credentials

The attack begins when users search Bing for WatchGuard VPN downloads. An administrator searching for a VPN client accidentally visited watchguard-vpn[.]net, a fraudulent website designed to resemble the official WatchGuard download page.

The website offers a download option for the WatchGuard Mobile VPN with SSL client. It also contains product information and frequently asked questions, which may help the fraudulent page appear legitimate in search results.

When users click the download option, a pop-up asks them to enter three details the VPN server address, login name, and password. These fields resemble the information requested by the genuine VPN client, making the phishing prompt appear trustworthy.

The credential-stealing functionality is implemented in a JavaScript file named popup.js. When users submit the form, the script packages their information into JSON and sends it to watchguard-ssl[.]online, a separate domain controlled by the attackers.

After the second submission, the phishing page displays a success message and downloads the legitimate WatchGuard Mobile VPN with SSL installer directly from WatchGuard’s official content delivery network.

The installer is version 12.11.5 and carries a valid digital signature from WatchGuard Technologies, Inc. Researchers verified that the file had not been modified after signing.

Delivering genuine software makes this campaign different from attacks that distribute trojanized installers or malicious DLL files.

Security tools may not flag the legitimate installer, while victims receive the expected application and may not realize their credentials have already been exposed.

The domain watchguard-vpn[.]net had previously appeared in research published by WatchGuard’s Secplicity team in January 2026.

Microsoft later linked related VPN credential-theft activity to the financially motivated threat actor Storm-2561. However, available evidence does not confirm that the same operators controlled both registrations of the domain.

Huntress detected the incident shortly after the phishing page loaded and provided remediation guidance before the attack could escalate. The main phishing domain was offline as of October 13, 2026.

Organizations should block the identified malicious domains and investigate potentially exposed accounts. Anyone who entered credentials on the fake website should immediately change the affected passwords and review VPN access logs.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post WatchGuard VPN Phishing Site Steals Server Address, Username and Password appeared first on Cyber Security News.

Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]