Scammers Target Remote Workers with Fake Compensation for Home Internet and Devices
Russian remote workers are facing targeted attacks from fraudsters who pose as employers, government agencies, or corporate IT departments. One common lure involves promises of compensation for home internet expenses and personal computer use. To claim these nonexistent payments, victims are directed to phishing sites for identity verification or asked to share SMS codes, according to Alexander Lunev, head of the information security training group at Yandex.
Instead of receiving funds, employees may unknowingly provide login credentials or payment information to attackers. The promised compensation turns out to be entirely remote, never reaching the victim's bank account. A separate scenario starts with emails claiming to come from a company's IT service, urging immediate renewal of system access, account confirmation, or installation of updates through provided links.
The sense of urgency is designed to prompt quick action before the recipient questions why a corporate administrator is contacting them from an unfamiliar address. Home networks add another layer of vulnerability, as users are responsible for their own router configurations unlike protected office setups. Multiple devices including work laptops, smartphones, cameras, smart TVs, and speakers often share the same router, meaning a single compromise can expose the entire household ecosystem.
Yandex specialist Alexander Lunev advises replacing default router and Wi-Fi passwords, applying firmware updates, and disabling quick device connection features. Smart devices should be moved to an isolated guest network separate from work computers. Any urgent requests should be verified through independent channels such as known phone numbers or corporate messengers. Legitimate companies, banks, and agencies never request passwords or SMS codes over the phone.
Related articles
Booking.com Security Overlooked Fake Downing Street Listing in Which? Fraud Test
Researchers from Which? successfully listed a fake apartment at 10 Downing Street on Booking.com to test the platform's fraud defenses. The listing included the exact address, photos of the UK Prime Minister's residence, and a description of a one-bedroom property near Parliament. Booking.com processed a payment for a week-long stay and failed to refund it even after more than six weeks. A fabricated positive review mentioning the official cat Larry was approved almost instantly. The platform also permitted a phishing link sent through its internal chat system asking for credit card details. The listing remained active from June 18 until its removal on August 27, prompting Which? to call for an Ofcom investigation into Booking.com's systemic security failures.
Password Spraying Campaign Targets AWS Root Accounts in Over 150 Organizations
A password spraying campaign targeted AWS root accounts across more than 150 organizations between July 24 and August 23, 2026. Attackers performed repeated login attempts against identities holding maximum privileges in the cloud environment. The root account is created with every AWS account and grants full access to resources, configurations, billing, and sensitive administrative functions. Researchers observed a median of two attempts per organization, with some targets receiving up to eight attempts. No successful authentications linked to the campaign have been identified so far. The attacks leveraged distributed proxies across multiple countries and networks, including hosting infrastructure and residential proxies, while using user agents that mimicked older versions of Microsoft Edge and Firefox. Since June 2025, AWS has required MFA for root users, significantly raising the bar for account takeover even if a password is discovered.
Unsolicited iPhone 15 Pro Max Delivery to Reddit User Sparks Fears of Targeted Cyber Attack
A Reddit user received an unexpected iPhone 15 Pro Max in a sealed box that was never ordered. Apple’s service identified the serial number as belonging to a device purchased or activated in December 2023, with its warranty already expired in 2024, creating a clear mismatch between the new-looking packaging and the device’s documented history. The included FedEx label contained a tracking number that does not exist in the carrier’s system. Discussion on the platform raised the possibility of a targeted attack, potentially a form of whaling, in which the phone could have been pre-modified to steal data or credentials once connected to a network or Apple ID. No concrete evidence confirms the package originated from an attacker, and alternative explanations such as a delivery error or order fraud remain possible. Experts recommend that recipients avoid powering on the device, inserting a SIM card, or entering any account credentials, and instead consider returning it to Apple for inspection or disposing of it as electronic waste.
Scammers Embed Phishing Inside Telegram Mini Apps After August Update
Cybercriminals are increasingly abusing Telegram's Mini Apps and WebView features to deliver phishing attacks that mimic legitimate banking, payment, and cryptocurrency services. Following the platform update on August 25, attackers can now present fake interfaces for transfers, airdrops, and voting systems directly inside the messenger. Victims are tricked into entering confirmation codes, connecting wallets, or pasting commands into PowerShell under the guise of fixing errors or claiming bonuses. The attacks rely heavily on social engineering rather than automated malware, requiring users to actively authorize actions such as signing transactions or providing phone verification details. Fake voting schemes are used to harvest account credentials, while crypto-related lures prompt users to link wallets to malicious services. Experts emphasize that simply opening a Mini App does not lead to immediate theft, but authorizing or connecting assets does expose users to significant risk.