#phishing — insecure by design

info1 source

Microsoft Support Details Core Phishing Detection and Sender Identification Vectors for End Users

Phishing remains a highly effective vector for threat actors seeking to harvest credentials, identity markers, and financial data by impersonating trusted entities across email, messaging apps, and corporate communication platforms. Attackers routinely leverage psychological pressure, deploying urgent calls to action, fake penalties, or immediate rewards to force targets into acting without proper verification. Key visual and contextual indicators of fraudulent communications include generic greetings, uncharacteristic grammatical errors, and unrecognized senders marked with external warning flags. Technical evasion tactics frequently rely on mismatched email domains, homoglyph attacks, and subtle character substitutions such as swapping letters for visually similar digits. Within client applications like Microsoft Outlook, specific warning banners trigger when inbound message headers deviate from expected authentication standards or fail standard sender verification. Threat actors also distribute lure URLs and malicious attachments, prompting defensive guidance to inspect link destinations via hover previews or mobile long-press menus before interaction. Beyond email-based delivery, social engineering campaigns increasingly branch out into SMS, automated call centers, and direct messages within Microsoft Teams environments. When encountering questionable communications, users are advised to verify legitimacy out-of-band using authenticated contact methods rather than replying directly to the source. For enterprise environments, administrators are directed toward centralized controls, including ATP anti-phishing policies, to mitigate organizational exposure. Ultimately, systematic identification protocols combined with proper reporting workflows form the baseline standard for handling incoming suspicious messages.

medium2 sources

Manchester Airports Group breach exposes booking and Wi-Fi data for 8.7 million travelers

Manchester Airports Group (MAG), operator of Manchester, London Stansted, and East Midlands airports, announced a cyberattack that exposed personal data belonging to approximately 8.7 million customers. Unauthorized third parties gained access to systems handling auxiliary airport services a few days prior to discovery on Tuesday. The exposed data includes customer email addresses, phone numbers, vehicle registration numbers, and postcodes collected via car park reservations, lounge access, Fast Track bookings, and airport Wi-Fi registration captive portals. MAG stated that in the vast majority of cases, only email addresses were compromised. The operator emphasized that neither MAG nor the compromised systems store customer bank or payment card data, so no financial records were leaked. Aviation security, flight schedules, and day-to-day airport operations remain unaffected by the incident. Following detection, MAG isolated the impacted systems, engaged external incident response specialists, and notified relevant UK regulatory authorities. As an immediate containment and precautionary measure, the company disabled its online Manage My Booking portal. Passengers requiring booking modifications within 72 hours are being routed to phone support while upcoming reservations remain active. MAG has initiated direct email notifications to impacted travelers, advising vigilance against follow-up phishing attempts.