Phishing on Locodigital

SPF, DKIM and DMARC: What They Are and How to Stop Spoofing

Thu, 29 Oct 2026 05:00:00 -0300

The original email protocol (SMTP) doesn't verify who the sender is. The "From:" field is just text: any server can send a message claiming to be finance@yourcompany.com, and the recipient sees exactly that. SPF, DKIM and DMARC are three DNS records created to close that gap. If you own a domain, at least one of them is probably missing or misconfigured.

The problem: the "From:" address proves nothing

This hole underlies much of email phishing and the fake-executive fraud described in BEC and CEO deepfakes. Without authentication, the attacker doesn't need to break into anything: writing your domain in the sender field is enough. If your domain is protected, the recipient's server discards or quarantines those messages before they reach the inbox.

Kevin Mitnick: the story of the FBI's most wanted hacker

Sat, 26 Sep 2026 09:00:00 -0300

It was 1:30 a.m. on February 15, 1995. In an apartment in Raleigh, North Carolina, FBI agents broke down a door and arrested a 31-year-old man living under a false name. Kevin Mitnick — the most wanted fugitive in the United States for computer crimes — had been found. Not because of a technical slip. Because of an attack made on Christmas Day, against the wrong computer, belonging to the wrong man.

Target 2013: the theft of 40 million cards via an HVAC vendor

Sat, 19 Sep 2026 09:00:00 -0300

It was the early hours of Black Friday 2013. Target's US stores were gearing up for the biggest sales day of the year. While customers slept, data from 40 million credit and debit cards quietly traveled to servers in Eastern Europe. The intrusion had already been running for two weeks — and the company's security system had raised alerts days earlier. Nobody acted.

What Target looked like in 2013

Target Corporation was the second-largest retail chain in the US, with more than 1,800 stores and annual revenue near $70 billion. The company had an active security team and used sophisticated tools — including FireEye for malware detection. The breach didn't happen for lack of investment. It happened from a combination of poorly segmented third-party access and ignored alerts — a lesson the industry is still learning the hard way.

How to disable Office macros and close this classic attack vector

Tue, 15 Sep 2026 10:00:00 -0300

Before Emotet was taken down in 2021, it infected hundreds of thousands of machines worldwide using a surprisingly simple method: a Word file with a macro that asked the user to click "Enable Content." One line of VBA code downloaded the payload, established persistence, and opened the door to ransomware, credential theft, and lateral movement. The same mechanism was used by Qakbot, Dridex, and dozens of other loaders. Office macros aren't a new vulnerability — they're a configuration problem.

Fake support: when AI hands you the scammer's phone number

Mon, 14 Sep 2026 09:00:00 -0300

The flight is delayed, the card is blocked, the package vanished. You do what everyone does: type "[company] customer service phone" into a search engine — or, increasingly, ask an AI directly. A number shows up looking official, you call, and on the other end a polite agent fixes everything: they just need you to confirm a few details, the card number, that code that arrived by SMS. Weeks later the statement arrives. The agent was the scammer — and you were the one who dialed.

AI scams: the 6 most common ones and how to protect yourself

Fri, 04 Sep 2026 08:00:00 -0300

The call comes from an unknown number, but the voice is your child's. The email from the bank doesn't have a single spelling mistake. The finance director appeared on video, live, authorizing the transfer. None of those three scenes proves anything any more: deepfake fraud in Brazil grew 126% between 2024 and 2025, and the country already accounts for roughly 39% of the cases detected in Latin America. Artificial intelligence didn't invent a new scam — it took the scams that already existed and removed everything that used to give them away.

How generative AI changed phishing: perfect emails, zero mistakes

Sat, 29 Aug 2026 09:00:00 -0300

For years, the number one piece of advice against phishing was simple: be suspicious of email with spelling mistakes, odd formatting or a badly done translation. That advice still holds — but less and less. Since late 2022, security researchers have recorded a 1,265% increase in malicious phishing emails, coinciding directly with the popularization of generative AI tools capable of writing fluent text in any language.

What changed, in practice

Why is AI-generated phishing more dangerous?

Generative AI tools eliminate the grammar errors and awkward tone that historically gave phishing away, producing emails with a professional tone, clear structure and natural language — making the scam much harder to spot at first glance. A study comparing phishing emails written by humans and by ChatGPT found click rates of up to 81% on the AI-generated ones — practically equivalent to, or even better than, those written by experienced scammers.

Watering hole attack: when legitimate sites become a trap

Fri, 28 Aug 2026 08:00:00 -0300

A financial-sector company closes out a normal working day. The next morning, the security team detects suspicious traffic on the servers. The source isn't a phishing email, isn't a malicious attachment, isn't an employee clicking a dodgy link. It's the sector regulator's website — the same one staff visit every week to check rules and circulars. The site had been compromised for weeks. The attack simply waited for the right victim to come to it.

The fake-relative scam with an AI-cloned voice: how it works and how to protect yourself

Thu, 27 Aug 2026 09:00:00 -0300

The phone rings. On the other end, your son's voice, shaking, asking for help: he crashed the car, he's being held, he needs money transferred right now. The voice is identical — the same way of speaking, the same tone. Except it isn't your son. It's a clone generated by artificial intelligence from any random video he posted on social media.

This scam — a variation on the classic virtual kidnapping — has been spreading in 2026, and digital security specialists already treat voice cloning as the new frontier of the phone scam.

WormGPT and FraudGPT: how the malicious AI sold on the dark web works

Wed, 26 Aug 2026 09:00:00 -0300

In July 2023, a chatbot called FraudGPT went on sale in dark web forums with a straightforward pitch: no refusing requests, no ethical filter, no "I can't help with that". Within a few weeks, the listing already recorded more than 3,000 confirmed sales. Three years later, this market for "AI with no brakes" has only grown.

What WormGPT and FraudGPT are

What is WormGPT?

WormGPT is considered the first openly commercialized malicious language model, built on GPT-J — a 6-billion-parameter open source model created by EleutherAI — trained specifically on malware and phishing data. It appeared in hacker forums in 2023 as a "no rules" alternative to ChatGPT, sold by subscription for between US$60 and US$700. The original developer shut the project down in August 2023 after attracting heavy attention from the press and from security researchers — but variants and clones kept appearing.

Deepfake: how to spot an AI-generated fake video (7 signs)

Tue, 25 Aug 2026 09:00:00 -0300

Deepfake fraud in Brazil grew 126% between 2024 and 2025, according to reporting by the newspaper Estado de Minas — the country already accounts for roughly 39% of all deepfakes detected in Latin America, and the pattern repeats in every region where the tooling has become cheap. A video that "proves" someone said something, or that confirms the identity of the person on the other end of a call, no longer guarantees anything.

How formjacking steals your card data without you noticing

Thu, 20 Aug 2026 08:00:00 -0300

In September 2018, British Airways discovered that 380,000 customers had card data stolen while booking on the airline's website and app. The culprit: 22 lines of malicious JavaScript quietly inserted into the checkout page's code. No virus, no suspicious pop-up — just a payment form that sent a copy of everything typed into it to a criminal server. The transaction went through normally. You noticed nothing.

The attack has a name: formjacking.

Malicious Chrome extension: how to spot it and remove it

Mon, 17 Aug 2026 10:00:00 -0300

You install a PDF converter extension, use it once, forget it exists. Six months later, your Gmail password changes without you asking. The extension had quietly changed owners and started collecting session cookies — the equivalent of having your login intercepted on every site you visited. This isn't a hypothetical: in January 2026, more than 840,000 browsers were compromised by seemingly legitimate extensions that turned into digital spies, according to research published by Techtudo.

Social engineering: the attack no antivirus blocks

Mon, 10 Aug 2026 08:00:00 -0300

A complex password, an up-to-date antivirus, a properly configured firewall — and the company was compromised anyway. The attack vector? An employee got a phone call from someone claiming to be from IT support and handed over their credentials without questioning it. Social engineering doesn't attack systems. It attacks people. And that's exactly why it's the most effective method there is.

What social engineering is

Social engineering is the set of psychological techniques used to manipulate people into revealing confidential information, taking harmful actions or granting access to protected systems. The term describes the idea of "engineering" human behavior — exploiting natural tendencies like trust, obedience to authority, fear and urgency to get what a purely technical attack couldn't.

What credential stuffing is and how leaked passwords open other accounts

Thu, 06 Aug 2026 09:00:00 -0300

You get an alert: access to your Netflix account detected in Bucharest, at 3 in the morning. You've never been to Romania. But the password was correct — so the system let it through. What happened wasn't a hacker guessing your password. It was a credential stuffing attack, and the blame most likely lies with a breach at some site you don't even remember signing up for.

What is credential stuffing?

Credential stuffing is a type of attack in which criminals take lists of username and password combinations obtained from old breaches and test them, automatically, against dozens of other services at the same time.

How to know if your email was leaked — and what to do next

Tue, 04 Aug 2026 09:00:00 -0300

In June 2026, a database containing 56 million unique email addresses harvested by infostealers — malware that captures credentials in real time — was indexed by the world's largest breach-tracking service. Those addresses, along with passwords, session tokens and cookies, are available for purchase on dark web channels right now. The question is simple and direct: is yours in there?

What Have I Been Pwned is

Have I Been Pwned (HIBP) is a free service created by Australian researcher Troy Hunt in December 2013. The platform aggregates databases from confirmed breaches — more than 1,000 compromised services indexed to date — and lets anyone check whether their data shows up on those lists.

What is typosquatting? How one wrong letter steals your data

Thu, 30 Jul 2026 09:00:00 -0300

You type chase.com into the browser, but you miss a letter: chsae.com. The page that opens is identical to the bank's — same blue, same logo, same login form. You enter your account number and password. The money doesn't leave immediately, but your credentials have just landed on a criminal's server. That's typosquatting: a scam with no explicit malware, no phishing email, triggered by nothing more than a typo.

What is typosquatting?

Typosquatting (from typo, a typing error, + squatting, illegally occupying space) is the practice of registering domains that imitate legitimate addresses with small variations: one extra letter, one missing, swapped vowels or visually similar characters. The fake domain sits there waiting for whoever mistypes.

How to spot a phishing email: 7 practical signs

Tue, 28 Jul 2026 09:00:00 -0300

You get an email from your bank saying your account has been blocked for suspicious activity. The logo is perfect, the copy is well written, the button is red and it asks you to confirm your details "now". It looks legitimate — and that is exactly the problem. Phishing has evolved far beyond the spelling mistakes and odd senders of ten years ago. With generative AI tools, attackers build messages that precisely imitate the tone and visual identity of banks, carriers and government agencies.

What is vishing? The AI voice scam that clones you in 3 seconds

Thu, 23 Jul 2026 10:00:00 -0300

You get a call. It's your boss's voice — the tone, the cadence, the accent, everything matches. He asks you to transfer $50,000 urgently to close a contract. You hesitate for two seconds and make the transfer. Only hours later do you find out the "boss" was an AI that cloned his voice from a 3-second clip pulled out of a recorded meeting.

That isn't a TV script. It's vishing — and attacks grew 442% between the first and second half of 2024, according to CrowdStrike's Global Threat Report 2025. In the first half of 2025 the volume had already surpassed all of 2024.

Twitter hack 2020: how three hackers hijacked Obama and Musk

Sat, 18 Jul 2026 09:00:00 -0300

On 15 July 2020, anyone who opened Twitter at 20:00 UTC saw something impossible: Barack Obama asking people to send him Bitcoin. Joe Biden too. Bill Gates, Elon Musk, Jeff Bezos, Apple, Uber. All posting the same message: "Send $1,000, get $2,000 back." In 45 minutes, 320 people transferred Bitcoin to the attackers' wallet. The total: $118,000 stolen before Twitter managed to delete the posts. Whoever was behind it wasn't an elite state-sponsored group. It was a 17-year-old from Tampa, Florida.

Fake public Wi-Fi: how the evil twin attack steals your passwords

Thu, 16 Jul 2026 09:00:00 -0300

You're at the airport, flight delayed, battery in the red. You see the "AirportFree" network available — the same one you use in that terminal every time — and you connect without thinking. Thirty metres away, someone with a laptop and a device the size of a router is watching every request that leaves your phone. That's an evil twin attack: simple to set up, invisible to the victim and devastating if you're logging into anything.

2FA with TOTP: how to turn it on in Gmail, Instagram and WhatsApp

Wed, 15 Jul 2026 09:00:00 -0300

More than 23 billion credentials are circulating on cybercriminal forums today. Most of them belong to users with a reasonable password — but with no additional layer of protection. If the server of a service you use gets compromised, or if your password turns up in a credential stuffing attack, a password alone doesn't keep your account safe. That's exactly what 2FA exists for — and specifically TOTP.

What TOTP is and how it works

What is TOTP, exactly?

TOTP (Time-based One-Time Password) is an authentication method that generates a 6-digit code every 30 seconds, calculated locally on your phone from a secret key — with no need for internet or SMS. The algorithm (RFC 6238) uses HMAC-SHA1, combining that key with the current timestamp. Because the server and the app start from the same key and the same clock, they arrive at the same code — and any generated code is valid for a single 30-second window.

OPSEC: what it is and how to apply it to protect your privacy

Tue, 07 Jul 2026 09:00:00 -0300

In 1966, the US Army set up a secret group called Purple Dragon with an unusual mission: work out why the enemy was able to anticipate every movement of American troops in Vietnam, even without intercepting encrypted communications. The conclusion was uncomfortable — the soldiers themselves were giving away critical information without realising it, through everyday habits, behavioural patterns and apparently trivial slips. The process that came out of that investigation was named OPSEC, and today it makes more sense for anyone with a smartphone than it does for a soldier in the jungle.

Credential stuffing: what it is and how to protect your accounts

Fri, 03 Jul 2026 09:00:00 -0300

At 4am on 1 July 2025, an executive at a Brazilian fintech was woken by an urgent alert: a suspicious instant transfer of around US$3 million had just gone through. Over the following hours, at least six other Brazilian financial institutions logged the same coordinated pattern — legitimate customer credentials, harvested from earlier breaches, being used to break into real accounts. Brazil's central bank estimated the operation's potential losses could reach US$180 million. That is credential stuffing running at industrial scale.

What is SIM swap: the phone-number scam that empties your bank account

Thu, 02 Jul 2026 10:30:00 -0300

Your line vanishes from your phone with no warning. No signal, no texts, no data — as if the SIM had been switched off all at once. Hours later you check your statement and see that someone emptied the account by instant transfer while you were unable to receive a single verification code. That's SIM swap: a silent scam that starts at the carrier and ends in your bank account.

What is quishing? The fake QR code scam

Thu, 25 Jun 2026 00:00:00 -0300

You sit down at a restaurant table, spot the usual QR code stuck in the corner, scan it to see the menu or pay the bill, and get on with your life. The problem is that, more and more often, that sticker isn't the original — it's another one, pasted on top, pointing at a payment that doesn't go to the restaurant. The scam has a technical name: quishing, "QR code" welded to "phishing". And it exploits exactly what makes QR codes convenient: nobody sees the destination before scanning.

The "hi, mum" WhatsApp scam: how it works and how to avoid it

Mon, 22 Jun 2026 06:00:00 -0300

The message arrives from a new number, but with the photo and the name of someone you know: "hi mum, I've changed my number, save this one and delete the old one". Minutes later comes the request — an urgent transfer, a bill that has to be paid right now, a card that's been blocked. There's nothing technically sophisticated about it. It's pure social engineering, and it works because it exploits the trust you already have in whoever is on the other end — or thinks they are.

iFood data breach: 1.2 million Brazilian IDs exposed

Tue, 16 Jun 2026 09:00:00 -0300

In late May 2026, a threat actor going by "bacen" posted on BreachForums claiming to hold 43.84 million customer records from iFood, Brazil's dominant food-delivery platform — names, CPF numbers (the country's national taxpayer ID), addresses, phone numbers. iFood responded by confirming an incident, but with a very different figure: 1.2 million users, around 2% of the platform's base. The story is more interesting than it looks, because the entry vector reveals a chronic blind spot at companies operating in Brazil.

Carnival Corporation: 6m customers leaked by ShinyHunters

Fri, 29 May 2026 09:00:00 -0300

The world's largest cruise operator has just notified nearly 6 million customers about a data breach. Carnival Corporation confirmed that the ShinyHunters group accessed its systems on 14 April 2026 using a vector companies insist on underestimating: an employee who was tricked. Passports, dates of birth, email addresses and loyalty programme data belonging to 5,995,277 people were exposed. Notifications started landing in customers' inboxes on 27 May — more than six weeks after the intrusion.

MFA Fatigue: the attack that turns your 2FA against you

Wed, 27 May 2026 10:00:00 -0300

In April 2025, Marks & Spencer — one of the largest retailers in the UK — had its e-commerce operation offline for five consecutive days. The cause wasn't a sophisticated zero-day or an unknown vulnerability. The Scattered Spider group phoned the company's help desk, posed as an employee, obtained a password reset, and from there it was only a matter of time. Losses estimated by the Cyber Monitoring Centre: between £270 million and £440 million. It all started with a phone call and an MFA notification approved by mistake.

ShinyHunters: 275 million student records exposed

Mon, 18 May 2026 14:00:00 -0300

On the morning of 7 May 2026, students at at least 330 universities around the world tried to log into Canvas — the most widely used learning management system in American higher education — and found the login screen replaced by an extortion message. It wasn't a server error. It was the ShinyHunters group announcing that it held 3.65 terabytes of data and that Instructure had until the 12th to pay. That scene, multiplied across hundreds of institutional portals, sums up how far the group's campaign had escalated by April and May 2026.