By John Wilson, Senior Fellow, Threat Research at Fortra
1. Holiday Job Scams
The holiday season often brings a surge in temporary and remote job listings — and scammers are taking advantage of those looking for work. They pose as recruiters from well-known companies, send fake job offers to collect personal information, and demand upfront payments for “training” or “equipment.” They are even incorporating AI, making scams increasingly difficult to identify.
Before accepting any offer, verify the opportunity directly through the company’s official website or HR department. Legitimate employers will never ask for money or sensitive data during the hiring process. A few red flags: No company is going to hire you without an interview no matter how qualified you may be for the position. Scam job offerings almost always mention a minimum age requirement. This is so they have an excuse to ask for a photo of your ID. Finally, look to see who sent the message and who it was sent to. A lot of scam texts and emails will come from a strange phone number or email address, and many scammers will send messages to numerous recipients at the same time.
2. Gift Card Scams
The use of gift cards during the holiday season ramps up, and so does the attackers’ exploitation of them. Attackers can send their victims emails claiming they’ve won a gift card or received a gift. These may even be customized with AI generated images and tend to impersonate popular retailer brands to increase the authenticity of the fake gift card. But to claim it, they’ll say you must give your personal information or pay a shipping fee first.
If you receive a message like this, remember that legitimate companies will not ask you for payment to receive a gift card.
3. Fake Shopping Websites and Ads
Fake websites, such as phishing sites or phishing, remain a top threat for consumers conducting their holiday shopping online. Cybercriminals often create ‘eCommerce’ websites optimized for search engines and offer goods at below market prices to entice consumers into making a purchase. These sites may even be shared on social media platforms and circulate around as fake enticing ads to lure as many victims as possible.
When you hand over your payment details by shopping on these sites, the hackers record them and use them to commit identity fraud and fraudulent purchases later.
4. Always Use Secure Payment Methods
Never use a debit card online and avoid other payment methods that don’t provide adequate fraud protection when conducting your holiday online shopping. Credit cards tend to be a safer option against fraud, and services such as Apple Pay or Google Pay are generally more secure than entering your card information directly. Some credit card issuers enable you to create virtual card numbers to use on a single website. This is helpful because the card number can’t be used by a scammer to clone your credit card or to purchase from some other website.
This could protect you from fraud, impersonation, and reduce the likelihood of an attacker compromising your bank accounts.
5. Travel Scams
The holiday season is the season of travel, and scammers are always on the lookout for ways to take advantage of these vacation plans. Victims can receive phishing emails offering discounted travel deals and offers that impersonate legitimate online travel service providers. Booking travel plans through these fake malicious sites can compromise your sensitive personal information and even lead to financial losses.
Always verify the legitimacy of websites by navigating to the service provider’s website directly instead of using suspicious links embedded in emails, use secure payment methods to protect your personal information, and remember – if a deal is too good to be true, it likely is.
Congressional Budget Office Pwned By Hackers
Posted in Commentary with tags Hacked on November 7, 2025 by itnerdThis isn’t good. The Congressional Budget Office has apparently been pwned according to Reuters:
“The incident is being investigated and work for the Congress continues,” the CBO said in a statement, without commenting on whether a foreign actor was behind the incident.
“Like other government agencies and private sector entities, CBO occasionally faces threats to its network and continually monitors to address those threats,” it added.
Officials in the Senate Sergeant at Arms office notified multiple congressional offices on Tuesday of a “cyber incident,” according to a notification reviewed by Reuters. The officials warned email communication between the CBO and Senate offices may have been exposed to hackers, and that the compromised data could be “used to craft highly targeted phishing emails that appear to be legitimate CBO communications.”
Offices receiving communications from purported CBO email addresses should verify the legitimacy of sources, particularly for any email, voice or text communications related to the incident, the officials warned. The communications could include office chat logs, according to the Washington Post.
CNN is also reporting on the story and pointed the finger at China.
The email from the Senate sergeant at arms did not name a culprit, but a US official briefed on the hack told CNN on Thursday that Chinese state-backed hackers are suspected of being behind the breach. The email said the hacking incident was “ongoing” and that staffers should avoid clicking on links sent from CBO accounts because the accounts may still be compromised.
Regardless of who is behind this, this is not good. Normally, I would say that there needs to be a robust investigation to get to all the details behind this hack and to make sure that steps are taken to make sure that this doesn’t happen again. But while steps have been apparently taken to mitigate this, I am seriously doubtful that we’ll ever find out all the facts as cybersecurity doesn’t seem to be a focus at the moment for the US Government. But I am free to be proven wrong on that front.
Leave a comment »