1. Cookie Hijacking (Session Hijacking)

Ever stayed logged in to your favorite platforms? That comfort comes from cookies—tiny files that remember your logins. But if a hacker steals those cookies via a shady link or unsecured Wi-Fi, they can quietly access your accounts without needing your password.

Defense tip: Stick to secure (HTTPS) websites, enable “HttpOnly” and “Secure” cookie settings, and always log out when you’re done.

2. SIM Swapping & Port-Out Fraud

These attacks are alarmingly widespread. In the first quarter of 2025, SIM swap attacks rose 38%, costing victims around $11,500 per incident on average. And that’s not the worst—some scams have led to losses in the millions, like a single case with a staggering $1.8M loss.

How it works: Hackers gather your personal info (think social media posts or public data), contact your mobile provider posing as you, and convince them to port your number to their SIM. Once they control your number, they intercept one-time codes and take over accounts (Wikipedia).

Defense tip: Drop SMS-based MFA. Use authenticator apps (like Google Authenticator) or hardware keys instead. Also, set a strong PIN or password for your mobile account, and alert your provider not to change your SIM without direct approval.

3. Deep Dives into Scattered Spider—Advanced Human Manipulation

A new wave of threat actors is gaining ground—and it’s not just about brute force. Meet Scattered Spider, a cybercriminal collective (also known as UNC3944, Oktapus, or Muddled Libra) that’s redefining stealth.

These attackers rely on deep social engineering—smishing (text phishing), vishing (voice impersonation), and well-timed helpdesk manipulation—to crack passwords and steal MFA tokens. They pose as trusted staff or vendors, tricking IT help desks into granting access or transferring MFA to their device.

Once inside, they rarely deploy overt malware. Instead, they “live off the land,” using legitimate tools like PowerShell, AnyDesk, Mimikatz, and remote access utilities to stay hidden while escalating access. Recent cases show these attackers now leverage platforms like Slack and Microsoft Teams to eavesdrop on internal chats and launch targeted strikes—all while quietly compromising systems.

Defense tip: Train your helpdesk team on strict identity checks and callback procedures. Use phishing-resistant MFA (like hardware security keys or FIDO/WebAuthn). Monitor suspicious lateral movement or sudden Remote Desktop sessions. And patch software and segment networks to limit damage (FBI/CISA advisory coverage).

4. Third-Party App Vulnerabilities

Linking apps for convenience is normal, but those third-party apps might not have strong security. A weak connection anywhere can open the door to your linked accounts.

Tip: Only connect apps you fully trust, regularly audit their permissions, and disconnect any unused or obsolete integrations.

5. Keylogging Malware

Hidden keylogging malware keeps a silent watch on every keystroke—passwords, messages, you name it—without triggering any obvious red flags.

Tip: Keep your antivirus and operating systems updated. Avoid downloading files or opening email attachments from unknown sources. Always verify macros and scans.

6. Deepfake Impersonations

Picture yourself video-calling what looks like your boss—and it isn’t. Deepfake tech is making this frighteningly real. Hackers can now mimic voices or video to manipulate targets into giving up credentials.

Tip: If anything feels off—like timing, tone, or facial cues—pause and verify through a separate channel (a quick phone call or in-person check can save a lot of trouble).

7. AI-Powered Phishing

Gone are the days of typo-filled, obviously fake scam emails. AI now crafts messages that mimic tone, industry jargon, and your communication patterns, making phishing far more convincing.

Tip: Don’t click links impulsively—even if they look real. Hover to check URLs, verify email addresses, and when in doubt, go directly to the official site or app.

Bring It All Together: Security That’s Smart—and Human

Numbers and tactics can be overwhelming, but here’s what matters most: layering smart technology with human awareness. Use strong MFA tools, train your team to question unexpected requests, and keep your systems segmented and updated.

Want to install multi-layered defenses—or build a training plan that feels real to your people? We’d be thrilled to help you design something practical, trusted, and ready for today’s threats.

Caldera Cybersecurity is located in Albuquerque, New Mexico and provides cybersecurity support and consulting nationwide. 

Contact Caldera at 505-975-4470 or [email protected] and begin making your business safe from cybercrime.