Executive Summary The OPCOPRO “Truman Show” operation is a fully synthetic, AI‑powered investment scam that uses legitimate Android and iOS apps from the official mobile app stores, and AI‑generated communities to steal money and identity data from victims. Instead of relying on malicious code, the attackers use social engineering. The attackers pull victims using phishing SMS/ads/Telegram into tightly-controlled WhatsApp and Telegram groups, where AI‑generated “experts” and synthetic peers simulate an institutional‑grade trading community for weeks before any money or personal details are requested. The mobile apps themselves contain no trading logic and act only as WebView shells connected to attacker‑controlled […]

The post The Truman Show Scam: Trapped in an AI-Generated Reality appeared first on Check Point Blog.

This report describes a phishing campaign in which attackers impersonate legitimate Google generated messages by abusing Google Cloud Application Integration to distribute malicious emails that appear to originate from trusted Google infrastructure. The emails mimic routine enterprise notifications such as voicemail alerts and file access or permission requests, making them appear normal and trustworthy to recipients. In this incident, attackers sent 9,394 phishing emails targeting approximately 3,200 customers over the past 14 days. All messages were sent from the legitimate Google address noreply-application-integration@google.com, which significantly increased their credibility and likelihood of reaching end users’ inboxes. Method of attack Based on […]

The post Phishing Campaign Leverages Trusted Google Cloud Automation Capabilities to Evade Detection appeared first on Check Point Blog.

Key Insights Insider recruitment is a growing cyber threat across banks, telecoms, and tech firms. Darknet ads offer payouts from $3,000 to $15,000 for access or data. Crypto exchanges, banks, and cloud providers are prime targets. Prevention requires employee education, strict access controls, and darknet monitoring. The Rise of Insider Recruitment in Cyber Crime Cyber criminals are no longer relying solely on brute force, social engineering, or exploiting vulnerabilities. Increasingly, they are recruiting insiders within organizations to gain access to corporate networks, user devices, and cloud environments. Across darknet forums, employees are being approached, or even volunteering, to sell access […]

The post Cyber Criminals Are Recruiting Insiders in Banks, Telecoms, and Tech appeared first on Check Point Blog.

Executive Summary Ink Dragon, a Chinese espionage group, has expanded from Asia and South America into European government networks. The group turns compromised servers into relay nodes, using victims to route commands and support operations in other environments. Updated tooling, including a new FinalDraft variant, allows the attackers to blend into Microsoft cloud activity and maintain long term access. Multiple threat actors, including RudePanda, exploited the same public facing weakness, showing how a single flaw can draw in several advanced groups. Check Point Research continues to track Ink Dragon’s activity and provide intelligence to help organizations detect and disrupt its […]

The post Ink Dragon Expands With New Tools and a Growing Victim Network appeared first on Check Point Blog.