MetaCert

It’s time for a new way to spot & avoid online impersonators inside any mobile app or service: Messages including SMS and iMessage, Mail, Gmail, Discord, WhatsApp, Telegram, LinkedIn, Twitter/X, QR Codes… All without opening a link Zero Trust for URLs apps.apple.com/us/app/metace…

We will be publishing a new draft white paper in the coming days for community review and feedback before it moves from draft to fully approved. Finalising this white paper is an important step before Mackie Mobile launches in the coming months.

Extortion is the second act of phishing. PornHub reported extortion demands linked to analytics data allegedly sourced from a phishing-enabled third-party breach. Once data is exposed, the damage compounds. bleepingcomputer.com/news/se…

$3.3M lost. No malware. No breach. Just phishing and impersonation convincing enough to redirect payments. This is what link trust failure looks like in the public sector. timesunion.com/state/article…

Even “official” SMS numbers can’t be trusted. Attackers compromised Mobile Commons and sent scam texts from legitimate short codes to thousands of recipients. Sender ID isn’t security. Links still decide the outcome. bitdefender.com/en-gb/blog/h…

Phishing doesn’t need email anymore. Attackers abused Google Tasks notifications to push victims to credential-harvesting pages, bypassing traditional security controls. Channel based defenses keep failing. The link stays the choke point. cyberpress.org/abuse-google-…

Attackers sent phishing emails from Google infrastructure itself. 9,400 phishing emails. 3,200 organisations targeted. Legitimate domains abused to bypass filters. This shows why reputation and sender trust don’t work. Only link verification does. thehackernews.com/2026/01/cy…

MetaMask phishing emails warned end users to “secure their wallet now” and pushed them to malicious links designed to steal credentials and keys. Security theatre doesn’t help if links are trusted first. techloy.com/metamask-users-t…

One interaction. $1.08M gone. A reported crypto phishing attack tricked a victim into approving a malicious transaction after interacting with deceptive content. Crypto didn’t fail. Cryptography didn’t fail. Phishing. Trust in a link did. cryptopolitan.com/phishing-v…

Your card never left your wallet. The money still did. Phishing was used to steal card details, add them to Apple Pay or Google Pay, and commit fraud without physical theft. This isn’t a wallet problem. It’s a link problem. theguardian.com/money/2026/j…

When regulators issue scam alerts, it’s already too late for many victims. HKMA warned about fraudulent banking websites, fake login screens, and phishing messages impersonating real banks. The common denominator isn’t the channel. It’s the link. hkma.gov.hk/eng/news-and-med…

This is phishing with real human cost. Dubai Police warned about fake work visa and employment scams using phishing to extract fees and personal data from job seekers. That trust still starts with a link. cybernews.com/news/dubai-pol…

New Year event and delivery scams in India used phishing links and cloned sites to harvest card details, UPI pins, and OTPs at scale. Same pattern every year. Same failure every year. Phishing. Trusting links by default is the real vulnerability. timesofindia.indiatimes.com/…

A reminder that scams don’t take holidays. WhatsApp New Year greeting messages carrying phishing links and malicious APKs. One tap installs malware. Data is stolen. Banking fraud follows. No exploit. No zero-day. Just a trusted link. timesofindia.indiatimes.com/…

New EU PSD3 regulation raises fraud liability for banks and payment providers Most digital fraud begins with phishing Today’s security can’t protect people from unreported phishing threats Zero Trust for links delivers upstream protection developer.metacert.com/banks…

Someone replied to a LinkedIn post with a tool they believe can stop phishing by rewriting links and scanning them at click time. It can’t. New links have no history or signals for detection to analyse. That’s why people are still told to stay vigilant. developer.metacert.com/when-…

Most cyberattacks start with phishing, and most phishing begins with a dangerous link - every security vendor will tell you this. That’s why this chart might be the most important one you’ll see about AI and cybersecurity. The next one will go even further. #Smishing #APPFraud

✍🏻 New blog post: a look at how phishing began in the mid-1990s, how trust on the web was built, lost, and is now being rebuilt. developer.metacert.com/the-e…

Palo Alto’s new report calls a global smishing campaign “sophisticated.” It’s not. It’s the same phishing problem that’s existed for decades - fake links leading to fake websites. developer.metacert.com/the-i…