Scam Watch

The FBI issued a formal warning in May 2026 about Kali365, a phishing kit sold on Telegram that bypasses multi-factor authentication without stealing your password. A phishing email with a legitimate-looking Microsoft device authorization code links to Microsoft’s real login page. When you complete MFA normally, the attacker receives your OAuth access token and gains persistent access to your Outlook, Teams, and OneDrive. Even users with MFA enabled are vulnerable.

The FTC issued an alert in June 2026 about a scam that looks exactly like a standard CAPTCHA. A pop-up asks you to prove you are human but instead of clicking images or typing characters, it instructs you to press Windows + R, then Ctrl + V, then Enter. Following those steps pastes and runs hidden malware placed in your clipboard without your knowledge.

The FTC warned in May 2026 that scammers are sending fake digital invitations impersonating platforms like Evite and Paperless Post. The invitation may list someone you know as the host. To RSVP, it asks you to sign in with Google or Microsoft. Those login screens are fake and capture your credentials, giving attackers access to every account linked to that login. Over 80 fraudulent domains running this campaign have been identified.

Travel-related cyberattacks increased 122% over the past three years, with 47,318 new fraudulent travel domains registered in May 2026 alone — one in every 112 already classified as malicious. Scammers impersonate Booking.com, Airbnb, Skyscanner, and major airlines with convincing fake websites and WhatsApp messages claiming problems with your reservation. Some messages include genuine booking details obtained from prior data breaches to appear credible. Norton data shows imposter scams surge 144% in summer months.

Over 80% of phishing emails are now AI-generated, with a 60% higher click rate than traditionally written scams. These emails are grammatically perfect, match your organization’s tone, and can appear to come from someone you know. Hoxhunt research recorded a 14x surge in AI-generated phishing in late 2025 that has continued into 2026. You can no longer use poor writing or odd phrasing as a warning sign.

Emails appearing to come from your CEO or a senior executive urgently requesting a wire transfer, gift card purchase, or payment instruction change. AI now mimics the exact writing style of specific executives pulled from public sources including LinkedIn and company websites. Business email compromise caused $3.05 billion in verified losses in 2025.

A phishing email with a fake invoice, subscription renewal, or security alert tells you to call a phone number to resolve the issue. Phone numbers bypass email security filters entirely. Once you call, attackers use social engineering to walk you through installing remote access software or revealing credentials. This method increased 500% in late 2025 and continues to grow in 2026.

A scammer compromises a vendor’s email account or spoofs their domain and sends a fraudulent invoice or updated banking details notice. Payments are redirected to the attacker’s account. The FTC flagged fake invoice scams targeting small businesses specifically in May 2026, noting that scammers send invoices for products or services never ordered, counting on busy staff to pay without checking.

Microsoft remains the most impersonated brand in phishing attacks in 2026, followed by Google. Emails warn of unusual account activity and link to convincing fake login pages. Google’s June 2026 advisory confirmed that attackers are increasingly using cloud-hosted documents with hidden pages to host phishing content, bypassing standard security scanners by exploiting the reputation of trusted platforms.

The IRS published its 2026 Dirty Dozen list in March 2026. Top threats include emails impersonating the IRS, QuickBooks, TurboTax, and DocuSign with fake filing alerts, AI robocalls using cloned IRS agent voices, and spear-phishing targeting tax professionals. The IRS flagged fabricated long-term capital gains claims on Form 2439 as a new scheme. Over 600 social media IRS impersonators were reported in fiscal year 2025.

Scammers monitor real estate transaction email threads and at a critical moment send fraudulent wire instructions appearing to come from your agent, attorney, or title company. Funds sent to the wrong account are rarely recovered. This remains a consistently active threat reported regularly to the NJCCIC from New Jersey residents.

With over 1.17 million U.S. layoffs in 2025, employment scams continue to grow in 2026. Scammers post fake positions on legitimate job boards or contact job seekers directly to collect Social Security numbers, banking details, or upfront fees. Hoxhunt data shows a surge in recruitment scams targeting HR professionals with fake job seekers and Sales and Marketing staff with fraudulent job offers.

The FTC issued a warning in June 2026 specifically targeting childcare providers and other service businesses. A scammer contacts a provider urgently needing service and sends a check for more than the agreed amount, then asks you to wire back the difference. The check is fraudulent and you are left liable for the full amount once it bounces. Similar versions target pet sitters, tutors, cleaners, and other service providers.

Google’s June 2026 scams advisory flagged fake calendar invites as an emerging attack vector. Scammers send invitations that automatically appear on your Google Calendar even from unknown senders. The invites look like security alerts, billing notices, subscription renewals, or event notifications. Because calendar invites arrive outside the email inbox, they bypass many phishing filters. Google confirmed attackers are also using “invisible pages” in cloud documents to host phishing instructions that evade standard web filters.

The NJCCIC continues to receive active reports in 2026 of SMS phishing targeting New Jersey residents. Texts impersonate the NJ Motor Vehicle Commission claiming unpaid traffic tickets with threatening language about license suspension and credit damage. Separate campaigns impersonate E-ZPass and NJ Courts. The NJCCIC identified over 20,000 second-level domains linked to these campaigns. The FTC reported $470 million in losses from text message scams in 2024, a fivefold increase since 2020.

The FTC warned in May 2026 that scammers are sending fake digital invitations by text as well as email, impersonating platforms like Evite and Paperless Post. To RSVP, it asks you to sign in with Google or Microsoft. Those login screens are fake and capture your credentials, giving attackers access to every account linked to that login.

In a widely reported case, a finance employee wired $25 million after joining a video call where every participant, including the CFO, was a deepfake. The FBI’s 2025 Internet Crime Report noted deepfake and voice cloning scams cost Americans nearly $900 million in 2025. Romance scams using AI-generated video profiles are surging in summer 2026, with Norton blocking 20 million dating scam attacks in Q1 2026 alone. The old “send me a selfie holding today’s newspaper” verification is no longer reliable.

A pop-up, email, or phone call claims your computer has a critical security problem and instructs you to call a number or grant remote access. Tech support scams surge 30% in summer months according to Norton’s 2026 research. Apple issued a specific warning in early 2026 about Apple Pay impersonation scams. The AARP notes a terror-based variation where scammers claim you are the subject of a criminal investigation and hold you “digitally captive” on video calls for hours or days, pressing for payment.

The FTC reported $3.5 billion in losses to imposter scams in 2025, with government impersonation the leading category for the ninth consecutive year. A resurgent version involves calls claiming you missed jury duty and threatening arrest unless you pay immediately by gift card or cryptocurrency. The FTC filed a complaint in April 2026 against operators impersonating the government and large insurance carriers to sell fake health insurance plans.

A phishing email with a fake invoice or security alert instructs you to call a phone number to resolve the issue. Phone numbers bypass email security filters. Once you call, attackers use social engineering to walk you through installing remote access software or revealing credentials. This method increased 500% in late 2025 and continues to grow in 2026.

The FTC issued a warning in late June 2026 specifically about pet scams targeting animal lovers. Scammers steal and manipulate real pet photos and videos, or use AI-generated deepfakes, to create convincing fake listings for puppies, kittens, and other animals. After you pay a deposit or purchase price, the animal never arrives and the seller disappears. Some demand additional fees for “shipping insurance” or “customs clearance” to extract further payments. These scams are particularly common on social media and classified ad sites.

The FTC issued a hurricane season warning on June 1, 2026 — the first day of hurricane season. Scammers follow weather emergencies wherever they strike, impersonating FEMA, the Red Cross, and local relief organizations to collect donations that never reach victims, or to target displaced residents with fake recovery assistance offers. Fraudulent contractors also appear after storms offering debris removal or home repairs, collecting deposits and disappearing. These scams are active even in regions where the storm did not hit directly.

The FIFA World Cup runs through July 19, 2026, with MetLife Stadium in East Rutherford, NJ hosting the final. Norton’s threat research found gambling scams surge 88% during summer and 338% in the U.S. specifically. Fraudulent ticketing websites, fake merchandise stores, counterfeit sportsbook apps with deepfake celebrity endorsements, and phishing campaigns using World Cup branding are all active. Hundreds of scam domains impersonating FIFA and venue websites were registered ahead of the tournament.