The Church Card Con:

A citizen reported nearly falling victim to an impersonation email scam. The email appeared to come from their church’s pastor, but the sender’s name contained a subtle change: “Lucille” was spelled with one “L” instead of two. The message asked the reporter to purchase Target gift cards. Believing the request was related to a well-known church project helping immigrant families buy groceries and diapers, the reporter purchased the gift cards and was preparing to send them. But in the nick of time, a church-wide warning about the ongoing impersonation scam came through on email. The reporter contacted their Visa card provider, and because the transaction was still pending, the charge may be reversed. They still possess the gift cards, so thankfully no financial loss has occurred. The reporter noted that both they and their husband initially believed the email was legitimate, and another church member also fell for the scam. They expressed concern about how convincing such scams are and how AI could potentially make them even more convincing in the future. CyberWyoming Note: The reporter’s assumptions are correct. Scammers are increasingly using AI tools to craft more convincing messages by adding realistic details and tailoring emails to specific organizations or individuals, which makes them harder to detect. These scams often impersonate trusted authority figures such as supervisors or clergy members and rely on a person’s kindness, willingness to help, and trust to pressure them into acting quickly. Always verify unusual requests for gift cards, money, or urgent help by contacting the person directly using a trusted phone number or email.

Phony Apple Pay Approval:

A Laramie resident received a suspicious email from a Gmail account belonging to “Kajol Dash.” The email had a blank subject and message but included an attachment named “APPLE PAY..docx”. The attachment preview resembled an Apple approval notice asking the recipient to verify their identity. The recipient found it suspicious that an Apple Pay email would come from a Gmail (Google) address. CyberWyoming Note: Never open attachments or click links from unexpected emails, especially if they come from personal email addresses instead of official company domains. Always verify messages by contacting the company directly through official channels.

Gmail Impersonation Warning:

Let's say your name is Jane Smith and you have a domain called JaneSmithCo.com that you use for your business. Your email is Info@JaneSmithCo.com. You have clients, you are doing great business, you have trust built up and all is well. Now, imagine someone creates a Gmail Account called "JaneSmithCo@gmail.com" and impersonates you! This actually happened to a business owner in Western Wyoming. So, if your company's Gmail address isn't already taken, get it now. If it’s already taken, add a note in your email signature like: "All email correspondence will only come from JaneSmithCo.com. Similar email addresses are not valid."

FBI Warns Outdated Wi-Fi Routers Are Vulnerable:

The FBI is warning that older Wi-Fi routers, particularly models from the late 2000s and early 2010s that no longer receive updates, are highly vulnerable to cyberattacks. Without security patches, these end-of-life devices can be easily hijacked by hackers who exploit known flaws to install malware, gain control, and turn them into botnets or proxy servers. Many affected routers, including several Linksys models like the E1200, E2500, and WRT320N, have remote management features that make them especially easy targets. These attacks are hard to detect because the malware resides in the router itself, not on connected computers, meaning traditional antivirus software won’t catch it. Users with outdated routers are strongly advised to upgrade to more secure models.
– Brought to you by SlashGear
‍https://www.slashgear.com/2104404/wifi-routers-unsafe-fbi-warning/

Fake Zoom Update to Deploy Surveillance Malware:

A sophisticated scam tricked 1,437 Windows users in just 12 days by pretending to be a Zoom meeting. The fake page looked real, showing “participants” and even playing background chatter. It then showed a “Network Issue” message and a pop-up claiming a Zoom update was needed. If users clicked, a file downloaded—but instead of malware, it installed a legitimate employee-monitoring program called Teramind, secretly letting attackers watch everything on the computer. The software ran quietly in the background, disguised as normal system files, so antivirus programs often missed it. Experts say if you downloaded the file, don’t open it, check for suspicious folders or services, change your passwords from a safe device, and alert IT if it’s a work computer. This scam highlights a growing trend of cybercriminals weaponizing legitimate business tools rather than custom malware.
– Brought to you by Cyber Press
https://cyberpress.org/fake-zoom-update-malware/

Interested in cybersecurity business training?

The Made Safe™ Cybersecurity Training Program is a one-on-one program designed specifically for micro-businesses to reduce cyber risk and relieve anxiety around cybersecurity. Thanks to CyberWyoming’s members and sponsors, scholarships are available for Wyoming companies. Learn more at https://cyberwyoming.org/cyber-training/ or email info@cyberwyoming.org.

MS-ISAC and CISA Patch Now Alert:

The Multi-State Information Sharing and Analysis Center (MS-ISAC) or the Cybersecurity & Infrastructure Security Agency (CISA) has published a patch now (update your software) alert for Mozilla Firefox, Adobe products, and Microsoft products. If you use any of these products, make sure the software (or firmware) is updated.

Data Breaches in the News:

Adidas, PIH Health, Trizetto Provider Solutions, Banner Capital Bank, US Mortgage Corporation, and Ericsson US. Note: If you have an account with these companies, be sure to change your password and consider placing a credit freeze on your accounts through the three credit reporting agencies: TransUnion, Experian, and Equifax.

Please report scams you may experience to phishing@cyberwyoming.org to alert your friends and neighbors.

‍Other ways to report a scam:

• Better Business Bureau Scam Tracker: bbb.org/scamtracker/us/reportscam
• Wyoming Attorney General’s Office, Consumer Protection
  • Email ag.consumer@wyo.gov
  • Complaint form attorneygeneral.wyo.gov/law-office-division/consumer-protection-and-antitrust-unit/consumer-complaints

• File a complaint with the Federal Trade Commission at reportfraud.ftc.gov
• Get steps to help at www.IdentityTheft.gov
• Report your scam to the FBI at www.ic3.gov/complaint
• Reported unwanted calls to the Federal Trade Commission’s Do Not Call Registration. Online at donotcall.gov/report.html or call 1-888-382-1222, option 3
• Office of the Inspector General: oig.ssa.gov
• If you believe someone is using your Social Security number, contact the Social Security Administration’s (SSA) fraud hotline at 1-800-269-0271.
• AARP Fraud Watch Network (any age welcome) Helpline 877-908-3360
• IRS: report email scams impersonating the IRS to phishing@irs.gov
• Call the Wyoming Senior Medicare Patrol (SMP) for assistance with potential Medicare fraud, abuse, or errors at 1 800 856-4398
• Victim Support: The AARP Fraud Watch Network and Volunteers of America (VOA) created a new, free program to provide emotional support for people impacted by a scam or fraud, called ReST. Visit www.aarp.org/fraudsupport to learn more about the free program and register