www.wyocan.org
www.cyberwyoming.org/alliance
307-223-1265, PO Box 2332, Laramie, WY 82073
Former Boss’s Fake Google Invite:
A Laramie resident reported receiving a scam email appearing to come from their former boss, suggesting that the boss’s account may have been compromised. The email, titled “Re: Document to sign,” mimicked a Google Docs document invitation, complete with the boss’s name and email, Google branding, and a link labeled “View New DocuSign.” However, the links did not lead to Google but to a suspicious csjmu-result redirect domain, making the email a very convincing phishing attempt. CyberWyoming Note: Even if the email appears to come from a trusted person, always verify the sender’s address and hover over links to ensure they lead to legitimate domains, and if you are suspicious, confirm via an outside channel such as a phone call or another trusted email before clicking.
Zoho Invoice Impostor:
A Wyoming resident received a phishing email from "Secure Account Dept" using a “sender.zohoinvoice” domain, with the subject “Your Order Processing.” The email impersonated Zoho, a business cloud software company and included a fake invoice claiming a $445.90 autopay payment had been processed. It urged the recipient to call a number if the payment was unauthorized, however it was not the correct customer service number for Zoho and does not appear to be accosted with the real company. The email mimicked legitimate Zoho branding and included links to Zoho’s invoice site. CyberWyoming Note: Never click links or call phone numbers in unexpected emails like this. Always contact the company directly through official channels to verify any payment or invoice.
Hackers Registered 18,000 Holiday-Themed Domains:
During the 2025 holiday season, cybercriminals have launched an extensive wave of attacks targeting online shoppers and retailers, registering over 18,000 holiday-themed domains featuring keywords like “Christmas,” “Black Friday,” and “Flash Sale.” These domains are used to create look-alike websites for phishing, gift card scams, and payment harvesting, often exploiting SEO to appear alongside legitimate search results. Security analysts report over 1.57 million stolen login credentials circulating in underground markets, enabling account takeovers. The attacks also exploit critical e-commerce vulnerabilities allowing remote code execution, administrative access, and web skimmer installation, highlighting an urgent need for merchants to patch systems and strengthen defenses. CyberWyoming Note: Customers can stay safe by using strong, unique passwords, enabling multi-factor authentication, carefully checking URLs, avoiding suspicious links, and keeping devices and software up to date.
– Brought to you by Cyber Security News
cybersecuritynews.com/hackers-registered-18000-holiday-themed-domains/
Weak Passwords Persist in 2025:
A 2025 report from NordPass reveals that “admin” is the most common password in the U.S., highlighting widespread reliance on weak, easily guessed logins. Common choices include simple words like “password,” number sequences, and predictable patterns, which put accounts at high risk of breach. The trend spans generations: younger users favor long number strings, older users use names, but both approaches are insecure. Globally, similar patterns persist, though more passwords now include special characters. Experts recommend creating long passwords or short passphrases of at least 20 characters that mix letters, numbers, and special characters, avoiding password reuse, using password managers, enabling multi-factor authentication, keeping software updated, and considering data removal services to reduce exposure to breaches.
– Brought to you by Fox News
foxnews.com/tech/americas-most-used-password-2025-revealed
The Threat of AI in Recruitment and Employment Scams:
AI deepfakes are increasingly disrupting talent acquisition by creating convincing fake candidate profiles that slow hiring processes and pose security risks. With AI making deepfakes harder to detect, hiring managers, especially in tech and cybersecurity, face an overwhelming number of fraudulent applications. Gartner predicts that by 2028, one in four candidate profiles may be fake, and creating deepfakes requires minimal time or expertise. Companies are adopting stricter screening measures such as in-person interviews, on-camera verification, careful review of resumes and cover letters, and asking unique follow-up questions to distinguish genuine candidates from AI-generated ones. On the flip side, job seekers are also at risk, as AI makes scams more convincing. Fraudulent recruiters can create highly professional fake offers, often impersonating legitimate companies, and target vulnerable candidates with schemes that may involve requests for money or personal information. Reports of job scams have tripled since 2020, resulting in hundreds of millions in losses, showing the need for vigilance, verification of recruiters, and caution with unsolicited job offers. For more information, see the FTC’s guidance on avoiding job scams:
consumer.ftc.gov/consumer-alerts/2025/06/how-avoid-work-home-job-scams
– Brought to you by Express Employment & KOLD News
expresspros.blog/leadership/how-ai-deepfakes-are-disrupting-talent-acquisition/
kold.com/2025/10/23/job-scams-rise-with-ai-making-fake-offers-more-convincing/
MS-ISAC and CISA Patch Now Alert:
The Multi-State Information Sharing and Analysis Center (MS-ISAC) or the Cybersecurity & Infrastructure Security Agency (CISA) has published a patch now (update your software) alert for React Server Components, Microsoft products, Mozilla products, and Adobe products. If you use these products, make sure the software is updated.
Data Breaches in the News:
Marquis, Freedom Mobile, Petco, Tri-Century Eye Care, and Prosper Marketplace. Note: If you have an account with these companies, be sure to change your password and consider placing a credit freeze on your accounts through the three credit reporting agencies: TransUnion, Experian, and Equifax.
Please report scams you may experience to phishing@cyberwyoming.org to alert your friends and neighbors.
Other ways to report a scam:
- Better Business Bureau Scam Tracker: bbb.org/scamtracker/us/reportscam
- Wyoming Attorney General’s Office, Consumer Protection
- File a complaint with the Federal Trade Commission at reportfraud.ftc.gov
- Get steps to help at www.IdentityTheft.gov
- Report your scam to the FBI at www.ic3.gov/complaint
- Reported unwanted calls to the Federal Trade Commission’s Do Not Call Registration. Online at donotcall.gov/report.html or call 1-888-382-1222, option 3
- Office of the Inspector General: oig.ssa.gov
- If you believe someone is using your Social Security number, contact the Social Security Administration’s (SSA) fraud hotline at 1-800-269-0271.
- AARP Fraud Watch Network (any age welcome) Helpline 877-908-3360
- IRS: report email scams impersonating the IRS to phishing@irs.gov
- Call the Wyoming Senior Medicare Patrol (SMP) for assistance with potential Medicare fraud, abuse, or errors at 1 800 856-4398
- Victim Support: The AARP Fraud Watch Network and Volunteers of America (VOA) created a new, free program to provide emotional support for people impacted by a scam or fraud, called ReST. Visit www.aarp.org/fraudsupport to learn more about the free program and register
.jpg)
