Cybercrime just got benched, Digital Defenders.

In today’s updates: more than half of employees fall victim to mobile phishing scams, an AI voice scam deepfakes Marco Rubio, and luxury cars face a critical Bluetooth RCE.

Here’s what you need to know:

Zero-Day Download

Confidence Cracked: Over Half of Employees Fall for Mobile Phishing, Study Finds

While 96% of security leaders say they’re confident in their employees’ ability to spot phishing attempts, a new Lookout study shows that 58% have still seen staff fall victim to mobile impersonation scams.

Based on responses from more than 700 security leaders worldwide, the report found that half of the respondents were concerned about mobile phishing attacks, particularly those impersonating company executives.

Despite 68% of leaders providing cybersecurity training in their organizations, Lookout suggests that a stronger emphasis should be given towards mobile endpoints to prevent social engineering attacks, either through SMS, voice calls, or messaging apps.

Security Teams: Update cybersecurity training programs to include hands-on simulations and scenarios involving mobile-based threats, specifically executive impersonation attacks.

Rubio Deepfake Hits Diplomats in Voice Scam Sting

An impersonator was found using AI voice-cloning technology to impersonate US Secretary of State Marco Rubio in an attempt to extract sensitive information from high-level officials

The perpetrator sent Signal messages and voicemails, mimicking Rubio’s tone and speech patterns. The targets included three foreign ministers, a US governor, and a member of Congress. The US State Department has confirmed the incident and initiated an internal review. 

IT Teams: Train employees on detecting AI-generator voice scams and apply zero-trust principles to ensure communications are verified and secure. Get started with this customizable Zero Trust Policy template.

Busted: Four Hackers Behind M&S, Harrods Cyberattacks Arrested

Four individuals allegedly involved in cyberattacks against UK retailers—including Marks & Spencer, Co-op, and Harrods—were arrested last Thursday.  

According to the UK’s National Crime Agency, they were apprehended under suspicion of Computer Misuse Act offenses, as well as money laundering, blackmail, and participating in the activities of an organized crime group. Damages from the attacks are believed to be around £270 million to £440 million. 

Let this be a reminder to bolster your ransomware defenses, audit third-party integrations, and prepare for social engineering tactics employed by malicious actors.

Share this newsletter!

Pulse Check

In your view, what’s the most serious cyber threat right now?

Yesterday's Pulse Check Results

Where do you put your trust for secure storage?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Hold the Aux: PerfektBlue Bluetooth Exploit Exposes Mercedes, Volkswagen Cars

Four vulnerabilities called PerfektBlue have been discovered in OpenSynergy’s Bluetooth SDK, potentially allowing remote code execution and unauthorized access to vehicles from manufacturers like Mercedes-Benz AG, Volkswagen, and Skoda.

Source: Unsplash / Haberdoedas

OpenSynergy confirmed and patched the vulnerabilities back in September 2024, but Bleeping Computer reports that many car manufacturers have yet to push out the firmware updates to their vehicles.

Check with your vehicle manufacturer for firmware updates and apply them as soon as they become available to reduce the risk of remote access.

LLMs Struggle in Vulnerability Discovery and Exploitation Tasks, Forescout Finds

Researchers from Forescout Research - Vedere Labs have found that AI models are still struggling to perform vulnerability research (VR) and exploit development (ED), showing consistently high failure rates.

In tests run across 50 AI models, 48% failed the first VR task and 55% failed the second. The performance was even worse on ED tasks, with 66% failing and 93% failing on the second try.

While LLMs are yet to become reliable tools for threat actors, security teams and analysts should track advancements closely and explore defensive applications of AI to stay ahead of future offensive breakthroughs.

Security Tip of the Day

Choose Your Browser Extensions Carefully

Browser extensions can add tons of useful features to your online experience—but they’ve also become a prime target for hackers. Malicious extensions can mimic legitimate tools, steal your data, or even exploit your computer.

Source: Unsplash / Growtika

Here’s how to stay safe from rogue browser extensions:

Avoid risky options and keep your browsing experience clean and safe. Check out this thorough Secure Browser Usage Policy template to learn more.

Meet Our Writer:

Luis Millares

Senior Staff Writer at TechnologyAdvice

Luis Millares is a seasoned tech writer with broad experience reviewing consumer gadgets and enterprise software, offering clear, reliable insights across the latest in technology. 

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.