01
16 October 2026 · 6 min read
Firefox 158 fixes sandbox flaws: update, restart and verify
Mozilla has fixed dozens of issues, including sandbox escapes and use-after-free flaws. Here is what people and organisations should do next.
Topic · 103 articles
Human Security
Phishing, scams, safer work and practical habits that help employees recognise pressure, verify requests and report threats quickly.
FIELD NOTES
TOPIC INDEX
Latest research
02
12 October 2026 · 5 min read
Fake Claude search ad: a Bing domain and a substituted command
Push Security describes an ad leading to a fake Claude installer for macOS. Respond to requests to paste a command and report what happened to your IT team.
03
9 October 2026 · 5 min read
Fake quotation requests: CERT Polska warns about XLS files delivering Remcos
Verify a new customer's quotation request before running an attachment. Establish a procedure for sales, procurement and IT, with a clear reporting route.
04
7 October 2026 · 5 min read
Firefox 157.0.1: CVE-2026-106016 and the workplace browser restart
Mozilla has fixed a mitigation bypass in file handling. Check the Firefox update channel, the version actually running and devices awaiting a restart.
05
6 October 2026 · 5 min read
MediaTek's October fixes: verify updates across work phones
MediaTek's bulletin covers 31 CVEs, including two critical modem flaws. Identify affected device variants and verify vendor updates across the organisation.
06
5 October 2026 · 5 min read
An OLX listing problem by SMS? Verify the request through a trusted route
CERT Orange warns about texts claiming that an OLX account needs verification. Use an independent check and a practical employee training scenario.
07
3 October 2026 · 5 min read
Buy a top-up and send a photo: the scam targeting drivers and couriers
CERT Orange warns about criminals obtaining top-up codes from drivers and couriers. Learn how to recognise the request and set clear rules for extra purchases.
08
2 October 2026 · 9 min read
A signed installer can still give attackers remote access: phishing deployed MSP360 and ScreenConnect
Microsoft described campaigns in which fake invitations and documents installed legitimate remote access tools. Here is what employees and organisations should do.
09
30 September 2026 · 8 min read
Poland's Cybersecurity Forum opens awareness month: how organisations can turn ideas into action
The eighth Cybersecurity Forum and European Cybersecurity Month begin on 30 September. Here is a practical plan for staff and management.
10
29 September 2026 · 10 min read
Malicious ads led Polish users to Google Play apps that charged their phone bills
CERT Polska linked 852 Meta ads to 17 Google Play apps in a toll-fraud operation. We explain the risk and actions for users and employers.
11
27 September 2026 · 10 min read
Attackers impersonated staff and spoofed Astrana Health's main phone number
Astrana Health deemed an incident material after a social-engineering campaign. We explain why caller ID is not identity verification.
12
27 September 2026 · 10 min read
Trust first, fake investment later: one victim allegedly lost $16 million
A new DOJ case shows how a crypto investment scam can develop over weeks or months. Learn the warning signs and what to do after sending money.
13
23 September 2026 · 14 min read
A domain or hosting renewal invoice arrived? Check who you are really paying
Fake renewal notices exploit fear of losing a website. This guide helps people verify the service without clicking a scam link or paying the wrong company.
14
23 September 2026 · 16 min read
An employee is leaving. Secure offboarding without chaos or burned bridges
An employee departure requires more than disabling email. This practical checklist transfers work, removes access and treats the person with respect.
15
23 September 2026 · 15 min read
A health-service text asks about a prescription, payment or appointment? Verify it outside the message
Fake medical messages exploit concern and urgency. Check a prescription or appointment through a known channel before sharing data or paying.
16
23 September 2026 · 14 min read
Hundreds of subscription emails arrived? A real transaction may be hiding in the noise
A newsletter flood can hide a purchase, password change or account takeover. Do not delete everything—first find the message someone wants you to miss.
17
22 September 2026 · 15 min read
A supplier changed the bank account on an invoice? Verify it before paying
A new bank account on a convincing invoice may be fraud. This practical verification process protects both the business and its supplier relationship.
18
22 September 2026 · 15 min read
A work laptop was left in a taxi, hotel or train. What to do in the first hour
A lost laptop does not have to become a data breach. Fast reporting, safe recovery and sound company decisions can contain the risk.
19
21 September 2026 · 13 min read
An email claims it recorded your webcam and shows an old password. Do not pay
Mass blackmail uses shame and panic, while an old password supplies credibility. Learn how to distinguish a broad bluff from a real account compromise and respond safely.
20
21 September 2026 · 14 min read
A loved one’s voice asks for money? End the call before you trust it
Panic, a familiar voice and instructions to keep the call secret can force a rushed payment. Use a simple family verification plan that also works against voice cloning.
21
21 September 2026 · 14 min read
Lost your wallet? Protect your cards, ID and identity in this order
A lost wallet is more than missing cash. This calm response plan covers payment cards, identity documents, workplace access and the weeks after the loss.
22
21 September 2026 · 13 min read
“Your streaming account is expiring.” Update payment only inside the app
A fake payment-failure email or text leads to a copied sign-in page. Learn how to check a subscription without surrendering your password and card details.
23
20 September 2026 · 15 min read
Perfect rental, but the deposit comes before the viewing? Verify the home first
A great listing, an owner abroad and a queue of applicants are designed to rush your payment. Learn how to check the property, landlord and agreement before paying.
24
20 September 2026 · 15 min read
“Hi, is this Anna?” A wrong-number text can begin a long confidence scam
The conversation begins as a harmless mistake and ends weeks later with an investment pitch. Learn when a friendly stranger is building trust to steal money.
25
19 September 2026 · 14 min read
Someone says they found your missing pet? Ask for proof before you pay or share a code
A scammer can exploit your missing-pet post, photos and fear to demand a code or urgent payment. Learn how to verify a finder without putting your pet at risk.
26
19 September 2026 · 13 min read
One-ring missed call from abroad? Do not call back on impulse
A missed call may be designed to trigger an expensive callback. Learn how Wangiri works, how to verify the caller safely and what to do after a charge.
27
19 September 2026 · 14 min read
A message says your power will be disconnected tomorrow? Check the bill outside the message
A tiny balance and same-day shutoff threat are designed to trigger a fast click. Learn how to verify the account and pay a real bill safely.
28
18 September 2026 · 14 min read
Received a payment ‘by mistake’? Do not return it to a different account
An unexpected credit and an urgent refund request can pull you into someone else’s fraud. Learn how to preserve the money and use the provider’s safe return process.
29
18 September 2026 · 14 min read
HR received a payroll account change request. How do you verify the employee?
A routine payroll request can redirect a salary to a scammer. Learn how to verify account changes safely and respond if the payment has already gone out.
30
17 September 2026 · 13 min read
A debt collection demand you do not recognize? Verify before you pay
A logo, reference number and your personal details do not prove a debt is genuine. Verify the debt, sender and payment route separately before clicking or paying.
31
16 September 2026 · 12 min read
Clicked a phishing link and entered your details? A first-hour response plan
Opening a page, entering a password, sharing card details and installing software require different responses. This plan helps you prioritize without panic.
32
16 September 2026 · 12 min read
A remote job asks you to buy equipment from an ‘approved vendor’? Stop the payment
A fake employer may hold an interview, send a contract and promise money for a laptop. The real risk begins when the candidate must pay an unknown seller.
33
15 September 2026 · 7 min read
An antivirus renewal invoice? Do not call the number provided to cancel it
A message claims you are about to pay a large fee for software you do not remember buying. Check the real account before asking a scammer for a refund.
34
15 September 2026 · 8 min read
An “official” email knows your case number. That is not enough reason to pay
Criminals can use public details about an application, property or business and add a fraudulent fee. Confirm the payment outside the message you received.
35
15 September 2026 · 7 min read
Posted a complaint on social media? Fake customer support may reply first
A public comment reveals that you are waiting for help. Before moving into direct messages, verify the profile and start contact through the company’s official channel.
36
14 September 2026 · 8 min read
Added to an “investment group”? Other members’ profits may be part of the script
Free lessons, a mentor and profit screenshots are designed to build trust. Learn why an unknown WhatsApp or Telegram group is not an investment reference.
37
14 September 2026 · 8 min read
A Microsoft alert shows a phone number? Do not call support from a pop-up
A loud warning says your computer or account is at risk and tells you to call immediately. Here is a simple way out of the fake emergency.
38
14 September 2026 · 7 min read
“Could you vote for my child?” A small favour can give away your WhatsApp account
A message from someone you know leads to a vote, then asks for a code or QR scan. Learn where to stop and how to secure your account after a mistake.
39
12 September 2026 · 9 min read
An extension wants to “read and change data on all websites.” What are you approving?
A free coupon finder, translator or PDF tool may gain broad browser access. Learn what permission warnings mean and how to restrict access to a click.
40
12 September 2026 · 9 min read
“A courier will collect your deactivated card.” How scammers build a credible story
A fake bank, a document carrying a police logo and a courier collecting your card can be one scam. Here is how to break the pressure and keep control.
41
12 September 2026 · 10 min read
An intimate image or deepfake was shared without consent. What to do next
You do not have to handle this alone. Learn how to preserve evidence, report the content and use StopNCII or Take It Down without sending the image.
42
11 September 2026 · 8 min read
Children can be victims of identity theft too. Warning signs parents can spot
A child's national ID number and personal data can be misused for years before a family notices. Here is how to reduce the risk and respond in Poland.
43
11 September 2026 · 7 min read
Want to help after a disaster? Check the fundraiser before emotion decides
Appeals for help appear quickly after a disaster, and fake fundraisers follow. A few calm checks can make sure your donation reaches people in need.
44
10 September 2026 · 8 min read
Flood, outage or evacuation: make a digital plan before the emergency
Home photographs, document copies and important contacts only help when you can find them safely. Prepare a small, practical plan in advance.
45
10 September 2026 · 7 min read
The QR code on a parking meter may be somebody else's sticker
A parking meter may direct you to an app or payment page through a QR code. Check that nobody has covered the genuine instructions before you pay.
46
10 September 2026 · 7 min read
A social media advert does not mean the platform verified the shop
A polished advert and familiar logo can lead to an unrelated seller. Before buying from a reel or post, find the shop independently.
47
10 September 2026 · 7 min read
Spotted a scam? Report it and tell one person
A report can matter even when nobody lost money. Preserve the useful details, warn someone you know and avoid forwarding the live trap.
48
9 September 2026 · 8 min read
The dealership website looks real. The car and seller may not be
A cloned site can carry a genuine dealer's logo, vehicle photographs and glowing reviews. Check these details before sending a car deposit.
49
9 September 2026 · 7 min read
The first search result may not be the company you meant to pay
You want to settle a bill quickly, so you click the first result. Check who will receive the money before approving a transfer or entering card details.
50
9 September 2026 · 7 min read
A meeting appeared in your calendar by itself. Don't follow the link
An unfamiliar invitation can imitate an urgent message from a bank, courier or IT team. Learn how to check and remove it without following the trap.
51
8 September 2026 · 7 min read
The first-day-of-school photo: before the backpack and sign reach the whole internet
A back-to-school photograph can reveal a child's school, class and daily route. Keep the memory without taking away their privacy.
52
8 September 2026 · 8 min read
Café Wi-Fi does not have to be a trap. Check the network name first
Two similar network names, a quick bank transfer and a laptop left at the table. Use hotel, train and café internet with better judgement.
53
8 September 2026 · 8 min read
A recruiter wants your ID before the interview. This is a good moment to pause
A company logo and HR form are not enough reason to send identity documents or bank details. Verify the vacancy, recruiter and stage of the process.
54
8 September 2026 · 7 min read
RugOne Xsnap 7 Pro: the phone with an action camera you can pull out
RugOne has hidden a detachable action camera inside a rugged smartphone. It is not a GoPro, but it is one of IFA 2026's more interesting ideas.
55
8 September 2026 · 7 min read
A parcel you never ordered has arrived. Its QR code will not solve the mystery
An unexpected parcel may be a mistake or an attempt to support a fake review. Do not scan the enclosed QR code to identify its sender.
56
7 September 2026 · 7 min read
Share your holiday without telling the whole internet where you are
You do not have to disappear from social media. A few simple choices let you share a trip without unnecessarily revealing your location, schedule and other people's details.
57
7 September 2026 · 8 min read
Selling an old phone or laptop? Signing out is only the beginning
An old device remembers more than your photos. Learn how to prepare a phone or laptop for sale without handing your accounts and data to its next owner.
58
7 September 2026 · 7 min read
Someone shared a document you were not expecting. You do not have to open it
An invoice, HR file or urgent review invitation can look like a routine cloud notification. Learn how to check it without clicking blindly.
59
6 September 2026 · 7 min read
Your ‘boss’ wants gift cards. This favour should wait
A quick message, an urgent request and photos of scratched-off codes: learn how the boss gift-card scam works and how to verify the request safely.
60
6 September 2026 · 8 min read
You emailed the wrong person. What to do before panic takes over
A wrong recipient does not have to become a major incident. The first few minutes matter: contain the mistake, report it quickly and assess the risk honestly.
61
6 September 2026 · 8 min read
The hotel knows your booking and wants another payment. Is the message genuine?
Your name, stay dates and hotel may all be correct while an urgent payment request is still fraudulent. Verify the booking without using the supplied link.
62
5 September 2026 · 7 min read
A sold-out concert ticket from social media: a screenshot proves nothing
The seller replies in minutes, shows a receipt and wants a bank transfer. Here is a safer way to approach second-hand event tickets.
63
5 September 2026 · 8 min read
The flat looks perfect, but the landlord wants a deposit before the viewing
A tempting price, pressure from other applicants and a reservation transfer can signal a fake rental listing. Verify the property, person and agreement before paying.
64
5 September 2026 · 7 min read
You found a USB drive at work. Curiosity can wait
An unknown USB drive may belong to a colleague, but plugging it into a computer is not a safe way to identify its owner. Here is what to do instead.
65
4 September 2026 · 8 min read
What happens to your online accounts after you die? A plan that does not share passwords
Photos, documents, domains and subscriptions do not organise themselves. A simple digital-legacy plan can help loved ones without leaving a master password on paper.
66
4 September 2026 · 8 min read
Lost or stolen phone: what to do in the first 30 minutes
A phone is the key to email, banking and everyday services. Here is a calm order of action after losing it, without jumping between random guides.
67
4 September 2026 · 8 min read
Lost money to a scam? Beware the stranger who promises to recover it
After the first fraud, a fake law firm, authority or recovery expert may appear. Here is how to avoid paying the scammers a second time.
68
3 September 2026 · 7 min read
Not sure whether a message is a scam? CERT Polska has launched a new knowledge base
The new wiedza.cert.pl portal offers practical guidance for individuals and organisations. Here is when to use it—and when to report an incident immediately.
69
3 September 2026 · 8 min read
“Receive the money and keep a cut”: how people are recruited as money mules
An easy job, quick commission and a request to move money through a personal account can be recruitment into laundering criminal proceeds.
70
3 September 2026 · 8 min read
Online games: how to talk to a child without turning it into an interrogation
Europol’s new guide for parents puts conversation before surveillance. The goal is to make sure a child still feels able to ask for help when something goes wrong.
71
2 September 2026 · 8 min read
“A few clicks, great daily pay”: the fake job that asks you to deposit money
The offer arrives on WhatsApp, the tasks are effortless and the balance keeps growing. Learn how a task scam turns apparent earnings into a real loss.
72
2 September 2026 · 7 min read
“Hi Mum, this is my new number”: the three-minute check that can stop a scam
A message from an apparent child soon turns into a request for money. Use a simple family verification routine that still works under pressure.
73
2 September 2026 · 8 min read
“Install AnyDesk and I’ll help”: when remote support takes over your money
A call from a bank or support desk ends with a request for remote access. Learn when to end the call and what to do after sharing your screen.
74
2 September 2026 · 9 min read
A relationship first, an investment later: spotting romance scams without blame
A criminal may build closeness for weeks before revealing an apparent opportunity. Learn the manipulation signs and a response that does not start with shame.
75
2 September 2026 · 8 min read
A calmer back-to-school login: keeping school portals safe in 2026
School messages, parent groups, urgent payments and new login links. A simple family plan that improves safety without turning home into an IT department.
76
3 August 2026 · 9 min read
Fake Roblox Xeno Executor installs a RAT and infostealer
A campaign impersonates the popular Roblox scripting tool. We analyse the Java chain, theft scope and practical signals for users and SOC teams.
77
30 July 2026 · 16 min read
Online child abuse: grooming, sextortion and deepfakes
A new Polish guide addresses grooming, sextortion and AI-generated abuse. We add a technical model for account protection, evidence and response.
78
29 July 2026 · 15 min read
Cloned company sites stole B2B advance payments
A campaign cloned Russian corporate websites to steal B2B advance payments. Learn its tradecraft, warning signs and payment controls.
79
22 July 2026 · 12 min read
Free SOC Analyst Course: 32-Module Path
Explore a free SOC analyst course with 32 modules, 316 lessons, quizzes, and worked analysis from triage and SIEM to OT, AI, and crisis response.
80
10 July 2026 · 8 min read
Ghostwriter Gmail and 2FA phishing targets Poland
CERT Polska reports an intense UNC1151/Ghostwriter Gmail campaign. Fake security alerts steal passwords and real-time 2FA codes from Polish users.
81
10 July 2026 · 9 min read
OpenAI Privacy Filter: PII masking does not equal GDPR
OpenAI's local model detects and masks PII, but it does not guarantee anonymisation or GDPR compliance. Build a safer pipeline for European data.
82
10 July 2026 · 8 min read
Signal backup recovery key phishing: FBI warning
FBI and CISA warn that Russian-linked actors are phishing Signal backup recovery keys. Learn how the attack works and how to respond safely.
83
22 June 2026 · 9 min read
Deepfakes in fake investment ads: how the scam works
Fake ads featuring well-known people are flooding social media. We explain how deepfake investment fraud works and how to recognise it.
84
20 June 2026 · 10 min read
Help-desk vishing: the call that breaches a company
Groups like Scattered Spider call the IT help desk to reset MFA and breach the company. How the 2026 attacks work and how to verify identity.
85
20 June 2026 · 5 min read
Quishing: phishing hidden in QR codes
A QR code slips past email filters and leads to a fake page straight from your phone. We explain how quishing works and how to defend against it.
86
19 June 2026 · 9 min read
SIM swapping: how criminals hijack your number
A SIM swap lets criminals take over your phone number — and with it your texts, codes and accounts. How it works, how to spot it and how to protect yourself.
87
18 June 2026 · 6 min read
Fake KSeF and gov.pl notifications target businesses
Criminals impersonate KSeF, e-government and gov.pl domains to target company finance teams. What this phishing looks like and how to secure it.
88
15 June 2026 · 6 min read
Fake mObywatel fine: how one SMS can drain your account
A campaign impersonating mObywatel uses sender spoofing and a fake 200 PLN fine. We explain why it looks so convincing and how not to fall for it.
89
14 June 2026 · 6 min read
Business Email Compromise: the costliest scam
BEC is one of the most expensive scams for companies. We explain how invoice fraud and the 'urgent CEO transfer' work — and how to stop them.
90
5 June 2026 · 6 min read
BLIK SMS spoofing: how one link hijacks your banking
An intensive campaign impersonates BLIK using SMS spoofing and fake login panels. We show how criminals take over online banking and how to break the chain.
91
1 June 2026 · 6 min read
'Your bank is calling' — vishing and caller-ID spoofing
A call from the bank's number, a calm 'consultant' and a supposed break-in on your account. We break down the fake-bank-employee scam and how to stop it.
92
28 May 2026 · 11 min read
Phishing in 2026: why training alone isn't enough
Phishing still accounts for most successful breaches. We explain why employee education alone isn't enough and what to add to your defences.
93
28 May 2026 · 9 min read
Safe online shopping: how not to lose money
Fake shops, spoofed payments and intercepted cards. A practical guide to spotting a fraudulent store and paying safely online.
94
20 May 2026 · 9 min read
The 'pay a small fee' parcel smishing, explained
A fake parcel-fee text leads to card or banking phishing. Learn how to inspect the domain, authorisation prompt and incident response.
95
14 May 2026 · 10 min read
Smartphone security: 12 settings worth changing
Your phone knows more about you than your computer. Twelve practical settings and habits that genuinely protect your data, accounts and privacy.
96
12 May 2026 · 11 min read
Secure remote work: a standard, not an exception
Remote work is here to stay — and with it company data on home networks and private hardware. A practical standard: devices, access, Wi-Fi.
97
10 May 2026 · 9 min read
OLX and Vinted: fake payment gateways, explained
Impersonations of OLX and Vinted are among the most reported scams in Poland. We explain the 'safe payment' mechanism that actually robs the seller.
98
7 May 2026 · 9 min read
VPN: myths and facts. Does it really protect you?
Ads promise a VPN gives anonymity and total security. We explain what a VPN really does, what it doesn't protect against and when it's worth using.
99
30 April 2026 · 9 min read
Scams targeting seniors: how to protect loved ones
Seniors are fraudsters' most common target: fake grandchild, police or bank staff. Learn the schemes and how to protect parents and grandparents.
100
28 April 2026 · 9 min read
'Send me a BLIK code': Facebook account takeovers
A hacked friend's account asks for a BLIK code or a scan of your ID. We explain how account takeovers happen and why the chain of trust is the weakest link.
101
9 April 2026 · 10 min read
Children's online safety: a guide for parents
How to protect your child online without surveillance and bans? A practical guide to the risks, parental control settings and the conversation that works.
102
2 April 2026 · 10 min read
SPF, DKIM and DMARC: how to secure your company email
Without SPF, DKIM and DMARC anyone can send emails impersonating your domain. We explain these three mechanisms simply and show how to deploy them.
103
6 January 2026 · 11 min read
Microsoft 365 phishing from your own domain: complex routing explained
Microsoft documented internal-looking phishing enabled by complex mail routing and weak spoof protection. A technical analysis of headers, DMARC and connectors.
BR / NEXT STEP
Want to prepare your team for these threats?
We turn current threats into role-based training, safe exercises and a clear reporting path. The free Academy remains available for self-directed learning.
NDA · clear scope · direct communication