Scammers are posing as help desk staff and job recruiters. Here are 9 simple ways to check who is asking before you act.
This week, new reports showed attackers pretending to be people you trust. They posed as help desk staff and job recruiters. The best defense is simple: check who is asking before you send money, codes, files or access.
Why this matters now
The FBI linked the theft of more than $6 billion in crypto from Binance to a North Korea-aligned group called TraderTraitor, The Hacker News reports. The sources give different totals. The Hacker News says $6.43 billion. Help Net Security's weekly review gives a slightly lower total. This group has a history of tricking people into downloading apps with malware. Malware is harmful software hidden inside something that looks normal.
In a separate report, Help Net Security notes that Cisco Talos documented attackers posing as IT help desk staff. Their goal was remote access. Remote access means control of your computer from far away.
Sophos also found that one ransomware group used AI agents to hunt for passwords inside victim networks, Help Net Security reports. Ransomware is software that locks files and demands payment. An AI agent is an AI tool that can take steps on its own.
The common thread is trust. The request looks normal, so people act. These tips help you pause and check.
Tips for your family
Tip 1: Set up a private way to check callers
Agree on a way to confirm a call is real. Do this before anyone sends money or information. One option is Trust Onion, a free app for macOS, iOS and Android. It shows a group three codewords that change every minute. To check a caller, ask them to say the words. Then compare them with your app. Both people need to join the group first. Keep your own phrase private.
Tip 2: Practice once with older relatives
A practice call can help an older person learn the steps, the review says. The app also has a section called Scam Pulse. It shows examples of reported voice-cloning scams. Voice cloning means copying a person's voice with software. Real examples can help someone spot warning signs.
Tip 3: Hang up and call back
If a call feels urgent, end it. Then call the person back on a number you already know. Trust Onion also lets users send a callback request to trusted contacts. They can add a short note if they want.
Tips for you
Tip 4: Slow down on surprise job offers
TraderTraitor uses front companies and job-themed messages. It targets people in cybersecurity, AI, blockchain, and talent recruiting. Reports say the group also uses AI to create fake personas. If a recruiter asks you to download a tool or run code as a test, stop. Check the company on your own first.
Tip 5: Update Microsoft Authenticator on Android
Researchers at Enclave found a flaw in this app. It let any app on an Android phone quietly take over a work account. The app needed no permissions. The user did not need to tap anything. If you use Microsoft Authenticator on Android, update it today.
Tip 6: Use only official channels for crypto updates
Binance said it resumed the first phase of withdrawals after pausing them. It said deposit services were not affected. If you use the service, check news inside the official app or website. Do not trust links in messages.
Tips for small businesses
Tip 7: Keep the basics strong and act fast
Sophos said existing controls still work. These include:
- Fixing devices that face the internet
- Using phishing-resistant multi-factor authentication
- Watching security alerts
Multi-factor authentication means a second check after your password. Phishing-resistant types are harder for fake websites to trick. Sophos added that a quick response is key.
Tip 8: Take passwords out of shared files
In the Sophos case, the AI agents searched network shares, documents and backups for passwords. Do not store passwords in shared folders or notes. Use a proper password tool instead. Also act fast when you hear your logins have leaked. Last school year, 808 of 6,116 K-12 member groups were told their staff logins were for sale online. Attackers used those logins to reach the next district.
Tips for travelers
Tip 9: Check location details before you share photos
Photos can include time and location information. Trust Onion's signed selfies, called Proofies, can include these details. Anyone with the link or QR code can view one. You can add a password or delete it. But copies others already saved stay with them. Before you share any photo on a trip, check what it shows about where you are.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist, The Hacker News, 2026-11-01
- Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability, Help Net Security, 2026-11-01
- Product showcase: Trust Onion uses rotating codewords to verify callers, Help Net Security, 2026-11-02
- Ransomware gang talked AI agents into doing much of its dirty work, Help Net Security, 2026-11-02
Tags
Frequently Asked Questions
Who did the FBI link to the Binance theft?
The FBI linked it to TraderTraitor, a North Korea-aligned hacking group. Reports give slightly different totals. The Hacker News says $6.43 billion.
How do fake job offers spread malware?
TraderTraitor uses job-themed messages and front companies to get people to run harmful code. It targets people in cybersecurity, AI, blockchain and recruiting.
Why should I update Microsoft Authenticator on Android?
Researchers at Enclave found a flaw that let any app on the phone take over a work account. It needed no permissions and no taps from the user.
How does the Trust Onion app check a caller?
It shows a group three codewords that change every minute. You ask the caller to say the words and compare them with your app. Both people must join the group first.
Do basic security steps still work against AI-assisted attacks?
Sophos said yes. Fixing internet-facing devices, phishing-resistant multi-factor authentication and watching security alerts still work. But a quick response matters.
Enjoyed this article?
Share it with your network
