Polish Police Report 20-Year-Old Scammed into Taking 563,000 PLN in Loans and Transferring Funds to Criminals via Bitomats

Internet Week 2026 Session Examines Shifting Phishing Tactics and Multi-Stakeholder Defenses

Internet Week 2026 will host a dedicated session on current phishing trends and countermeasures on November 27. The program, organized by the Phishing Countermeasures Council under JPCERT/CC, highlights how attacks have not decreased but have changed form after the January 2026 deactivation of overseas residential proxies. Speakers will cover real-world cases including support scams that display warning screens, lures to install malicious apps, and follow-on attacks that abuse stolen credentials. The session stresses that individual organizations cannot handle comprehensive defense alone and calls for coordinated information sharing between analysis bodies and law enforcement. NEC representative Kensuke Yumiya will address IT asset management practices that help prevent phishing-related incidents. The National Police Agency will present ongoing police operations and results against internet-enabled crime. The event is open to all attendees without prerequisite knowledge and aligns with the overall conference theme of surviving the AI era, where AI tools can both be deceived and used to deceive victims.

Security Researcher Earns Second Place in Hackfest Quebec Social Engineering CTF Using Custom Tools

A journalist competed for the seventh time in the Social Engineering CTF at Hackfest de Québec, finishing second among twenty participants. The event required building an OSINT report on 28 companies including Decathlon, Ikea, Air Canada and Home Depot, followed by timed phone calls to extract information from real employees. The competitor developed five custom tools including an intelligent directory, a sound ambiance synthesizer and a private AI for handling objections during calls. Preparation involved a full week of open-source research yielding 95 percent of answers before any calls, with the remaining score determined by 30-minute phone sessions. In the final round the journalist adopted the persona of a union representative conducting a salary survey, drawing on local Quebec media coverage to build credible context. The performance resulted in 39 direct answers from employees out of 67 objectives and reinforced the lesson that tools alone cannot replace human understanding in social engineering scenarios.

Russian Li Auto Owners Lose Master Accounts to Thieves Demanding Up to 45,000 Rubles

Russian owners of Li Auto vehicles are experiencing a wave of master-account thefts that disrupt vehicle functions including infotainment screens, climate control, and in some cases engine start. Attackers then contact victims and offer to restore access for payments ranging from 35,000 to 45,000 rubles. The master account is tied to the official mobile application used for remote vehicle management. Approximately twenty confirmed cases have been reported so far, though the actual number may be higher. The exact infection vector remains unknown, and even owners who previously used the paid eSender service to retain Chinese phone numbers are now affected. Li Auto and its Russian distributor Sinomach Auto are developing both protective measures and an account-recovery procedure that will eventually support email-based binding instead of Chinese phone numbers.