Critical severity vulnerabilities CVE-2025-5777 and CVE-2025-6543 were identified in Citrix NetScaler ADC and NetScaler Gateway. CVE-2025-5777 could allow unauthorized attackers to steal valid session tokens from the memory of internet-facing NetScaler devices via malformed requests.
The NJCCIC’s email security solution observed a new phishing campaign targeting Intuit login credentials. In this campaign, threat actors send an email impersonating accounting software Intuit QuickBooks. While the spoofed email address may appear to come from Intuit at first glance...
Over the last week, the NJCCIC has received several incident reports from NJ residents regarding an SMS text phishing (SMiShing) scam impersonating the Department of Motor Vehicles (DMV). These messages claim that the user has an outstanding traffic ticket.
The NJCCIC continues to receive reports of scams targeting and impersonating business executives using social engineering tactics. Threat actors perform reconnaissance on organizations to target and impersonate business executives, including chief executive officers.
The NJCCIC recently reported on malicious QR codes used in multiple quishing campaigns impersonating human resources or information technology. The NJCCIC’s email security solution observed a similar quishing campaign attempting to deliver malicious QR codes.
The NJCCIC observed several compromised government email accounts sending phishing emails to the user’s contacts, attempting to compromise additional accounts. Using legitimate accounts increases the likelihood of successful attacks as these messages come from...
The NJCCIC observed an uptick in employment scams that target and exploit individuals seeking employment. Threat actors first perform reconnaissance on their targets, gathering information from various sources, such as past data breaches, publicly disclosed data...
Microsoft Exchange Server 2016 and 2019 will reach end-of-life status on October 14. While these systems will continue to run, they will no longer receive security patches or bug fixes. Additionally, extended support and Extended Security Updates will not be offered.
The NJCCIC received reports of Social Security Administration (SSA) phishing emails, consistent with the SSA’s scam alert earlier this month. The emails contain SSA branding to appear legitimate and claim to be from the SSA. However, upon further inspection, they were sent from...
In direct deposit or payroll diversion scams, threat actors research the targeted organization and identify an employee to impersonate. They typically register a free email address using the employee’s name and utilizing display name spoofing in the messages.
