Stay Sharp: Your Phishing and Smishing Survival Kit Body
Cybercriminals are getting smarter but so can you. The National Computer Incident Response Team of The Bahamas (CIRT‑BS) has launched the Phishing and Smishing Survival Kit to help you spot
CIRT‑BS Advisory: Beware of Fraudulent NIB Smart Card Renewal Text Scam
CIRT‑BS warns the public about fraudulent messages impersonating the National Insurance Board (NIB). These scams aim to deceive recipients into clicking unsafe links or sharing personal information under the guise
Smishing vs Phishing: Understanding the Dual Threat
Cyber‑criminals continue to evolve their tactics, targeting both mobile and desktop users. Smishing uses SMS or messaging apps to lure victims into clicking fraudulent links or sharing sensitive data. Phishing
Advisory: Fake Traffic Fine Payment Scam
The National Computer Incident Response Team of The Bahamas (CIRT-BS) is aware of fraudulent websites impersonating legitimate government services and attempting to collect fake traffic fine payments. These scams use
Bahamas Election Security Awareness 2026
Daily Election Checklist: Stay Informed. Stay Secure. Verifying information is everyone’s responsibility: Follow updates from official government channels and the Parliamentary Registration Department Rely on verified Bahamian news outlets for
Child Online Protection Webinar: A Conversation That Matters
On May 20, 2026, the National Computer Incident Response Team of The Bahamas (CIRT‑BS) will host the Child Online Protection Webinar, uniting international experts to explore how we can build
New Advisory: (Critical) Authentication Bypass Vulnerability (FortiOS, FortiProxy, and FortiSwitch Manager)
ⓘ This advisory addresses a critical vulnerability impacting FortiOS, FortiProxy, and FortiSwitchManager platforms. Attention constituent: CVE-2022-40684 is a critical authentication bypass vulnerability impacting Fortinet’s FortiOS, FortiProxy, and FortiSwitchManager platforms. This flaw enables attackers to gain unauthorised administrative access, potentially leading to system compromise, data theft, and operational disruption. A leaked list of 15,000 vulnerable IP addresses has heightened the risk of exploitation. Immediate action is
New Advisory: (Critical) FortiOS Vulnerability
ⓘ This advisory addresses a critical vulnerability impacting FortiOS systems (CVE-2024-55591). Attention constituent: A critical vulnerability (CVE-2024-55591) has been identified in Fortinet’s FortiOS systems. This vulnerability stems from an authentication bypass flaw in the FortiOS web management interface. Exploitation of this vulnerability allows remote, unauthenticated attackers to gain unauthorised administrative access and execute arbitrary actions on affected systems. CVE: CVE-2024-55591 Severity: Critical (CVSS: 9.8) Affected Platforms: FortiOS systems
WhatsApp Account Hijacking Scams Advisory
ⓘ This advisory addresses an increase in compromised WhatsApp accounts. Attention constituent: CIRT-BS is advising members of the public to stay alert as a sophisticated scam targeting WhatsApp users is on the rise. Cybercriminals are hacking accounts and deceiving users’ friends and family into sending money by posing as trusted contacts. How the Scam Works Scammers make contact, sometimes with a WhatsApp call, and use fake
CrowdStrike Update (Phishing Attempts)
ⓘ This advisory addresses new phishing attempts related to CrowdStrike’s Falcon sensor crash. Attention Constituents: Since CrowdStrike deployed its international Falcon sensor fix last Friday, 19 July 2024, Crowd Strike Intelligence has identified that threat actors are leveraging this event for malicious purposes such as: Distributing a malicious zip file named “crowdstirke-hotfix.zip”; Establishing fraudulent domains to mimic CrowdStrike; Sending phishing emails posing as CrowdStrike support
New Advisory: CrowdStrike Update Crashes Windows Systems Worldwide
ⓘ This advisory addresses a recent update to CrowdStrike’s Falcon sensor which has led to widespread Blue Screen of Death errors. Attention Microsoft service users: A recent update to CrowdStrike’s Falcon sensor has led to widespread Blue Screen of Death (BSOD) errors on Windows hosts, resulting in disruptions locally to several services, including payment processing, and global disruptions. CrowdStrike has deployed a fix for this
“Free Money” WhatsApp Scam
ⓘ This advisory addresses an uptick in “free money” scams on WhatsApp. Attention constituent: CIRT-BS is observing an uptick in “free money” scams on WhatsApp involving threat actors impersonating the “Ministry of Labour and [Public Service]” and offering mobile device “top-ups” to solicit personally identifiable information like internet protocol (IP) addresses and telephone numbers from members of the general public. In the attacks, actors are
Parcel Delivery Scams
ⓘ This advisory addresses an uptick in parcel delivery scams. Attention constituent: CIRT-BS is observing an uptick in parcel delivery scams involving threat actors impersonating Bahamas Postal Services’ (BPS) website to solicit payment and personally identifiable information from members of the general public. Actors are sending SMS messages from the telephone number “+0123456789” advising recipients that their “delivery” is on hold and requesting they visit
Consumer Loan Scams
Attention Constituent: We would like to inform you about a series of consumer loan scams originating from actors posing as third-party representatives of financial institutions, including Central Bank of The Bahamas and Bank of The Bahamas Limited. Sources: https://www.centralbankbahamas.com/ and https://www.facebook.com/BOBBankofSolutions/ CIRT-BS reminds you that scammers often attempt to draw on your emotions by creating a sense of urgency and appearing to be trustworthy. Remember to do
Build Better Passwords for Online Security this “Change Your Password Day”
What do your bank, social media, and email accounts share? A password! Passwords are one of the most critical lines of defence against cyber attacks. They help ensure our data is only accessed by authorised users, even in the event of device theft or loss. Many people choose passwords found in the dictionary and reuse them across multiple accounts, meaning that once a cybercriminal has
Cybersecurity Awareness Month: Enable MFA; Disable the Hackers
Last week, we kicked off Cybersecurity Awareness Month, detailing strong passwords as your first line of defence against a cyber attack; this week, we cover the second: multi-factor authentication (MFA). Multi-factor Authentication adds an extra layer of security by requiring two or more methods of verification to access your accounts. Rather than relying solely on a password, MFA can come in several forms. These include
Cybersecurity Awareness Month: Use a Strong Password + a Password Manager
Cybersecurity professionals always say it, but it’s true: passwords are your first line of defence against data breaches. Because of this, it is crucial to make them strong and difficult to crack. Remember these three keys to make your passwords stronger: Make them long. The longer a password is, the more challenging to crack. CIRT-BS and other industry experts recommend passwords of 16 characters minimum.
Help Secure Our World this Cybersecurity Awareness Month
Welcome to Cybersecurity Awareness Month, an international initiative that educates everyone about online safety and empowers individuals and organisations to protect their data from cybercrime. Amidst large-scale data breaches and cyber-attacks, Cybersecurity Awareness Month reminds us about simple, effective ways to remain safe online, protect personal data, and ultimately help secure our world. The National Computer Incident Response Team of The Bahamas (CIRT-BS) is proud
Cash or Card? 10 Tips to Outsmart Card Fraud
In its 2022 Annual Report, the Bahamian monetary regulator, Central Bank of The Bahamas, reported over $15M in fraud complaints from debit and credit card users.[1] In many instances, better handling of financial cards could help to protect potential victims. This article shares ten practical but effective recommendations for protecting your financial accounts through your bank cards. (1) Invest in an RFID-blocking wallet to store
Don’t Get Reeled In! Recognising and Reporting Phishing
Have you ever received an email from a foreigner requesting financial assistance? How about a text message claiming you’ve won a particular prize for a competition you’ve never entered? In cybersecurity, these scams are commonly known as “phishing” attempts. Believed to come from the term “phoney fishing,” the Internet Engineering Task Force defines phishing as a technique for attempting to acquire sensitive data (e.g.
Spring Forward into Cyber Hygiene
Remember that time changes this Sunday! We move forward one hour. As you take time to update your clocks and declutter your homes this weekend, CIRT-BS reminds you to ensure that your cyber hygiene is being taken care of, too! Organise Your Files Clean folders make spotting malicious files and viruses easier. Review Bank Statements Check for unauthorised transactions and query them.
Build Better Passwords for Online Security this “Change Your Password Day”
What do your bank, social media, and email accounts share? A password! Passwords are one of the most critical lines of defence against cyber attacks. They help ensure our data is only accessed by authorised users, even in the event of device theft or loss. Many people choose passwords found in the dictionary and reuse them across multiple accounts, meaning that once a cybercriminal has
Data Privacy Week: 4 Ways to Protect Your Data
So what’s the big deal about privacy, anyway? When you avoid taking measures to take control of your data, you make yourself susceptible to identity theft, which can lead to several issues, including financial loss and damage to your online footprint. Throughout this Data Privacy Week, CIRT-BS covered topics around practising discernment in sharing specific data with various services and taking action on our decisions through
Data Privacy Week: Get Comfortable with Privacy
We may feel despair about how our data is collected and used by our apps and web services—especially as they often request more data than necessary. But here’s the silver lining, thanks to privacy rules like the GDPR and Data Protection Act: you have some control! Privacy rules help protect us, the users. Websites and apps are now increasing transparency around the info they collect and how
- RFC 2350