Hello. More wannabe cybercriminals are turning to user-friendly online tool kits designed to help them steal login credentials, passwords, credit card numbers and other sensitive data.

The strategy isn’t new but the services’ increasing ease-of-use and sophistication—fueled by artificial intelligence—is driving booming demand on the dark web. One such Chinese platform went from zero to nearly 1,700 users in its new secure messaging page since April. Read our full story. 

What can corporate cyber chiefs do to combat this trend? Scroll down for our Newsletter Bonus story. 

Also today: 

• Online and some in-store operations down at Victoria's Secret
• U.S. collects DNA samples from migrant children
• Attempted espionage at Defense Intelligence Agency
• Rosy picture in cloud security for Netskope, Zscaler
• Executive insights from across WSJ Pro
• And more

The website of Victoria's Secret remained down Thursday after the women's clothing retailer disclosed Wednesday that it was dealing with a "security incident."

• "We have taken down our website and some in store services as a precaution. Our team is working around the clock to fully restore operations," a message at the website said.
• The company didn't provide details about the incident.

Privacy: U.S. officials are adding immigrant children's DNA samples to a federal law-enforcement database. From October 2020 through the end of last year, the U.S. Customs and Border Protection swabbed as many as 133,539 minors, including at least one four-year old, for genetic material to add to the Codis database. The Federal Bureau of Investigation runs Codis as a resource for local police and investigators. (Wired)

The U.S. sanctioned Funnull Technology, a Philippines company that the Treasury Department said provides tech infrastructure to people running so-called pig butchering campaigns and to other cryptocurrency scam websites. Funnull is run by a Chinese national who was also sanctioned, Treasury said. 

Attempted espionage: A 28-year-old tech worker with Top Secret security clearance at the federal Defense Intelligence Agency was arrested Thursday, accused of attempting to give U.S. defense information to a foreign government, the Justice Department said. The man, a Virginia resident, was communicating with an undercover FBI agent. 

Can Phishing-as-a-Service be Stopped?

Beyond tech-heavy security measures, guarding against the worrisome surge in phishing attacks calls for old-school training and awareness programs, cybersecurity experts said.

Even then, spotting fake emails and login pages “is becoming increasingly difficult,” said James Maude, field CTO at BeyondTrust. “With generative AI and specialist criminal providers, the days of misspelled emails and obviously suspicious login pages are behind us,” Maude said.

Kern Smith, vice president of global solutions at cybersecurity firm Zimperium, said companies need to take a multi-layered approach that includes AI-driven detection, real-time analysis of links and app behaviors, and protection directly on mobile devices.

Protection also requires more dynamic identity verification methods, such as multi-factor authentication and biometrics, said Darren Guccione, chief executive and co-founder of Keeper Security.

“These cybercriminals are not only relying on stolen credentials, but also on social manipulation,” Guccione said.

— Angus Loten

Rosy picture in cloud-security: Santa Clara, Calif.-based Netskope is working with investment firm Morgan Stanley to prepare for an IPO as soon as next quarter, Reuters reported, citing people familiar with the matter. 

• Rival Zscaler on Thursday reported that revenue was up 23% in its fiscal third quarter compared to same period a year earlier. The company narrowed its quarterly loss to $4.1 million from $19.1 million. Kevin Rubin joined as CFO from online coaching service BetterUp, Zscaler said. Rubin succeeds Remo Canessa, who is retiring. 

• U.S. venture capitalists are racing to tap into China’s growing biotechnology prowess.
• Some of the U.S. banks that cut ties with a leading industry climate group have shifted how they talk about their climate efforts.
• Big private-equity firms increasingly are taking two different approaches as they strive to expand, with most following an “asset light” strategy.

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten, James Rundle and Catherine Stupp. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.