Cybercriminals Archives • Daily CyberSecurity

TA488 Uses Half-Click OWA Exploit to Deploy OWAReaper Implant TA488 half-click exploit abusing CVE-2026-42897 in Outlook Web Access to deploy OWAReaper implant

TA488 half-click exploit abusing CVE-2026-42897 in Outlook Web Access to deploy OWAReaper implant

TA488 Uses Half-Click OWA Exploit to Deploy OWAReaper Implant

Do Son July 29, 2026

At a glance Actor TA488 (Void Blizzard / Laundry Bear), Russia-aligned Activity Half-click XSS exploit of Outlook...

Insikt Group Finds Four New Golden Chickens Malware Families Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Insikt Group Finds Four New Golden Chickens Malware Families

Do Son July 28, 2026

At a glance Actor or group TAG-195, also tracked as Golden Chickens and Venom Spider; deployment observed...

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools

Do Son July 28, 2026

At a Glance Actor or group JadeProx, a China-nexus cluster named by Group-IB; no known group named...

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers

Do Son July 28, 2026

At a glance Threat actor Famous Chollima, also called Wagemole; North Korea-aligned Activity type Social engineering via...

VMRay Exposes Operation STANDOFF, a Russian-Speaking Intrusion Campaign Hidden Behind GitHub Operation STANDOFF infrastructure map showing a Russian-speaking threat group hiding C2 servers behind GitHub redirects

Operation STANDOFF infrastructure map showing a Russian-speaking threat group hiding C2 servers behind GitHub redirects

VMRay Exposes Operation STANDOFF, a Russian-Speaking Intrusion Campaign Hidden Behind GitHub

Do Son July 27, 2026

At a glance Actor or group Unnamed Russian-speaking crew tracked as Operation STANDOFF; self-branded “GG Influence” and...

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants

Do Son July 27, 2026

At a glance Actor or group Kimsuky, a North Korea-linked group also tracked as Springtail, Thallium and...

TELESHIM Malware Targets Middle East Governments Through Telegram SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

TELESHIM Malware Targets Middle East Governments Through Telegram

Do Son July 27, 2026

At a glance Threat actor Unnamed group with links to East Asia (moderate-to-high confidence) Activity type Targeted...

APT42 TAMECAT Malware Grows with AI-Assisted Phishing Tamecat

APT42 TAMECAT Malware Grows with AI-Assisted Phishing

Do Son July 27, 2026

At a glance Actor or group APT42 (Iran-linked; also tracked as TA453) Activity type AI-assisted spear-phishing, credential...

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests

Do Son July 24, 2026

At a glance Actor / group DPRK-aligned group behind the Contagious Interview campaign (Elastic tracks it as...

DOJ Indicts Chinese National Over Gift Card Fraud Scheme in New Hampshire Gift card fraud conspiracy indictment tied to a wire fraud conspiracy charge and a New Hampshire electronics warehouse

Gift card fraud conspiracy indictment tied to a wire fraud conspiracy charge and a New Hampshire electronics warehouse

DOJ Indicts Chinese National Over Gift Card Fraud Scheme in New Hampshire

Do Son July 24, 2026

At a glance Actor Jinbin Ren, 38, a Chinese national who lived in Lynnfield, Massachusetts; co-conspirators unnamed...

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims

Do Son July 23, 2026

At a Glance Actor or group A vendor using the alias “Kontraktnik”; no real identity published Activity...

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms

Do Son July 23, 2026

At a glance Actor / group Suspected Chinese-speaking APT group (low confidence) Activity type Cyberespionage using malicious...

DoNot APT Targets Bangladesh Military With a Fake Officer Biography CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

DoNot APT Targets Bangladesh Military With a Fake Officer Biography

Do Son July 23, 2026

At a glance Actor / group DoNot (APT-C-35); assessed by multiple vendors as India-aligned Activity type Targeted...

GitHub Actions Abuse Powers a Distributed cPanel and WHM Attack Campaign WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

GitHub Actions Abuse Powers a Distributed cPanel and WHM Attack Campaign

Do Son July 23, 2026

At a Glance Actor or group Unattributed threat actor; no group name published Activity type GitHub Actions...

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe

Do Son July 22, 2026

At a glance Actor / group UAT-11795 (suspected Russian-speaking, financially motivated) Activity type Credential and cryptocurrency theft...

Nextcloud Website Suffers Cyberattack and Phishing Redirect Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud Website Suffers Cyberattack and Phishing Redirect

Do Son July 21, 2026

Initial Attack Details The renowned open-source private cloud software, Nextcloud, suffered a cyberattack yesterday morning. This incident...

Threat Actor Rebuilt a Live Botnet in Six Minutes Using an AI Coding Agent AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Threat Actor Rebuilt a Live Botnet in Six Minutes Using an AI Coding Agent

Do Son July 21, 2026

At a Glance Actor Russian-speaking solo actor using the handle “bandcampro” Activity type AI-assisted C&C botnet, password...

Qilin Ransomware Deployed via Palo Alto GlobalProtect Flaw CVE-2026-0257 Qilin ransomware attack chain starting with a Palo Alto GlobalProtect CVE-2026-0257 authentication bypass

Qilin ransomware attack chain starting with a Palo Alto GlobalProtect CVE-2026-0257 authentication bypass

Qilin Ransomware Deployed via Palo Alto GlobalProtect Flaw CVE-2026-0257

Do Son July 21, 2026

During June 2026, Arctic Wolf Labs traced several ransomware intrusions to one entry point. Attackers exploited a...

United States Seizes More Than 1,000 Domains Streaming World Cup 2026 Matches Website Seizure Graphic

United States Seizes More Than 1,000 Domains Streaming World Cup 2026 Matches

Do Son July 20, 2026

At a glance Actor / group Piracy site operators. Four alleged members of “Los Ciberinfiltrados” arrested in...

OAuth Client ID Spoofing Lets Attackers Enumerate Entra ID Accounts Without a Trace OAuth client ID spoofing enabling stealthy account enumeration against Microsoft Entra ID sign-in logs

OAuth client ID spoofing enabling stealthy account enumeration against Microsoft Entra ID sign-in logs

OAuth Client ID Spoofing Lets Attackers Enumerate Entra ID Accounts Without a Trace

Do Son July 20, 2026

At a Glance Field Detail Actors UNK_pyreq2323 and UNK_OutFlareAZ (two independent, unattributed clusters) Activity Account enumeration and...

Operation ShadowRecruit Uses Fake Government Job Ads to Plant SheetAgent RAT on Indian Systems Salt Typhoon Teleco Hack, Cisco Academy Link CVE-2025-0282 PoC exploit

Salt Typhoon Teleco Hack, Cisco Academy Link CVE-2025-0282 PoC exploit

Operation ShadowRecruit Uses Fake Government Job Ads to Plant SheetAgent RAT on Indian Systems

Do Son July 20, 2026

Operation ShadowRecruit targets Indian job seekers with SheetAgent RAT, abusing ControlR and Google Sheets for C2. Seqrite...

SonicWall SMA Zero-Day Chain Roots VPN Appliances and Plants Hidden Malware SonicWall SMA zero-day exploit chain compromising SMA VPN appliances to deploy malware

SonicWall SMA zero-day exploit chain compromising SMA VPN appliances to deploy malware

SonicWall SMA Zero-Day Chain Roots VPN Appliances and Plants Hidden Malware

Do Son July 19, 2026

At a glance Actor / group UTA0533 (Volexity tracking cluster); no nation or identity confirmed Activity type...

Critical Alert 1 Active Exploit Detected Today