Cybercriminals Archives • Daily CyberSecurity

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns

Do Son July 8, 2026

At a glance Details Activity type Phantom squatting: registering AI hallucinated domains for phishing and malware Actors...

ARToken Phishing Platform Steals Microsoft 365 Tokens and Bypasses MFA

Do Son July 7, 2026

At a glance Details Actor or group ARToken operators; assessed as an EvilTokens affiliate panel Activity type...

DeepSeek AI Generates Browser Native Ransomware

Do Son July 7, 2026

At a Glance Actor/Group Unknown threat actors allegedly testing DeepSeek AI Activity Type Browser native ransomware Targets...

The Illusion of Security: Kairos Ransomware and the Rise of Data Extortion Without Encryption Kairos ransomware data extortion case study showing cyber extortion risks without encryption

Kairos ransomware data extortion case study showing cyber extortion risks without encryption

The Illusion of Security: Kairos Ransomware and the Rise of Data Extortion Without Encryption

Do Son July 6, 2026

A recent case study published by Ransom-ISAC reveals a disconcerting trend in cyber extortion. As outlined in...

Microsoft GDID Tracking: How Windows Caught a Hacker Microsoft GDID tracking visualization identifying Scattered Spider hacker Peter Stokes

Microsoft GDID tracking visualization identifying Scattered Spider hacker Peter Stokes

Microsoft GDID Tracking: How Windows Caught a Hacker

Do Son July 6, 2026

On July 1, 2026, the US Department of Justice and the FBI announced the extradition of a...

TAG-182 Threat Cluster Spreads MarkiRAT Malware Diagram of TAG-182 threat cluster spreading MarkiRAT malware

TAG-182 Threat Cluster Spreads MarkiRAT Malware

Do Son July 6, 2026

At a glance: Actor/Group: TAG-182 threat cluster (suspected Iran-nexus) Activity Type: Cyber surveillance and malware distribution Targets/Victims:...

The Fall of HiAnime: Vietnamese Police Arrest Piracy Ring Vietnamese police conduct HiAnime piracy arrests, dismantling a massive illegal anime streaming syndicate.

Vietnamese police conduct HiAnime piracy arrests, dismantling a massive illegal anime streaming syndicate.

The Fall of HiAnime: Vietnamese Police Arrest Piracy Ring

Do Son July 6, 2026

In March 2026, HiAnime abruptly announced its closure and issued a farewell statement. This platform was arguably...

FBI Warns of TeamPCP Supply Chain Attack TeamPCP supply chain attack and software supply chain compromise alert

FBI Warns of TeamPCP Supply Chain Attack

Do Son July 4, 2026

At a glance Actor TeamPCP Activity type Software supply chain compromise Targets Enterprise developers, security tools Scale...

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Do Son July 3, 2026

At a glance Actor Suspected North Korean Lazarus-linked group (attribution by TTP similarity) Activity npm supply chain...

ToddyCat APT Umbrij Tool Steals Cloud Email Tokens Diagram of ToddyCat APT Umbrij tool performing OAuth token theft from Chrome

ToddyCat APT Umbrij Tool Steals Cloud Email Tokens

Do Son July 3, 2026

Security analysts recently discovered the ToddyCat APT Umbrij tool. It hijacks corporate Gmail accounts without triggering standard...

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government

Do Son July 2, 2026

At a glance Group Mustang Panda (China-aligned APT; also tracked as Hive0154) Activity Cyberespionage, spear-phishing, cloud-service C2...

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

The Gentlemen Ransomware Group Expands With New Lockers and Custom Tools

Do Son July 2, 2026

At a glance Group The Gentlemen (ransomware-as-a-service) Activity Ransomware, data-leak extortion, custom tool development Targets Large firms...

Pro-Russia Influence Ecosystem Expands Global Reach Diagram showing the pro-Russia influence ecosystem and information operations

Pro-Russia Influence Ecosystem Expands Global Reach

Do Son July 2, 2026

At a glance Actor: Suspected Russian state-sponsored actors and proxies Activity type: Covert information operations and hacktivism...

Scattered Spider Arrest: Teen Extradited in $100M Scheme Scattered Spider arrest suspect Peter Stokes extradition

Scattered Spider Arrest: Teen Extradited in $100M Scheme

Do Son July 2, 2026

At a glance Actor or Group: Scattered Spider (Octo Tempest, UNC3944, 0ktapus) Activity Type: Data extortion, computer...

UNC1151 Phishing Campaign Targets Belarus and Ukraine UNC1151 phishing campaign login page created by the Ghostwriter threat actor.

UNC1151 Phishing Campaign Targets Belarus and Ukraine

Do Son July 1, 2026

At a glance Actor: UNC1151 (Ghostwriter / Frosty Neighbor) Activity type: Spear-phishing and credential theft Targets: Belarusian...

Operation DragonReturn Targets Indian Tax Infrastructure WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

Operation DragonReturn Targets Indian Tax Infrastructure

Do Son July 1, 2026

At a glance Actor: Suspected China-nexus threat cluster Activity type: Spear-phishing and cyber espionage Targets: Indian taxpayers,...

Report Maps 3,900 Eastern European C2 Servers Across 302 Providers Eastern European C2 servers mapped across 302 providers and bulletproof hosting networks

Eastern European C2 servers mapped across 302 providers and bulletproof hosting networks

Report Maps 3,900 Eastern European C2 Servers Across 302 Providers

Do Son July 1, 2026

At a glance Field Detail Actors Many groups sharing the same networks: commodity crime plus APTs (Cloud...

Hospitality Malware Campaign Deploys Node.js Implant digital-hacker

Hospitality Malware Campaign Deploys Node.js Implant

Do Son June 30, 2026

At a glance Actor: Unknown threat actor Activity type: Phishing and multi-stage intrusion Targets: Hospitality and hotel...

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure digital-hacker

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure

Do Son June 30, 2026

At a glance Actor or Group: CL-STA-1062 (suspected Chinese-speaking actors) Activity Type: Cyber espionage and network infiltration...

Thailand Healthcare Malware Exploits RAR Archives Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Thailand Healthcare Malware Exploits RAR Archives

Do Son June 29, 2026

At a glance Actor: Suspected unknown threat cluster (tracked by Seqrite Lab) Activity Type: Spear-phishing, credential theft,...

US Seizes Domains to Stop Illegal World Cup Streaming Law enforcement officials announce domain seizures to stop illegal World Cup streaming.

US Seizes Domains to Stop Illegal World Cup Streaming

Do Son June 27, 2026

At a Glance Actor or Group: Unnamed digital piracy networks Activity Type: Copyright infringement Targets or Victims:...

US Offers $10 Million Reward for Russian Hacker Group UNC5792 UNC5792 Rewards for Justice $10 million reward Russian Signal phishing group

US Offers $10 Million Reward for Russian Hacker Group UNC5792

Do Son June 27, 2026

At a Glance Actor / group UNC5792 (linked to FSB Border Guards); UNC4221 (Russian military) Activity Phishing...

Critical Alert 4 Active Exploits Detected Today