Cybercriminals Archives • Page 2 of 35 • Daily CyberSecurity

APT-C-60 Attacks Target Japan With SpyGlace Malware APT-C-60 attacks on Japan using LNK files and legitimate services to deploy SpyGlace malware

APT-C-60 Attacks Target Japan With SpyGlace Malware

Do Son July 18, 2026

At a glance Actor / group APT-C-60 (threat group) Activity Spear-phishing, LNK loader, SpyGlace backdoor Targets /...

Misconfigured Server Exposes Three AiTM Phishing Operators Open directory exposing three AiTM phishing operators using Evilginx MFA bypass tooling

Open directory exposing three AiTM phishing operators using Evilginx MFA bypass tooling

Misconfigured Server Exposes Three AiTM Phishing Operators

Do Son July 17, 2026

At a glance Actor / group codemado, mail-argenta, saroula01 (online aliases) Activity AiTM phishing and OAuth Device...

China and India Cyberespionage Converge on Pakistani Law Enforcement Chinese cyberespionage against Pakistani law enforcement targeting Balochistan Police records

Chinese cyberespionage against Pakistani law enforcement targeting Balochistan Police records

China and India Cyberespionage Converge on Pakistani Law Enforcement

Do Son July 16, 2026

At a Glance Actors Suspected China-nexus (PlugX, ShadowPad, Cobalt Strike) and India-nexus (Remcos; TAG-179) groups Activity type...

Helix Data Extortion Group Emerges from BlackFile, ReliaQuest Reports Helix data extortion group using device code phishing to exfiltrate data from SharePoint

Helix data extortion group using device code phishing to exfiltrate data from SharePoint

Helix Data Extortion Group Emerges from BlackFile, ReliaQuest Reports

Do Son July 16, 2026

At a glance Actor / group Helix (suspected ties to BlackFile and ShinyHunters) Activity type Data extortion...

Clubfoot Wolf Hits Russian Firms With NetSupport Manager exfiltrating AWS credentials - fabrice package

Clubfoot Wolf Hits Russian Firms With NetSupport Manager

Do Son July 15, 2026

At a glance Actor / group Clubfoot Wolf (cluster tracked by BI.ZONE) Activity type Phishing that deploys...

Malicious Go Module Exposes a 222-Repository GitHub Lure Network Malicious Go module exposing GitHub lure network of 222 repositories in Operation Muck and Load

Malicious Go module exposing GitHub lure network of 222 repositories in Operation Muck and Load

Malicious Go Module Exposes a 222-Repository GitHub Lure Network

Do Son July 15, 2026

Actor / group Unnamed actor tracked as “Operation Muck and Load”; overlaps with the ischhfd83 cluster Activity...

Passkey Phishing Campaign Uses Vishing Calls to Hijack Microsoft Entra Accounts Passkey phishing vishing attack targeting Microsoft Entra passkey enrollment by O-UNC-066

Passkey phishing vishing attack targeting Microsoft Entra passkey enrollment by O-UNC-066

Passkey Phishing Campaign Uses Vishing Calls to Hijack Microsoft Entra Accounts

Do Son July 15, 2026

At a Glance Actor O-UNC-066 (Okta); tracked as CL-CRI-1147 / “Pink” by Palo Alto Unit 42; linked...

Mexican Banking Fraud: REF6045 Operation Exposed Diagram of the REF6045 operation executing Mexican banking fraud using SCMBANKER.

Mexican Banking Fraud: REF6045 Operation Exposed

Do Son July 14, 2026

On June 18, 2026, security analysts detected a host downloading suspicious PowerShell scripts from an open directory....

UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments UNK_MassTraction Roundcube exploitation infection chain deploying the VShell backdoor at universities

UNK_MassTraction Roundcube exploitation infection chain deploying the VShell backdoor at universities

UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments

Do Son July 13, 2026

At a glance Actor UNK_MassTraction — suspected China-aligned espionage cluster Activity Roundcube exploitation for credential theft, webshells,...

GemStuffer RubyGems Campaign RubyGems Data Exfiltration TanStack npm Compromise Supply Chain Attack DNS Hijacking APT28 (Fancy Bear) OpenVSX Supply Chain Attack Checkmarx Plugin Breach Stryker Cyberattack CISA Alert Trans-Regional Cyber Conflict Operation Epic Fury Cyber Operation MacroMaze APT28 Cyber Espionage Notepad++ Supply Chain Attack Lotus Blossom Group Defense Industrial Base Threats GTIG Report APT28 Operation Neusploit CVE-2026-21509 Bookworm Malware

UAT-7810 Expands Its LapDogs ORB Network With New Router Malware

Do Son July 13, 2026

At a glance Actor UAT-7810 — assessed China-nexus APT (Cisco Talos, high confidence) Activity Building and expanding...

CMS Exploitation Campaign Plants Webshells on Business Websites CMS exploitation campaign deploying webshell attacks on WordPress and CMS websites

CMS exploitation campaign deploying webshell attacks on WordPress and CMS websites

CMS Exploitation Campaign Plants Webshells on Business Websites

Do Son July 13, 2026

At a glance Actor / group Unattributed malicious cyber actors Activity Mass exploitation of CMS flaws to...

Cavern Manticore APT Deploys Modular C2 Framework digital-hacker

Cavern Manticore APT Deploys Modular C2 Framework

Do Son July 13, 2026

At a Glance Actor or group: Cavern Manticore APT (suspected Iran-linked) Activity type: Cyber-espionage and network infiltration...

Armored Likho APT Deploys New BusySnake Stealer Diagram showing BusySnake Stealer infection chain by Armored Likho APT

Armored Likho APT Deploys New BusySnake Stealer

Do Son July 13, 2026

At a Glance Actor or group: Armored Likho APT (suspected) Activity type: Spear-phishing and information theft Targets...

Indirect Prompt Injection Threatens AI Agents Diagram showing indirect prompt injection exploiting AI agent vulnerabilities

Indirect Prompt Injection Threatens AI Agents

Do Son July 13, 2026

At a Glance Malware Family: Indirect Prompt Injection (IPI) Threat Actor: Suspected GitHub user (Open-Agent-Utilities) Target: Autonomous...

SpaceX X Account Breach Exploited for Crypto Scam Official SpaceX X account breach promoting fraudulent crypto token

SpaceX X Account Breach Exploited for Crypto Scam

Do Son July 13, 2026

Yesterday, Elon Musk and Sam Altman engaged in a fierce public dispute on X. Meanwhile, an opportunistic...

Florida ransomware negotiator sentenced for BlackCat ransomware extortion scheme

Florida Ransomware Negotiator Sentenced for Betraying Victims to BlackCat

Do Son July 10, 2026

At a Glance Actor Angelo Martino, 41, former ransomware negotiator; worked with BlackCat/ALPHV affiliates Activity type Insider...

PolinRider supply chain attack diagram showing North Korean hackers hiding loaders in open-source packages

North Korea-Linked PolinRider Supply Chain Attack Expands Across Open Source

Do Son July 9, 2026

At a Glance Actor / group Suspected North Korean actors in the Contagious Interview / Famous Chollima...

Rare Werewolf Phishing Campaign Targets Russian Aerospace With AnyDesk WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

WhatsApp Worm, Brazilian Banking Trojan LAPSUS$ Alliance, Scattered Spider Ransomware, Cybercrime RedCurl APT group Russian Cyberespionage, ApolloShadow Malware

Rare Werewolf Phishing Campaign Targets Russian Aerospace With AnyDesk

Do Son July 9, 2026

At a glance Actor / group Rare Werewolf (aka Librarian Ghouls, Rezet) — suspected Activity Invoice-themed spear-phishing...

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns

Do Son July 8, 2026

At a glance Details Activity type Phantom squatting: registering AI hallucinated domains for phishing and malware Actors...

ARToken Phishing Platform Steals Microsoft 365 Tokens and Bypasses MFA

Do Son July 7, 2026

At a glance Details Actor or group ARToken operators; assessed as an EvilTokens affiliate panel Activity type...

DeepSeek AI Generates Browser Native Ransomware

Do Son July 7, 2026

At a Glance Actor/Group Unknown threat actors allegedly testing DeepSeek AI Activity Type Browser native ransomware Targets...

The Illusion of Security: Kairos Ransomware and the Rise of Data Extortion Without Encryption Kairos ransomware data extortion case study showing cyber extortion risks without encryption

Kairos ransomware data extortion case study showing cyber extortion risks without encryption

The Illusion of Security: Kairos Ransomware and the Rise of Data Extortion Without Encryption

Do Son July 6, 2026

A recent case study published by Ransom-ISAC reveals a disconcerting trend in cyber extortion. As outlined in...

Critical Alert 1 Active Exploit Detected Today