Cybercriminals Archives • Page 3 of 38 • Daily CyberSecurity

UNC6671 Vishing Extortion Rebrands Across 5 Brands UNC6671 vishing extortion group using AiTM credential phishing across five extortion brands

UNC6671 vishing extortion group using AiTM credential phishing across five extortion brands

UNC6671 Vishing Extortion Rebrands Across 5 Brands

Do Son August 12, 2026

At a glance Actor or group UNC6671 (suspected single coordinated group) Activity type Vishing-led data theft and...

Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks Lazarus zero-day exploit code on a screen showing Operation Dream Job fake job offer lure

Lazarus zero-day exploit code on a screen showing Operation Dream Job fake job offer lure

Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks

Do Son August 12, 2026

What happened at a glance Actor or group Lazarus (DPRK-linked), per Check Point Research Activity type Spear-phishing,...

Greatness PhaaS Platform Steals Microsoft 365 Tokens Past MFA Greatness PhaaS platform operator panel for the AiTM phishing kit targeting Microsoft 365

Greatness PhaaS platform operator panel for the AiTM phishing kit targeting Microsoft 365

Greatness PhaaS Platform Steals Microsoft 365 Tokens Past MFA

Do Son August 10, 2026

At a glance Actor or group Operators of the Greatness kit, also tracked as HoneyStorm Activity type...

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access

Do Son August 7, 2026

At a Glance Attribute Detail Actor / group Unattributed threat actor (tracked by Securonix as SMOKE#SCREEN) Activity...

Astaroth WhatsApp Spambot Turns Brazil Victims Into Unwitting Malware Distributors Astaroth WhatsApp spambot targeting Brazil via headless browser automation

Astaroth WhatsApp spambot targeting Brazil via headless browser automation

Astaroth WhatsApp Spambot Turns Brazil Victims Into Unwitting Malware Distributors

Do Son August 7, 2026

At a glance Field Detail Actor Unidentified LATAM threat actor behind the Astaroth/Guildma botnet Activity WhatsApp Web...

Canadian Man Pleads Guilty to Cloud Hacking Extortion Scheme That Hit 165 Companies Cloud hacking extortion guilty plea over the Snowflake data breach affecting 165 companies

Cloud hacking extortion guilty plea over the Snowflake data breach affecting 165 companies

Canadian Man Pleads Guilty to Cloud Hacking Extortion Scheme That Hit 165 Companies

Do Son August 7, 2026

At a glance Actor Connor Riley Moucka, 26, of Kitchener, Ontario Activity type Cloud account intrusion, data...

DarkSword iOS Exploit Spreads Across 100+ Sites and Drops GHOSTBLADE DarkSword iOS exploit chain operator panel serving GHOSTBLADE implant and fake Apple ID login credential harvesting page

DarkSword iOS exploit chain operator panel serving GHOSTBLADE implant and fake Apple ID login credential harvesting page

DarkSword iOS Exploit Spreads Across 100+ Sites and Drops GHOSTBLADE

Do Son August 6, 2026

At a glance Actor Chinese-speaking operator (suspected, moderate confidence); one of 7-8 unrelated groups using the leaked...

CaptiveCrunch malware campaign diagram showing hotel Wi-Fi captive portal hijack by Storm-2945

CaptiveCrunch Malware Campaign Hijacks Hotel Wi-Fi Worldwide

Do Son August 6, 2026

At a glance Actor or group Storm-2945, assessed as an operational sub-cluster of Midnight Blizzard Activity type...

Chinese Threat Actor Runs Autonomous AI Cyberattacks Using DeepSeek JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

Chinese Threat Actor Runs Autonomous AI Cyberattacks Using DeepSeek

Do Son August 5, 2026

At a glance Field Detail Actor Chinese-speaking operator, aliases knaithe and KnYuan Activity AI-enabled autonomous hacking campaign...

Adform Cyber Attack: Malicious Scripts Hijack Crypto Wallets CVE-2026-18072 video embedder backdoor authentication bypass

Adform Cyber Attack: Malicious Scripts Hijack Crypto Wallets

Do Son August 5, 2026

Adform, a prominent European advertising technology enterprise, recently disclosed a severe security breach. Hackers successfully compromised the...

Amazon Links North Korean Hackers to NPM Supply Chain Attacks North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Amazon Links North Korean Hackers to NPM Supply Chain Attacks

Do Son August 4, 2026

At a glance Actor DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) Activity NPM supply chain compromise...

Microsoft Teams vishing campaign STAC4749 deploying Chaos ransomware after fake IT support calls

Microsoft Teams Vishing Campaign STAC4749 Deploys Chaos Ransomware

Do Son August 4, 2026

At a glance Actor STAC4749 (unattributed threat cluster) Activity Teams vishing, remote access, ransomware Targets Dozens of...

COLDCARD Exploit Grows to 1,367 BTC Stolen Across Three Waves COLDCARD hardware wallet exploit growing to 1,367 BTC stolen across three attack waves from 4,585 wallets, tracked by Galaxy Research on-chain analysis

COLDCARD hardware wallet exploit growing to 1,367 BTC stolen across three attack waves from 4,585 wallets, tracked by Galaxy Research on-chain analysis

COLDCARD Exploit Grows to 1,367 BTC Stolen Across Three Waves

Do Son August 3, 2026

Recently, we covered the critical security failure in the Canadian hardware wallet COLDCARD. A flawed random-number algorithm...

COLDCARD Seed Flaw Let Hackers Steal 594 BTC in 15 Minutes COLDCARD hardware wallet seed generation flaw that shrank entropy from 128 bits to 40 bits, enabling theft of 594 BTC from 500 wallets in 15 minutes

COLDCARD hardware wallet seed generation flaw that shrank entropy from 128 bits to 40 bits, enabling theft of 594 BTC from 500 wallets in 15 minutes

COLDCARD Seed Flaw Let Hackers Steal 594 BTC in 15 Minutes

Do Son August 1, 2026

The respected Bitcoin hardware wallet COLDCARD has disclosed a severe security failure. A build error dating back...

Mirage Kitten Deploys New Malware Against Middle East and Africa Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten Deploys New Malware Against Middle East and Africa

Do Son August 1, 2026

At a glance Actor Mirage Kitten (also UNC1549, Smoke Sandstorm, Nimbus Manticore) Activity State-aligned cyber espionage and...

GoGRPC Backdoor Spreads Through Microsoft Teams Vishing Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

GoGRPC Backdoor Spreads Through Microsoft Teams Vishing

Do Son July 31, 2026

At a glance Actor Unnamed threat actor, likely a ransomware initial access broker Activity Vishing-led intrusion and...

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools

Do Son July 31, 2026

At a Glance Actor / group SilverFox (Silver Fox), a China-aligned APT tracked since about 2022 Activity...

Attackers Poison Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts Hotel Wi-Fi DNS poisoning attack chain leading to Microsoft 365 account compromise for traveling employees

Hotel Wi-Fi DNS poisoning attack chain leading to Microsoft 365 account compromise for traveling employees

Attackers Poison Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts

Do Son July 30, 2026

At a glance Actor Unnamed operator; ReliaQuest notes tradecraft similar to APT28 (Fancy Bear, Forest Blizzard) but...

BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine BlueNoroff phishing kit fake Zoom meeting page used in a DPRK ClickFix attack targeting crypto wallets

BlueNoroff phishing kit fake Zoom meeting page used in a DPRK ClickFix attack targeting crypto wallets

BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine

Do Son July 30, 2026

At a glance Field Detail Actor / group BlueNoroff (TA444), a subgroup of North Korea’s Lazarus Group...

TA488 Uses Half-Click OWA Exploit to Deploy OWAReaper Implant TA488 half-click exploit abusing CVE-2026-42897 in Outlook Web Access to deploy OWAReaper implant

TA488 half-click exploit abusing CVE-2026-42897 in Outlook Web Access to deploy OWAReaper implant

TA488 Uses Half-Click OWA Exploit to Deploy OWAReaper Implant

Do Son July 29, 2026

At a glance Actor TA488 (Void Blizzard / Laundry Bear), Russia-aligned Activity Half-click XSS exploit of Outlook...

Insikt Group Finds Four New Golden Chickens Malware Families Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages