Cybercriminals Archives • Page 3 of 41 • Daily CyberSecurity

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts Redirect to legitimate device code sign-in page

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts

Do Son September 18, 2026

At a glance Actor or group: Unidentified cybercrime group (financially motivated threat actors) Activity type: Device code...

Smishing Triad Phishing Kit Exposed by Group-IB The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

Smishing Triad Phishing Kit Exposed by Group-IB

Do Son September 17, 2026

Security researchers at Group-IB recently published an investigation into a Smishing Triad phishing kit deployed across global...

North Korean IT Worker Scam Infiltrates Tech Jobs GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

North Korean IT Worker Scam Infiltrates Tech Jobs

Do Son September 17, 2026

Security researchers at Silent Push identified a fraudulent job recruitment scheme hosted on a Discord server. The...

Adversarial AI Threats Drive New Cyber Operations Adversarial AI threats mapping AI credential harvesting

Adversarial AI Threats Drive New Cyber Operations

Do Son September 14, 2026

At a Glance Actor or Group: Suspected state-sponsored groups (UNC6508, BASIN CASTLE) and cyber criminals (UNC6780). Activity...

Phishing Campaign Exploits Google Infrastructure for Data Theft A diagram showing how attackers abuse Google infrastructure for credential harvesting

A diagram showing how attackers abuse Google infrastructure for credential harvesting

Phishing Campaign Exploits Google Infrastructure for Data Theft

Do Son September 11, 2026

At a glance Threat researchers from the KnowBe4 Threat Lab uncovered a highly sophisticated phishing campaign recently....

SonicWall SMA 1000 Flaw (CVE-2026-15409) Hits UK Council Diagram of the active SonicWall SMA 1000 campaign and SonicWall SMA 1000 campaign attack flow

Diagram of the active SonicWall SMA 1000 campaign and SonicWall SMA 1000 campaign attack flow

SonicWall SMA 1000 Flaw (CVE-2026-15409) Hits UK Council

Do Son September 11, 2026

At a Glance Category Details Actor or Group Unattributed threat actor (Chinese-language artifacts observed) Activity Type Mass...

Conti ransomware developer sentenced for extortion and wire fraud

Conti Ransomware Developer Sentenced to Four Years in Prison

Do Son September 11, 2026

At a Glance Category Details Actor or Group Conti ransomware syndicate (Oleksii Lytvynenko) Activity Type Wire fraud...

Ted Backdoor Hides in HAProxy to Spy on South Korea Ted backdoor Linux toolkit hidden inside HAProxy load balancer, with curlRAT targeting South Korean media and automotive sectors

Ted backdoor Linux toolkit hidden inside HAProxy load balancer, with curlRAT targeting South Korean media and automotive sectors

Ted Backdoor Hides in HAProxy to Spy on South Korea

Do Son September 10, 2026

At a glance Actor or group Suspected DPRK APTs (APT37 links, medium confidence) Activity type Linux backdoor,...

Phishing Attackers Repurpose AI ASCII Smuggling to Evade Detection ASCII smuggling phishing evasion diagram showing invisible Unicode tags

ASCII smuggling phishing evasion diagram showing invisible Unicode tags

Phishing Attackers Repurpose AI ASCII Smuggling to Evade Detection

Do Son September 10, 2026

At a glance Field Details Actor or Group Unattributed cybercrime operators Activity Type Email filter evasion, credential...

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys Diagram showing how Kimsuky uses the AI agent opencode to generate phishing lures

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys

Do Son September 10, 2026

At a glance Field Details Actor or Group Kimsuky (North Korean state-sponsored threat group) Activity Type Spearphishing,...

Passkey Social Engineering Attacks Breach Enterprise Cloud Data Diagram illustrating passkey social engineering and passkey social engineering attacks

Diagram illustrating passkey social engineering and passkey social engineering attacks

Passkey Social Engineering Attacks Breach Enterprise Cloud Data

Do Son September 10, 2026

At a glance Microsoft threat analysts reported active cloud intrusions utilizing passkey social engineering to breach enterprise...

PREY-0058: Microsoft 365 Vishing Attacks Extort Firms A diagram illustrating how Microsoft 365 vishing attacks fuel the PREY-0058 extortion campaign targeting executives.

A diagram illustrating how Microsoft 365 vishing attacks fuel the PREY-0058 extortion campaign targeting executives.

PREY-0058: Microsoft 365 Vishing Attacks Extort Firms

Do Son September 9, 2026

Threat actors are actively compromising executive accounts using highly targeted Microsoft 365 vishing attacks. The PREY-0058 extortion...

BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days Diagram of BlueMoon exploit kit campaigns deploying the BlueMoon exploit kit against Chrome

Diagram of BlueMoon exploit kit campaigns deploying the BlueMoon exploit kit against Chrome

BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days

Do Son September 9, 2026

Proofpoint threat researchers uncovered state-aligned espionage groups deploying zero-day browser exploit chains in late August 2026. Field...

Trojanized fake macOS installers used in Contagious Interview campaign

Trojanized Fake macOS Installers Spread OtterCookie Backdoor

Do Son September 9, 2026

At a glance Field Details Actor or Group Suspected DPRK-affiliated operators (Contagious Interview cluster) Activity Type Malware...

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails

Do Son September 9, 2026

At a glance Field Details Actor or Group Unidentified phishing actors and cybercrime groups Activity Type Email...

Attackers Use AI Tools to Hit Latin American Orgs Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Attackers Use AI Tools to Hit Latin American Orgs

Do Son September 9, 2026

At a Glance Threat clusters CL-CRI-1131 and CL-CRI-1163 Activity type Network intrusion and data exfiltration, AI-assisted Targets...

US Agencies Warn of Malicious AI Distillation Campaigns Diagram showing malicious AI distillation campaigns targeting frontier models

US Agencies Warn of Malicious AI Distillation Campaigns

Do Son September 8, 2026

At a glance On September 9, 2026, federal security agencies exposed intellectual property theft targeting American artificial...

Outsider Phishing Kit Survives Operation Ghost Hook Takedown Outsider Phishing Kit tracking panel and ChenLun Outsider PhaaS kit dashboard

Outsider Phishing Kit Survives Operation Ghost Hook Takedown

Do Son September 8, 2026

At a Glance Actor or group: Threat actor known as “ChenLun” and affiliated subscribers. Activity type: Phishing-as-a-Service...

Phantom Deal Scam Targets Executives With Fake NDAs Phantom Deal campaign document tracking diagram illustrating the Phantom Deal scam

Phantom Deal Scam Targets Executives With Fake NDAs

Do Son September 8, 2026

At a Glance Actor or group Unidentified cybercrime actors (dubbed Phantom Deal operators) Activity type Executive impersonation,...

Microsoft Teams IT support impersonation attack chain from external tenant contact to Node.js implant and WinRM lateral movement toward domain controllers

Microsoft Teams IT Support Impersonation Leads to Domain Takeover

Do Son September 8, 2026

At a glance Actor or group Unattributed; Microsoft tracks it as a campaign, no named actor Activity...

Chinese Actor Gambling Goblin Hijacks Brazilian Gov Sites Gambling Goblin campaign targeting government servers with Gambling Goblin malware

Gambling Goblin campaign targeting government servers with Gambling Goblin malware

Chinese Actor Gambling Goblin Hijacks Brazilian Gov Sites

Do Son September 8, 2026

At a Glance Actor or group Suspected Gambling Goblin (linked to Earth Berberoka) Activity type SEO poisoning,...

Liquid Network Security Incident: The White Hat Dilemma Liquid Network hack diagram showing Bitcoin transfer and white hat bounty negotiation

Liquid Network hack diagram showing Bitcoin transfer and white hat bounty negotiation

Liquid Network Security Incident: The White Hat Dilemma

Do Son September 8, 2026

Recently, the Bitcoin sidechain Liquid Network suffered a monumental security incident, resulting in a comprehensive suspension of...