Do Son Discover how the PREY-0058 extortion campaign uses Microsoft 365 vishing attacks and AiTM tactics to bypass MFA, steal cloud data, and demand high ransoms.
AiTM
A new AiTM phishing campaign targets healthcare. Learn how this healthcare AiTM phishing campaign chains compromised accounts to bypass MFA.
Researchers expose the Greatness PhaaS platform, an AiTM phishing kit sold on Telegram that steals Microsoft 365 tokens past MFA.
Microsoft warns of a massive AiTM phishing campaign targeting 13,000+ orgs. Using fake disciplinary lures, attackers bypass MFA to hijack active sessions.
Hunt.io discovers Canis C2, an AI-assisted surveillance framework targeting all major OSs. An exposed API revealed payloads and source code. Read more here.
NCSC unmasks APT28’s "digital funnel" using router DNS hijacking to steal OAuth tokens and passwords. Protect your remote workforce—patch your routers now.
Lotus Blossom hijacked Notepad++ updates to target admins. The supply chain attack deployed Chrysalis backdoor. Update to v8.9.1 immediately.
Cisco Talos exposes DKnife, a router malware that inspects traffic and swaps legitimate downloads for ShadowPad backdoors. Active since 2019.
Kaspersky exposes Evasive Panda’s AitM campaign, hijacking DNS to deliver MgBot through fake updates for SohuVA and Tencent QQ.
Socket uncovers an npm-based phishing campaign using CDNs to host lures targeting sales teams in critical infrastructure via fake MicroSecure pages.
A new report reveals a persistent phishing campaign targeting ScreenConnect super admins. The stolen credentials are being sold to ransomware affiliates for future attacks.
New research from Proofpoint shows that attackers can bypass FIDO passkeys using a downgrade attack, forcing a fallback to less secure authentication methods.
A new advanced phishing kit, PoisonSeed, bypasses MFA with AitM techniques to steal credentials and launch cryptocurrency scams. NVISO uncovers the tactics.
Proofpoint reveals an AiTM phishing campaign using fake OAuth apps and the Tycoon platform to bypass MFA, hijack Microsoft 365 accounts, and steal credentials.
Microsoft reveals Russian state actor Secret Blizzard is targeting foreign embassies in Moscow with ISP-level AiTM attacks, deploying ApolloShadow malware to spy on diplomats.
Scanception campaign uses QR code-based phishing in PDFs to bypass traditional security, targeting high-value industries globally for credential and 2FA theft.
Trustwave uncovers Dadsec and Tycoon2FA, new Phishing-as-a-Service kits bypassing MFA to target Microsoft 365 users with advanced AiTM tactics.
Cisco Talos reports on AiTM attacks that bypass MFA by using reverse proxies to steal credentials and session cookies, leading to account takeover.
Discover SessionShark, a sophisticated phishing toolkit designed to bypass Microsoft Office 365 multi-factor authentication by stealing session tokens.
Beware of phishing campaigns using file hosting services as a launching pad for business email compromise attacks. Stay informed and secure.
Uncover the details of the StormBamboo cyber attack: learn how this Chinese group infiltrated an ISP's systems to distribute malicious software updates.