Do Son BlueDelta (APT28) is targeting UKR.NET users with a sophisticated phishing campaign using ngrok and Mocky to bypass security and steal 2FA codes.
Credential Theft
Phantom v3.5 info-stealer targets passwords and crypto via a fake Adobe installer. It uses SMTP to exfiltrate data directly to attackers.
BlackForce, a new PhaaS kit, is being sold for €300, using React/React Router to disguise its code. It utilizes stateful sessions and MitB to bypass MFA in real time. Update to V5 shows rapid evolution.
CISA warned of a Critical (CVSS 9.4) flaw in D-Link DCS-F5614-L1 cameras. Missing Authentication allows attackers to bypass login, steal admin credentials, and hijack video feeds. Patch immediately.
A Rust supply chain attack used typosquatting (finch-rust) and an unpinned dependency to silently update the sha-rust payload over two weeks, stealing credentials and private keys from developers.
Devolutions Server patched a Critical SQLi flaw (CVE-2025-13757) allowing authenticated users to exfiltrate or modify data via log parameters. Update to v2025.2.21 or v2025.3.9 immediately.
eSentire exposed the Amatera Stealer campaign using ClickFix social engineering to deliver multi-stage PowerShell. The malware patches AMSI in memory and deploys NetSupport RAT for remote access.
Group-IB exposed an automated PhaaS kit that impersonates Aruba S.p.A. to steal credentials, credit card details, and OTPs. The multi-stage scam uses a CAPTCHA filter and Telegram for real-time exfiltration.
CRIL exposed fileless phishing using malicious HTML attachments. Credentials are stolen via a fake Adobe login and instantly exfiltrated to Telegram bots, bypassing traditional domain filters.
Proofpoint exposed UNK_SmudgedSerpent, an APT using RMM tools (PDQConnect) and M365 spoofs in targeted phishing campaigns against academics and foreign policy experts with complex Iranian political lures.
Koi Security exposed PhantomRaven, an npm supply chain attack using 126 packages. It leverages Remote Dynamic Dependencies (RDD) and AI slopsquatting to steal GitHub/CI/CD secrets from 86,000+ downloads.
Socket exposed an npm typosquat campaign using 10 fake packages (Netherеum.All). The malicious postinstall script deploys a 24MB PyInstaller stealer after prompting a fake CAPTCHA.
HelixGuard exposed a VSCode supply chain attack using 12 malicious extensions. They steal source code, capture screenshots, and open reverse shells via Ngrok and AWS EC2 to compromise developers.
A Critical (CVSS 10.0) flaw (CVE-2025-61481) in MikroTik RouterOS/SwOS exposes the WebFig management interface over unencrypted HTTP by default, allowing remote credential theft via MitM.
Cisco Talos reports Qilin RaaS is one of 2025’s biggest threats (40+ victims/month), abusing Cyberduck and Backblaze for data exfiltration and exploiting WDigest to steal admin passwords.
A sophisticated Lumma Infostealer MaaS campaign targets users with pirated software installers. It uses NSIS/AutoIt scripts, Process Hollowing, and MEGA cloud to steal credentials from browsers and crypto wallets.
SEQRITE exposed CAPI, a .NET trojan targeting Russian FinTech with malicious LNK resumes. It uses rundll32 for execution and a hidden "Security" scheduled task for persistence.
Akira ransomware is actively exploiting the unpatched/misconfigured SonicWall flaw (CVE-2024-40766) and using the rare "UnPAC the Hash" Kerberos technique for lateral movement.
Point Wild uncovered Shuyal Stealer, a sophisticated infostealer targeting 19 browsers. It disables Windows Task Manager via a registry key and exfiltrates data via Telegram Bot API.
APT SideWinder launched Operation SouthNet, targeting South Asia with over 50 malicious phishing portals hosted on Netlify and pages.dev to steal government and military credentials.
The TamperedChef malware campaign used a trojanized PDF editor, delivered via malvertising, to stealthily harvest browser credentials after operating undetected for two months.
Cisco Talos exposed UAT-8099, a Chinese group compromising IIS servers for SEO fraud, using BadIIS malware and Cobalt Strike to steal credentials and manipulate search rankings.