Do Son A new report reveals that Stealerium, an open-source infostealer, is being used in phishing campaigns to steal credentials, crypto wallets, and sensitive data.
Credential Theft
A new report reveals a phishing campaign using fake ads and login pages to steal credentials from employees in the hospitality and vacation rental industry.
A new report reveals a rise in phishing campaigns that abuse email marketing platforms and cloud services to evade detection and steal credentials from victims.
A new zero-click NTLM flaw (CVE-2025-50154) bypasses Microsoft's patch for a similar vulnerability, allowing attackers to leak credentials and drop malware.
A new advanced phishing kit, PoisonSeed, bypasses MFA with AitM techniques to steal credentials and launch cryptocurrency scams. NVISO uncovers the tactics.
A new "EPM Poisoning" attack technique exploits a Windows RPC flaw (CVE-2025-49760) to hijack services, enabling unprivileged users to steal machine credentials and compromise Active Directory.
PyPI warns of a new phishing campaign using "pypj.org" to spoof its login page, tricking maintainers into revealing credentials. PyPI itself is not compromised.
Unit 42 reveals homograph phishing attacks exploiting visually similar characters to bypass defenses and deceive users. AI is amplifying this threat, making malicious emails highly convincing.
eSentire unveils Cyber Stealer, a new infostealer-botnet hybrid offered as a service, fusing data theft, remote control, crypto mining, and DDoS attacks into one scalable toolkit.
Hybrid Analysis reveals SHUYAL, a new stealthy infostealer that harvests browser credentials, system data, and screenshots, exfiltrating it all via a Telegram bot.
Four open-source packages on npm and PyPI (56k+ downloads) are secretly deploying sophisticated spyware, performing webcam surveillance, keylogging, and credential theft.
Katz Stealer is a dangerous MaaS info-stealer (starting at $100/month) that plunders digital identities, evades detection with stealthy techniques, and targets a vast array of sensitive data.
Microsoft and eSentire expose SilentRoute, a backdoored SonicWall SSL VPN NetExtender client distributed via SEO poisoning, stealing credentials and breaching networks.
Google's GTIG uncovers UNC6148 using stolen credentials and a new rootkit, OVERSTEP, to gain persistent access to end-of-life SonicWall SMA 100 series appliances.
Evalian uncovers a phishing campaign spoofing Red Bull job offers using legitimate services, low-cost VPS, and "slow kill" tactics to steal credentials via fake Facebook logins.
Anatsa, an advanced Android banking trojan, is targeting North America via Google Play. It steals credentials and conducts remote fraud through disguised apps and overlay attacks.
A phishing campaign impersonates HunCERT & WeTransfer, using LogoKit on AWS S3 with Cloudflare Turnstile to steal credentials. The active domain has zero VirusTotal detections.
A new Snake Keylogger campaign exploits an undocumented DLL sideloading technique via jsadebugd.exe to target energy and logistics sectors with fake oil deals.
SonicWall and Microsoft uncover a campaign distributing a trojanized NetExtender VPN client that steals credentials by bypassing certificate validation.
APT36 is targeting Indian defense personnel with sophisticated phishing, using fake NIC documents and multi-layered malware to steal sensitive data and evade analysis.
A rogue WordPress plugin is distributing multi-functional malware, performing credit card skimming, credential theft, ad fraud, and RCE through advanced evasion tactics.
The Prometei botnet is back with a stealthy Linux variant, actively mining Monero and stealing credentials. It uses DGA, custom UPX packing, and sophisticated anti-analysis techniques.