phishing Archives • Daily CyberSecurity

UNC1151 Phishing Campaign Targets Belarus and Ukraine UNC1151 phishing campaign login page created by the Ghostwriter threat actor.

UNC1151 Phishing Campaign Targets Belarus and Ukraine

Do Son July 1, 2026

At a glance Actor: UNC1151 (Ghostwriter / Frosty Neighbor) Activity type: Spear-phishing and credential theft Targets: Belarusian...

Hospitality Malware Campaign Deploys Node.js Implant digital-hacker

Hospitality Malware Campaign Deploys Node.js Implant

Do Son June 30, 2026

At a glance Actor: Unknown threat actor Activity type: Phishing and multi-stage intrusion Targets: Hospitality and hotel...

Thailand Healthcare Malware Exploits RAR Archives Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Thailand Healthcare Malware Exploits RAR Archives

Do Son June 29, 2026

At a glance Actor: Suspected unknown threat cluster (tracked by Seqrite Lab) Activity Type: Spear-phishing, credential theft,...

US Offers $10 Million Reward for Russian Hacker Group UNC5792 UNC5792 Rewards for Justice $10 million reward Russian Signal phishing group

US Offers $10 Million Reward for Russian Hacker Group UNC5792

Do Son June 27, 2026

At a Glance Actor / group UNC5792 (linked to FSB Border Guards); UNC4221 (Russian military) Activity Phishing...

Remcos RAT delivered by a steganographic loader hidden in a bitmap image

Remcos RAT Delivered by a Steganographic Loader in Phishing Emails

Do Son June 26, 2026

At a Glance Malware family Remcos RAT (final payload), via a multi-stage .NET loader chain Threat actor...

Cyble Uncovers a FIFA 2026 Fraud Ecosystem With Nearly 4,000 Fake Domains FIFA 2026 fraud ecosystem mapped by Operation FanTrap with thousands of fake World Cup domains

FIFA 2026 fraud ecosystem mapped by Operation FanTrap with thousands of fake World Cup domains

Cyble Uncovers a FIFA 2026 Fraud Ecosystem With Nearly 4,000 Fake Domains

Do Son June 24, 2026

At a Glance Actors Multiple threat actors (no single named group); strong Chinese-language focus Activity FIFA-themed fraud:...

GitBait Phishing Campaign Targets 12 Mexican Banks via GitHub Pages GitBait phishing campaign abusing GitHub Pages and SheetBest API to steal Mexican banking credentials

GitBait phishing campaign abusing GitHub Pages and SheetBest API to steal Mexican banking credentials

GitBait Phishing Campaign Targets 12 Mexican Banks via GitHub Pages

Do Son June 23, 2026

At a glance Actor / group Unattributed, financially motivated operators (multiple GitHub accounts) Activity type Multi-brand bank...

FBI Warns of Traffic Distribution Systems in Cyber Attacks Diagram showing how cyber criminals use traffic distribution systems to redirect users to malicious websites.

Diagram showing how cyber criminals use traffic distribution systems to redirect users to malicious websites.

FBI Warns of Traffic Distribution Systems in Cyber Attacks

Do Son June 22, 2026

At a Glance Actor or Group: Unidentified cyber criminals Activity Type: Malicious website redirection and malware distribution...

SHEETCREEP Malware Abuses Google Sheets API for Command-and-Control DCMTK vulnerabilities enabling path traversal file write in the DICOM toolkit (CVE-2026-50003)

DCMTK vulnerabilities enabling path traversal file write in the DICOM toolkit (CVE-2026-50003)

SHEETCREEP Malware Abuses Google Sheets API for Command-and-Control

Do Son June 22, 2026

At a glance Malware family SHEETCREEP (SHEET#CREEP), C# .NET RAT Threat actor APT36 / Transparent Tribe (suspected,...

Device Code Phishing: Microsoft 365 Attack That Steals No Passwords

Do Son June 20, 2026

A clever new phishing technique skips the password entirely. ReversingLabs has uncovered an active device code phishing...

Hackers Capitalize on AI Hype With Sophisticated Attacks AI social engineering lures malvertising campaigns, credential theft, Vidar stealer

AI social engineering lures malvertising campaigns, credential theft, Vidar stealer

Hackers Capitalize on AI Hype With Sophisticated Attacks

Do Son June 16, 2026

As artificial intelligence continues to dominate tech headlines, cybercriminals are quickly cashing in on the hype. Recent...

UNK_DeadDrop Phishing Campaigns Target Developers

UNK_DeadDrop phishing campaigns Contagious Interview, Overlord malware

UNK_DeadDrop Phishing Campaigns Target Developers

Do Son June 16, 2026

In the ever-evolving landscape of cyber warfare, software developers have become prime targets for state-sponsored threat actors....

Fluffy Wolf phishing attacks PowerLoader malware, CVE-2023-38831, CVE-2022-30190, CVE-2024-21412

Fluffy Wolf Phishing Attacks Push PowerLoader Malware

Do Son June 16, 2026

Between March and May 2026, a notorious threat actor known as Fluffy Wolf ramped up its offensive...

Inside the Stealthy Agent Tesla Infection Chain CVE-2023-24059

Inside the Stealthy Agent Tesla Infection Chain

Do Son June 16, 2026

What looks like a simple payment receipt attachment can sometimes be the start of something far more...

Uncanny Automator Breach: Backdoored Plugin Build Hit WordPress Sites

Do Son June 15, 2026

A serious Uncanny Automator breach has exposed customer data and pushed a malicious plugin update to live...

Operation TaxShadow: Tax Phishing Hides In-Memory Malware Operation TaxShadow, tax phishing malware, in-memory malware, WebSocket C2

Operation TaxShadow: Tax Phishing Hides In-Memory Malware

Do Son June 12, 2026

A Fake Tax Notice Hides a Dangerous Payload Security researchers at CYFIRMA have uncovered Operation TaxShadow, a...

Massive Smishing Error524 Campaign Evades Traditional Security Filters Worldwide Smishing Error524 campaign Group-IB phishing report

Massive Smishing Error524 Campaign Evades Traditional Security Filters Worldwide

Do Son June 8, 2026

Overview of the Global Fraud Threat Cybercriminals are constantly finding new ways to bypass modern security defenses....

Football Fan Scams Surge Ahead of World Cup 2026 TASPEN, mobile malware North Korean IT Worker Fraud

Football Fan Scams Surge Ahead of World Cup 2026

Do Son May 31, 2026

Cybercriminals are actively launching football fan scams across various social media platforms. The upcoming FIFA World Cup...

Paper Werewolf Unleashed: Custom Stealers and AI-Assisted Loaders Target Global Industrial Hubs Paper Werewolf Espionage PaperGrabber Malware

Paper Werewolf Espionage PaperGrabber Malware

Paper Werewolf Unleashed: Custom Stealers and AI-Assisted Loaders Target Global Industrial Hubs

Do Son May 15, 2026

A new wave of cyber espionage has been unleashed against Russian industrial, financial, and transport sectors, revealing...

APT37’s New “Python-in-a-Cat” Malware Uses Environment Variable Obfuscation APT37 Phishing Campaign Python Malware Obfuscation

APT37’s New “Python-in-a-Cat” Malware Uses Environment Variable Obfuscation

Do Son May 12, 2026

In the world of cyberespionage, familiarity can be a fatal mistake for defenders. Just as security teams...

The “JobStealer” Trojan Hijacking Crypto Wallets via Fake Meetings JobStealer Trojan Crypto Wallet Theft

The “JobStealer” Trojan Hijacking Crypto Wallets via Fake Meetings

Do Son May 11, 2026

The job market is tough enough without a scheduled interview turning into a devastating cyber heist. According...

The Claude AI Trap: Sophos Uncovers Undocumented Backdoor Hiding in Fake “Pro” Lure Claude AI Malware DonutLoader Backdoor

The Claude AI Trap: Sophos Uncovers Undocumented Backdoor Hiding in Fake “Pro” Lure

Do Son May 11, 2026

As the popularity of generative AI tools soars, cybercriminals are increasingly capitalizing on the hype to deploy...