phishing Archives • Daily CyberSecurity

Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients Power BI phishing campaign delivering rogue ScreenConnect remote access clients

Power BI phishing campaign delivering rogue ScreenConnect remote access clients

Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients

Do Son October 9, 2026

At a Glance Malware family Rogue ScreenConnect clients and a defense evasion tool Threat actor Unknown; no...

Denmark CPR Data Breach Exposes CPR Numbers of 8.8 Million People Denmark CPR data breach - CPR numbers exposed for 8.8 million people in the national register

Denmark CPR data breach - CPR numbers exposed for 8.8 million people in the national register

Denmark CPR Data Breach Exposes CPR Numbers of 8.8 Million People

Do Son October 5, 2026

At a Glance Organization CPR-administrationen (Danish Central Person Register) Data exposed Names, addresses and CPR numbers, among...

Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor Star Blizzard RedFlick phishing campaign using scheduled tasks to install the CosmicPulse backdoor

Star Blizzard RedFlick phishing campaign using scheduled tasks to install the CosmicPulse backdoor

Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor

Do Son September 30, 2026

Since January 2026, a Russian state hacking group has sent at least 13 large phishing waves to...

SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections SVG phishing attacks using SVG smuggling to hide fake login pages inside image attachments

SVG phishing attacks using SVG smuggling to hide fake login pages inside image attachments

SVG Phishing Attacks Return in August as Symantec Logs 222,000 Detections

Do Son September 30, 2026

Symantec blocked 26,433 malicious SVG files in August 2026, nearly double its six-month average. That jump marks...

Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud Operation Master invoice fraud pipeline from GlobalProtect VPN breach to fake utility bills

Operation Master invoice fraud pipeline from GlobalProtect VPN breach to fake utility bills

Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud

Do Son September 29, 2026

Fake energy bills went out to Brazilian customers more than 2.4 million times this summer. Each one...

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts Redirect to legitimate device code sign-in page

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts

Do Son September 18, 2026

At a glance Actor or group: Unidentified cybercrime group (financially motivated threat actors) Activity type: Device code...

Smishing Triad Phishing Kit Exposed by Group-IB The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

Smishing Triad Phishing Kit Exposed by Group-IB

Do Son September 17, 2026

Security researchers at Group-IB recently published an investigation into a Smishing Triad phishing kit deployed across global...

Casbaneiro Banking Trojan Hits Latin American Banks Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Casbaneiro Banking Trojan Hits Latin American Banks

Do Son September 16, 2026

At a glance Malware family: Casbaneiro Threat actor: Unknown Latin American cybercriminal group (suspected attribution) Targets or...

Phishing Campaign Exploits Google Infrastructure for Data Theft A diagram showing how attackers abuse Google infrastructure for credential harvesting

A diagram showing how attackers abuse Google infrastructure for credential harvesting

Phishing Campaign Exploits Google Infrastructure for Data Theft

Do Son September 11, 2026

At a glance Threat researchers from the KnowBe4 Threat Lab uncovered a highly sophisticated phishing campaign recently....

Phishing Attackers Repurpose AI ASCII Smuggling to Evade Detection ASCII smuggling phishing evasion diagram showing invisible Unicode tags

ASCII smuggling phishing evasion diagram showing invisible Unicode tags

Phishing Attackers Repurpose AI ASCII Smuggling to Evade Detection

Do Son September 10, 2026

At a glance Field Details Actor or Group Unattributed cybercrime operators Activity Type Email filter evasion, credential...

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys Diagram showing how Kimsuky uses the AI agent opencode to generate phishing lures

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys

Do Son September 10, 2026

At a glance Field Details Actor or Group Kimsuky (North Korean state-sponsored threat group) Activity Type Spearphishing,...

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails

Do Son September 9, 2026

At a glance Field Details Actor or Group Unidentified phishing actors and cybercrime groups Activity Type Email...

Trezor Data Breach at ShipMonk Grows to 80,000 Customers Trezor data breach notice showing customer order data exposed through shipping provider ShipMonk in a third-party vendor breach

Trezor data breach notice showing customer order data exposed through shipping provider ShipMonk in a third-party vendor breach

Trezor Data Breach at ShipMonk Grows to 80,000 Customers

Do Son September 4, 2026

At a glance Organization Trezor (via shipping provider ShipMonk) Data exposed Names, emails, phone numbers, shipping addresses,...

Spring Ring Vishing Campaign Targets Microsoft Teams Anatomy of the Spring Ring vishing campaign and Microsoft Teams phishing attacks

Spring Ring Vishing Campaign Targets Microsoft Teams

Do Son September 4, 2026

At a glance Actor or group Unidentified attackers Activity type Voice phishing via Microsoft Teams Targets or...

AiTM Phishing Campaign Targets Healthcare via Account Takeovers Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

AiTM Phishing Campaign Targets Healthcare via Account Takeovers

Do Son September 4, 2026

At a Glance Category Details Threat Actor / Kit Sneaky 2FA (suspected Phishing-as-a-Service kit) Activity Type Adversary-in-the-Middle...

SynkLoader Malware Deploys Multi-Language Attack Tools C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

SynkLoader Malware Deploys Multi-Language Attack Tools

Do Son August 28, 2026

At a glance Factor Details Malware Family SynkLoader Threat Actor Suspected initial access broker or ransomware affiliate...

Google Tracks Russian Cyber Espionage Clusters

Google tracks suspected Russian cyber espionage clusters and Russian cyber espionage clusters abusing authentication flows

Google Tracks Russian Cyber Espionage Clusters

Do Son August 28, 2026

At a glance Factor Details Actor or Group UNC6293, UNC7005 (STORM-2945), and UNC5976 (Suspected Russian nexus) Activity...

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets

Do Son August 21, 2026

At a glance Actor Unnamed crypto fraud operator (single host) Activity type Phishing, vishing, fake wallet malware,...

Cisco Talos Discovers JWR Phishing Framework JWR phishing framework architecture and JWR phishing framework analysis diagram

Cisco Talos Discovers JWR Phishing Framework

Do Son August 20, 2026

At a glance Actor or group: Suspected Chinese-speaking cybercriminals. Activity type: Phishing-as-a-Service (PhaaS). Targets or victims: Shoppers...

SafePal Data Breach Exposes Order Information of 39,798 Customers SafePal data breach order information exposed 39798 customers authorization flaw phishing risk crypto wallet

SafePal data breach order information exposed 39798 customers authorization flaw phishing risk crypto wallet

SafePal Data Breach Exposes Order Information of 39,798 Customers

Do Son August 18, 2026

At a Glance Organization SafePal (crypto hardware wallet maker) Data exposed Names, emails, shipping addresses, phone numbers,...

Kimsuky AI Operations Reveal New Cyber Tactics Kimsuky AI operations flow diagram by North Korea threat actor

Kimsuky AI Operations Reveal New Cyber Tactics

Do Son August 18, 2026

At a glance Actor: Kimsuky (suspected North Korea threat actor) Activity type: Spear phishing and AI experimentation...

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT

Do Son August 18, 2026

At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a...