phishing Archives • Daily CyberSecurity

SynkLoader Malware Deploys Multi-Language Attack Tools C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

SynkLoader Malware Deploys Multi-Language Attack Tools

Do Son August 28, 2026

At a glance Factor Details Malware Family SynkLoader Threat Actor Suspected initial access broker or ransomware affiliate...

Google Tracks Russian Cyber Espionage Clusters

Google tracks suspected Russian cyber espionage clusters and Russian cyber espionage clusters abusing authentication flows

Google Tracks Russian Cyber Espionage Clusters

Do Son August 28, 2026

At a glance Factor Details Actor or Group UNC6293, UNC7005 (STORM-2945), and UNC5976 (Suspected Russian nexus) Activity...

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets

Do Son August 21, 2026

At a glance Actor Unnamed crypto fraud operator (single host) Activity type Phishing, vishing, fake wallet malware,...

Cisco Talos Discovers JWR Phishing Framework JWR phishing framework architecture and JWR phishing framework analysis diagram

Cisco Talos Discovers JWR Phishing Framework

Do Son August 20, 2026

At a glance Actor or group: Suspected Chinese-speaking cybercriminals. Activity type: Phishing-as-a-Service (PhaaS). Targets or victims: Shoppers...

SafePal Data Breach Exposes Order Information of 39,798 Customers SafePal data breach order information exposed 39798 customers authorization flaw phishing risk crypto wallet

SafePal data breach order information exposed 39798 customers authorization flaw phishing risk crypto wallet

SafePal Data Breach Exposes Order Information of 39,798 Customers

Do Son August 18, 2026

At a Glance Organization SafePal (crypto hardware wallet maker) Data exposed Names, emails, shipping addresses, phone numbers,...

Kimsuky AI Operations Reveal New Cyber Tactics Kimsuky AI operations flow diagram by North Korea threat actor

Kimsuky AI Operations Reveal New Cyber Tactics

Do Son August 18, 2026

At a glance Actor: Kimsuky (suspected North Korea threat actor) Activity type: Spear phishing and AI experimentation...

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT

Do Son August 18, 2026

At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a...

DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers DEF CON hacker fake WiFi hotspot attack Delta flight 591 phishing Google credentials deauthentication

DEF CON hacker fake WiFi hotspot attack Delta flight 591 phishing Google credentials deauthentication

DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers

Do Son August 15, 2026

Delta Air Lines is currently investigating the appearance of an unauthorized wireless network aboard Flight 591, which...

Greatness PhaaS Platform Steals Microsoft 365 Tokens Past MFA Greatness PhaaS platform operator panel for the AiTM phishing kit targeting Microsoft 365

Greatness PhaaS platform operator panel for the AiTM phishing kit targeting Microsoft 365

Greatness PhaaS Platform Steals Microsoft 365 Tokens Past MFA

Do Son August 10, 2026

At a glance Actor or group Operators of the Greatness kit, also tracked as HoneyStorm Activity type...

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access

Do Son August 7, 2026

At a Glance Attribute Detail Actor / group Unattributed threat actor (tracked by Securonix as SMOKE#SCREEN) Activity...

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files

Do Son July 22, 2026

A global phishing campaign hides a low-detection Lua loader inside fake .ttf font files to drop Remcos,...

Nextcloud Website Suffers Cyberattack and Phishing Redirect Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud Website Suffers Cyberattack and Phishing Redirect

Do Son July 21, 2026

Initial Attack Details The renowned open-source private cloud software, Nextcloud, suffered a cyberattack yesterday morning. This incident...

Misconfigured Server Exposes Three AiTM Phishing Operators Open directory exposing three AiTM phishing operators using Evilginx MFA bypass tooling

Open directory exposing three AiTM phishing operators using Evilginx MFA bypass tooling

Misconfigured Server Exposes Three AiTM Phishing Operators

Do Son July 17, 2026

At a glance Actor / group codemado, mail-argenta, saroula01 (online aliases) Activity AiTM phishing and OAuth Device...

Clubfoot Wolf Hits Russian Firms With NetSupport Manager exfiltrating AWS credentials - fabrice package

Clubfoot Wolf Hits Russian Firms With NetSupport Manager

Do Son July 15, 2026

At a glance Actor / group Clubfoot Wolf (cluster tracked by BI.ZONE) Activity type Phishing that deploys...

Node.js Backdoor Hides Its C2 on the TON Blockchain Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Node.js Backdoor Hides Its C2 on the TON Blockchain

Do Son July 15, 2026

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no...

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns

Do Son July 8, 2026

At a glance Details Activity type Phantom squatting: registering AI hallucinated domains for phishing and malware Actors...

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat

Do Son July 8, 2026

At a Glance Malware type Native Messaging backdoor with a malicious Chrome extension Threat actor Unattributed Targets...

Ousaban Banking Trojan Targets Spain and Portugal Ousaban banking trojan infection chain diagram showing malware delivery methods.

Ousaban Banking Trojan Targets Spain and Portugal

Do Son July 6, 2026

At a glance: Malware Family: Ousaban Threat Actor: Unknown (Suspected Latin American origin) Targets/Victims: Banking customers in...

UNC1151 Phishing Campaign Targets Belarus and Ukraine UNC1151 phishing campaign login page created by the Ghostwriter threat actor.

UNC1151 Phishing Campaign Targets Belarus and Ukraine

Do Son July 1, 2026

At a glance Actor: UNC1151 (Ghostwriter / Frosty Neighbor) Activity type: Spear-phishing and credential theft Targets: Belarusian...

Hospitality Malware Campaign Deploys Node.js Implant North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Hospitality Malware Campaign Deploys Node.js Implant

Do Son June 30, 2026

At a glance Actor: Unknown threat actor Activity type: Phishing and multi-stage intrusion Targets: Hospitality and hotel...

Thailand Healthcare Malware Exploits RAR Archives Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Thailand Healthcare Malware Exploits RAR Archives

Do Son June 29, 2026

At a glance Actor: Suspected unknown threat cluster (tracked by Seqrite Lab) Activity Type: Spear-phishing, credential theft,...

US Offers $10 Million Reward for Russian Hacker Group UNC5792 UNC5792 Rewards for Justice $10 million reward Russian Signal phishing group

US Offers $10 Million Reward for Russian Hacker Group UNC5792

Do Son June 27, 2026

At a Glance Actor / group UNC5792 (linked to FSB Border Guards); UNC4221 (Russian military) Activity Phishing...

Critical Alert 7 Active Exploits Detected Today