phishing Archives • Daily CyberSecurity

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files

Do Son July 22, 2026

A global phishing campaign hides a low-detection Lua loader inside fake .ttf font files to drop Remcos,...

Nextcloud Website Suffers Cyberattack and Phishing Redirect Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud Website Suffers Cyberattack and Phishing Redirect

Do Son July 21, 2026

Initial Attack Details The renowned open-source private cloud software, Nextcloud, suffered a cyberattack yesterday morning. This incident...

Misconfigured Server Exposes Three AiTM Phishing Operators Open directory exposing three AiTM phishing operators using Evilginx MFA bypass tooling

Open directory exposing three AiTM phishing operators using Evilginx MFA bypass tooling

Misconfigured Server Exposes Three AiTM Phishing Operators

Do Son July 17, 2026

At a glance Actor / group codemado, mail-argenta, saroula01 (online aliases) Activity AiTM phishing and OAuth Device...

Clubfoot Wolf Hits Russian Firms With NetSupport Manager exfiltrating AWS credentials - fabrice package

Clubfoot Wolf Hits Russian Firms With NetSupport Manager

Do Son July 15, 2026

At a glance Actor / group Clubfoot Wolf (cluster tracked by BI.ZONE) Activity type Phishing that deploys...

Node.js Backdoor Hides Its C2 on the TON Blockchain Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Node.js Backdoor Hides Its C2 on the TON Blockchain

Do Son July 15, 2026

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no...

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom squatting attacker registering AI hallucinated domains predicted by LLM chatbots

Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns

Do Son July 8, 2026

At a glance Details Activity type Phantom squatting: registering AI hallucinated domains for phishing and malware Actors...

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat

Do Son July 8, 2026

At a Glance Malware type Native Messaging backdoor with a malicious Chrome extension Threat actor Unattributed Targets...

Ousaban Banking Trojan Targets Spain and Portugal Ousaban banking trojan infection chain diagram showing malware delivery methods.

Ousaban Banking Trojan Targets Spain and Portugal

Do Son July 6, 2026

At a glance: Malware Family: Ousaban Threat Actor: Unknown (Suspected Latin American origin) Targets/Victims: Banking customers in...

UNC1151 Phishing Campaign Targets Belarus and Ukraine UNC1151 phishing campaign login page created by the Ghostwriter threat actor.

UNC1151 Phishing Campaign Targets Belarus and Ukraine

Do Son July 1, 2026

At a glance Actor: UNC1151 (Ghostwriter / Frosty Neighbor) Activity type: Spear-phishing and credential theft Targets: Belarusian...

Hospitality Malware Campaign Deploys Node.js Implant digital-hacker

Hospitality Malware Campaign Deploys Node.js Implant

Do Son June 30, 2026

At a glance Actor: Unknown threat actor Activity type: Phishing and multi-stage intrusion Targets: Hospitality and hotel...

Thailand Healthcare Malware Exploits RAR Archives Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Diagram showing the Thailand healthcare malware infection chain via RAR archive phishing

Thailand Healthcare Malware Exploits RAR Archives

Do Son June 29, 2026

At a glance Actor: Suspected unknown threat cluster (tracked by Seqrite Lab) Activity Type: Spear-phishing, credential theft,...

US Offers $10 Million Reward for Russian Hacker Group UNC5792 UNC5792 Rewards for Justice $10 million reward Russian Signal phishing group

US Offers $10 Million Reward for Russian Hacker Group UNC5792

Do Son June 27, 2026

At a Glance Actor / group UNC5792 (linked to FSB Border Guards); UNC4221 (Russian military) Activity Phishing...

Remcos RAT delivered by a steganographic loader hidden in a bitmap image

Remcos RAT Delivered by a Steganographic Loader in Phishing Emails

Do Son June 26, 2026

At a Glance Malware family Remcos RAT (final payload), via a multi-stage .NET loader chain Threat actor...

Cyble Uncovers a FIFA 2026 Fraud Ecosystem With Nearly 4,000 Fake Domains FIFA 2026 fraud ecosystem mapped by Operation FanTrap with thousands of fake World Cup domains

FIFA 2026 fraud ecosystem mapped by Operation FanTrap with thousands of fake World Cup domains

Cyble Uncovers a FIFA 2026 Fraud Ecosystem With Nearly 4,000 Fake Domains

Do Son June 24, 2026

At a Glance Actors Multiple threat actors (no single named group); strong Chinese-language focus Activity FIFA-themed fraud:...

GitBait Phishing Campaign Targets 12 Mexican Banks via GitHub Pages GitBait phishing campaign abusing GitHub Pages and SheetBest API to steal Mexican banking credentials

GitBait phishing campaign abusing GitHub Pages and SheetBest API to steal Mexican banking credentials

GitBait Phishing Campaign Targets 12 Mexican Banks via GitHub Pages

Do Son June 23, 2026

At a glance Actor / group Unattributed, financially motivated operators (multiple GitHub accounts) Activity type Multi-brand bank...

FBI Warns of Traffic Distribution Systems in Cyber Attacks Diagram showing how cyber criminals use traffic distribution systems to redirect users to malicious websites.

Diagram showing how cyber criminals use traffic distribution systems to redirect users to malicious websites.

FBI Warns of Traffic Distribution Systems in Cyber Attacks

Do Son June 22, 2026

At a Glance Actor or Group: Unidentified cyber criminals Activity Type: Malicious website redirection and malware distribution...

SHEETCREEP Malware Abuses Google Sheets API for Command-and-Control DCMTK vulnerabilities enabling path traversal file write in the DICOM toolkit (CVE-2026-50003)

DCMTK vulnerabilities enabling path traversal file write in the DICOM toolkit (CVE-2026-50003)

SHEETCREEP Malware Abuses Google Sheets API for Command-and-Control

Do Son June 22, 2026

At a glance Malware family SHEETCREEP (SHEET#CREEP), C# .NET RAT Threat actor APT36 / Transparent Tribe (suspected,...

Device Code Phishing: Microsoft 365 Attack That Steals No Passwords

Do Son June 20, 2026

A clever new phishing technique skips the password entirely. ReversingLabs has uncovered an active device code phishing...

Hackers Capitalize on AI Hype With Sophisticated Attacks AI social engineering lures malvertising campaigns, credential theft, Vidar stealer

AI social engineering lures malvertising campaigns, credential theft, Vidar stealer

Hackers Capitalize on AI Hype With Sophisticated Attacks

Do Son June 16, 2026

As artificial intelligence continues to dominate tech headlines, cybercriminals are quickly cashing in on the hype. Recent...

UNK_DeadDrop Phishing Campaigns Target Developers

UNK_DeadDrop phishing campaigns Contagious Interview, Overlord malware

UNK_DeadDrop Phishing Campaigns Target Developers

Do Son June 16, 2026

In the ever-evolving landscape of cyber warfare, software developers have become prime targets for state-sponsored threat actors....

Fluffy Wolf phishing attacks PowerLoader malware, CVE-2023-38831, CVE-2022-30190, CVE-2024-21412

Fluffy Wolf Phishing Attacks Push PowerLoader Malware

Do Son June 16, 2026

Between March and May 2026, a notorious threat actor known as Fluffy Wolf ramped up its offensive...

Inside the Stealthy Agent Tesla Infection Chain CVE-2023-24059

Inside the Stealthy Agent Tesla Infection Chain

Do Son June 16, 2026

What looks like a simple payment receipt attachment can sometimes be the start of something far more...