phishing Archives • Daily CyberSecurity

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts Redirect to legitimate device code sign-in page

GhostCode Phishing Kit Targets Enterprise Microsoft Accounts

Do Son September 18, 2026

At a glance Actor or group: Unidentified cybercrime group (financially motivated threat actors) Activity type: Device code...

Smishing Triad Phishing Kit Exposed by Group-IB The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

The new Smishing Triad phishing kit architecture and Smishing Triad phishing kit attack diagram

Smishing Triad Phishing Kit Exposed by Group-IB

Do Son September 17, 2026

Security researchers at Group-IB recently published an investigation into a Smishing Triad phishing kit deployed across global...

Casbaneiro Banking Trojan Hits Latin American Banks Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Casbaneiro Banking Trojan Hits Latin American Banks

Do Son September 16, 2026

At a glance Malware family: Casbaneiro Threat actor: Unknown Latin American cybercriminal group (suspected attribution) Targets or...

Phishing Campaign Exploits Google Infrastructure for Data Theft A diagram showing how attackers abuse Google infrastructure for credential harvesting

A diagram showing how attackers abuse Google infrastructure for credential harvesting

Phishing Campaign Exploits Google Infrastructure for Data Theft

Do Son September 11, 2026

At a glance Threat researchers from the KnowBe4 Threat Lab uncovered a highly sophisticated phishing campaign recently....

Phishing Attackers Repurpose AI ASCII Smuggling to Evade Detection ASCII smuggling phishing evasion diagram showing invisible Unicode tags

ASCII smuggling phishing evasion diagram showing invisible Unicode tags

Phishing Attackers Repurpose AI ASCII Smuggling to Evade Detection

Do Son September 10, 2026

At a glance Field Details Actor or Group Unattributed cybercrime operators Activity Type Email filter evasion, credential...

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys Diagram showing how Kimsuky uses the AI agent opencode to generate phishing lures

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys

Do Son September 10, 2026

At a glance Field Details Actor or Group Kimsuky (North Korean state-sponsored threat group) Activity Type Spearphishing,...

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Diagram illustrating the Microsoft 365 RejectDirectSend bypass method

Microsoft 365 RejectDirectSend Bypass Lets Attackers Spoof Internal Emails

Do Son September 9, 2026

At a glance Field Details Actor or Group Unidentified phishing actors and cybercrime groups Activity Type Email...

Trezor Data Breach at ShipMonk Grows to 80,000 Customers Trezor data breach notice showing customer order data exposed through shipping provider ShipMonk in a third-party vendor breach

Trezor data breach notice showing customer order data exposed through shipping provider ShipMonk in a third-party vendor breach

Trezor Data Breach at ShipMonk Grows to 80,000 Customers

Do Son September 4, 2026

At a glance Organization Trezor (via shipping provider ShipMonk) Data exposed Names, emails, phone numbers, shipping addresses,...

Spring Ring Vishing Campaign Targets Microsoft Teams Anatomy of the Spring Ring vishing campaign and Microsoft Teams phishing attacks

Spring Ring Vishing Campaign Targets Microsoft Teams

Do Son September 4, 2026

At a glance Actor or group Unidentified attackers Activity type Voice phishing via Microsoft Teams Targets or...

AiTM Phishing Campaign Targets Healthcare via Account Takeovers Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

Layoff Phishing Scam Remcos RAT Malware Aruba Phishing, Phishing-as-a-Service PyPI, phishing CVE-2024-25608 PyPI Phishing, Credential Theft

AiTM Phishing Campaign Targets Healthcare via Account Takeovers

Do Son September 4, 2026

At a Glance Category Details Threat Actor / Kit Sneaky 2FA (suspected Phishing-as-a-Service kit) Activity Type Adversary-in-the-Middle...

SynkLoader Malware Deploys Multi-Language Attack Tools C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

SynkLoader Malware Deploys Multi-Language Attack Tools

Do Son August 28, 2026

At a glance Factor Details Malware Family SynkLoader Threat Actor Suspected initial access broker or ransomware affiliate...

Google Tracks Russian Cyber Espionage Clusters

Google tracks suspected Russian cyber espionage clusters and Russian cyber espionage clusters abusing authentication flows

Google Tracks Russian Cyber Espionage Clusters

Do Son August 28, 2026

At a glance Factor Details Actor or Group UNC6293, UNC7005 (STORM-2945), and UNC5976 (Suspected Russian nexus) Activity...

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX crypto fraud attack chain showing vishing calls and fake wallet apps stealing seed phrases

Operation ASTERIX: Crypto Scam Used AI and Fake Wallets

Do Son August 21, 2026

At a glance Actor Unnamed crypto fraud operator (single host) Activity type Phishing, vishing, fake wallet malware,...

Cisco Talos Discovers JWR Phishing Framework JWR phishing framework architecture and JWR phishing framework analysis diagram

Cisco Talos Discovers JWR Phishing Framework

Do Son August 20, 2026

At a glance Actor or group: Suspected Chinese-speaking cybercriminals. Activity type: Phishing-as-a-Service (PhaaS). Targets or victims: Shoppers...

SafePal Data Breach Exposes Order Information of 39,798 Customers SafePal data breach order information exposed 39798 customers authorization flaw phishing risk crypto wallet

SafePal data breach order information exposed 39798 customers authorization flaw phishing risk crypto wallet

SafePal Data Breach Exposes Order Information of 39,798 Customers

Do Son August 18, 2026

At a Glance Organization SafePal (crypto hardware wallet maker) Data exposed Names, emails, shipping addresses, phone numbers,...

Kimsuky AI Operations Reveal New Cyber Tactics Kimsuky AI operations flow diagram by North Korea threat actor

Kimsuky AI Operations Reveal New Cyber Tactics

Do Son August 18, 2026

At a glance Actor: Kimsuky (suspected North Korea threat actor) Activity type: Spear phishing and AI experimentation...

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT

Do Son August 18, 2026

At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a...

DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers DEF CON hacker fake WiFi hotspot attack Delta flight 591 phishing Google credentials deauthentication

DEF CON hacker fake WiFi hotspot attack Delta flight 591 phishing Google credentials deauthentication

DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers

Do Son August 15, 2026

Delta Air Lines is currently investigating the appearance of an unauthorized wireless network aboard Flight 591, which...

Greatness PhaaS Platform Steals Microsoft 365 Tokens Past MFA Greatness PhaaS platform operator panel for the AiTM phishing kit targeting Microsoft 365

Greatness PhaaS platform operator panel for the AiTM phishing kit targeting Microsoft 365

Greatness PhaaS Platform Steals Microsoft 365 Tokens Past MFA

Do Son August 10, 2026

At a glance Actor or group Operators of the Greatness kit, also tracked as HoneyStorm Activity type...

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN campaign infection chain abusing ScreenConnect RMM through fake Zoom update phishing lures

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM for Stealthy Remote Access

Do Son August 7, 2026

At a Glance Attribute Detail Actor / group Unattributed threat actor (tracked by Securonix as SMOKE#SCREEN) Activity...

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files

Do Son July 22, 2026

A global phishing campaign hides a low-detection Lua loader inside fake .ttf font files to drop Remcos,...

Nextcloud Website Suffers Cyberattack and Phishing Redirect Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud website hacked showing unauthorized Cloudbox phishing redirect and wp2shell vulnerability.

Nextcloud Website Suffers Cyberattack and Phishing Redirect

Do Son July 21, 2026

Initial Attack Details The renowned open-source private cloud software, Nextcloud, suffered a cyberattack yesterday morning. This incident...

Critical Alert 4 Active Exploits Detected Today