Do Son A new report reveals APT36 (Transparent Tribe) is escalating cyber-espionage against India, using phishing and .desktop files to deploy the Poseidon backdoor for long-term access.
phishing
Proofpoint reveals an AiTM phishing campaign using fake OAuth apps and the Tycoon platform to bypass MFA, hijack Microsoft 365 accounts, and steal credentials.
Cloudflare exposes a phishing campaign that abuses link wrapping services like Proofpoint and Intermedia, making malicious URLs appear legitimate to bypass security and trick users.
Cisco Talos' Q2 2025 report reveals phishing is the top access method. Ransomware, including Qilin, dominated, with a surprising trend of attackers abusing PowerShell 1.0 to evade security.
Trellix uncovers 0bj3ctivityStealer, a sophisticated info-stealer using phishing, custom PowerShell, and steganography to evade detection and exfiltrate sensitive data.
Cyble uncovers RedHook, a new Android banking trojan targeting Vietnamese users with sophisticated phishing, remote access, screen capture, and keylogging for full device takeover.
PyPI warns of a new phishing campaign using "pypj.org" to spoof its login page, tricking maintainers into revealing credentials. PyPI itself is not compromised.
Unit 42 reveals homograph phishing attacks exploiting visually similar characters to bypass defenses and deceive users. AI is amplifying this threat, making malicious emails highly convincing.
A phishing attack compromised the 'is' npm library maintainer, leading to malicious versions being published with backdoors for remote code execution. Update immediately!
Weeks after a major takedown, Lumma Stealer has resurfaced with new stealth tactics, exploiting cracked software, fake CAPTCHAs, and GitHub to resume its credential-stealing operations.
Trustwave uncovers an Android malware cluster using fake Facebook & TikTok apps to lure victims via brand impersonation, abusing permissions for data collection and traffic monetization.
LARVA-208 is targeting Web3 developers with fake AI platforms (like Norlax AI) and job lures to deploy Fickle Stealer malware, aiming to steal crypto and sensitive data.
Scanception campaign uses QR code-based phishing in PDFs to bypass traditional security, targeting high-value industries globally for credential and 2FA theft.
Proofpoint reveals a surge in China-aligned cyber espionage targeting Taiwan's semiconductor industry with spearphishing, Cobalt Strike, and new malware like Voldemort.
Microsoft and eSentire expose SilentRoute, a backdoored SonicWall SSL VPN NetExtender client distributed via SEO poisoning, stealing credentials and breaching networks.
A sophisticated phishing campaign using a typosquatting domain (npnjs.com) stole an npm maintainer's credentials, injecting malware into popular packages like eslint-config-prettier and synckit.
Cisco Talos uncovers a sophisticated MaaS operation leveraging public GitHub repos and the Emmenhtal loader to distribute Amadey, SmokeLoader, and AsyncRAT, often via phishing.
McAfee warns of a new Android malware campaign targeting Bangladeshi expats with fake remittance apps like TapTap Send, stealing personal and financial data, including photo IDs.
The Rainbow Hyena threat cluster is unleashing PhantomRemote, a new backdoor, in phishing attacks against Russia's healthcare and IT sectors, leveraging compromised emails.
MoonPay CEO Ivan Soto-Wright lost $250K in a crypto scam where perpetrators impersonated a Trump Inaugural Committee co-chairman, highlighting executive-level deception.
Evalian uncovers a phishing campaign spoofing Red Bull job offers using legitimate services, low-cost VPS, and "slow kill" tactics to steal credentials via fake Facebook logins.
Google exposes a vast phishing campaign hijacking Booking.com reservation chats to steal credit card details from travelers, impacting thousands globally since Nov 2023.