Do Son DoNot APT (APT-C-35) expands its cyber-espionage to a European foreign affairs ministry, using spear-phishing with Google Drive links to deliver the LoptikMod backdoor.
phishing
Cybereason exposes a deceptive malware campaign using compromised WordPress sites and the "ClickFix" technique to deliver weaponized NetSupport Manager RAT clients for remote access.
A phishing campaign impersonates HunCERT & WeTransfer, using LogoKit on AWS S3 with Cloudflare Turnstile to steal credentials. The active domain has zero VirusTotal detections.
ASEC uncovers XwormRAT delivered via phishing emails using steganography, hiding sophisticated .NET malware within JPG images for stealthy execution and full system control.
APT36 (Transparent Tribe) is now targeting Indian government agencies via BOSS Linux with spear-phishing. It uses malicious .desktop files to deploy Go-based malware for espionage.
Socket uncovers a sprawling network of malicious Firefox extensions, masquerading as games, VPNs, and tools, to hijack affiliate links, steal OAuth tokens, and reroute traffic.
A global e-commerce fraud campaign uses thousands of fake retail websites mimicking Apple, Nordstrom, and more, to steal credit card data, with roots tied to Chinese developers.
Fortinet exposes a DCRat campaign impersonating a Colombian government agency, using obfuscated multi-stage infection, steganography, and AMSI bypass to deliver the RAT.
A Chinese student was jailed in London for running a smishing campaign with an "SMS Blaster" hidden in his car, spoofing texts to steal data.
A report exposes Pakistani freelancers building websites distributing cracked software with stealer malware, leveraging a pay-per-install model and geopolitical loopholes.
North Korean APT Kimsuky is evolving its ClickFix tactics, using deceptive social engineering, fake job portals, and obfuscated PowerShell to compromise targets via spear-phishing campaigns.
Trustwave exposes Blind Eagle (APT-C-36) leveraging exposed infrastructure and VBS malware in phishing campaigns, targeting Colombian banks with blatant disregard for concealment.
A new Snake Keylogger campaign exploits an undocumented DLL sideloading technique via jsadebugd.exe to target energy and logistics sectors with fake oil deals.
Varonis uncovers a widespread phishing campaign abusing Microsoft 365's Direct Send, spoofing internal users to bypass email security and harvest credentials.
Netskope uncovers Sainbox RAT (Gh0stRAT variant) and Hidden rootkit delivered via fake software installers to Chinese users, leveraging DLL sideloading and sRDI for stealth.
Arctic Wolf Labs reveals UAC-0226 is using evolving GIFTEDCROOK malware in cyber-espionage against Ukrainian military and government, exfiltrating sensitive documents
China-aligned Hive0154 is using phishing lures themed around Tibetan issues to deploy the Pubload backdoor. Campaigns target the Tibetan community, US military
APT36 is targeting Indian defense personnel with sophisticated phishing, using fake NIC documents and multi-layered malware to steal sensitive data and evade analysis.
Taiwan's BitoPro exchange confirms North Korea's Lazarus Group stole $11.5M in crypto via phishing an employee and bypassing MFA on AWS infrastructure.
Hackers are weaponizing legitimately signed ConnectWise ScreenConnect installers by using Authenticode stuffing to deploy malware and fake updates, leveraging social engineering.
A new Android spyware campaign uses a "Wedding Invitation" APK via WhatsApp to install SpyMax RAT, stealing OTPs, contacts, and banking credentials from Indian users.
CoinTelegraph was hacked on June 22, 2025, with attackers injecting malicious JavaScript to display fake CTG airdrop pop-ups, stealing crypto by draining connected wallets.