Do Son Following a data leak, emails from the French Ministry of the Interior's domain invited hackers to the 'new' BreachForums. The community warns it is likely a highly sophisticated honeypot.
phishing
Operation MoneyMount-ISO targets Russian financial institutions with a Phantom Stealer info-stealer hidden in an ISO file. The malware steals crypto wallets, browser data, and uses a keylogger. It has a SelfDestruct function for evasion.
SHADOW-VOID-042 impersonated Trend Micro via fake security advisories to breach defense, energy, and chemical firms. Tactics align with Void Rabisu (ROMCOM), using HR lures and targeted exploits.
A sophisticated phishing campaign uses salary review lures to target M365/Okta SSO. Attackers proxy the login page to preserve customization and hijack critical session tokens via dynamic redirection.
OpenAI reveals a data breach at analytics vendor Mixpanel exposed API user emails and IDs. OpenAI has terminated the partnership. Watch out for phishing.
Unit 42 reveals how malicious LLMs like WormGPT 4 and KawaiiGPT weaponize AI to automate ransomware and phishing, democratizing cybercrime for all.
RelayNFC is a new, zero-detection Android malware targeting Brazil that turns the victim's phone into a remote card reader to steal data and complete real-time contactless payments.
CISA, NSA, and FBI released a guide to dismantle Bulletproof Hosting (BPH) networks. It advises ISPs on precision filtering and stricter vetting to curb infrastructure used by ransomware and phishing campaigns.
Dutch police seized 250 servers from a bulletproof hosting provider (CrazyRDP) used by cybercriminals since 2022, facilitating over 80 cybercrime investigations.
A new macOS stealer (Nova) uses LaunchAgents to install a modular backdoor. Its main function is replacing legitimate Ledger/Trezor apps with phishing clones that exfiltrate seed phrases as users type.
Group-IB exposed an automated PhaaS kit that impersonates Aruba S.p.A. to steal credentials, credit card details, and OTPs. The multi-stage scam uses a CAPTCHA filter and Telegram for real-time exfiltration.
CRIL exposed fileless phishing using malicious HTML attachments. Credentials are stolen via a fake Adobe login and instantly exfiltrated to Telegram bots, bypassing traditional domain filters.
Zimperium exposed Fantasy Hub, a Russian MaaS Android RAT. It uses a Telegram bot for subscriptions and WebRTC to covertly stream live video and audio, targeting Russian banks with dynamic overlays.
Sekoia exposed a campaign exploiting compromised Booking.com/Expedia accounts to deliver PureRAT malware via a ClickFix lure. Attackers use authentic reservation details to steal guest credentials.
Proofpoint exposed UNK_SmudgedSerpent, an APT using RMM tools (PDQConnect) and M365 spoofs in targeted phishing campaigns against academics and foreign policy experts with complex Iranian political lures.
Google exposed UNC6229, a Vietnam-based group running "Fake Career" phishing on job boards. They use fake lures to compromise digital advertising accounts and corporate credentials for profit.
Unit 42 exposed Jingle Thief, a Morocco-linked group exploiting Microsoft 365 credentials via phishing. They maintain 10-month access to issue fraudulent gift cards worth hundreds of thousands of dollars.
Unit 42 exposed PhantomVAI Loader, a stealthy MaaS tool that uses steganography (hiding DLL in images) and VM detection to deploy Katz Stealer in MSBuild.exe and exfiltrate crypto credentials globally.
A sophisticated GhostBat RAT campaign targets Indian users by spoofing RTO apps (mParivahan). The malware steals UPI credentials and OTPs via phishing pages and uses a Telegram bot for C2.
Proofpoint exposed TA585, a self-reliant group that uses ClickFix phishing and private C2 infrastructure (CoreSecThree) to deploy MonsterV2 RAT (available for up to $2,000/month) with Hidden VNC capabilities.
Microsoft updated Edge’s IE Mode policy after a Chakra zero-day was exploited via phishing. Users must now manually enable and whitelist domains to prevent remote device compromise.
Seqrite discovered a campaign using SVG smuggling and a fake Colombian court lure to deploy AsyncRAT. The SVG executes JS to stage a malicious HTA file, evading detection.