Do Son Microsoft warns of Storm-2657, a financial crime group exploiting MFA flaws to hijack university employee accounts, rerouting salary payments through third-party HR platforms like Workday.
phishing
DomainTools exposed a Cryptocurrency Drain Conspiracy using a single IP to host scams like MedAI Genesis. Attackers use copied CSS and malicious MobileConfig profiles to drain crypto wallets.
Socket’s Threat Research Team has uncovered a massive supply-chain abuse campaign leveraging npm’s public registry and unpkg.com’s...
Expel uncovered a phishing attack using Cache Smuggling to deliver malware. The technique uses a fake Fortinet lure and PowerShell to execute a payload staged in the browser's cache, bypassing network detection.
Researchers from Palo Alto Networks Unit 42 have discovered a new phishing trend where attackers trick victims...
APT SideWinder launched Operation SouthNet, targeting South Asia with over 50 malicious phishing portals hosted on Netlify and pages.dev to steal government and military credentials.
The Cavalry Werewolf APT is using FoalShell reverse shells and StallionRAT backdoors, controlled via Telegram, to target Russian state agencies and energy/mining firms.
A Grooza cluster smishing campaign is exploiting unauthenticated APIs on 500+ industrial routers (Milesight) to send phishing texts impersonating Belgian and French government services.
Stormshield CTI uncovers ongoing APT35 phishing infrastructure impersonating video conferencing services to target organizations in Israel and other regions.
Silent Push details how cybercriminals and APTs are misusing DDNS services for stealthy C2 servers, phishing, and malware delivery. Dozens of high-profile groups are involved.
The Lone None group uses fake copyright notices to deliver a new stealer malware that focuses on crypto theft via clipboard replacement and utilizes Telegram for C2.
A new phishing campaign is targeting PyPI maintainers with emails from a fraudulent pypi-mirror.org domain to steal credentials and compromise accounts.
A new BankBot campaign targets Android users in Indonesia and Vietnam. The malware uses spoofed app stores and a WebSocket-based download for stealth.
A new report reveals attackers are abusing ScreenConnect to deliver AsyncRAT and custom malware payloads, a serious supply chain risk for enterprises and MSPs.
A new report reveals Subtle Snail, an Iran-nexus group, is using fake LinkedIn jobs to deliver a custom backdoor for espionage against European telecom and defense firms.
LastPass warns of a new SEO poisoning campaign that uses fake GitHub repos to trick Mac users into downloading Atomic Stealer, a malware that steals data.
A new malware loader, CountLoader, is linked to Russian ransomware groups. The malware uses phishing lures impersonating the Ukrainian National Police to deliver payloads.
A new report reveals a surge in coordinated hacktivist attacks on India's critical infrastructure. Groups from Pakistan, Russia, and others are launching breaches and DDoS attacks.
Microsoft’s DCU has seized 338 websites to disrupt RaccoonO365, a growing phishing service used to steal Microsoft 365 credentials from 94 countries.
A new, advanced FileFix attack campaign uses social engineering and steganography to hide malware in images, bypassing traditional security defenses.
The RevengeHotels cybercrime group has returned, using phishing lures with AI-generated code to target hotels and steal credit card data.
A new report reveals a multi-stage phishing campaign distributing DarkCloud Stealer. The malware hides its loader in a JPG file and injects code into MSBuild.exe for stealth.