Messaging app

November 8, 2026

• Verified X accounts are distributing malware through AI-generated personas and fake optimization tutorials. vx-underground reports seeing roughly a dozen accounts using locked-comment posts that direct users to obfuscated PowerShell. The observed chain encoded its download host as a decimal IPv4 address before delivering multiple stages and a Node.js payload. · Threat Activity & Operations · also via sms

October 29, 2026

• Finnish police warn of a new BEC variant in which fraudsters impersonate a company's own executives and request transfers tied to supposed acquisitions, contacting targets from foreign numbers and via messaging apps (Ilta-Sanomat). · Threat Activity · also via voice call

September 16, 2026

• Iranian state actors used fake MRI results to deliver CHOSEN BRICK against dissidents, activists and journalists. A joint UK, US and Dutch warning describes extended rapport-building over WhatsApp and Telegram before delivery of tailored Windows files. The spyware persists at login and collects contacts, email and social messages, screen content and microphone audio—enabling pattern-of-life analysis that can increase victims’ physical risk (UK NCSC; The Record). · Threat Activity & Malware

August 25, 2026

• Identity phishing is moving into internal collaboration channels. Unit 42 describes attackers sending direct messages inside trusted chat platforms that link to reverse-proxy infrastructure, harvesting credentials and MFA tokens in real time — the AiTM playbook, minus the email gateway (@Unit42_Intel). · Offensive Tradecraft & Detection

July 28, 2026

• JUMPSEC dissected a BlueNoroff (DPRK/Lazarus) ClickFix malware kit that abuses hijacked Telegram accounts and fake meetings to target high-value victims, deploying sophisticated Windows and macOS payloads over infrastructure tied to Cloudzy/RouterHosting (JUMPSEC). · Threat Activity · also via fake recruiter

July 27, 2026

• A cloaked Telegram phishing operation targeted an exiled Belarusian activist in Lithuania, delivering a fake security alert inside a Secret Chat to harvest one-time login codes (RESIDENT.NGO) (discussion). · Threat Activity

July 7, 2026

• EtherRAT is being pushed via fake IT-support calls on Microsoft Teams, where attackers impersonate corporate helpdesk staff to trick employees into installing the RAT for initial access (BleepingComputer). · Threat Activity · also via voice call

June 23, 2026

• WhatsApp-borne VBScript drops RMM software — an active campaign spreads malicious VBScript via WhatsApp Desktop/Web DMs disguised as financial documents, deploying remote-management tooling; victims span Malaysia (highest), Brazil, India, Mexico, Singapore, UK, Spain and more. Securelist · Threat Activity