kyber.today

daily cyber × ai intelligence

← attack vectors

vector 1 of 22

Phishing email

A message that carried a lure, an attachment or a link.

139 real attacks

November 4, 2026

  • ESET detailed Gorbag, a Russia-aligned actor active since at least February 2025 and targeting only Ukrainian entities — law enforcement and justice bodies, local administrations near the front line, and defense. Its GIFTEDCROOK and BeautyStealer tools pull browser credentials, OpenVPN configs, KeePass databases and RDP/VPN configs to Telegram or a FastAPI C2, delivered via XLSM macros and, earlier, WinRAR CVE-2025-8088 sideloading; ESET suggests it may be a first-stage access broker. The cluster overlaps CERT-UA's UAC-0226 (WeLiveSecurity). Nextron published IOCs and notes its generic YARA caught each stage well ahead of publication, including weaponized LNKs one day after first submission in February 2026 (Nextron). · Nation-State & Espionage

October 31, 2026

  • Microsoft walked two human-operated intrusions from Teams help-desk impersonation to domain compromise via AD CS. Both began with Teams messages and calls posing as IT, talking users into interactive remote access through Quick Assist, then staging portable Python, Bun or Java runtimes for discovery. Case 1 abused an ESC1-vulnerable template to mint authentication certificates for privileged accounts and ran DCSync; Case 2 used PetitPotam to coerce the DC, relayed its NTLM to AD CS Web Enrollment (ESC8), obtained a DC certificate and authenticated via PKINIT. No Teams vulnerability was involved. In Case 1 a privileged identity excluded from automated containment stayed usable and later supported exfiltration — the post ships hunting queries and investigation steps (Microsoft). · Intrusion Tradecraft & Detection · also via voice call
  • Nextron detailed two espionage chains against Arabic-speaking government, HR, diplomatic, student and NGO targets, built from fourteen files collected May–August 2026. Chain one: a macro document with reversed strings fetches an HTA over WMI, which strips the Zone.Identifier from an Arabic questionnaire decoy and XOR-extracts a Go backdoor from a PNG (key byte read from the image), persisting as Run value HostHelpLoader and beaconing to mmarketplaces[.]com. Chain two delivers a C++ libcurl implant inside a 200 MiB VHDX so the payload never receives Mark-of-the-Web, persisting via a Startup .lnk — or a scheduled task when Kaspersky is present — and skipping persistence entirely when it finds no AV. One sample is ESET's Arid Gopher (Arid Viper/APT-C-23) with high confidence; the two campaigns match no published indicator, so attribution there is moderate (Nextron). · Threat Intelligence

October 30, 2026

  • Group-IB documented MadApe, a previously undocumented phishing kit that abuses Microsoft's legitimate Device Code authentication flow for credential harvesting (@cyb3rops). · Cloud & Identity

October 29, 2026

  • SkyW4lker is a Microsoft 365 device-code phishing kit hitting US manufacturing, technology and healthcare, using password-protected "contract" documents and sites.google.com-hosted pages to walk victims through a legitimate OAuth device authorization flow — no credential capture, no MFA bypass needed. It shares infrastructure with Gabagool; ANY.RUN suggests hunting for session_public.php?action=start/poll correlated with suspicious Entra device-code sign-ins (ANY.RUN, The Hacker News). · Threat Activity

October 25, 2026

  • Sandworm and UAC-0099 teamed up for a destructive wiper attack on a Ukrainian logistics company, with UAC-0099 (aka Earth Sirrush) gaining initial access on July 16, 2025 via a spear-phishing attachment, per ESET. The intrusion involved a previously undocumented mesh-network backdoor. (The Hacker News) · Threat Activity

October 21, 2026

  • APT28 breached defense-sector targets in two unnamed NATO countries. Symantec’s Swallowtail cluster targeted a naval shipbuilder, military-aircraft engine manufacturer and law-enforcement agency. One July intrusion began with a malicious Word attachment, deployed HOOKEDGE, and later introduced an undocumented reflective loader that decrypted and executed code in memory. Activity ran from July 24 through at least September 24; sensitive-data theft and uninterrupted persistence were not confirmed, according to The Record. · Threat Activity
  • SafePay has breached at least 600 organizations since August 2024. A joint US, UK and German advisory calls it one of 2026’s most active ransomware groups. Initial access includes stolen or guessed credentials, phishing and exploited perimeter flaws such as CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766; operators then create or hijack accounts, disable defenses, use legitimate remote tools, exfiltrate data and encrypt systems. See the CISA advisory. · Threat Activity · also via stolen credentials, exposed service

October 20, 2026

  • GhostAction has added reverse-proxy phishing and OAuth device authorization to its GitHub workflow attacks. A fake security alert harvested passwords and 2FA codes, then used JavaScript to authorize an OAuth flow with repo, workflow, and read:org permissions. The report also ties a credential stealer disguised as a font to 94 repositories, showing the operator adapting after GitHub disrupted its malicious Actions workflows. The Hacker News (earlier coverage) · Supply Chain, Cloud & Identity
  • Nextron attributes seven malicious Office documents submitted between July 8 and July 14 to APT28. Some initially scored only 5 detections across 62 engines. Obfuscated VBA assembled strings at runtime, performed XOR-encoded reconnaissance, and dropped a 64-bit Covenant Grunt loader disguised as a log file; the samples contacted Dropbox infrastructure. Nextron Systems · Threat Activity

October 17, 2026

  • UAT-11985 is spear-phishing people affiliated with Taiwanese research organisations using fake event invitations, steering them into an adversary-in-the-middle framework that harvests Google credentials and MFA codes (The Hacker News). · Threat Intelligence

October 16, 2026

  • A Kazakhstan-nexus cluster used four delivery chains against government and energy targets across nine CIS countries. Activity tracked as UAT-6275/TAG-193, with assessed overlap with Silent Lynx/YoroTrooper, ran from June 2025 through August 2026. Chains used macro documents, PS2EXE-packaged PowerShell, GitHub-hosted scripts and crafted WinRAR archives exploiting CVE-2025-8088, ultimately deploying FoalShell, Chvost, Laplas or PickleShell. Researchers found no direct indicator or tool overlap proving UAT-6275 and YoroTrooper are identical; the umbrella attribution remains an assessment. The Hacker News has the analysis, and Cisco published campaign indicators. · Threat Activity & Espionage

October 15, 2026

  • Malicious ChatGPT Custom GPTs remain an active ClickFix lure. Huntress says attackers are rotating Google Sites and standalone domains that direct users from legitimate ChatGPT-hosted pages into PowerShell-based malware installation. Its SOC handled at least 40 incidents tied to one campaign domain, with two confirmed as originating through a Custom GPT. Huntress · AI & Model Security · also via drive-by
  • Microsoft and partners seized domains behind YAM Store, CoGUI and Iron Man. The court-authorized action, coordinated with Japan’s National Police Agency and Health-ISAC, disrupted a Chinese-language ecosystem that Microsoft says powered more than one billion malicious messages worldwide. Microsoft, The Record · Threat Activity
  • Casbaneiro now pairs its Delphi banking trojan with a Chromium extension. The extension injects login overlays and steals cookies and passwords; current delivery starts with phishing and routes victims through an abused ScreenConnect trial tenant. Unit 42 · Threat Activity
  • A fake WatchGuard VPN site steals credentials before serving the legitimate signed installer. The handoff leaves victims with the expected software after the phishing step, reducing suspicion and complicating user reports. Huntress · Threat Activity

October 14, 2026

  • Kimsuky is reply-baiting Ukrainian diplomacy and security experts. Genians documents fake conference invitations with genuine event details and no malicious payload in the first message — the attachment only arrives after the target replies — plus fake PDFs and Zoom installers. Likely collection targets include North Korean troop losses and the handling of captured soldiers; most observed attempts failed. Japanese-language documents on the same infrastructure suggest planned Japanese targeting (The Record, Dark Reading). · Threat Activity

October 13, 2026

  • Blinder Tunnel has a new, invisible variant. Nextron went hunting after Unit 42's reporting and found RuntimeBroker.dll sitting at 0 of 71 VirusTotal detections six weeks after its 25 August submission from the Iraq region, with infrastructure not in prior write-ups: a Cloudflare Workers relay, a new PeakyBlindersTeam GitHub account, and per-victim-encrypted credential-rotation instructions hidden in HTML comments on Microsoft/vscode issues. Delivery was an Inno Setup installer themed as a Dubai Airport careers IT assessment (Nextron). Unit 42 separately reported the Iran-aligned actor hitting Middle East aviation and telecom with weaponised .csproj files and GitHub C2 (@Unit42_Intel; earlier coverage). · Threat Intelligence
  • Kimsuky has been observed delivering Funhouse ransomware through a malicious Hangul (HWP) document disguised as a résumé (@blackorbird). · Threat Intelligence

October 12, 2026

  • North Korea-linked Kimsuky has expanded Operation GitPower into Ukraine. Genians Security Center observed reply-driven conference and collaboration lures targeting experts in diplomacy, security, and international policy. The chain uses malicious LNK files, PowerShell, and GitHub/GitLab for delivery, C2, and exfiltration; repositories matched earlier GitPower infrastructure. Most observed attempts were unsuccessful. The broader campaign also uses the opencode AI agent and a local LLM to produce decoy material. · Threat Activity
  • Business-contact impersonation is becoming deliberately indicator-light. Ilta-Sanomat’s Digitoday, citing Microsoft’s Digital Defense reporting, says initial messages increasingly contain no link, attachment, or payment request and merely ask whether the recipient is available. Microsoft observed more than 46 million such attempts over a 12-month window; April 2026 volume was 121% higher than in March. Detection needs to consider conversational progression and identity context, not just payload indicators. · Threat Activity

October 10, 2026

  • Wazza phishkit adds traffic filtering, session management and bot controls at the infrastructure layer, targeting banking, government and manufacturing across the US, EU and Australia (ANY.RUN via The Hacker News). · Threat Activity

October 8, 2026

  • UAC-0099 / Earth Sirrush embeds ZIP payloads inside PNG images, extracted via predefined markers, with spear-phishing for access, scheduled-task persistence, C2 tasking hidden in invisible HTML footer elements, sandbox checks and hybrid AES-RSA C2 encryption (technical brief). · Threat Activity

October 7, 2026

  • A human-operated phishing platform is impersonating AI advertising portals for Gemini, Claude, ChatGPT, Perplexity, Meta Muse and Manus. Clicking "Connect" draws a browser-in-the-browser window with a fake address bar showing accounts.google.com or an Okta tenant; the backend fingerprints the device over Socket.IO and lets a live operator choose which MFA challenge the victim is shown next, replaying credentials in real time. One domain, museads.ai, appeared on September 16, days after Meta launched Muse (The Hacker News, BleepingComputer). · Identity, Certificates & Cloud

October 2, 2026

  • Proofpoint exposed a previously unreported China-aligned actor targeting people who shape US AI policy. TA419 began with benign rapport-building emails impersonating former White House official Lynne Parker or economist Heidi Crebo-Rediker, using fake invitations to an “AI Policy Advisory Committee” or a Senate report on export controls. Respondents were subsequently sent through redirects to a OneDrive credential-phishing page. Targets included universities, think tanks, law firms, and defense-related organizations. Proofpoint · Threat Activity & Supply Chain

October 1, 2026

  • Zimbra CVE-2026-73570 — unauthenticated OS command injection in the SNMP notification path, triggered by a crafted SMTP message against internet-facing servers where the optional zimbra-snmp package is installed and notifications are enabled. Microsoft Threat Intelligence saw two out-of-band scanning tools probing the same swatchdog-to-snmptrap path between 28 July and 7 August — after the 20 July fix in 10.1.20, before the 13 August disclosure — followed by JSP web shells, reverse shells, memory-backed execution, root via passwordless sudo, and mailbox/auth-secret collection across multiple regions and sectors. Microsoft published Defender XDR hunting queries. One staging host was tied to a hands-on campaign against Ukrainian government mail infrastructure, which @malwrhunterteam flagged for the affected agency. · Exploited in the Wild

September 30, 2026

  • ShinyHunters' alleged leader arrested in the Netherlands. Dutch police arrested a 24-year-old Amsterdam man on 15 September; the FBI's Cyber Division AD Brett Leatherman publicly called him one of the group's alleged leaders and told remaining members to turn themselves in. A Rotterdam court extended pre-trial detention by at least 90 days on 29 September, and police say further arrests are not ruled out. The FBI puts the group at 140+ organizations breached since last year and at least $70 million in extortion payments, typically via corporate SSO, third-party vendors and SaaS platforms like Salesforce and Snowflake. Dutch police add that material recovered from the suspect's laptop concerns two murders to be committed abroad, with indications he gave the order (BleepingComputer, Politie) (earlier coverage). The group has since put out a statement claiming its operations and infrastructure remain "completely fine" (Dark Web Informer), and CERT.dk notes it has resumed Oracle PeopleSoft CVE-2026-35273 attacks (CERT.dk). · Threat Activity
  • Star Blizzard has shifted from narrow spear-phishing to large-scale multi-stage campaigns against 100+ organizations, using compromised legitimate websites and a new delivery technique Microsoft calls RedFlick, paired with the CosmicPulse backdoor (Microsoft, The Hacker News). · Threat Activity
  • Phishing campaigns abuse MSP360 RMM to deploy ScreenConnect, deliberately stacking two remote-access channels so losing one doesn't cost the operator access — a detection problem, since both are signed, legitimate tools (Microsoft). · Threat Activity

September 29, 2026

  • AgtaBackup RAT campaign impersonates a popular videoconferencing product and legitimate RMM enrollment to deploy a full-featured .NET RAT with browser credential theft, keylogging and a hidden-desktop remote shell (Unit 42). · Threat Activity

September 27, 2026

  • Lunex Stealer abuses an AMD driver to disable security monitoring in a four-stage chain targeting Ukrainian-speaking users, starting from fake Cloudflare CAPTCHA pages on compromised Ukrainian sites. Ontinue ties the previously reported Psychedelic Stealer to the wider Lunex MaaS platform (The Hacker News). · Threat Activity

September 26, 2026

  • Ukraine-targeted campaign pairs an "air raid alert" lure with a military unit property inventory, both dropping a Telegram-controlled VBScript RAT capable of credential theft, screenshots, command execution and targeted file collection. The collection focus is unusual — CAD, BIM, GIS, LiDAR and weather-model data, with per-host tasking and date-based harvesting; the second lure pushes the campaign back to at least 26 August 2026 (Nextron IOCs). · Threat Intelligence
  • ClickFix, quantified. CTM360 analysed more than 17,000 infected URLs serving fake Cloudflare verification pages, around 3,000 still live at publication. Microsoft attributed 47% of initial-access cases handled by its Defender Experts team in 2025 to the technique, ahead of conventional phishing; ESET measured a 517% rise into H1 2025 and a further 108% from H2 2025 to H1 2026 (The Hacker News). SANS ISC has follow-up malware analysis from the macOS-focused Macfinger cluster (ISC). · Threat Intelligence

September 25, 2026

  • DarkMe RAT has dropped the exploits — Huntress finds the RAT previously used in a zero-day APT campaign now arriving in ordinary phishing mail as a fake image file. Huntress Separately, Ontinue documents Lunex, a new infostealer deployed through BYOVD. Ontinue · Threat Activity

September 24, 2026

  • RemControl: an Android banking MaaS whose overlays were written by an AI assistant. Group-IB documents 30+ phishing overlay targets across Italy, France, Spain, Poland, Portugal, Canada and some GCC states, distributed through fake Play Store pages impersonating the TVTap IPTV app. The dropper blocks Play Protect via a local VPN service and generates a unique signing certificate per install; C2 is resolved through an encrypted Telegram dead-drop. The operator's panel API documentation was exposed during analysis, and a complete AI assistant response was left verbatim in a live phishing page served to victims (Group-IB, BleepingComputer). · AI-Enabled Threat Activity
  • UTA0565 ran the Chrome-to-Windows chain as zero-days on 3–4 September. Volexity attributes attacks combining CVE-2026-85046 and CVE-2026-87491 in Chrome with Windows ALPC flaw CVE-2026-85880 — the BlueMoon exploit kit — delivered from fake sites imitating China Digital Times and the Center for American Progress in emails to Asian government entities. The payload, CLEANGULP, supports shell, process listing, file upload/download and beacon object file execution, and beacons to a domain typosquatting theconversation.com. Volexity assesses the kit is shared across multiple Chinese operators (The Hacker News). · Threat Activity
  • ChainScript RAT rotates C2 through Polygon. Blackpoint APG documents ClickFix-style lures delivering a previously undocumented RAT under build names including ComponentTask33, UpdateDigital and OrchidViolet66, posing as Spotify, Zoom Workplace and Microsoft Teams (The Hacker News). · Threat Activity

September 23, 2026

  • Microsoft's DCU dismantled EvilTokens, an AI-assisted phishing-as-a-service platform built around OAuth device-code flow token theft, seizing 50 websites and disabling 150+ domains under a US court order obtained with Health-ISAC. The service sold on Telegram for a $1,500 initiation fee plus $500/month and is linked to 12,000+ compromised inboxes at over 10,000 organizations since February 2026. Met Police arrested two men, aged 32 and 38, earlier this month; both are on bail (The Record, Microsoft). · AI in the Attack Chain
  • SideCopy has extended its India targeting to academic institutions, using spear-phishing that abuses mshta.exe to execute scripts and deliver ReverseRAT, per Trellix (The Hacker News). · Threat Activity & Breaches

September 19, 2026

  • Huntress's SOC is seeing fake Adobe update lures used to deploy rogue RMM tooling — cheap persistence that looks like sanctioned IT software (Huntress). · Threat Activity

September 18, 2026

  • Revolut's breach is now reported as a five-month run of fraudulent information requests sent from an email address on a legitimate government agency domain, impersonating an Italian agency, with roughly 680 high-profile accounts affected and a $3M ransom demand (SecurityWeek). Affected customers began receiving phishing SMS on 14 September, two days after disclosure, landing in the same thread as genuine Revolut messages; one link requested camera access and imitated Revolut's "turn your head" liveness check before asking for a password (Malwarebytes) (earlier coverage). · Supply Chain & Breaches · also via sms

September 17, 2026

  • KREMLIN force-installs Chrome and Edge extensions without user approval — it waits for or kills the browser, copies the extension into the profile directories, enables developer mode, then retrieves the browser's own encryption keys to regenerate the Secure Preferences HMACs so the add-on passes Chromium's integrity checks. The chain starts from a JS file masquerading as an invoice, pulls Node.js, persists via scheduled task, and resolves its payload location from an Ethereum smart contract. Elastic tracks the Brazilian operation as REF9334 across at least seven campaigns since May 2025 impersonating 12 banks, with 1,515 confirmed infections almost all in Brazil. BleepingComputer, The Hacker News. · Threat Activity

September 16, 2026

  • China-linked UTA0560 used a then-zero-day Chrome–Windows chain against multiple NGOs on September 1. Volexity says the spear-phishing campaign delivered GRIMWEDGE, a JavaScript backdoor, through vulnerabilities that have since been patched (The Hacker News). · Threat Activity & Malware

September 13, 2026

  • Revolut confirmed it handed customer data to an unauthorised third party after fraudulent information requests arrived from a legitimate government agency email domain. Exposed fields include names, dates of birth, addresses, passports and driving licences, verification selfies, IBANs, account statements and full transaction histories (Reuters, @DarkWebInformer). The open question is whether a government mailbox was compromised or the envelope sender was simply spoofed — Wicher argues a callback to the purported agency was the minimum due diligence either way (discussion). · Threat Intelligence & Incidents
  • Trezor's Brevo-sourced phishing wave hit 347,000 addresses, with 2,500 users clicking before the malicious domain was taken down within 20 minutes. The lure was a fake "Critical Security Alert: STM32 Entropy Vulnerability" sent from help@trezor.io; the underlying incident touched 120 Brevo accounts, and BitBox and CoinTracking users were targeted through the same platform (BleepingComputer, SecurityWeek). · Threat Intelligence & Incidents

September 12, 2026

  • Passkey and SSO-themed phishing is compromising corporate Microsoft 365 accounts. Microsoft links the campaigns to ShinyHunters, Helix, and other extortion crews seeking cloud data, BleepingComputer reports. The activity abuses passwordless-authentication branding through social engineering; it is not a cryptographic break in passkeys. · Cloud & Identity
  • Microsoft saw AI-consistent templating in a million-email BEC campaign. Microsoft Threat Intelligence observed more than one million messages from August 3–5, with 87.7% of the campaign sent to U.S. enterprise users. Fake executive identities, ServiceNow threads, and invoices sought ACH payments near $50,000. Repeated narrative structure with changing company details suggested automated generation but did not prove model use. · Cloud & Identity
  • Trellix now documents DarkSword in a Russian spear-phishing campaign against NATO-aligned officials. Its September threat-hunting report adds observed campaign use to the iOS framework’s technical profile. This is the material update to earlier reporting that DarkSword is a multi-stage access and post-exploitation framework, not a single browser exploit (earlier coverage). · Threat Activity

September 11, 2026

  • ClickFix volume is spiking off compromised legitimate sites serving fake CAPTCHA prompts, with consumer infection reports piling up on Reddit (Kevin Beaumont). · Exploitation in the Wild
  • Trezor's third-party email provider was breached and used to send phishing from legitimate Trezor infrastructure, under the subject "Critical Security Alert: STM32 Entropy Vulnerability" (BleepingComputer). · Breaches

September 9, 2026

  • Malone Lam pleaded guilty to RICO charges over the theft of more than 4,100 BTC (~$245M at the time) from a single Washington, D.C. victim in August 2024, in which the crew impersonated Google and Gemini support to obtain Drive access and security codes (The Record). · Threat Activity

September 8, 2026

  • BigBear 2.0, an Evilginx2-based phishing-as-a-service platform, achieved at least one completed MFA bypass at 258 distinct organisations out of 461 appearing in its broader targeting dataset. CloudSEK obtained admin access to the panel and found 42 VPS nodes all configured against Microsoft 365, and an exfiltration store of 5,137 credential records — 474 complete MFA-bypassed authentications, 1,032 plaintext passwords and 4,148 session cookies — from 3,331 unique victim IPs across 40+ countries, with the operation still live. Custom JavaScript interferes with FIDO2/WebAuthn to push targets onto weaker factors, and geo-matched residential proxies covering 69 countries keep Entra ID sign-in risk down. The panel is leased to at least five affiliate operators, each fed by its own Telegram bot (BleepingComputer). · Cloud & Identity

September 7, 2026

  • Kimsuky's Operation GitPower is now mass-producing decoys with an AI coding agent: Genians analysed 13 malicious LNK files collected 11–19 August 2026 whose decoy PDF metadata names the open-source agent OpenCode as producer. Lures shifted from diplomacy and academia to finance and corporate operations (fund disbursement, insurance premiums, Visa payments); the LNKs launch PowerShell with encrypted loaders buried in over-long arguments padded with leading spaces, pull decoys and follow-on commands from GitHub Raw using hardcoded PATs, and now add Pastebin as a second-stage channel plus anti-analysis routines that check for virtualization and analysis tooling, inspect sandbox usernames and wipe command history. All 13 share the same decoder constant and array variable name — cheap hunting pivots. · Threat Intelligence

September 6, 2026

  • Huntress reached the Knight Office login console by pivoting from an IP seen in an adversary-in-the-middle incident. Its phishing-kit investigation offers identity defenders a concrete view of the infrastructure behind session and credential theft. Huntress · Threat Activity

September 5, 2026

  • ASCII smuggling crossed from prompt-injection research into commodity phishing. Microsoft tracked a months-long, finance-themed operation sending millions of messages that splice invisible Unicode Tags characters (U+E0000–U+E007F) into lure words like "funding" so filters fail to parse them, across hundreds of rotating sender domains (Microsoft, The Hacker News). Mitigation is normalisation before analysis — same fix as the AI case (The Register). · Threat Activity & Malware
  • "Phantom Deal" operators are researching target companies in depth and using fabricated M&A activity to push midlevel finance staff into large transfers (Dark Reading). · Threat Activity & Malware

September 4, 2026

  • An RMM phishing operation spans 46 countries, with ANY.RUN linking 601 cases to a campaign originally read as Canada-focused; the US now accounts for ~45% of observed activity (The Hacker News). · Threat Activity

September 2, 2026

  • Nimbus Manticore / Mirage Kitten is now cross-platform, delivering the previously undocumented NodeRabbit and PollCat Node.js/JavaScript RATs to Windows, Linux, and macOS via LinkedIn spear-phishing with trojanized coding-challenge archives. Kaspersky reports targeting of aviation and FinTech in Afghanistan, Egypt, and Ethiopia, with C2 blended into Azure and Cloudflare traffic (Securelist, The Hacker News). · Threat Activity

August 31, 2026

  • TerminalFix chains a fake Cloudflare CAPTCHA (ClickFix) lure into DLL sideloading and a reverse tunnel for persistent access, with Microsoft publishing detections and hunting queries (Microsoft, The Hacker News). Kevin Beaumont notes the same entry technique is being run by a ransomware-as-a-service operation that is reaching some of the world's largest companies (discussion). · Threat Activity
  • Finland's NCSC-FI is seeing Signal-themed phishing: criminals posing as "Signal Support" walk victims through locating — or first creating — their Secure Backups recovery key, then ask for the 64-character string, which is enough to decrypt the backup and restore the full message archive elsewhere. That key should never leave the device (IS Digitoday). · Threat Activity

August 28, 2026

  • BlueDelta ran initial-access campaigns against European diplomacy from late September 2025 to early April 2026, delivering a lightweight Windows batch-script backdoor dubbed HOOKEDGE via macro-enabled Word documents. Targets were government and diplomatic bodies in Romania, Spain and Türkiye, with lures impersonating Spain's Ministry of the Presidency (Recorded Future). · Threat Activity
  • Spark RAT campaigns against Cambodia are pairing an open-source RAT with BYOVD, abusing a vulnerable OPSWAT driver to disable security tooling; lures span government notices, public-health material and real estate (The Hacker News). · Threat Activity

August 27, 2026

  • NovaCookies is an adversary-in-the-middle phishing service that steals authenticated Microsoft 365 sessions, not just credentials, and rides genuine DocuSign notifications for delivery. Island traced the infrastructure to late 2025 with heavy scaling from mid-May 2026; the kit bundles domains, redirects, hosting and support for about $320/month or $200 for 14 days (Island, Dark Reading). · Identity & Phishing
  • Mirage2FA has hit roughly 4,500 US and EU companies since 2024 by abusing legitimate Microsoft 365 login flows to defeat 2FA; ANY.RUN assesses 48% of targeted addresses as potentially compromised (The Hacker News). · Identity & Phishing

August 26, 2026

  • Twenty-four npm packages served as free phishing infrastructure rather than install-time malware. Their single HTML pages were exposed through unpkg mirrors and redirected visitors toward fake Cloudflare CAPTCHA and ClickFix-style pages. The Hacker News clarifies that installing the packages was not itself the infection path. · Threat Activity & Supply Chain
  • CloudAtlas-linked documents are targeting Russian and Iraqi recipients. The DOC lures show technical and thematic overlap with recent CloudAtlas activity and use malicious template injection in their delivery chain, according to Positive Technologies’ Russian-language analysis. · Threat Activity & Supply Chain
  • Operation Jackal IV produced 58 arrests and identified 263 suspects across 22 countries. The INTERPOL-led action targeted Black Axe and other West African networks involved in BEC, romance and investment fraud, sextortion, laundering and crime-as-a-service. The Record details the service infrastructure; BleepingComputer has the operation totals. · Threat Activity & Supply Chain

August 25, 2026

  • Kimsuky LNK campaign against South Korean and Japanese targets. Nextron found multiple samples overlapping ENKI WhiteHat's reporting: phishing mail delivering OneDrive-hosted ZIPs containing oversized LNK files with embedded script content and URL-based payload retrieval (Valhalla rule). · Threat Activity
  • Operation QUICSILVER targets Myanmar government and IT with graduation-invitation lures dropping a Go backdoor called QUICAgent; Seqrite attributes it with moderate confidence to a China-nexus actor (The Hacker News). · Threat Activity

August 23, 2026

  • TELEPUZ is a modular campaign chaining compromised WordPress sites (via the ErrTraffic distribution framework) into a fake Cloudflare verification page, ClickFix manual-execution social engineering, and blockchain-hosted C2 for resilience (@DailyDarkWeb). · Threat Activity

August 22, 2026

  • Kimsuky is installing a malicious Chrome extension that auto-exfiltrates victims' Gmail to C2 in spear-phishing against South Korean and Japanese targets, alongside abuse of legitimate remote-control tooling. Korean-language comments and debug strings throughout the extension's JavaScript suggest most of it was written with generative AI (ENKI). · Threat Activity

August 21, 2026

  • Hiring-themed lures against German-speaking businesses sideload through a signed Microsoft binary. Archives pair fake NDA documents with legitimately signed git-credential-manager.exe and bundled ssh.exe; the credential manager sideloads a malicious signed gcmcore.dll, which loads a C2 agent tracked as Snake Agent (Git.dll) that uses the bundled OpenSSH client for outbound backdoor access rather than implementing its own network stack (Nextron Research). · Offensive Tradecraft & Evasion
  • A threat actor is targeting Black Hat and DEF CON attendees by posing as a CoinDesk marketing exec pitching a new conference. The lure is a fake "Google Doc" delivering AMOS on macOS and NetSupport RAT on Windows; a Huntress researcher engaged the actor and documented the flow (Catalin Cimpanu). · Threat Activity

August 20, 2026

  • The US charged 17 members of Iran's Mabna Institute over a decade-long spearphishing campaign against university professors and government email accounts, with $3.4B in claimed IP theft and $10M rewards on five defendants. The 50-page superseding indictment carries considerably more methodological detail on the three-phase targeting than the press coverage (The Record, SecurityWeek, indictment analysis) (discussion). · Threat Intelligence
  • SilkParasite is hitting Central Asian government targets with five new RATs, a China-nexus spear-phishing operation with links to FamousSparrow (The Hacker News, Dark Reading). · Threat Intelligence

August 16, 2026

  • RingCentral breach data hits Have I Been Pwned — roughly 1.6M unique email addresses, plus names, physical addresses, and phone numbers, were dumped following the July social-engineering intrusion tied to ShinyHunters (earlier coverage). The Register · Breaches

August 14, 2026

  • Cisco Talos dissected "JWR," an operator-driven real-time phishing framework. Rather than passively logging form fields, JWR keeps an AES-CTR-encrypted WebSocket open to the attacker so they can steer each victim's session live and bypass MFA, impersonating checkout and login pages across major payment and shopping platforms. (Talos) · Threat Activity
  • AmnesiaStealer targets macOS via ClickFix lure. A new Rust-based stealer spread through a fake "verified publisher" GitHub download page hijacks Chromium sessions for live browser control, deployed after victims paste a Base64 command into Terminal. (The Hacker News) · Threat Activity · also via drive-by
  • SideCopy delivering CrimsonRAT via Outlook .msg lures, and BitterAPT using malicious .accdr documents against government, defense, and maritime targets — both flagged by Nextron with fresh IOCs. (SideCopy, BitterAPT) · Threat Activity

August 13, 2026

  • Midnight Blizzard (APT29 / Storm-2945) is weaponizing hotel Wi-Fi captive portals in a campaign Microsoft tracks as CaptiveCrunch. The group manipulates DNS and HTTP traffic on hospitality-venue captive networks to redirect guests to attacker infrastructure for Microsoft 365 credential harvesting, device-code phishing, and malware delivery — with evidence it compromised shared captive-portal servers, per Zscaler. · Cloud & Identity

August 12, 2026

  • Lazarus revived Operation Dream Job with a new Windows zero-day, delivering malicious PDFs via fake recruiters to exploit CVE-2026-68820 — the same afd.sys bug Microsoft patched this week — alongside CVE-2025-49113. Check Point traced a chain including a new in-memory backdoor, a kernel rootkit, and webshells against defense sectors in Europe and India (Check Point Research). Separately, ANY.RUN, BCA and NorthScan stood up a fake DeFi startup ("Blue Whale LTD") and knowingly hired suspected Famous Chollima operatives to observe DPRK IT-worker infiltration from the inside (ANY.RUN). · Threat Activity · also via fake recruiter

August 10, 2026

  • U.S. defense manufacturer IEH Corporation disclosed a phishing-driven breach exposing potentially export-controlled data. IEH produces components for military satellites, missiles, and fighter jets, and reported the incident to the SEC (The Record, SecurityAffairs). · Threat Activity

August 8, 2026

  • A widespread AitM phishing campaign is hijacking Microsoft 365 accounts to harvest payroll and finance email. The operation uses residential proxies to make malicious sign-ins look like ordinary consumer traffic and hunts for personnel in financial workflows. The Hacker News · Cloud & Identity
  • Google/Mandiant tie a 200+ organization extortion spree to UNC6671, which has quietly rebranded from BlackFile into Redact, Pink, Helix, and Falcon. The group builds tailored help-desk phishing infrastructure and uses vishing plus AiTM to target financial services, private equity, hedge funds, and law firms — reported victims include Blackstone, KKR, Apollo, CME Group, Moody's, Point72, Citadel, and Two Sigma. BleepingComputer, SecurityWeek, Reuters · Threat Activity · also via voice call

August 6, 2026

  • SideWinder deployed a new multi-stage chain abusing ClickOnce .application files delivered via phishing PDFs. The chain uses white-binary side-loading to run RC4/XOR-encrypted Rust backdoors that persist via the registry and take C2 over Cloudflare Workers, with malicious Office macros as an alternate initial-access vector (blackorbird). · Threat Activity
  • The SMOKE#SCREEN campaign uses social engineering and legitimate code signing to stealthily install ConnectWise ScreenConnect for persistent remote control (Security Affairs). · Threat Activity
  • Coldcard fallout turns to phishing. A campaign is exploiting fear over the recently disclosed wallet RNG flaw and suspected $88.6M Bitcoin theft to trick users into installing ScreenConnect via a fake "security audit" (earlier coverage; BleepingComputer). · Supply Chain

August 2, 2026

  • Microsoft attributes worldwide hotel Wi-Fi hijacking to Midnight Blizzard (Storm-2945). In its CaptiveCrunch report, Microsoft ties the Russian SVR actor to manipulation of captive-portal management infrastructure since May 2026, redirecting guest traffic through actor infrastructure to push fake OS updates and steal credentials — an evolution of the hotel-network abuse tracked earlier (earlier coverage). Since February the group has also run AI-augmented device-code and OAuth phishing leading to rogue Entra device registration and M365 data theft (Microsoft, The Hacker News). · Cloud & Identity

August 1, 2026

July 30, 2026

  • AI-powered phishing kits are automating business email compromise at scale, per Eye Security's teardown of two phishing-as-a-service platforms that use agents to generate lures and manage victim conversations. Eye Security research · AI & Model Security
  • TA488 (Laundry Bear / Void Blizzard) is exploiting an Outlook Web Access XSS zero-day (CVE-2026-42897) for persistent mailbox access (earlier coverage). Proofpoint says the Russia-aligned actor began the campaign on July 22, targeting US and European government, telecom, financial, hospitality and aerospace orgs, and is doubling down on "half-click" exploits where merely opening the email triggers compromise. Proofpoint, The Record · Threat Activity
  • Phishing crews are abusing Microsoft's legitimate authentication infrastructure rather than spoofed login pages — Check Point tracked 200+ emails against ~120 organizations impersonating Teams/HR task notifications while directing victims to a genuine Microsoft sign-in page. Check Point · Threat Activity

July 28, 2026

  • Operation BlueDash used Microsoft Teams "secure document" lures and a counterfeit Microsoft Store "Teams update" page to deploy legitimate RMM tools (Level RMM, ScreenConnect) for hands-on access (The Hacker News). · Threat Activity

July 27, 2026

  • ShinyHunters leak data is fueling a $2,000 sextortion campaign. Scammers are mining email addresses from previously dumped datasets — attributed to Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill — to send targeted-looking Bitcoin demands; BleepingComputer confirmed some recipients appeared in the referenced dumps (BleepingComputer). · Threat Activity

July 26, 2026

  • Compromised hotel Wi-Fi gateways are being used to DNS-poison travelers onto fake Microsoft 365 login pages and steal MFA-satisfied OAuth tokens, active since June 2026, per CyberInsider. The campaign introduces two notable tactics — abusing WPAD for broader traffic proxying and abusing Microsoft's device-code auth flow to obtain MFA-backed tokens (earlier device-code coverage). @blackorbird notes the tradecraft is similar to APT28. · Cloud & Identity
  • Infostealer operators are hosting phishing pages as Claude Artifacts, Huntress reports — the malicious link genuinely resolves to claude.ai, defeating URL-reputation checks and hitting 29 organizations. · AI & Model Security
  • Kimsuky is running a phishing campaign impersonating diplomatic staff and deploying PebbleDash and PrxClient, per AhnLab via lazarusholic. · Threat Activity
  • ClickFix lures on Steam discussion forums are pushing XMRig cryptominers disguised as fixes for game problems, per BleepingComputer. · Threat Activity
  • An Illinois man was sentenced to 76 months for phishing access codes from 750+ women to steal private photos while impersonating Snapchat support, contacting over 4,500 potential victims, per BleepingComputer. · Industry & Policy

July 25, 2026

  • Device-code phishing gets stealthier. Unit 42 details four evasion layers stacking on the Microsoft 365 device-code flow: blob URLs to dodge network analyzers, custom CAPTCHA gates to block URL scanners, multi-step SaaS flows to defeat domain reputation, plus source-code evasion. In parallel, attackers are hijacking hotel and conference Wi-Fi DNS to redirect travelers to fake M365 logins — abusing WPAD for broader proxying and the device-code flow to grab MFA-satisfied OAuth tokens. Unit 42, BleepingComputer. · Cloud & Identity
  • BlueNoroff Zoom phishing kit profiles crypto wallets. The North Korean crew's typosquatted Zoom/Teams ClickFix operation runs an active kit that fingerprints wallets before deciding on malware delivery. The Hacker News. · Threat Activity

July 24, 2026

  • A US/UK-led coalition exposed a Russian state campaign exploiting Zimbra zero-click flaw CVE-2025-66376 against NATO, Ukraine, CIS and African targets. The actor — tracked as Laundry Bear / Void Blizzard / TA488 (CL-STA-1114) — plants malicious JavaScript that fires the instant a webmail message is previewed, no click required; its Ulej tool then exfiltrates the last 90 days of email, org directories, saved browser passwords, and 2FA recovery codes. CISA advisory, NCSC-UK, Unit 42, The Record. · Threat Activity
  • An exposed Alibaba Cloud directory blew the cover on a China-nexus operation, "JadeProx." Group-IB found bash history, toolkits, webshell paths and staged phishing kits on an operator server, tying simultaneous intrusions against a Vietnamese hospital's imaging system, Malaysia's foreign ministry and Hong Kong universities — and a new TriBack loader plus fake-Anthropic Claude phishing lures. Group-IB, The Hacker News. · Threat Activity

July 23, 2026

  • Kimsuky compromises South Korean groupware vendors with a new Gomir variant. ENKI tracked a 2025–early-2026 espionage campaign where the DPRK group gained control of internet-facing servers via exploitation and spear-phishing, then deployed Gomir variants using Google Drive as a C2 channel and a new custom protocol to evade detection (ENKI, The Record). · Threat Activity

July 22, 2026

  • Device-code phishing is surging against Microsoft 365 tenants, abusing the OAuth device-authorization flow to trick victims into entering an attacker-supplied code and hand over tokens for persistent access. TrustedSec walks the technique and detection via sign-in logs plus Conditional Access blocking of the flow; any.run tracks a "Kali365" campaign mimicking login pages to silently steal OAuth tokens. TrustedSec, any.run. · Threat Activity
  • A new ClickFix variant, "ConsentFix," targets Microsoft 365 accounts via OAuth, exploiting users' habit of clicking through consent/CAPTCHA prompts to grant attacker access; NCSC-FI amplified the research. Kaspersky. · Threat Activity

July 20, 2026

  • UAC-0145 is using fake ClickFix CAPTCHAs to infect Ukrainian devices, tricking targets into pasting attacker commands to deliver malware (The Hacker News). · Threat Activity

July 17, 2026

  • Hidden text "salting" is quietly beating AI/LLM email filters at scale, with 1M+ phishing emails using invisible characters to slip past inspection (Dark Reading). · AI & Model Security
  • Sandworm is using a fake-CAPTCHA lure against Ukrainian victims — instead of verifying they're human, users are instructed to paste a malicious PowerShell command into Windows (The Record). · Threat Activity

July 15, 2026

  • Kratos, a Phishing-as-a-Service platform, targets Microsoft 365 users across the US and EU with trusted lure chains, anti-bot checks, and evolving fake login pages; detection hinges on specific page assets and exfil endpoints. ANY.RUN · Threat Activity
  • A Welsh Doxbin administrator ("KT"/"Chans"), Callum Dare, was sentenced to two years and three months for encouraging and assisting swatting attacks across the UK, US and Canada; investigators tied him to Doxbin via a PayPal account and email, and recovered phishing software mimicking dark-web marketplaces. The Register · Policy & Industry

July 14, 2026

  • Forg365, a new phishing-as-a-service operation ($400/month via Telegram), targets Microsoft 365 with device-code phishing, adversary-in-the-middle session theft, antibot evasion, AI-assisted lure generation, and post-compromise mailbox operations. The Hacker News · Cloud & Identity
  • A misconfigured public Python HTTP server exposed three separate AiTM phishing operations run by operators "codemado," "mail-argenta," and "saroula01," revealing custom Evilginx forks used to bypass MFA and harvest credentials across platforms for over a year. Lexfo · Cloud & Identity
  • The FBI and Google dismantled "Outsider," an $88-a-week phishing-as-a-service platform linked to roughly $1.9 billion in losses. Ministry of Cyber Affairs · Threat Activity
  • Odido disclosed a February 2026 breach exposing personal details of 6.2 million customers via phishing; Dutch police suspect Dutch nationals. Security Affairs · Breaches

July 9, 2026

  • ClickFix operators expanded: Unit 42 tracks a macOS variant installing a LaunchAgent backdoor via affiliate/cloaking redirects, and Elastic details SCMBANKER (REF6045), an AI-assisted PowerShell toolkit hitting Mexican banking customers via fake CAPTCHA pages. Unit 42, Elastic Security Labs · Threat Activity · also via malvertising
  • Ghost phishing / EvilTokens keeps its malicious page encrypted until it decrypts inside the victim's browser, evading URL reputation checks in a US/EU campaign targeting Microsoft 365. The Hacker News · Threat Activity

July 8, 2026

  • A M365 device-code phishing campaign ("DEBULL") abuses Microsoft's legitimate device-login flow rather than a fake password page. ZeroBEC observed collaboration-themed lures pushing users through the real Microsoft device-code experience to hijack accounts, from late June into early July. The Hacker News · Threat Activity
  • Huntress tracked a threat actor abusing Meta's Business Account Manager workflow to send phishing lures from a legitimate Meta address by injecting a URL into the partner-name field. Huntress · Threat Activity

July 5, 2026

  • Verified X ad pushes Mac malware plus a browser-based M365 token thief. A sponsored post from a verified account impersonated the DynamicLake utility and redirected to a lookalike domain instructing users to paste a Terminal command, delivering an Atomic Stealer variant (tracked as MacSync, with DigitStealer in some cases). The same report flags ConsentFix, a ClickFix-style trick that steals Microsoft 365 session tokens through the browser — no malware, no password. Malwarebytes · Threat Activity · also via malvertising
  • Silver Fox (SwimSnake) runs an RBI-themed phishing lure to deliver ValleyRAT / Winos 4.0 via DLL sideloading to a live C2 — the first Reserve Bank of India-themed lure observed for this family (medium-high confidence). FalconFeeds · Threat Activity

July 3, 2026

  • Cisco Talos dissected an EvilTokens affiliate panel branded ARToken, a phishing-as-a-service platform targeting Microsoft 365 with 80+ API endpoints for device-code phishing, Primary Refresh Token (PRT) persistence, mailbox access, BEC, and SharePoint exfiltration — sharing infrastructure with the EvilTokens kit documented by Sekoia and Microsoft. Related reporting covers ConsentFix/ClickFix OAuth token theft that hijacks accounts "in three seconds." Talos, BleepingComputer. · Cloud & Identity

July 1, 2026

  • Nextron tracked a threat actor running five concurrent spear-phishing campaigns against European defense and UAV supply-chain targets, all sharing one trick: AWS Cognito unauthenticated identity pools. Payloads (C#, Python, HTA) fetch fresh 15-minute STS credentials at runtime — no static keys to burn — and exfiltrate to attacker S3 buckets signed with hand-rolled SigV4. IOCs and detection rules published. Nextron (X) · Cloud & Identity
  • UNC1151 (Ghostwriter) is running targeted Gmail phishing lures themed around "suspicious account activity," with public domain-hunting and campaign analysis available. resident.ngo / Censys · Threat Activity

June 29, 2026

  • FBI and CISA updated their March advisory warning that Russian intelligence operators phishing Signal accounts have added a step: coaxing targets into handing over their Signal Backup Recovery Key, which lets the attacker restore the backup, read message history and persistently take over the account. (The Hacker News) · Threat Activity

June 27, 2026

  • Bitter APT (APT-C-08) is hitting maritime and government officials with a .accdr file disguised as a PDF: AutoExec VBA fires on open, decodes payloads in memory via MSXML2, side-loads a DLL through signed fsquirt.exe, and plants a 17-minute scheduled task masquerading as a Chrome updater that pipes C2 responses straight into cmd.exe. The DLL runs TLS-callback anti-analysis and WMI/BIOS VM checks before fetching stage two. Nextron Research · Threat Activity
  • Microsoft flagged a "Photo ZIP" phishing campaign hitting hospitality orgs across Europe and Asia since April, dropping a Node.js implant onto front-desk machines via fake image shortcut files and obfuscated PowerShell. The Hacker News, Microsoft · Threat Activity

June 26, 2026

  • ESET detailed Gamaredon's 2025 evolution: six new PowerShell downloaders (PteroDee, PteroDum, PteroPaste, PteroOdd, PteroEffigy, PteroCache) plus the revived PteroSetup weaponizer, 35 spear-phishing campaigns against Ukrainian government/military, and heavy infrastructure laundering via Cloudflare Workers, Microsoft dev tunnels, Loophole, and dead drops on Telegram, Telegraph, Rentry, Dropbox, Supabase and Clever Cloud. WeLiveSecurity, whitepaper + IOCs · Threat Intelligence

June 21, 2026

  • Gamaredon is exploiting the WinRAR path-traversal flaw CVE-2025-8088 against Ukrainian targets: military/conscription-themed .rar lures use a malicious NTFS alternate data stream to silently plant a .lnk into the Startup folder on extraction, executing a hidden PowerShell stager on next logon. Active since February 2026 and ongoing (Nextron). · Vulnerabilities & Exploits
  • Rapid7 detailed Dropping Elephant delivering an in-memory RAT via a China-themed loader chain; Nextron tied 44 samples to one continuous LNK-loader line spanning May 2023 to June 2026, each a shortcut posing as a PDF that fires a hidden PowerShell stager with sandbox/debugger checks before self-deleting (Nextron). · Threat Intelligence
  • ClickFix campaigns expanded with three new loaders — BabaDeda, Lorem Ipsum, and Potemkin — per Morphisec, BlueVoyant, and Huntress, with the Lorem Ipsum activity possibly tied to Vice Society (The Hacker News). Microsoft also detailed CryptoBandits, a USB-LNK worm spreading a Windows clipper that uses Windows Script Host, ActiveX, and a bundled Tor proxy for C2 (BleepingComputer). · Threat Intelligence

June 19, 2026

  • Gamaredon is weaponizing WinRAR path-traversal CVE-2025-8088 against Ukraine: a malicious NTFS alternate data stream plants a .lnk directly into the Startup folder on archive extraction, then runs a hidden anti-analysis PowerShell stager. Campaign active since February 2026 with military/conscription lures (Nextron). · Nation-State & APT
  • Dropping Elephant has run one continuous China-themed LNK loader line for three-plus years (44 samples, 2023–2026) delivering an in-memory RAT via PDF-masquerading shortcuts and hidden PowerShell stagers (Rapid7, Nextron); SideCopy (APT36) swapped in a "Minutes Of Meeting" double-extension .lnk lure dropping a .NET RAT with HKCU Run persistence (Nextron). · Nation-State & APT

June 18, 2026

  • ScarCruft (APT37) delivered NarwhalRAT via spear-phishing impersonating Microsoft account security alerts, using Korean sites and pCloud for C2 (The Hacker News). · Threat Activity & Ransomware
  • SideCopy (APT36 / Transparent Tribe) continues its double-extension LNK → PowerShell → CrimsonRAT chain against Indian defense, swapping lures between fake PowerPoint briefings and Word "Minutes of Meeting" docs; staged components barely register at delivery. IOCs via Nextron (Nextron). · Threat Activity & Ransomware
  • ClickFix campaigns expanded with three new loaders — BabaDeda, Lorem Ipsum, and Potemkin — via fake update lures and compromised WordPress sites, one cluster possibly linked to Vice Society (The Hacker News). · Threat Activity & Ransomware · also via drive-by

June 17, 2026

  • SideCopy / APT36 (Transparent Tribe) targeted Indian defense personnel with a weaponized PowerPoint package and a double-extension .pptx.lnk shortcut launching a .NET CrimsonRAT loader. Nextron Research. · Threat Activity
  • ScarCruft (APT37) used spear-phishing impersonating Microsoft account security alerts to deliver NarwhalRAT. The Hacker News. · Threat Activity