Threat map
Countries named in threat reports added in the last 30 days, shaded by how often they appear. Reports listing more than 10 target countries are left out.
Global threat distribution
Countries by threat count
Select a country to see its latest threats
Recent threats
Newest by publish date, naming a country, added in the last 30 days
The Industry Leader in Enterprise Brand Protection
A sophisticated phishing campaign targets hospitality customers by impersonating Booking.com and other hotel services with fake reservation pages. The campaign uses personalized reservation details to increase credibility and employs advanced features such as real-time card validation, interactive verification workflows, and multi-language support. It focuses particularly on Japanese hotels but is designed for global deployment. The phishing kit uses multiple backend endpoints to track victim progression and can prompt additional verification after initial card submission.
Phishing
Japan
Lookalike Domains Expose the iPhone Theft Economy
An underground marketplace on Telegram facilitates unlocking stolen iPhones despite Apple's Activation Lock. Attackers use SMS phishing with lookalike domains to trick owners into revealing passcodes. Unlocking tools, sold for $5-50, can jailbreak older phones and gather data to improve phishing. Over 10,000 domains linked to these operations have been identified, with a significant increase in DNS traffic. The operation spans multiple countries and focuses on wiping devices for resale rather than data theft.
Campaign
United States, Bangladesh, India +4 more
Email threat landscape: Q3 2026 trends and insights
Between July and September 2026, approximately 7.3 billion email-based phishing threats were detected, with a significant 41% increase in attacks in September compared to August. Attack techniques shifted notably, including a decline in QR code phishing and a resurgence of CAPTCHA-gated attacks using SVG attachments. Domain spoofing persisted, affecting 129 million messages impersonating business services. Credential theft remained the primary goal, while business contact impersonation declined. Teams-based phishing increasingly used common personal names instead of help desk identities. Targeted campaigns affected legal organizations and Spanish-speaking users, delivering Agent Tesla malware. The disruption of the Tycoon2FA phishing platform resulted in a 99.8% reduction in its phishing volume.
Analysis
United States, Chile, Colombia +2 more
CWPdoor: The Invisible Backdoor Living Inside Control Web Panel
CWPdoor is a sophisticated passive backdoor targeting Control Web Panel (CWP), a Linux server management control panel. It embeds malicious code into the legitimate cwpsrv binary and activates only upon receiving specially crafted HTTP requests with cryptographic signatures. The backdoor executes remote commands while suppressing access logs, leaving no forensic evidence. First observed in June 2026, it has evaded detection by security vendors and has been linked to a real-world victim in Brazil. It uses RSA signature verification and AES-256-CBC encryption for command and control communications via Unix domain sockets, making detection difficult.
Malware
Brazil
From Streaming to Stealing: Mirax and the Rise of Server-side Android Device Takeover in META
Between March and September 2026, the Mirax malware infected thousands of Android devices in the META region, causing millions in estimated financial losses. Distributed via malicious ads in low-reputation streaming apps on Google Play, Mirax impersonates Google Play Services using Cyrillic characters and tricks victims into granting Accessibility Service permissions, enabling full device takeover. It uses server-side configuration with dual-WebSocket command-and-control infrastructure and DNS-over-HTTPS. The malware dynamically pushes phishing templates targeting over 20 regional banks and digital wallets. Attackers remotely control infected devices in real time to perform unauthorized transactions that appear legitimate, with stolen funds transferred to suspected mule accounts in India. The campaign peaked during Eid holidays and remains active.
Malware
India