A recurring phishing scheme impersonates United Healthcare, offering a free Oral-B toothbrush as bait. The scammers have evolved their tactics, now using IPv6-mapped IPv4 addresses to obfuscate links in emails. This technique makes the IP addresses appear confusing while remaining valid and routable. The phishing emails direct victims to fast-rotating landing pages, likely aiming to collect personal information and card data under the guise of confirming eligibility or paying for shipping. The article provides technical details on how the IPv6 trick works and offers advice on staying safe, including steps to take if personal information has been compromised.
Law enforcement agencies in the US and Europe targeted the cybercrime service that has impacted 360,000 devices since 2020. The post Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet appeared first on SecurityWeek .
On Wednesday, a phishing message made its way into our handler inbox that contained a fairly typical low-quality lure, but turned out to be quite interesting in the end nonetheless. That is because the accompanying credential stealing web page was dynamically constructed using React and used a legitimate e-mail service for credential collection.
Key Findings Introduction Handala Hack, also tracked by Check Point Research as Void Manticore, is an Iranian threat actor that is known for multiple destructive wiping attacks combined with “hack and leak” operations. The threat actor operates several online personas, with the most prominent among them being Homeland Justice, maintained from mid-2022 specifically for multiple attacks […] The post “Handala Hack” – Unveiling Group’s Modus Operandi appeared first on Check Point Research .
Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. The post The Human IOC: Why Security Professionals Struggle with Social Vetting appeared first on SecurityWeek .
A sophisticated infection chain has been discovered that installs CastleRAT malware without leaving traces on disk. The attack uniquely abuses the Deno runtime as a malicious framework, combining social engineering, steganography, and in-memory execution to evade detection. The process involves tricking users into executing a command, installing Deno, running obfuscated JavaScript, and decoding a payload hidden in a JPEG image. CastleRAT then gains total control, performing host fingerprinting, keylogging, clipboard hijacking, digital identity theft, and audio/video surveillance. This campaign demonstrates the evolution of malware towards invisibility and the need for advanced endpoint behavioral monitoring to detect such threats.
BlackSanta is a malware module designed to disable endpoint detection and response (EDR) and antivirus (AV) solutions before executing its primary malicious payload. By killing these security defenses first, it increases the likelihood of successful infection and persistence on targeted systems. Although no known exploits are currently reported in the wild, the malware’s capability to neutralize security tools poses a significant risk. The threat is rated medium severity due to its potential impact on system integrity and confidentiality, but it requires initial access to the target environment. Organizations should prioritize detection of unusual process terminations and implement robust endpoint protection strategies. Countries with high adoption of EDR/AV solutions and critical infrastructure are more likely to be targeted. Immediate mitigation involves hardening endpoint security, monitoring for suspicious process behavior, and applying strict access controls to limit malware execution opportunities.
A new phishing technique abusing Microsoft's OAuth Device Code flow is on the rise, with over 180 phishing URLs detected in a week. This method shifts from credential theft to token-based account takeover, making detection more challenging. Attackers initiate a device authorization process, tricking victims into approving it on legitimate Microsoft pages. The attack uses encrypted HTTPS traffic and legitimate authentication flows, bypassing traditional phishing indicators. Victims unknowingly grant attackers access to their Microsoft 365 accounts through OAuth tokens. This poses a critical risk as it allows immediate access to corporate data and resources, potentially leading to business email compromise and persistent access through refresh tokens.
A new study has uncovered hundreds of vulnerabilities in popular mental health apps, including leaks of diagnoses, therapy notes, and mood tracking. We break down exactly how this data escapes, and how to choose a more secure service.
Salesforce has confirmed that customers are being targeted via poorly secured instances. The post Hundreds of Salesforce Customers Allegedly Targeted in New Data Theft Campaign appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 9th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES AkzoNobel, a Netherlands-based global paint manufacturer, has confirmed a cyberattack affecting one of its United States sites. The company said the intrusion was contained, while the Anubis ransomware group claimed it stole […] The post 9th March – Threat Intelligence Report appeared first on Check Point Research .
Abusing DNS record management controls, the threat actor hides the location of malicious content via Cloudflare. The post Internet Infrastructure TLD .arpa Abused in Phishing Attacks appeared first on SecurityWeek .
