A sophisticated phishing campaign impersonating the Indian Income Tax Department has been targeting local businesses. The attack begins with a spear-phishing email containing a PDF attachment that directs victims to a fake compliance portal. This triggers the download of a malicious ZIP file, which initiates a multi-stage infection chain. The payload, delivered through NSIS installers, deploys a Remote Access Trojan (RAT) with persistence capabilities. The malware harvests system information and establishes communication with command and control servers. Technical indicators suggest a China-linked development environment. This campaign demonstrates how seemingly simple tax-themed phishing can lead to complete device compromise, emphasizing the need for heightened security awareness.
An analysis of threat clusters, dubbed UNG0801 or Operation IconCat, targeting Israeli organizations. The actors use socially engineered phishing lures in Hebrew, exploiting antivirus icon spoofing from well-known vendors like SentinelOne and Check Point. Two distinct infection chains were identified, both utilizing AV-themed decoys dropped by malicious Word and PDF documents. The first campaign deploys a PyInstaller-based implant called PYTRIC, capable of system-wide wipes and backup deletion. The second campaign uses a Rust-based implant named RUSTRIC, focusing on antivirus enumeration and system information gathering. Both campaigns share similar tactics but differ in their ultimate objectives, with the first aimed at destruction and the second at espionage.
A sophisticated espionage campaign targeting Indian entities has been identified, masquerading as the Income Tax Department of India. The activity is associated with the SideWinder APT group, which has evolved its toolkit to evade detection by mimicking Chinese enterprise software. The campaign uses DLL side-loading techniques with legitimate Microsoft Defender binaries to bypass EDR, and utilizes public cloud storage and URL shorteners to evade reputation-based detections. The threat actors employ geofencing behavior, focusing on systems in South Asian timezones. The attack chain includes phishing emails, fraudulent websites, and malicious payloads delivered through file-sharing services. The final stage involves a resident agent that beacons to a command-and-control server, mimicking Chinese endpoint tool protocols.
Threat actors are increasingly abusing legitimate Remote Monitoring and Management (RMM) tools such as PDQ and GoTo Resolve to deploy secondary RMM tools like ScreenConnect or SimpleHelp, enabling persistent and stealthy access. Attacks often start with phishing emails or malicious downloads, targeting diverse sectors including real estate, investment firms, and car dealerships. Social engineering lures include holiday-themed messages and fake bid transcripts to trick users into executing malicious payloads. The abuse of multiple RMM tools complicates detection and remediation efforts. Detection and mitigation require a managed Security Operations Center (SOC) with visibility into RMM tool usage and network behavior. The threat is medium severity due to the potential for persistence and lateral movement, but exploitation requires initial user interaction. European organizations using these RMM tools are at risk, especially those in Germany and countries with high adoption of these management platforms. Practical mitigations include strict RMM access controls, multi-factor authentication, monitoring for unusual RMM deployments, and user training against phishing. No known exploits in the wild have been reported yet, but the trend indicates growing attacker interest in RMM abuse for persistence and lateral movement.
Multiple threat clusters, including state-aligned and financially-motivated actors, are utilizing phishing tools to trick users into granting access to Microsoft 365 accounts via OAuth device code authorization. This technique leads to account takeovers, data exfiltration, and further compromises. Threat actors are leveraging the OAuth 2.0 device authorization grant flow to gain unauthorized access by approving various applications. Campaigns often begin with an initial message containing a URL, which initiates an attack sequence using Microsoft's legitimate device authorization process. Tools like SquarePhish2 and Graphish are being used to facilitate these attacks. Both cybercriminal groups and state-aligned actors have adopted this technique, with Russia-aligned threat actors being particularly active.
Between June 2024 and April 2025, a sustained credential-harvesting campaign targeting UKR.NET users was identified, attributed to the Russian state-sponsored threat group BlueDelta. The group deployed multiple credential-harvesting pages themed as UKR.NET login portals, leveraging free web services and proxy tunneling platforms to collect user credentials. BlueDelta distributed PDF lures with embedded links to evade detection. The campaign demonstrates the group's adaptability and persistent focus on Ukrainian user credentials for intelligence purposes. Infrastructure changes, including the transition to ngrok and Serveo, reflect responses to takedown efforts. The activity highlights the GRU's continued interest in compromising Ukrainian credentials amid ongoing conflict.
A new campaign by Kimsuky involves distributing malicious mobile apps through QR codes and phishing websites. The apps, masquerading as delivery services, VPNs, and cryptocurrency tools, decrypt an embedded APK to deploy a RAT with extensive capabilities. The malware uses a native decryption function and diverse decoy behaviors. Infrastructure overlaps and Korean language comments link this activity to Kimsuky. The threat actor employs sophisticated phishing techniques and leverages QR codes to redirect victims to malicious downloads. The malware requests extensive permissions and implements keylogging, audio recording, and data exfiltration. Multiple C&C servers were identified, some hosting Naver and Kakao phishing sites.
A Russian APT group has been conducting targeted phishing campaigns against government entities in the Baltic and Balkan regions since at least 2023. The attackers use spoofed email attachments mimicking official documents to trick victims into submitting credentials on sophisticated fake login pages. These phishing pages feature blurred backgrounds and complex password validation, yet stolen credentials are exfiltrated regardless of password strength. The campaign specifically targets countries including Moldova, Ukraine, Lithuania, Bosnia and Herzegovina, Macedonia, Montenegro, Spain, and Bulgaria. The stolen credentials are sent to third-party services, enabling potential unauthorized access to sensitive government systems. This ongoing campaign poses a medium-level threat due to its targeted nature and potential for credential theft leading to further compromise. Defenders should focus on phishing awareness, email filtering, and credential monitoring to mitigate risks. The threat is particularly relevant to European government organizations in the affected regions due to geopolitical tensions and strategic importance.
The BlackForce phishing kit, first seen in August 2025, is a sophisticated phishing toolkit designed to steal credentials and bypass multi-factor authentication (MFA) using Man-in-the-Browser (MitB) attacks. It impersonates popular brands, leveraging advanced evasion techniques such as blocklists for security vendors and web crawlers to avoid detection. The kit uses a dual-channel communication setup, separating phishing servers from Telegram-based data drops, enabling real-time alerts to attackers. Its attack chain includes user validation, credential capture, and session management via a command-and-control panel. Rapid version updates indicate active development to enhance resilience and evade defenses. The kit targets users through multiple phishing domains, many mimicking streaming services, suggesting a broad attack surface. European organizations face risks from credential theft and MFA bypass, potentially leading to unauthorized access and data breaches. Mitigation requires targeted detection of phishing domains, enhanced user awareness, and monitoring of Telegram-based communications. Countries with high streaming service usage and digital service adoption, such as Spain, Germany, and the UK, are likely most affected.
Operation MoneyMount is a Russian phishing campaign targeting finance and accounting sectors by delivering Phantom stealer malware through fake payment confirmation emails. The attack uses a ZIP file containing an ISO image; when mounted, it reveals an executable that loads the stealer. Phantom stealer employs anti-analysis techniques and steals sensitive data including cryptocurrency wallets, browser data, and Discord tokens. It also features keylogging and clipboard monitoring to capture additional credentials and information. Stolen data is exfiltrated via Telegram, Discord webhooks, or FTP, making detection and blocking more challenging. The use of ISO files for initial access helps evade traditional security controls. This campaign highlights the growing sophistication of commodity stealers and the strategic targeting of financial sectors. No known exploits in the wild or CVE identifiers are associated with this malware yet. The campaign’s medium severity reflects its targeted nature and complexity of attack chain.
A sophisticated adversary-in-the-middle phishing campaign targets Microsoft 365 and Okta users by exploiting single sign-on (SSO) flows. Attackers use lookalike domains and malicious JavaScript injections to steal credentials and session tokens, bypassing multi-factor authentication. Initial access is gained through phishing emails themed around compensation and benefits, sent via compromised mailboxes and Amazon SES. The phishing infrastructure is hosted on Cloudflare, enhancing resilience and evasion. This campaign specifically targets organizations relying on Okta as an identity provider for Microsoft 365, enabling session hijacking and credential theft. The threat poses a medium severity risk due to its complexity and potential impact on confidentiality and integrity. European organizations using these platforms are at risk, especially in countries with high adoption of Microsoft 365 and Okta. Mitigation requires targeted user training, domain monitoring, and enhanced detection of anomalous authentication flows. No CVSS score is available; however, the threat is assessed as high severity given the bypass of MFA and session hijacking capabilities.
UDPGangster, a UDP-based backdoor associated with the MuddyWater threat group, has been observed targeting users in Turkey, Israel, and Azerbaijan. The malware is delivered through malicious Microsoft Word documents with embedded VBA macros, employing sophisticated anti-analysis techniques to evade detection. The campaigns use phishing emails impersonating government entities and include decoy images to distract victims. UDPGangster installs persistence, collects system information, and communicates with its command and control server using UDP. The malware supports various commands for remote execution, file extraction, and payload deployment. Analysis reveals connections to previous MuddyWater operations and shared infrastructure with other known malware.
A malicious email campaign exploits workforce anxieties by disguising itself as internal HR announcements about layoffs. The emails contain a RAR archive with a double-extension executable masquerading as a PDF document. Upon execution, the file deploys Remcos RAT, a remote access tool, which establishes persistence, collects system information, and prepares the infected host for remote access. The malware uses NSIS compilation to conceal its intent and creates configuration files and registry entries for victim identification and persistence. The campaign highlights the ongoing exploitation of current organizational trends by threat actors to gain initial access to targeted systems.
Insikt Group has identified four distinct activity clusters associated with GrayBravo's CastleLoader malware, each with unique tactics and victim profiles. This supports the assessment that GrayBravo operates a malware-as-a-service model. One cluster, TAG-160, impersonates logistics firms and uses phishing lures with the ClickFix technique to distribute CastleLoader. Another cluster, TAG-161, impersonates Booking.com and employs similar techniques. The analysis also uncovered potential links to the online persona "Sparja" and the broader cybercriminal ecosystem. GrayBravo demonstrates rapid evolution, technical sophistication, and adaptability in response to public exposure. The report recommends various security measures to defend against these threats.
The threat actor leveraged Evilginx (likely version 3.0), an open source, advanced phishing adversary-in-the-middle (AITM, aka MITM) framework designed to steal login credentials and session cookies. Evilginx is widely used by cybercriminals to undermine multi-factor authentication (MFA) security, and this actor has used it to target at least 18 universities and educational institutions across the United States since April 2025. The campaigns were delivered through email and the phishing domains used subdomains that mimicked the legitimate SSO sites.
A sophisticated social engineering campaign exploits Microsoft Teams' 'Chat with Anyone' feature to impersonate IT support and trick users into initiating Quick Assist sessions. This multi-stage attack involves phishing, malware deployment (notably an infostealer named 'updater.exe'), and reconnaissance to steal credentials and potentially exfiltrate data. The threat actors leverage legitimate collaboration tools to bypass traditional security controls. Organizations are advised to disable the vulnerable Teams feature, enforce multi-factor authentication, and adopt Zero Trust principles to mitigate risks. No CVSS score is assigned, but the attack poses a medium severity risk due to its credential theft focus and social engineering complexity.
A hybrid phishing threat combining Salty2FA and Tycoon2FA phishing kits has emerged, leveraging code and infrastructure from both frameworks. This hybridization appears driven by Salty2FA infrastructure failures, causing fallback to Tycoon2FA hosting and payload delivery. The overlap complicates attribution and weakens detection rules tailored to either kit alone. The threat is linked to the Storm-1747 adversary group, known for Tycoon2FA operations. Indicators include multiple suspicious domains used for hosting phishing pages. Defenders should update detection logic to address cross-kit overlaps and prepare for more resilient phishing campaigns that can adapt to infrastructure disruptions. The threat is rated medium severity and does not require exploits in the wild or CVSS scoring. European organizations should be vigilant due to the widespread use of 2FA and phishing susceptibility. Mitigation requires tailored detection updates, domain monitoring, and user awareness enhancements.
Ahead of Black Friday and festive sales, over 2,000 holiday-themed fake online stores have been detected, organized into two main clusters. These sites impersonate major retailers like Amazon and use uniform holiday banners, fake trust indicators, and phishing kits to deceive shoppers. They employ urgency tactics and fake checkout pages to steal sensitive financial information. The scams are timed to activate during peak shopping periods to maximize victim traffic and financial theft. This campaign leverages social engineering, typosquatting, and e-commerce impersonation to exploit consumer trust during high-volume shopping events. Although no direct exploits target software vulnerabilities, the threat poses significant risks to consumers and indirectly to organizations handling payment and customer data. European organizations involved in e-commerce, payment processing, and consumer protection are particularly at risk. Mitigation requires proactive detection of fraudulent domains, consumer awareness campaigns, and enhanced monitoring of payment fraud. Countries with high e-commerce adoption and large consumer markets are most likely affected. The threat severity is assessed as high due to the potential financial impact and widespread exposure without requiring user authentication but relying on user interaction.
The Lumma infostealer is a sophisticated malware distributed as Malware-as-a-Service, targeting Windows systems. It primarily steals sensitive data such as browser credentials, cryptocurrency wallets, and VPN/RDP accounts. Lumma is often used in the initial stages of multi-vector attacks, including ransomware and network breaches. The malware is distributed through phishing sites, disguised as pirated software, and uses complex techniques like NSIS packaging, AutoIt scripts, and process hollowing to evade detection. To combat this threat, organizations should implement behavior-based detection systems and integrate threat intelligence into their security strategies.
A threat campaign linked to the Scattered Lapsus$ Hunters group is targeting Zendesk users through over 40 typosquatted domains impersonating Zendesk and various organizations. These domains host phishing pages to harvest credentials. Attackers also submit fraudulent tickets to Zendesk portals to infect support staff with remote access trojans (RATs). This campaign follows similar attacks on other SaaS platforms like Salesforce, with Discord reportedly breached via its Zendesk support system. The attack leverages phishing, typosquatting, and social engineering to compromise customer service environments. Organizations are advised to implement strong authentication, monitor for typosquatted domains, and secure Zendesk chat to mitigate risks. The threat poses a medium severity risk due to its potential to compromise sensitive support operations and enable persistent access. No CVSS score is available, but the attack's impact on confidentiality and integrity, combined with ease of exploitation, warrants a medium severity rating.
