Iranian and Russian shadow fleet vessels are utilizing sophisticated online infrastructure consisting of over 36 inauthentic websites to facilitate sanctions evasion. These websites impersonate ship registries, national maritime administrations, seafarer training organizations, protection and indemnity clubs, and classification societies from jurisdictions including Comoros, Benin, Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia. The infrastructure operates through three identified clusters designated Alpha, Bravo, and Charlie, which demonstrate technical overlaps suggesting a broader ecosystem supporting multiple sanctions evasion networks. Operators employ tactics including automated document generation, typosquatting, identity spoofing, and mutual endorsement loops between fraudulent entities. Attribution includes links to Indian web development company Oceaniek Technologies and two Syrian nationals. The infrastructure has documented connections to seventeen vesse...
An investigation into phishing activity targeting users across the Middle East and North Africa uncovered SniperDz, a centralized Push-Notification-as-a-Service and Phishing-as-a-Service platform. The operation uses fraudulent Facebook accounts impersonating politicians, public figures, and trusted organizations to promote fake offers including free mobile internet packages and financial compensation. Victims are redirected through trusted link-aggregation services like Linktree and Linkbio to evade detection. SniperDz provides 80 phishing templates mimicking over 30 global brands across financial services, social media, streaming, and gaming platforms. The infrastructure employs browser notification abuse, history manipulation creating a back-button prison, premium SMS subscriptions, premium-rate calls, investment scams, and affiliate marketing for monetization. Analysis revealed over 900 suspicious domains linked to shared hosting infrastructure and a recurring VAPID public key connecting multiple campai...
US Federal authorities have seized 13 domains allegedly used in a Chinese intelligence-linked operation to recruit Americans with access to classified government information. The websites posed as legitimate consulting firms, offering vague consultancy and advisory roles to current and former US government employees, military personnel, and security clearance holders. The operation, which began in November 2023, used fake company websites, online job postings, and social media recruiting to approach potential targets. Recruiters offered paid consulting work, then pressured candidates to share confidential insider information. The campaign employed false personas, stolen identities, AI-generated profile photos, encrypted messaging, cryptocurrency, and fake contracts to appear legitimate. Job postings appeared on platforms including Upwork, Expertia AI, and Hubstaff Talent, covering topics aligned with Chinese government interests.
An advanced voicemail-themed phishing campaign is utilizing HTML attachments to hijack Microsoft 365 sessions through silent OAuth exploitation. Emails arrive spoofing legitimate businesses with fake voicemail notifications containing embedded HTML files. When victims click the play button, the kit triggers a rogue OAuth 2.0 request using the prompt=none parameter to steal authentication tokens from active M365 sessions. If no active session exists, victims are redirected to credential harvesters hosted on compromised infrastructure, specifically a Turkish domain hosting over 100 active campaign directories. The operation includes multiple attack vectors: fake login portals mimicking DocuSign, Outlook and Google, OAuth device code phishing interfaces, and RMM deployment disguised as document viewers. This represents a sophisticated Phishing-as-a-Service operation deploying concurrent attack types from consolidated infrastructure.
Operation Riptide is an ongoing coordinated law enforcement campaign announced by the FBI targeting criminal actors and the key services they rely on, including their infrastructure, tools, communications platforms, and financial channels. The campaign aims to disrupt illicit activities by focusing on multiple facets of criminal operations. No specific technical vulnerabilities or exploits are detailed in the available information. There is no indication of affected software versions or direct exploitation methods. The campaign represents a law enforcement initiative rather than a software vulnerability or malware threat.
This diary continues the Internet Storm Center&#;x26;#;39;s tracking of the TeamPCP supply chain campaign, first documented in the SANS white paper When the Security Scanner Became the Weapon and most recently in the handler diary Activity Through 2026-05-24. Since that update, the story moved into two new places: the United States government, which formally caught up to the campaign, and the wider population of attackers now wielding the Mini Shai-Hulud framework that TeamPCP open-sourced last month.
This report describes a campaign promoting a WhatsApp group that offers discounted cybersecurity exam vouchers and subscriptions. The campaign appears to target cybersecurity learners and professionals by advertising access to discounted certifications and premium platforms. There is no technical vulnerability or exploit detailed, and no direct evidence of malicious activity or compromise is provided. The source is a Reddit post linking to a WhatsApp group, with minimal discussion and no known exploits in the wild. The nature of the campaign suggests potential risks related to trust and payment fraud rather than a software vulnerability.
A sophisticated multi-stage malware campaign targets victims through tax-themed phishing emails impersonating Indian and Japanese government authorities. The operation leverages social engineering, fraudulent tax notifications, and trusted third-party email delivery services to distribute ZIP archives containing three staged payloads. The malware implements advanced evasion techniques including DLL Search Order Hijacking, API hooking, token manipulation, Mersenne Twister-based execution logic, COM callback execution, mutated RC4 encryption, and reflective PE loading. Execution occurs primarily in memory, significantly reducing forensic artifacts. The malware establishes persistent WebSocket-based command-and-control communication through HTTP protocol upgrades, allowing malicious traffic to blend with legitimate activity. Chinese-language artifacts were observed throughout the infrastructure and code, though attribution remains at moderate confidence. The campaign demonstrates characteristics of a mature, ...
A new extortion group called Pink, tracked as cluster CL-CRI-1147, employs voice phishing and fake IT helpdesk impersonation to compromise organizations. The gang steals employee credentials, bypasses multi-factor authentication, and exfiltrates data from cloud storage platforms like SharePoint and OneDrive. Pink threatens to leak stolen information unless ransom demands are met, setting 72-hour deadlines. The group's data-leak site launched on May 31, 2026. This approach mirrors tactics popularized by Lapsus$, Scattered Spider, and ShinyHunters. Incident responders link Pink to The Com, a loosely connected network of English-speaking hackers and extortionists. Attackers use compromised victim accounts and internal Teams messages for extortion communications, reusing domains across multiple targets.
A new Magecart campaign is using Stripe's API infrastructure to host the credit card-stealing payload and the data exfiltrated from checkout pages. [...]
Activity began with a ClickFix-style social engineering chain that led to MSI execution, PowerShell staging, and installation/use of Deno to run attacker-controlled JavaScript. Follow-on activity downloaded a portable Python runtime, `install.pyc`, and an encrypted `.MOa` container, which was later decrypted to recover a 64-bit Windows PE payload. Analysis of the recovered payload showed Steam Community being used as a dead-drop resolver for C2, with the profile title resolving to `smokeenew[.]com`, while `ip-api.com` was used for victim network/geolocation profiling. The payload also contained logic for browser/wallet data collection, clipboard/keylogging-related capabilities, Defender exclusions, UAC bypass/relaunch behavior through `ComputerDefaults.exe`, and a C2-tasked mechanism to receive and install an additional `Krutyak.zip` / `usbmmidd_v2` component. Recommendations: Block artifacts where applicable.
Microsoft Threat Intelligence discovered a large-scale npm supply chain attack compromising 32 malicious packages across over 90 versions under the @redhat-cloud-services scope. The compromise originated from the RedHatInsights/javascript-clients CI/CD pipeline, enabling attackers to publish trojanized packages through legitimate GitHub Actions OIDC workflows with authentic provenance signatures. The malicious packages executed a heavily obfuscated 4.29 MB dropper via npm preinstall hooks, which downloaded the Bun JavaScript runtime and launched payloads designed to harvest credentials from GitHub, npm, AWS, Azure, GCP, HashiCorp Vault, Kubernetes, and developer systems. The malware scraped GitHub Actions runner memory for secrets, escalated privileges using passwordless sudo, exfiltrated stolen data through GitHub infrastructure, and propagated by compromising additional maintainer packages with forged SLSA provenance. The campaign marker "Miasma: The Spreading Blight" was embedded throughout the malicious
Multiple malicious Chrome extensions are exploiting the growing use of AI platforms by disguising themselves as legitimate productivity tools while secretly stealing user conversations and personal data. Extensions including Urban VPN, Smart Sidebar, and AI Assistant/Chat AI collectively reach millions of users but contain hidden scripts that intercept communications with popular AI platforms like ChatGPT, Claude, DeepSeek, Gemini, and others. These extensions inject malicious JavaScript that overrides network requests, monitors DOM elements for chat interactions, and exfiltrates sensitive data including conversation content, session identifiers, and timestamps to remote servers. The threat is particularly concerning as users frequently share confidential personal, medical, and corporate information with AI platforms, making intercepted conversations highly valuable for threat actors.
A sophisticated smishing and phishing operation active since the second half of 2025 has impersonated over 267 brands across 72 countries, with particular concentration in Latin America. The campaign generated 4,389 phishing domain instances, with Mexico accounting for 1,851 cases. Telecommunications is the most targeted sector with 1,754 instances, followed by financial services and consumer rewards programs. The operation employs fake Cloudflare error pages as decoys, revealing malicious content only to victims matching specific geofencing and mobile device criteria. Data exfiltration occurs through encrypted WebSocket channels using binary encoded payloads. Approximately 30% of infrastructure is hosted on Tencent Cloud and Alibaba US servers, fronted by Cloudflare to mask hosting IPs. The attack chain progresses from SMS lures through progressive credential harvesting, ultimately capturing complete credit card details including CVV codes.
The attackers had access to a senior executive’s email account for 150 days and exfiltrated data for months. The post Hackers Target Global Stock Exchange in Espionage Operation appeared first on SecurityWeek .
The Miasma campaign is a supply chain attack targeting Red Hat npm packages under the @redhat-cloud-services namespace. Attackers used a compromised Red Hat employee's GitHub account to push malicious commits and abused GitHub Actions OIDC workflows to publish packages with valid SLSA provenance, bypassing supply chain verification. This attack highlights a weakness in the trust model of npm publishing workflows, where the build pipeline's trust boundary can be circumvented upstream. The campaign also includes new variants that collect cloud identities from GCP and Azure, escalating the threat beyond credential harvesting to active cloud access enumeration. Attribution remains uncertain, with possible links to the publicly released TeamPCP toolkit. No known exploits in the wild or official patches have been reported yet.
The WaSteal campaign involves a large number of malicious Chrome extensions used for data exfiltration. Recent analysis revealed 57 additional extensions linked to the same operator and backend, bringing the total to 183 active extensions on the Chrome Web Store. These extensions share the same exfiltration behavior and remain live, posing ongoing risk to users who install them. The campaign is actively tracked and reported by threat intelligence sources, but no specific patch or remediation guidance is provided in the available data.
This entry describes an update to a Threat Actor Intelligence Dashboard, a tool designed to track and profile threat actors with real-time intelligence. It is a resource aimed at the security community to aid defenders by providing refreshed actor profiles and improved search capabilities. The content is promotional in nature, describing the tool's features and availability rather than a specific security vulnerability or active threat. No technical vulnerability, exploit, or attack campaign details are provided.
On May 28, 2026, the Dutch National Police and National Cyber Security Center (NCSC) jointly dismantled a large-scale botnet comprising approximately 17 million compromised devices worldwide. The botnet infrastructure was hosted on about 200 servers physically located in the Netherlands, which were seized from a local hosting provider. The compromised devices included computers, smartphones, and tablets, and were reportedly used as part of a residential proxy service, likely the Asocks network. The hosting provider permanently took the botnet infrastructure offline following the seizure. The NCSC issued prevention guidance emphasizing prompt patching, multi-factor authentication, changing default credentials, securing Wi-Fi with WPA2/WPA3, and maintaining visibility over network devices. This takedown is part of a broader pattern of coordinated international law enforcement actions against proxy and botnet networks in 2026.
This is a public release of an advanced, fully automated Server-Side Request Forgery (SSRF) testing framework designed for security researchers, bug bounty hunters, and penetration testers. The tool automates discovery, validation, and analysis of SSRF vulnerabilities, including cloud metadata testing and advanced testing modules such as WebSocket, gRPC, Kubernetes, and serverless SSRF. It integrates AI-assisted payload generation and analysis to improve testing efficiency. The project is intended strictly for authorized security testing and research. There is no indication of active exploitation or malicious campaigns associated with this tool. No official patches or vendor advisories apply as this is a testing framework, not a vulnerability itself.
