A global cybercriminal network responsible for over one billion phishing messages targeting more than 75,000 organizations across 150 countries has been disrupted by law enforcement and partners. The operation involved a Chinese-language cybercrime marketplace called YAM Store, which sold compromised Microsoft and Google accounts and infrastructure. Phishing kits such as CoGUI, Haozi, and Iron Man were used to conduct large-scale phishing campaigns, including device-code phishing to steal authentication tokens. Microsoft and allied agencies seized domains, deactivated accounts, and blocked domains to disrupt the infrastructure. The campaign targeted Microsoft 365 customers heavily and used sophisticated evasion techniques like geofencing and fake CAPTCHA gates. The takedown is ongoing with continued removal of malicious infrastructure.
Microsoft uncovered a Chinese-language cybercriminal ecosystem involving phishing kit developers, an illicit marketplace called YAM Store, and downstream threat actors. This ecosystem enables large-scale phishing campaigns targeting organizations worldwide, including in Japan, the US, Australia, and India. The phishing kits impersonate legitimate brands and facilitate credential theft. YAM Store sells fraudulently acquired Microsoft and Google cloud environments to support these operations. Microsoft and partners disrupted the primary developers and infrastructure behind this ecosystem.
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace comprising YAM Store, CoGUI, and Iron Man, which sent over one billion malicious messages since January 2026. These services supplied stolen accounts, phishing kits, and infrastructure to criminals worldwide, targeting consumers and more than 75,000 organizations in over 150 countries. The phishing kits allowed real-time credential harvesting with interactive platforms and included thousands of templates tailored to many countries. The disruption was enabled by a US federal court order and involved multiple cybersecurity and law enforcement partners. Microsoft disabled over 20,000 accounts and blocked more than 100,000 domains related to this operation. The phishing infrastructure depended on vendor licensing servers, making it vulnerable to takedown efforts.
Critical infrastructure organizations face increasing cyber risks from nation-state groups, particularly those affiliated with Iran, and AI-driven attacks. These adversaries have shifted from espionage to destructive attacks targeting essential services like water, energy, and government facilities. Challenges include asset visibility gaps, especially in older operational technology (OT) systems that are difficult to inventory and patch. Attackers leverage AI to rapidly map IT/OT networks and exploit legacy systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) advises critical infrastructure operators to strengthen cyber hygiene by reducing vulnerabilities, replacing unsupported legacy devices, and preparing rapid recovery plans. CISA emphasizes foundational cybersecurity practices such as employee education, strong authentication, timely patching, monitoring, data backup, and incident response planning. This guidance aims to help organizations mitigate risks from sophisticated nation-state and AI-enhanced cyber threats.
The FBI arrested Edward Dubrovsky, co-founder of a Canadian cybersecurity firm specializing in ransomware negotiation, on charges related to assisting the ShinyHunters hacking group. ShinyHunters is known for using phishing and stolen credentials to steal data from software-as-a-service companies and extorting victims by threatening to publish stolen data. Dubrovsky faces charges including conspiracy to threaten confidentiality with intent to extort and interference with commerce by threats. The investigation has centralized in the FBI's Eastern District of Texas, the hub for ShinyHunters-related cases. Dubrovsky authored a book on ransomware negotiation strategies. The case is ongoing with several documents sealed, and further charges against other ransomware negotiation firms may follow.
The CyberAgents Exchange by Tenable is an open-source directory for AI agents used in security operations, which undergoes a rigorous vetting process called the Exchange Inspector before listings earn a vetted tag. This process includes automated checks, AI model assessments, and human verification to identify security issues such as SSRF, path traversal, excessive permissions, and memory poisoning. The vetted AI agents help accelerate threat hunting, remediation triage, and cloud posture investigation. The Exchange Inspector aims to mitigate risks associated with deploying AI agents that carry credentials and perform autonomous actions, reducing the potential blast radius compared to typical open-source libraries. The directory promotes transparency by requiring contributors to keep code in public repositories for review prior to deployment. The Exchange Inspector combines Tenable’s exposure detection tools, OpenAI GPT cyber models, and human review to ensure security before deployment.
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign targeting Taiwan research organizations. The campaign used AI-assisted content generation to craft personalized phishing emails impersonating reputable academic and policy institutions. It combined traditional email phishing with QR code phishing (quishing) by modifying legitimate event posters with malicious QR codes. The phishing infrastructure included an advanced adversary-in-the-middle (AitM) framework impersonating Google authentication pages to intercept credentials and multi-factor authentication challenges in real time. The campaign leveraged legitimate event details as cover but redirected victims to actor-controlled phishing sites. The phishing kit's UI was originally developed in Simplified Chinese and adapted for Traditional Chinese and English, suggesting a developer with a Simplified Chinese primary language background.
A coordinated campaign involving 16 malicious Firefox extensions targets cryptocurrency wallet users by stealing wallet recovery phrases and private keys. These extensions impersonate legitimate wallet portals and tools, including clones of Rabby Wallet and OKX Wallet. The stolen credentials are sent to attacker-controlled Cloudflare Workers endpoints. Mozilla has removed these extensions from their store. Users who have entered their credentials into these extensions are advised to create new wallets and transfer their assets immediately.
A phishing campaign exploited legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools. Attackers sent phishing emails with links redirecting victims to fake reference documents hosted on Power BI infrastructure. Clicking the download link led to attacker-controlled sites that fingerprinted victims' systems before downloading malicious ScreenConnect installers. Multiple ScreenConnect instances were deployed for persistent remote access, with scheduled tasks created to maintain persistence. The campaign used browser fingerprinting and Telegram bots to filter victims and track infections, leveraging trusted Microsoft domains to bypass email security and increase credibility.
This report discusses the emerging threat of autonomous AI agent swarms conducting cyber attacks on public infrastructure and organizations. These AI-driven attacks can rapidly execute complex campaigns involving social engineering, exploitation of unpatched vulnerabilities, and phishing at scale. While current public incidents resemble noisy penetration tests, future attacks may prioritize stealth and persistence, making detection and defense more challenging. The report emphasizes the need for organizations to prepare incident response plans, map attack paths, run AI-specific tabletop exercises, enforce strong multi-factor authentication, and enhance internal detection capabilities to build resilience against these evolving AI-powered threats.
Japanese media giant Nikkei disclosed breaches of two employee email accounts—one Google Workspace account accessed in July and one Microsoft 365 account accessed in September. The Google account breach exposed personal information of 1,646 employees and business partners but did not include reader or interviewee data. The Microsoft 365 breach was used to send 9,000 phishing emails targeting internal staff and interviewees. Nikkei changed passwords after discovering the breaches and has contacted affected individuals. No unauthorized logins have been detected since remediation. The company has not attributed the attacks to any specific threat actor or linked the two incidents.
XWorm is a modular malware associated with the DDGroup cybercrime group. It uses multiple delivery methods such as phishing emails, drive-by downloads, exploit kits, USB drives, and RDP exploitation. The malware enables remote access, data theft including passwords and credit card information, ransomware deployment, spyware installation, and can cause system crashes and denial-of-service attacks. Its modular design and diverse attack vectors make it a persistent and multifaceted threat requiring continuous cybersecurity vigilance.
Since January 2026, the Russian state threat actor Star Blizzard has enhanced its cyberespionage operations by adopting a new malware delivery technique called RedFlick, alongside large-scale phishing campaigns and use of compromised website accounts. These tactics improve detection evasion and target Ukrainian individuals and institutions, as well as international NGOs, Western think tanks, governments, and organizations linked to Ukraine support. Indicators include multiple malicious domains, file hashes, and an IP address associated with the campaign. No specific software vulnerabilities or CVEs are identified.
This content describes a free educational course offered by Kaspersky aimed at university students to build foundational cybersecurity skills. It addresses students' concerns about practical skills and career readiness, emphasizing the importance of cybersecurity knowledge in technical fields. The course covers cybersecurity basics, common cyber threats like phishing, and introduces concepts such as Security by Design. It is designed to improve digital literacy and reduce human error-related security incidents. The course is not a security threat or vulnerability but an educational resource.
Russian state-sponsored APT Star Blizzard has employed a new malware delivery technique called RedFlick in large-scale phishing campaigns targeting Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial institutions supporting Ukraine. The infection chain involves sending a password-protected archive containing a shortcut file disguised as a PDF, which executes a background script to deliver the CosmicPulse Python backdoor. The group uses scheduled tasks for persistence and has adapted its tactics to evade detection, including multistage execution chains involving PowerShell and MSI installers.
Cisco Talos identified a China-nexus cyber espionage campaign named UAT-11587 targeting government and policy organizations across Asia, including Taiwan, India, the Philippines, and Cambodia. The campaign uses spear-phishing emails with tailored decoy documents to deliver a Rust-compiled Windows backdoor called Antino. Antino supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence. Its command-and-control communication uniquely operates through Microsoft 365 applications using Microsoft Graph to interact with Outlook and OneDrive. The campaign has affected at least 16 institutional environments across eight Asian countries with approximately 350 compromised endpoints. Talos assesses this activity as an intelligence gathering operation with moderate to high confidence. No patch or remediation guidance is provided in the report.
In July 2026, phishing campaigns targeted organizations across multiple industries by distributing a masqueraded MSP360 Remote Monitoring and Management installer through meeting invitations, PDF-themed lures, and software update prompts. Once executed, the legitimate MSP360 installer established remote management access on affected devices, providing threat actors with an initial foothold using trusted administrative software. The MSP360 deployment was then used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel for redundant access to compromised systems. Following access establishment, threat actors deployed additional tools and conducted post-compromise activity, including information collection and credential-access operations. The campaigns utilized multiple delivery mechanisms including actor-controlled domains, compromised websites, and legitimate cloud services such as Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
Two former United States Air Force members were sentenced to a combined 189 months in federal prison for their involvement in a multi-year campaign of business email compromise (BEC) scams and phishing attacks. These attacks targeted organizations to fraudulently obtain funds or sensitive information through deceptive emails.
Executive Threat Detection (ETD) is a proactive cybersecurity service launched by Cisco Talos Incident Response to protect high-value executive accounts from sophisticated, targeted attacks. It provides monthly human-led threat hunting and intelligence analysis focused on executives' corporate systems, addressing the gap left by enterprise-wide security tools tuned for average users. The service integrates open-source intelligence (OSINT) to identify emerging threats such as phishing kits and zero-day exploits targeting executives. ETD hunts for subtle, low-and-slow attack techniques and monitors corporate information for signs of compromise. It operates with minimal impact on executive productivity by leveraging existing security tools without requiring system changes. Monthly reports provide technical findings and strategic recommendations, enabling informed leadership decisions. ETD is designed to complement existing Talos IR retainer services, allowing rapid escalation to emergency response if needed.
Three vulnerabilities in Salesforce Agentforce, collectively dubbed 'SalesBleed,' allowed attackers to hijack trusted agents, exfiltrate sensitive CRM data without user interaction, and conduct phishing attacks via Slack. The flaws exploited weaknesses in the Trusted URLs mechanism and the Agentforce-Slack integration, enabling zero-click data exfiltration and unauthorized message posting. Salesforce confirmed these vulnerabilities were fixed by August 19, 2026.
