A Russian national was indicted in the United States for conducting a phishing campaign that infected approximately 80,000 freelancers with TVRAT and DarkVNC malware. The attacker used fake accounts to send malicious Microsoft Excel attachments containing macros, which downloaded malware onto victims' systems. The malware enabled remote control of infected devices and exfiltration of stolen data, including e-commerce credentials and personally identifiable information. The campaign primarily targeted users of a freelance employment platform, with half of the victims located in the United States, especially in Northern California. The attacker has been extradited and is in federal custody.
Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. This abuse involves leveraging the admin tool to deploy unauthorized remote access software, potentially enabling attackers to control affected systems remotely.
The Spring Ring campaign is a voice phishing operation targeting Microsoft Teams users. It abuses the platform to deploy malware and aims at compromising enterprise domain controllers. This campaign leverages social engineering via voice phishing to infiltrate organizations. The threat focuses on enterprise environments using Microsoft Teams for communication.
This analysis covers the use of JavaScript obfuscation techniques commonly found in phishing kits, malware loaders, and other malicious scripts. Obfuscation transforms JavaScript code to hide its true intent by encoding strings, renaming functions, and using runtime decoding, making manual analysis difficult. While obfuscation can be used for legitimate purposes such as performance optimization or IP protection, it is frequently employed to conceal malicious behavior like credential theft and malware delivery. The article emphasizes that beautifying code is insufficient to fully understand obfuscated scripts, as it does not restore original logic or decode runtime-generated content. Analysts should treat such samples as hostile and avoid executing them in unsafe environments. The post provides definitions and examples of obfuscation techniques and discusses approaches to analyzing these challenging scripts.
This report analyzes a polymorphic phishing page that dynamically generates different variants of its credential-stealing content on each visit. The phishing page uses heavily obfuscated JavaScript, which occasionally contains a coding error causing an infinite loop and preventing the page from rendering. The polymorphism includes randomized function and variable names, altered HTML attributes, and obfuscation techniques to evade detection. Despite these changes, the page's core functionality remains consistent. The obfuscation mechanism likely uses a simple random renaming approach rather than advanced AI generation. This polymorphism complicates detection by static signature-based tools but does not fundamentally alter the phishing intent.
This is a sophisticated global phishing campaign that abuses legitimate Remote Management and Monitoring (RMM) software to gain unauthorized remote access. Initially targeting Canadians with fake Canada Revenue Agency tax documents, it has expanded to 46 countries, with nearly half of the activity in the United States. Attackers impersonate trusted organizations and use advanced techniques such as password-protected archives, browser fingerprinting, and Telegram-based victim filtering. The campaign uses rapidly rotating infrastructure hosted mainly on Vercel, leveraging legitimate TLS certificates and domain reputations. Signed commercial RMM tools are abused, making traditional signature-based detection ineffective. The campaign has been active steadily since January 2026.
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs. These pages redirect visitors to attacker-controlled websites, facilitating phishing attacks. This abuse leverages the trust in npm package hosting and its mirrors to distribute deceptive content.
AnonyMousKIT is a phishing-as-a-service platform that uses voice AI agents to trick victims into revealing iPhone passcodes and Apple account credentials. The service automates the retrieval of unlocking codes to bypass Apple's Activation Lock, enabling thieves to unlock stolen iPhones and access sensitive data. It impersonates Apple through phishing emails and calls, directing victims to fake Apple pages to harvest passcodes and two-factor authentication codes. The platform has been active since early 2024 and operates a large ecosystem with hundreds of reseller storefronts. Most attacks target Brazil, but campaigns have a global footprint including South Africa, Indonesia, Italy, India, and Kenya. Compromised Apple IDs can expose iCloud backups, Keychain passwords, and corporate data. The service lowers the value of stolen devices by enabling full unlocking and data access.
This report discusses a category of risky websites that browsers often mistakenly classify as safe. These 'gray-area' sites are not outright phishing scams but are untrustworthy and may cause financial loss or data compromise. Examples include subscription aggregators with hidden costly renewals, scam online stores selling counterfeit or non-existent goods while harvesting personal and payment data, fraudulent crypto trading platforms that steal investments and credentials, deceptive middleman services charging excessive fees, and fake browser extensions that hijack browsing data and sessions. These sites often exploit legal loopholes or obscure terms to avoid direct illegality. Users are advised to be cautious even when browsers show no warnings, especially with suspicious payment methods or requests for sensitive information.
RecruitTrap is a sophisticated phishing campaign targeting enterprise credentials by impersonating HR personnel from well-known companies. It uses Browser-in-the-Browser techniques on desktop and full-screen fake login pages on mobile without visible URL indicators. The campaign actively screens victims to focus on corporate accounts, rejecting personal emails. Attackers impersonate multiple global brands and use persistent hosting on Amazon and SEDO networks. Detection of malicious domains is significantly delayed by traditional threat feeds. The campaign facilitates credential harvesting, OAuth token theft, and lateral movement within organizations.
A ReliaQuest employee fell victim to a phishing attack and the hackers gained access to a dashboard. The post ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited appeared first on SecurityWeek .
A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]
Researchers say iAuthFlow V2 can register an attacker-controlled passkey, enabling persistent access even after passwords are changed and active sessions revoked. The post New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets appeared first on SecurityWeek .
Phishing attacks are becoming more sophisticated due to AI, making them more personalized and harder for traditional email filters to detect. Managed Service Providers (MSPs) are advised to monitor identity, email, and endpoint activity to detect and contain phishing attacks that bypass inbox filters. This threat highlights the evolving challenge of phishing in the context of AI-enhanced social engineering.
Attackers are increasingly exploiting enterprise collaboration platforms to conduct identity phishing, credential theft, impersonation, and social engineering. These platforms, integral to business communication and connected to enterprise identity providers, have become part of the attack surface. Threat actors leverage compromised accounts, trusted relationships, and external access to conduct malicious activities that appear as normal collaboration interactions. Over the past year, alerts related to malicious activity in collaboration tools have significantly increased, primarily involving chat or voice phishing. This trend highlights the need for strong authentication and enhanced visibility into activity within authenticated collaboration sessions.
A coordinated campaign involving 77 Firefox browser extensions has been identified, targeting cryptocurrency users by stealing wallet secrets and credentials. The campaign, named 'Offside Wallet Theft Factory,' includes 40 confirmed malicious extensions that exfiltrate sensitive data such as recovery phrases and private keys via Supabase-controlled remote switches, Cloudflare Workers, and hardcoded command-and-control infrastructure. An additional 37 extensions initially appeared benign but evolved into wallet-stealing malware. The operation ran from at least March 2026 through August 2026 and impersonated popular Web3 products like OKX, Rabby Wallet, and TronLink. The extensions use phishing interfaces, modified wallet code, and direct credential theft to enable immediate cryptocurrency theft and financial loss.
Cybercriminals are operating fraudulent cryptocurrency wallet-checking websites that impersonate legitimate anti-money laundering (AML) services. These fake sites mimic authentic platforms like AMLBot and trick users into connecting their wallets and approving transactions or token permissions. The scam uses fake progress bars, compliance messages, and error notifications to appear legitimate and request small fees. Once users approve these requests, attackers can drain their cryptocurrency holdings. This is a social engineering scam exploiting user trust and security awareness rather than a software vulnerability.
Researchers identified an exposed web directory on infrastructure supporting a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, achieving a 13.6% hit rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fake support cases before being directed to counterfeit wallet applications designed to steal recovery phrases via Telegram exfiltration. Notable findings include extensive use of AI coding assistants throughout development, including GitHub Copilot and Claude Code. When one AI model resisted malicious requests, the operator switched providers and attempted to bypass safety controls using a structured jailbreak prompt targeting the model's reasoning patterns and safety mechanisms.
Google Workspace attacks do not always begin with phishing. Stolen OAuth tokens can provide another path into Gmail, Drive, and connected systems. Material Security explains why organizations need defenses that cover the entire Workspace attack chain. [...]
Welcome to this week’s edition of the Threat Source newsletter. “Experiment is the mother of knowledge.” ― Madeleine L'Engle, A Wrinkle in Time “Don't slide down the rabbit hole. The way down is a breeze, but climbing back's a battle.” ― Kate Morton, The Clockmaker's Daughter Hacker Summer Camp has come and gone, which means it’s time for you to start planning next year’s trip. I’m surely going to recap Camp Season, right? Nope. One of the things that I’ve really enjoyed lately is a segment on the Beers with Talos podcast that we call “Make Hazel a Hacker.” If you haven’t listened to it, this is a perfect time to start. Each episode we take a few minutes and pose a security question, term, or concept to Hazel and force her to come up with an idea or explanation on the spot. There are no parameters, so she’s faced with the entirety of information security — past, present, and future. I know, it’s insane. The craziest part is that (I think) Hazel came up with this idea and still volunteered to put herself in the line of fire. As we put Hazel’s feet to the fire, one of my favorite things happens: The rest of us listen in and offer our thoughts during her brainstorming process. Invariably, we’ve got three very different answers, ideas, hints, or directions for her. It’s surely maddening for Hazel, but to me, the best part of the discussion that inevitably follows is that although they’re all different, they’re all correct. For example, this past episode I asked her about a behavioral indicator (regarding “wallpaper.bmp”) that seems benign on its own, but can be interesting to use as a pivot for a threat hunt. We had various interesting angles to consider, backed by years of knowledge and experience. It gave us a good conversation, and that was a .bmp! One of the most nebulous things to learn in this field is that multiple things can be both different and correct. When you are making your decisions this week — whether it’s deciding on a new pivot in your hunting, what devices to prioritize in your patching and updating, or which books or online training to focus on — take a quick second and get a second, third, and fourth opinion. Then try something that’s outside of your normal wheelhouse but sounds good when it’s proposed. None of this is a solo sport. It’s a team game and the best plays come from a mix of perspectives, experiences, and mistakes. The “right” answer can wear many faces, and your ability to hold different truths will lead you to undiscovered territory, the rabbit hole where anomaly lives and breathes. So... welcome back from Vegas. Now go down a rabbit hole on a path you wouldn’t normally take because one of your friends (Joe) or your mortal enemy (Dave) told you that it would work. “She'd been to Narnia, Wonderland, Hogwarts, Dictionopolis. She had tessered, fallen through the rabbit hole, crossed the ice bridge into the unknown world beyond.” ― Anne Ursu, Breadcrumbs The one big thing Cisco Talos recently discovered "JWR," a previously undocumented, real-time phishing framework and likely variant of "The Outsider" phishing-as-a-service platform. JWR uses an open WebSocket connection that allows attackers to monitor keystrokes live and dynamically steer victims through fake checkout and login flows. Currently deployed via SMS lures impersonating regional toll and postal authorities, JWR enables operators to steal payment data, 2FA codes, identity documents, and device fingerprints. Why do I care? Because JWR is operator-driven in real time, attackers can actively bypass multi-factor authentication (MFA) by prompting victims for 2FA codes exactly when needed. The sheer volume of collected data gives threat actors a comprehensive identity profile primed for extensive follow-on fraud and network compromise. Furthermore, JWR's seamless integration with legitimate e-commerce platforms like Shopify makes these lures incredibly convincing to the untrained eye. So now what? Prioritize user education around SMS-based phish…
