Search: otx.alienvault.com

A hybrid phishing threat combining Salty2FA and Tycoon2FA phishing kits has emerged, leveraging code and infrastructure from both frameworks. This hybridization appears driven by Salty2FA infrastructure failures, causing fallback to Tycoon2FA hosting and payload delivery. The overlap complicates attribution and weakens detection rules tailored to either kit alone. The threat is linked to the Storm-1747 adversary group, known for Tycoon2FA operations. Indicators include multiple suspicious domains used for hosting phishing pages. Defenders should update detection logic to address cross-kit overlaps and prepare for more resilient phishing campaigns that can adapt to infrastructure disruptions. The threat is rated medium severity and does not require exploits in the wild or CVSS scoring. European organizations should be vigilant due to the widespread use of 2FA and phishing susceptibility. Mitigation requires tailored detection updates, domain monitoring, and user awareness enhancements.

Malware#tycoon2fa#phishingGermany+6

The Water Saci campaign is a sophisticated malware operation primarily targeting Brazilian banking and cryptocurrency platforms via WhatsApp. It employs multi-format malware delivery using various scripting languages, including a shift from PowerShell to Python, likely enhanced by AI tools to evade detection and complicate analysis. The malware features aggressive anti-sandbox techniques, extensive backdoor capabilities, and persistence mechanisms. Although currently focused on Brazil, the use of WhatsApp as a propagation vector and targeting financial applications poses a potential risk to European organizations with ties to Brazilian markets or users. The campaign’s complexity and AI-enhanced development pipeline indicate a medium severity threat with significant evasion and persistence capabilities. Defenders should prioritize monitoring WhatsApp-based phishing attempts, scrutinize multi-format file attachments, and implement advanced behavioral detection to mitigate risks. Countries with strong economic or diaspora links to Brazil and high WhatsApp usage are more likely to be affected.

Malware#backdoor#pythonPortugal+6

Arkanix Stealer is a newly discovered information-stealing malware designed for short-term financial gain. Initially developed in Python, it has evolved into a more sophisticated C++ version employing VMProtect obfuscation and a technique called 'Chrome Elevator' to bypass App Bound Encryption. It targets browsers, crypto wallets, VPN accounts, Steam accounts, and system information. Distributed primarily via Discord and online forums disguised as legitimate tools, it offers threat actors a web panel with premium features for managing stolen data. The malware demonstrates advanced capabilities and rapid evolution, highlighting the ease of launching cybercrime operations for quick profits. While no known exploits in the wild have been reported yet, its medium severity reflects the potential impact on confidentiality and financial assets. European organizations using targeted browsers, crypto wallets, or VPN services are at risk, especially those with users active on Discord or similar platforms. Mitigation requires targeted detection of obfuscated binaries, network monitoring for suspicious domains like arkanix.pw, and user education on social engineering risks. Countries with high crypto adoption and active gaming communities are more likely to be affected.

Campaign#discord#pythonGermany+6

Operation Hanoi Thief is a spear-phishing campaign targeting Vietnamese IT professionals and recruitment teams. It uses malicious ZIP files containing fake resumes and LNK files that execute a pseudo-polyglot payload. This payload deploys a C++ DLL implant named LOTUSHARVEST via DLL sideloading, which steals browser credentials and history. The stolen data is exfiltrated to attacker-controlled servers. The campaign uses anti-analysis techniques and abuses trusted Windows tools to evade detection. While it shares similarities with Chinese-origin campaigns, state sponsorship is not confirmed. The attack primarily affects Vietnam's IT and recruitment sectors, with no known exploits in the wild beyond spear-phishing. The campaign poses a medium severity threat due to its targeted nature and credential theft capabilities. European organizations are not directly targeted but could be at risk if similar tactics spread. Mitigation requires focused user training, monitoring for DLL sideloading, and blocking known indicators of compromise.

Malware#spear-phishing#it-professionalsFrance+4

Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like Telegram and Discord as command-and-control servers. The group employs various programming languages including Go, Rust, C/C#/C++, and Python to develop reverse shell tools. Some infections lead to the deployment of open-source post-exploitation frameworks such as Havoc and AdaptixC2. The campaign primarily focuses on Russian-speaking users and entities, with additional targets in Central Asian countries.

Malware#apt#tomiris powershell telegram backdoorRussia+7

Ahead of Black Friday and festive sales, over 2,000 holiday-themed fake online stores have been detected, organized into two main clusters. These sites impersonate major retailers like Amazon and use uniform holiday banners, fake trust indicators, and phishing kits to deceive shoppers. They employ urgency tactics and fake checkout pages to steal sensitive financial information. The scams are timed to activate during peak shopping periods to maximize victim traffic and financial theft. This campaign leverages social engineering, typosquatting, and e-commerce impersonation to exploit consumer trust during high-volume shopping events. Although no direct exploits target software vulnerabilities, the threat poses significant risks to consumers and indirectly to organizations handling payment and customer data. European organizations involved in e-commerce, payment processing, and consumer protection are particularly at risk. Mitigation requires proactive detection of fraudulent domains, consumer awareness campaigns, and enhanced monitoring of payment fraud. Countries with high e-commerce adoption and large consumer markets are most likely affected. The threat severity is assessed as high due to the potential financial impact and widespread exposure without requiring user authentication but relying on user interaction.

Campaign#social engineering#fake online storesGermany+9

The Lumma infostealer is a sophisticated malware distributed as Malware-as-a-Service, targeting Windows systems. It primarily steals sensitive data such as browser credentials, cryptocurrency wallets, and VPN/RDP accounts. Lumma is often used in the initial stages of multi-vector attacks, including ransomware and network breaches. The malware is distributed through phishing sites, disguised as pirated software, and uses complex techniques like NSIS packaging, AutoIt scripts, and process hollowing to evade detection. To combat this threat, organizations should implement behavior-based detection systems and integrate threat intelligence into their security strategies.

Malware#phishing#infostealerGermany+5

APT31, a Chinese cyber espionage group, is actively targeting the Russian IT sector, especially government contractors, using advanced malware and stealthy tactics. They leverage cloud services for command and control, deploy new malware families like AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor, and use prepared scripts for lateral movement. Their operations are timed to exploit organizational workflows, such as holidays, enabling prolonged undetected presence. The group employs multiple persistence, credential access, and data exfiltration techniques, evolving their toolkit while retaining older tools to maintain stealth. Although primarily focused on Russia, the sophistication and targeting of government contractors pose risks to European organizations with similar profiles. Mitigation requires tailored detection of cloud-based C2, monitoring lateral movement scripts, and enhanced credential security. Countries with significant IT sectors supporting government contracts and geopolitical interest in Russia-China dynamics are most at risk. The threat is assessed as high severity due to its espionage nature, stealth, and potential for long-term data compromise without requiring user interaction or known exploits in the wild.

Malware#localplugx#cloudsorcererGermany+6

The 'GhostAd' campaign is a large-scale Android adware threat that infiltrated Google Play with seemingly benign apps embedding persistent background advertising engines. These apps exploited Android foreground services, job schedulers, and continuous ad refreshing to maintain presence and aggressively display ads without user interaction, causing significant battery drain, degraded device performance, and difficulty in removal. Although primarily impacting users in East and Southeast Asia, the adware's use of legitimate advertising SDKs complicates detection and removal. Google has removed the malicious apps and disabled them via Google Play Protect. European organizations with Android device fleets could face indirect impacts such as reduced device availability and user productivity if similar apps spread. Mitigation requires proactive app vetting, enhanced endpoint monitoring for abnormal resource usage, and user education on app permissions and removal techniques. Countries with high Android adoption and significant Google Play usage, such as Germany, France, and the UK, are more likely to be affected if the campaign expands. Given the medium severity rating, the threat poses a moderate risk primarily through resource exhaustion and user disruption without direct data compromise or remote exploitation.

Malware#advertising sdks#androidGermany+6

The Shai-hulud 2.0 campaign is an advanced malware operation targeting cloud platforms (AWS, GCP, Azure) and developer ecosystems by stealing credentials and secrets. It automates backdooring of NPM packages maintained by victims, enabling rapid supply chain propagation. The malware abuses GitHub Actions workflows for command-and-control and secret exfiltration, leveraging cloud secret management services and destructive failsafes to maintain stealth and persistence. This campaign threatens the confidentiality and integrity of cloud and developer environments, potentially impacting thousands of downstream users. It requires no known exploits in the wild but uses sophisticated tactics to evade detection. European organizations relying heavily on cloud services and open-source development are at risk, especially those with significant use of NPM packages and GitHub repositories. The threat severity is assessed as high due to the broad impact on supply chains and credential theft without requiring user interaction. Immediate mitigation includes securing cloud credentials, auditing GitHub workflows, and monitoring supply chain dependencies for unauthorized changes.

Malware#azure#githubGermany+7

Sha1-Hulud is a sophisticated new variant of an NPM supply chain attack that executes during the preinstall phase of popular packages like Postman, Zapier, and AsyncAPI. It harvests cloud credentials across AWS, Azure, and GCP, and establishes persistence by creating a self-hosted GitHub Actions runner named 'SHA1HULUD' with an injection-vulnerable workflow. This enables attackers to move laterally across cloud environments beyond the initial development environment. Immediate mitigation includes removing compromised packages, revoking and regenerating all tokens and credentials, and enforcing hardware-based MFA for developer accounts. The attack leverages multiple MITRE ATT&CK techniques related to execution, persistence, credential access, and lateral movement. No known exploits in the wild have been reported yet, but the threat poses a medium severity risk due to its potential impact on cloud infrastructure security and software supply chains.

Malware#github actions#sha1-huludGermany+6

A threat campaign linked to the Scattered Lapsus$ Hunters group is targeting Zendesk users through over 40 typosquatted domains impersonating Zendesk and various organizations. These domains host phishing pages to harvest credentials. Attackers also submit fraudulent tickets to Zendesk portals to infect support staff with remote access trojans (RATs). This campaign follows similar attacks on other SaaS platforms like Salesforce, with Discord reportedly breached via its Zendesk support system. The attack leverages phishing, typosquatting, and social engineering to compromise customer service environments. Organizations are advised to implement strong authentication, monitor for typosquatted domains, and secure Zendesk chat to mitigate risks. The threat poses a medium severity risk due to its potential to compromise sensitive support operations and enable persistent access. No CVSS score is available, but the attack's impact on confidentiality and integrity, combined with ease of exploitation, warrants a medium severity rating.

Malware#customer service#saas platformsGermany+8

Shai-Hulud 2.0 is a highly aggressive and automated supply-chain malware targeting the npm ecosystem, identified in November 2025. It rapidly compromises hundreds of npm packages within hours, behaving like a worm that harvests credentials and cloud secrets. The malware leverages GitHub Actions as a persistent backdoor and creates public repositories to exfiltrate stolen data. This attack represents a significant escalation in supply-chain attack sophistication, affecting major projects and organizations globally. It results in tens of thousands of attacker-created GitHub repositories, facilitating widespread propagation. The malware automates spreading to new npm accounts, increasing infection speed and scale. It does not require user interaction once initial compromise occurs and exploits trusted software supply chains. No CVE or patch is currently available, and no known exploits in the wild have been reported yet. The attack’s medium severity rating may underestimate its potential impact given its worm-like behavior and credential theft capabilities.

Malware#supply-chain attack#npmGermany+8

This analysis details a sophisticated DPRK-linked operation called Contagious Interview, which uses a fake job platform to target U.S. AI talent. The campaign mimics legitimate recruitment processes, offering job listings from well-known tech companies to lure victims. The platform, hosted at lenvny[.]com, is designed to appear as a legitimate AI-powered interview tool. It employs various techniques to establish credibility, including professional design, fake testimonials, and comparisons with real companies. The attack culminates in a malware delivery through a clipboard hijacking technique, triggered when victims attempt to record a video introduction. This operation specifically targets high-value professionals in AI and cryptocurrency sectors, aiming to gain access to strategic information and financial assets.

Malware#social engineering#ai talentUnited Kingdom+5

A hacking group named NetMedved has been conducting phishing attacks against Russian organizations since October 2025. The campaign uses malicious LNK files disguised as business documents to deliver NetSupport RAT malware. The attackers employ various techniques including PowerShell scripts, finger protocol, and anti-analysis checks. They utilize multiple domains for payload delivery and command and control. The group's infrastructure overlaps with previous campaigns from 2024, suggesting an evolution of tactics rather than a new actor. NetMedved's operations involve social engineering, custom obfuscation, and abuse of legitimate tools to evade detection and maintain persistence on compromised systems.

Malware#phishing#finger protocolRussia+5

FlexibleFerret is a sophisticated macOS malware campaign leveraging fake job assessment scams and social engineering to infect victims. It uses multi-stage attacks starting with JavaScript files on fraudulent recruitment websites that trick users into executing shell commands. These commands download and run a Golang backdoor that establishes persistence, enabling data theft and remote control. The malware can collect system info, steal Chrome credentials, upload/download files, and execute arbitrary commands. Attackers exfiltrate stolen data via Dropbox, complicating detection. The campaign is attributed to DPRK-aligned threat actors and targets macOS users globally. No CVSS score exists, but the threat is medium severity due to social engineering reliance and macOS focus. European organizations with macOS endpoints, especially in tech and government sectors, face risks. Mitigations include user education on phishing, restricting script execution, monitoring unusual Dropbox traffic, and deploying endpoint detection tuned for macOS threats.

Malware#flexibleferret#golang backdoorGermany+7

A sophisticated attack chain was uncovered involving a malicious disk-cleaning utility that installed proxyware on a compromised system. The infection used PowerShell scripts, download cradles, and in-memory execution to evade detection and establish a connection to a command-and-control (C2) server. The attack was intercepted before the proxyware installation completed. This incident underscores the dangers of unauthorized software installations and the critical need to restrict PowerShell usage in corporate environments. The threat leverages multiple advanced techniques including obfuscation, living-off-the-land binaries, and scheduled task abuse. Although no known exploits are currently in the wild, the attack demonstrates a medium severity risk due to its potential for stealthy persistence and resource abuse. European organizations should be vigilant, especially those with lax software installation policies and insufficient PowerShell controls.

Campaign#download cradle#node.jsGermany+5

A multi-stage malware execution chain originating from a ClickFix lure has been discovered, leading to the delivery of infostealing malware like LummaC2 and Rhadamanthys. The campaign utilizes steganography to hide malicious code within PNG images. Two distinct ClickFix lures were observed: a standard 'Human Verification' and a convincing fake Windows Update screen. The execution chain involves mshta.exe, PowerShell, and .NET assemblies, ultimately extracting and injecting shellcode into target processes. The steganographic technique encodes malicious data directly into image pixel data, using specific color channels for payload reconstruction and decryption in memory. This sophisticated approach helps evade signature-based detection and complicates analysis.

Malware#multi-stage#social engineeringGermany+7

APT-C-26 (Lazarus) has conducted a sophisticated attack campaign deploying customized monitoring software disguised as remote IT tools. The malware includes a registration program, daemon process, and DLL, leveraging Windows Shell extensions for persistence and creating a covert remote desktop environment. It employs advanced evasion techniques such as disabling Windows Defender and manipulating firewall rules. The monitoring software captures screen data and uploads it to a remote server, enabling persistent surveillance and remote control. This campaign targets various industries globally and is attributed to the North Korean Lazarus group. The attack does not require known exploits but uses stealthy persistence and privilege escalation tactics. European organizations face risks of espionage, data leakage, and operational disruption. Mitigation requires targeted detection of the specific malware components, strict control of remote IT access, and enhanced endpoint monitoring. Countries with high adoption of Windows enterprise environments and strategic industries are most at risk, including Germany, France, the UK, and the Netherlands.

Campaign#systemuiext.dll#remote desktopGermany+6

The ToddyCat APT group has developed advanced tools and techniques to covertly access corporate email data by targeting both on-premises Outlook OST files and Microsoft 365 cloud environments. Their toolkit includes PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and methods to steal OAuth tokens from Microsoft 365 processes. They leverage SMB for remote file access, dump process memory, and search for access tokens to bypass security monitoring. These tactics enable stealthy data theft of sensitive email content and credentials. Detection guidance is available for each technique to help defenders identify and mitigate these intrusions. The threat is assessed as medium severity due to the complexity and targeted nature of the attacks, with no known exploits in the wild yet. European organizations using Microsoft 365 and Outlook are at risk, especially those with valuable email communications and cloud integrations.

Campaign#browser#oauthGermany+7