Microsoft Threat Intelligence observed a sophisticated human-operated campaign exploiting Microsoft Teams external collaboration features to impersonate IT helpdesk personnel. Attackers socially engineer users into granting remote access via legitimate remote monitoring tools. Once established, they deploy malicious MSI packages through PowerShell, staging a portable Node.js runtime and obfuscated JavaScript implant for persistent command execution. The campaign progresses through extensive Active Directory reconnaissance, periodic screenshot captures, and lateral movement via Windows Remote Management toward high-value infrastructure including domain controllers. Unlike commodity phishing operations, this hands-on-keyboard intrusion leverages legitimate tooling throughout, blending malicious activity into normal enterprise operations. The reconnaissance patterns and targeting of identity systems indicate precursor activity consistent with data theft, extortion, or ransomware deployment objectives.
A Chinese-speaking cybercrime group known as Gambling Goblin has targeted Brazilian government and educational websites since mid-2025 by compromising web servers and installing malicious Apache modules. These modules reverse-proxy visitors to phishing pages impersonating trusted app stores but actually promote online gambling and sports betting. The attackers manipulate search engine rankings by chaining compromised high-reputation domains, mainly Brazilian government sites. The operation uses a heavily obfuscated Linux toolkit with custom downloaders, backdoors, credential stealers, and reconnaissance tools. The campaign also targets victims in Vietnam, Spain, and English-speaking regions.
Since mid-2025, a Chinese-speaking cybercrime group dubbed Gambling Goblin has conducted a sustained campaign targeting Brazilian organizations, mainly government and educational institutions. The attackers compromise web servers and install malicious Apache modules that stealthily reverse-proxy visitors to phishing pages impersonating trusted app stores. These phishing pages promote online gambling and sports betting while leveraging hijacked high-reputation domains to manipulate search engine rankings and hijack traffic. The group uses a heavily obfuscated Linux toolkit including downloaders, backdoors, credential stealers, and brute-forcers. The infrastructure is scalable and extends beyond Brazil, with parallel phishing networks targeting Vietnamese, Spanish, and English-speaking victims. The phishing infrastructure could be reconfigured to deliver malware directly, posing a latent escalation risk.
A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Malicious installers deploy payloads that establish persistence, disable security protections, and communicate with attacker-controlled infrastructure. The campaign employs dynamically generated installers with rotating hashes, spoofed vendor pages on .com.cn and .hl.cn domains, and randomized payload staging paths. Follow-on activity includes disabling Windows Defender, deleting shadow copies, neutralizing Windows Update, creating scheduled tasks for persistence, and establishing command-and-control over non-standard ports. Microsoft assesses this activity aligns with publicly reported Silver Fox operations but has not attributed it to a nation-state actor.
This report analyzes a scam campaign observed through the lens of a URL shortener service. The campaign involved three short links that collectively received nearly 90,000 clicks in 48 hours. The destination URLs employed sophisticated cloaking techniques, including user-agent checks, Selenium/Puppeteer detection, ad blocker detection, mouse movement sampling, and device fingerprinting to evade detection and only target real human victims. Attempts to block the malicious destination were circumvented by the attackers quickly reusing the same short links with new domains forwarding to the same scam content. The URL shortener operator implemented a fix by reserving purged slugs to prevent reuse. This analysis provides insight into the evasive tactics used in this scam campaign and the challenges in detecting it.
A Magecart campaign uses EtherHiding techniques to perform card-skimming on e-commerce platforms. Attackers compromise legitimate online storefronts, mainly WooCommerce, but also PrestaShop, Magento, and WordPress sites, injecting malicious loaders disguised as Google Tag Manager code. The skimming payloads are staged inside Ethereum blockchain smart-contract storage, making detection more difficult. Over 40 websites across 15 countries have been impacted since April 2026. The infrastructure involves 144 Sepolia contracts controlled by a single wallet, with 20 distinct contracts and skimmer-hosting domains identified. The malicious code appears as normal analytics but steals credit card data from shoppers.
An attacker exploited a flawed GitHub Actions workflow in the npm package @7nohe/openapi-react-query-codegen to publish 10 malicious versions. The vulnerability stemmed from an issue_comment trigger lacking author-association checks, allowing arbitrary users to trigger npm publishing from forked repositories. The malicious payload used multiple execution methods, including a binding.gyp file exploiting node-gyp's Python evaluation and a preinstall hook, ultimately delivering a large obfuscated script that downloaded Bun v1.4.0. This attack aligns with the Mini Shai-Hulud toolkit previously seen in other supply chain compromises. All malicious versions have been removed from npm.
The Rhysida ransomware group claimed responsibility for a cyberattack on Berlin's Senate Department for Mobility, Transport, Climate Protection, and Environment, stealing over 5.7 terabytes of data including personal information, credentials, and confidential documents. The attack was detected in mid-August 2026, leading to network shutdowns to contain the breach. The extortion group demanded a ransom of approximately 30 bitcoins (~$2.3 million), which Berlin has publicly refused to pay. An ongoing investigation is being conducted by local and federal authorities. The stolen data reportedly includes sensitive personal and financial information of over 12,000 individuals.
In July 2026, multiple APT campaigns targeted South Korean entities using spear phishing emails with malicious LNK files. Seven distinct attack types employed various techniques such as PowerShell scripts, AutoIt programs, DLL side-loading, and curl.exe downloads. Malware was distributed via platforms like GitHub, Google Drive, and Dropbox, disguised as legitimate documents or resumes. The campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate sensitive information and maintain persistence through Task Scheduler entries. Communication with command and control servers used PubNub channels with Base64-encoded data. The attacks focused on deceiving victims with work-related content to execute malicious payloads.
A campaign identified by the Socket Threat Research team involves 19 malicious browser extensions (18 for Chrome, 1 for Edge) active since February 2024. These extensions deliver a modular malware framework that communicates with command and control servers via WebSocket, strips Content Security Policy headers, and uses cross-site scripting (XSS) injection to execute payloads. The primary goal is to steal cryptocurrency wallet secrets and drain crypto assets, as well as harvest credentials. The threat actor either creates malicious extensions from scratch or compromises legitimate extensions with existing user bases, such as the 'Enable Right Click & Copy' extension with tens of thousands of users. The campaign, named 'Superior,' shows sophisticated and evolving capabilities targeting multiple cryptocurrency platforms and exchanges.
AnonyMousKIT is an AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered system, it automates credential harvesting through email, SMS, WhatsApp, and AI-driven voice phishing calls. The investigation exposed a reseller supply chain spanning 506 domains and 168 storefront brands active since early 2024. The platform targets owners of stolen Apple devices using device-specific lures with internal model identifiers and real-time Find My statuses. Conversational AI agents impersonating Apple Support conduct vishing operations, with over 200 calls placed primarily to Brazil at minimal cost. Coding vulnerabilities exposed 120,242 lines of operational logs, revealing 689 distinct WhatsApp operator accounts and detailed attack infrastructure. The ecosystem operates through a decentralized enterprise structure with developers, resellers, and hundreds of subscriber-operators monetizing stolen iPhone hardware through industrialized soc...
A China-linked cyber espionage infrastructure provider operates a multi-component 'quartermaster' system that offers reconnaissance, proxy orchestration, and traffic routing services to Chinese state-sponsored actors. The infrastructure includes QScan for reconnaissance, Fast Labyrinth for encrypted relay networks using commercial proxy services, QTRouter for proxy access management, and QTProxy for operational node control. It targets research universities, defense networks, government agencies, and critical infrastructure worldwide, with notable focus on the U.S., U.K., and Asia-Pacific regions. The operation leverages commercial proxy services designed to bypass China's Great Firewall, enabling multiple threat actors to maintain anonymity and coordinate operations via shared infrastructure. This represents an advanced evolution in state-enabled cyber espionage capabilities.
The FBI has disrupted a proxy network infrastructure used as a technical "quartermaster" to support Chinese cyber espionage operations. This infrastructure facilitated reconnaissance, proxy management, and operational routing for espionage activities. The disruption targets the operational capabilities of the threat actor but does not describe a specific software vulnerability or exploit. No affected software versions or patches are indicated.
This is a sophisticated global phishing campaign that abuses legitimate Remote Management and Monitoring (RMM) software to gain unauthorized remote access. Initially targeting Canadians with fake Canada Revenue Agency tax documents, it has expanded to 46 countries, with nearly half of the activity in the United States. Attackers impersonate trusted organizations and use advanced techniques such as password-protected archives, browser fingerprinting, and Telegram-based victim filtering. The campaign uses rapidly rotating infrastructure hosted mainly on Vercel, leveraging legitimate TLS certificates and domain reputations. Signed commercial RMM tools are abused, making traditional signature-based detection ineffective. The campaign has been active steadily since January 2026.
A network of fraudulent websites branded as SysScan uses fake security scans with Microsoft logos to deceive victims into uninstalling legitimate antivirus software. These sites run fabricated security checks that always fail, falsely claiming Windows no longer supports third-party antivirus. Victims are tricked into submitting personal, banking, and remote-access information through forms that send data to Telegram. Afterward, they receive calls from scammers posing as refund managers who exploit the lack of security protections. The campaign targets both consumer and enterprise users and shows signs of AI-generated code.
RecruitTrap is a sophisticated phishing campaign targeting enterprise credentials by impersonating HR personnel from well-known companies. It uses Browser-in-the-Browser techniques on desktop and full-screen fake login pages on mobile without visible URL indicators. The campaign actively screens victims to focus on corporate accounts, rejecting personal emails. Attackers impersonate multiple global brands and use persistent hosting on Amazon and SEDO networks. Detection of malicious domains is significantly delayed by traditional threat feeds. The campaign facilitates credential harvesting, OAuth token theft, and lateral movement within organizations.
Three suspected Russian cyber espionage clusters—UNC6293, UNC7005, and UNC5976—target individuals in academia, aerospace, defense, governments, and think tanks in Europe and the US. They use sophisticated phishing techniques including app password phishing, OAuth phishing, device code phishing, and malware deployment. UNC6293 and UNC7005 are linked with moderate confidence to ICE RELIC (APT29), while UNC5976 is distinct. Their operations involve social engineering tactics such as fake diplomatic invitations and conference registrations. They abuse legitimate authentication mechanisms like Google OAuth and Microsoft device codes, complicating detection.
Kimsuky conducted spear phishing campaigns targeting South Korean and Japanese entities in early 2026. The attacks used LNK malware distributed via OneDrive share links to establish scheduled tasks that periodically retrieved PowerShell scripts from command-and-control servers. These scripts profiled infected systems, exfiltrated email data from Thunderbird and Outlook, and logged keystrokes. The threat actor leveraged legitimate remote control tools such as Chrome Remote Desktop and AnyDesk to evade antivirus detection and maintain persistent access. Additionally, a malicious Chrome extension with AI-generated code was used to steal Gmail data. The operation employed rotating infrastructure and compromised legitimate Korean servers as command-and-control nodes to hinder tracking efforts.
BRIDGEHEAD is a supply-chain typosquatting campaign discovered in August 2026 that distributed 40 malicious npm packages impersonating popular libraries such as chalk, axios, and lodash. These packages contained install scripts that detect Windows or Windows Subsystem for Linux (WSL) environments and download a 22MB Rust-based executable from GitHub. The payload executes entirely in memory without writing files to disk and targets cryptocurrency wallets, browser credentials, cookies, and Telegram sessions. The campaign leverages legitimate services for reconnaissance and data exfiltration, complicating detection and takedown efforts. Although the malicious npm packages were removed within 84 minutes, the GitHub-hosted payload remained active for 39 hours, and the command-and-control server continued operating. This campaign specifically targets developers using WSL by crossing from Linux environments into Windows systems.
Educational institutions continue to be the most targeted sector globally, experiencing an average of 4,696 weekly cyberattacks per organization between January and July 2026, representing an 8% increase year-over-year and more than double the cross-industry average. The back-to-school period sees intensified malicious activity, with July 2026 recording 4,848 weekly attacks. Threat actors are registering thousands of education-themed domains, with one in every 226 newly registered domains being malicious. APAC leads with 7,452 weekly attacks, while Europe and Latin America show the fastest growth at 18% and 42% respectively. Attackers deploy phishing campaigns impersonating retailers, schools, and Microsoft 365 to steal credentials and financial information from students, educators, and families during peak enrollment periods.
