Threats Tagged 'brand abuse'

A sophisticated fraud campaign exploiting Indonesia's tax season targeted 67 million residents through fake Coretax applications distributed via phishing websites and WhatsApp social engineering. The GoldFactory threat cluster orchestrated operations using Gigabud.RAT and MMRat malware families with shared infrastructure abusing over 16 trusted brands across government and financial sectors. The attack chain combines vishing, screen recording, and remote access capabilities to achieve device compromise and unauthorized financial transfers. Estimated financial impact reaches USD 1.5-2 million nationwide, with global implications extending to USD 6 million annually across multiple countries. The industrialized malware-as-a-service infrastructure enables horizontal scaling across Thailand, Vietnam, Philippines, and South Africa, demonstrating a shift toward unified cross-border operations that systematically undermine trust in digital government services.

MediumMalwareIndonesiaPeruPhilippines+2#goldfactory#gigabud.rat#mmrat

Attackers are leveraging the trusted reputation of Foxit PDF Reader, used by over 650 million people, to distribute malicious installers disguised as legitimate software. Rather than exploiting vulnerabilities, threat actors impersonate the vendor through fake installers with document-themed filenames that bypass user suspicion. When executed, these files display decoy passport images while downloading malicious MSI packages that deploy UltraVNC remote access tools disguised as GPU drivers. The attack establishes persistence through registry modifications and firewall exceptions, connecting to attacker-controlled infrastructure for complete remote system control. Telemetry indicates broad distribution across Germany, the United States, the United Kingdom, and Ukraine. This campaign demonstrates how brand impersonation combined with social engineering proves more effective than technical exploits, relying on user trust and behavioral patterns rather than software vulnerabilities.

MediumMalwareGermanyUnited StatesUnited Kingdom+1#brand abuse#document decoy#ultravnc

In 2025, a significant surge in phishing attacks targeting major U.S.energy companies was observed. The campaign primarily focused on Chevron, ConocoPhillips, PBF Energy, and Phillips 66, utilizing sophisticated impersonation techniques. Attackers employed HTTrack-based cloning to replicate legitimate websites, creating over 1,465 phishing domains. The infrastructure was distributed across multiple hosting providers and countries to evade takedowns. Notably, Chevron faced the highest volume of impersonation attempts with 158 fake domains. The phishing sites combined credential harvesting with investment scam frameworks, enhancing their profitability. Many malicious domains showed low detection rates across security vendors, exposing gaps in current defense systems. The analysis highlights the need for improved threat intelligence integration and faster mitigation strategies in the energy sector.

MediumMalwareUnited KingdomGermanyFrance+5#energy sector#httrack#credential harvesting