This is a credential phishing campaign targeting professionals through fake business bid invitations. It uses password-protected PDF attachments to evade automated security scans. The PDFs contain a fake OneDrive button that redirects victims to a fraudulent document-sharing site, prompting them to enter their email and then credentials on a counterfeit Microsoft login page. The campaign exploits trusted business workflows and familiar brand interfaces to bypass technical and human defenses.
A coordinated disruption targeted Chinese-speaking cybercriminals operating three major phishing kits—CoGUI, CoAceV, and CoFish_Ws—that distributed hundreds of millions of credential phishing messages primarily against Japanese organizations. These phishing campaigns impersonated 66 well-known consumer and finance brands to steal usernames, passwords, and payment data. The threat actors used sophisticated evasion techniques, including approximately 17,000 unique rotating domains. The disruption involved civil lawsuits and domain seizures against ecosystem enablers YAM Store and Iron Man, conducted collaboratively by Microsoft, Health-ISAC, and security partners. This action is expected to significantly disrupt multiple threat groups involved in financial fraud within the Chinese phishing ecosystem.
A credential phishing campaign targeted WatchGuard Mobile VPN users via a fake download site watchguard-vpn.net. The attackers used SEO poisoning to appear in search results and collected credentials through repeated browser pop-ups, deliberately rejecting the first submission to capture multiple passwords. After credential theft, the campaign downloaded the genuine WatchGuard VPN client from the official CDN, bypassing detection by security tools. The stolen credentials included server addresses, usernames, and passwords, potentially granting attackers network access. The phishing domain watchguard-ssl.online was re-registered and fully operational by September after being inactive earlier in the year.
In July 2026, China-aligned threat actor TA419 conducted credential phishing campaigns impersonating prominent economists and AI policymakers, targeting AI experts at US think tanks, universities, and legal organizations. The group sent benign conversation starter emails themed around AI policy topics, such as invitations to join an AI Policy Advisory Committee. Upon receiving responses, TA419 deployed multi-stage URL redirection chains leading to Adversary-in-the-Middle credential phishing pages using a customized Frameless Browser-in-the-Browser tool. Active since April 2025, TA419 consistently targets individuals at US and Japan-based think tanks, defense contractors, universities, and law firms. This activity likely supports Chinese intelligence objectives to monitor US AI policy and regulatory developments amid strategic competition involving AI technologies, model distillation concerns, and export controls between the US and China.
SynkLoader is a sophisticated modular malware loader that uses multiple programming languages to evade detection. It begins with a Microsoft Teams phishing attack impersonating IT helpdesk staff to trick victims into installing a fake PowerShell cleaner via an MSI installer. The malware operates in memory, using Python, C#, C++, and PowerShell components to profile systems, maintain persistence through scheduled tasks, and deploy a fake Windows lock screen to phish credentials. Additional modules provide reverse proxy capabilities for network tunneling, remote shell, and VNC access, enabling attackers to move laterally and perform hands-on-keyboard operations. The complexity and multi-stage infection chain indicate potential use for ransomware or initial access brokering.
Children are targeted by a sprawling ecosystem of websites exploiting their interest in Roblox and Minecraft through offerwall reward schemes and phishing campaigns. These sites promise free in-game currency in exchange for completing tasks, collecting personal data, enrolling minors in paid subscriptions, and violating platform terms of service that can result in account bans. The infrastructure relies on cheap, disposable hosting with aggressive domain rotation. Using Internet-wide scan data from Censys, this analysis characterizes two categories: offerwall get-paid-to reward sites and credential harvesting generators. The exposed infrastructure handles children's data with minimal security, monetizing their attention at scale through affiliate commissions while presenting significant privacy and security risks.
A new extortion group called Pink, tracked as cluster CL-CRI-1147, employs voice phishing and fake IT helpdesk impersonation to compromise organizations. The gang steals employee credentials, bypasses multi-factor authentication, and exfiltrates data from cloud storage platforms like SharePoint and OneDrive. Pink threatens to leak stolen information unless ransom demands are met, setting 72-hour deadlines. The group's data-leak site launched on May 31, 2026. This approach mirrors tactics popularized by Lapsus$, Scattered Spider, and ShinyHunters. Incident responders link Pink to The Com, a loosely connected network of English-speaking hackers and extortionists. Attackers use compromised victim accounts and internal Teams messages for extortion communications, reusing domains across multiple targets.
Researchers uncovered a massive fraud ecosystem targeting the 2026 FIFA World Cup, identifying over 4,300 fraudulent domains impersonating FIFA's official website since August 2025. At the center operates GHOST STADIUM, a Chinese-speaking threat actor running a sophisticated phishing campaign across 300+ domains using a pixel-perfect clone of FIFA's authentication system. The operation harvests credentials, sells fake tickets, and processes payments through five distinct channels including cryptocurrency. Estimated losses from premium ticket fraud alone range from $71 million to $474 million, with total campaign losses potentially reaching billions. Six distinct fraud schemes operate in parallel: credential phishing, fake ticket sales, counterfeit merchandise, fake streaming platforms, fraudulent betting sites, and infostealer-driven credential theft. Over 2,513 FIFA account credentials are already circulating on dark-web markets. The campaign exploits Facebook advertising as its primary distribution chann...
Storm-2755 is a financially motivated threat actor conducting payroll pirate attacks targeting Canadian employees. The campaign uses malvertising and SEO poisoning to redirect victims searching for terms like "Office 365" to fraudulent sign-in pages. By employing adversary-in-the-middle techniques, the attacker captures authentication tokens and session cookies, bypassing MFA protections. The actor maintains persistence by replaying stolen tokens and performs discovery to identify payroll and HR contacts. They impersonate compromised users to socially engineer HR staff or directly manipulate payroll systems such as Workday. Malicious inbox rules are used to hide attacker communications. These attacks have resulted in direct financial losses through redirected salary payments to attacker-controlled bank accounts.
