Threats Tagged 'domain registration'

Educational institutions continue to be the most targeted sector globally, experiencing an average of 4,696 weekly cyberattacks per organization between January and July 2026, representing an 8% increase year-over-year and more than double the cross-industry average. The back-to-school period sees intensified malicious activity, with July 2026 recording 4,848 weekly attacks. Threat actors are registering thousands of education-themed domains, with one in every 226 newly registered domains being malicious. APAC leads with 7,452 weekly attacks, while Europe and Latin America show the fastest growth at 18% and 42% respectively. Attackers deploy phishing campaigns impersonating retailers, schools, and Microsoft 365 to steal credentials and financial information from students, educators, and families during peak enrollment periods.

A large-scale fake account creation campaign was detected involving tens of thousands of bot-driven registrations using 330 unique custom email domains created within a short timeframe. Attackers used a modified Chrome browser with anti-detection techniques such as canvas randomization to evade fingerprinting and detection. The use of numerous custom domains, which appeared legitimate and were not on public blocklists, complicated traditional anti-abuse defenses. This campaign highlights the limitations of static disposable domain lists and underscores the need for multi-layered defenses including behavioral analysis, proxy detection, fingerprinting, and email intelligence. The threat is medium severity due to the complexity of evasion and potential for abuse but does not involve direct exploitation or system compromise. European organizations with online services requiring account creation are at risk, especially those lacking advanced bot and fraud detection capabilities. Countries with high digital service adoption and significant online user bases are more likely to be targeted. Defenders should implement dynamic domain reputation systems, advanced browser fingerprinting, and continuous behavioral monitoring to mitigate this threat effectively.

MediumCampaignGermanyFranceNetherlands+5#anti-abuse#fake accounts#bot detection

A Russian-speaking threat actor is conducting a large-scale phishing campaign targeting travelers by registering over 4,300 fake hotel and travel-related domains impersonating brands like Airbnb and Booking.com. The campaign uses sophisticated phishing sites with customized pages, fake CAPTCHA, and multilingual support to appear legitimate. Malicious emails redirect victims through multiple sites before landing on phishing pages designed to steal payment card data. The attacker continuously registers new domains with travel-related naming conventions, focusing on specific registrars. The phishing kit collects data in real-time and contains Russian language elements. This campaign poses a medium severity risk due to its scale, sophistication, and potential financial impact on victims. European organizations in the travel, hospitality, and financial sectors should be vigilant. Countries with high tourism and travel service usage, such as the UK, Germany, France, Spain, and Italy, are most likely to be affected. Mitigation requires targeted detection of phishing domains, enhanced email filtering, user awareness training focused on travel scams, and collaboration with domain registrars to disrupt domain registrations.

MediumCampaignGermanyFranceSpain+7#phishing#domain registration#malspam