Threats Tagged 'google sites'

Wazza is a multi-stage phishing kit actively targeting Microsoft 365 accounts since July 2026. It uses phishing emails with PDF lures themed around business documents to redirect victims through a complex infrastructure involving Google Sites and CloudFlare Workers. The kit impersonates multiple well-known services and employs advanced browser checks and client-side protections. It abuses Microsoft OAuth device authorization to trick victims into completing authentication, allowing attackers to gain access to accounts and cloud resources. The campaign is medium severity due to credential theft risks.

Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate ChatGPT models, directing victims through sponsored Google ads to malicious Custom GPTs titled 'Plus 5.6'. These instances served fake service availability notices, redirecting users to Google Sites pages hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. Victims were tricked into executing PowerShell commands that downloaded malicious MSI installers. The attack chain employed DLL sideloading through legitimate Canon-signed and later Stardock-signed executables, establishing dual persistence mechanisms via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and ultimately deployed a feature-rich remote access trojan with capabilities including remote desktop, browser hijacking, credential theft, and follow-on payload delivery. Huntress investigated approximately 40 incidents linked to this campaign, with confirmed Cus...