Threats Tagged 'phishing campaign'

A sophisticated phishing campaign targets YouTube content creators by impersonating well-known brands such as Hollyland, Nike, and Spotify. Attackers send personalized sponsorship emails referencing specific videos from the creators' channels, directing them to fake platforms that mimic legitimate campaign dashboards. The scam culminates in a Google sign-in prompt that either steals credentials directly or requests excessive permissions. Compromised accounts are then locked by changing recovery options and used to propagate further scams to followers. This modular campaign operates globally, with confirmed targeting in Peru, Japan, and English-speaking regions, using multiple domains with consistent design and functionality.

MediumCampaignJapanPeru#google account compromise#sso abuse#social engineering

Threat actors are distributing legitimate Remote Monitoring and Management (RMM) tools such as ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able through phishing campaigns. These campaigns use social engineering tactics with fake Adobe Acrobat updates, DocuSign viewers, and document access prompts to trick victims into installing remote access tools disguised as business documents. Delivery methods include LNK files, BAT scripts, VBS files, and PDFs. The RMM tools contain embedded configuration data linking back to attacker infrastructure, enabling remote access while evading detection.

A sophisticated phishing campaign impersonates AI advertising products from major platforms using a Browser-in-the-Browser technique to steal credentials and bypass MFA in real-time. Targeting advertising account managers and recruiters, the campaign uses a shared backend infrastructure and reuses code across multiple fake brands. It also includes refund scams and fake recruitment sites connected to the same infrastructure.

Between July and August 2026, a sophisticated phishing campaign targeted organizations in East and Southeast Asia, particularly Japanese entities. The attackers used phishing emails in Japanese and Korean, masquerading as product damage complaints, to lure victims to fake document-sharing websites. These sites delivered ZIP archives containing malware executables with double extensions and DLLs employing advanced loader techniques. The final payloads were consistently from the PureRAT and PureLogs malware families. The campaign used frequent changes in loader structures and multiple evasion techniques to bypass detection. Infrastructure analysis showed commonalities in sending patterns and identifiers across campaigns.

MediumCampaignJapan#purerat#process hollowing#stealer

Since early May 2026, a large-scale phishing campaign has targeted individuals with fraudulent text messages claiming their T-Mobile rewards points are about to expire. The messages create urgency by stating that point balances, typically cited as 18,400 points, will expire imminently if not redeemed. Recipients are directed to click on phishing links using rotating domains designed to mimic legitimate T-Mobile websites. The campaign has generated over 1,000 closely related message templates with only superficial variations in salutations, dates, and point balances. The operation experienced two major spikes in activity before declining. The criminals employed at least 81 domains over four months, all following a recognizable pattern. These messages use generic greetings and formal language to appear legitimate, exploiting social engineering tactics to trick recipients into divulging login credentials, personal information, or payment details.

Threat actors are leveraging generative AI to enhance financial fraud campaigns targeting enterprise organizations. Between August 3-5, over one million phishing emails were distributed through third-party infrastructure, primarily targeting US-based organizations (87.7%). The attacks employed sophisticated executive impersonation, specifically CEOs and CFOs, combined with fabricated ServiceNow invoices requesting ACH transfers of approximately $50,000. The campaign demonstrated multiple AI-assisted indicators including extensive HTML comments, structured section labeling, and uniform template construction. Attackers registered lookalike domains and created elaborate forwarded email threads between spoofed executives to establish legitimacy. The fraudulent invoices contained detailed branding, personalized recipient information, and specific payment instructions to attacker-controlled bank accounts. Multiple layered social engineering techniques were deployed to reduce recipient skepticism and convince acc...

MediumCampaignUnited States#business email compromise#ai-assisted attacks#servicenow impersonation

Two multi-stage network intrusion campaigns are actively targeting organizations in Latin America, specifically in Mexico, Ecuador, and Brazil. The Mexican campaign targets transportation and government entities using living-off-the-land techniques and self-hosted NextChat instances. The Brazilian campaign targets financial organizations with custom remote access trojans (RATs) and tunneling tools, including a Go-based SOCKS5 proxy. Both campaigns leverage AI tools such as Claude and GPT-4.1 to generate scripts and troubleshoot operations. Operational security failures by attackers, including exposed staging directories and unsecured interfaces, have allowed defenders visibility into their activities. Indicators include multiple duckdns.org domains, an IP address, and various file hashes. There are no known exploits in the wild or confirmed active threat actors at this time.

MediumCampaignBrazilEcuadorMexico#phishing campaign#socktz#nextchat

A phishing campaign abuses npm package mirrors to host fake Cloudflare Captcha pages embedded in malicious npm packages. These pages are served via trusted mirror domains, increasing their credibility and facilitating phishing attacks such as ClickFix delivery. The campaign uses typosquatted domains and legitimate key-value storage services to redirect victims dynamically. Downloading the packages is not harmful, but accessing the HTML files through mirror URLs exposes users to phishing risks.

A sophisticated phishing campaign has been identified where attackers impersonate employees of a US company, sending emails that claim to contain transaction receipts. Recipients are urged to verify fund deposits by opening an attached PDF file. The malicious PDF displays a fake Adobe Flash Player update prompt, which when clicked, downloads a VBS script. This script executes with administrator privileges, displays a decoy payment receipt document, and silently installs ScreenConnect remote management software via an MSI package. The installation establishes persistent remote access to the compromised system, enabling attackers to execute commands, transfer files, and deploy additional payloads using legitimate administrative tools in a Living-off-the-Land attack technique.

APT-C-06 (Darkhotel) is an APT organization that has been active since at least 2007, targeting corporate executives, defense industries, and electronics sectors. In April 2026, the group launched phishing attacks using a decoy document titled 'North Korean Central Television Real-time Broadcasting Program Instructions.' The document instructs users to download an application for watching North Korean Central Television. By late May, attacks evolved to deliver malicious MSI files through phishing emails. These MSI files execute VBS code that creates scheduled tasks to download and execute PowerShell scripts, which then retrieve subsequent payloads. The malware employs ChaCha20 encryption and ultimately deploys shellcode. PowerShell has become a high-frequency component in APT-C-06's attack chain since 2025, handling payload downloads and persistence mechanisms.