Threats Tagged 'phishing campaigns'

The 2026 FIFA World Cup creates a large attack surface across three countries and multiple sectors, attracting diverse cyber threats. Attackers have initiated phishing campaigns, fraudulent ticket sales, and brand impersonation targeting governments, sponsors, broadcasters, transportation, and telecom companies. Financially motivated actors focus on credential theft and payment fraud. Hacktivist and state-aligned groups, including pro-Iranian actors, may conduct DDoS attacks, website defacements, and espionage amid geopolitical tensions. Ransomware groups threaten organizations dependent on continuous service availability. Thousands of FIFA-themed domains have been registered, many linked to fraud. The overall threat level is medium, reflecting the broad but varied nature of these campaigns.

BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach.

MediumMalwareArgentinaBrazil#android rat#latin america#phishing campaigns

Two distinct phishing campaigns have been identified targeting companies in Greece, Spain, Slovenia, Bosnia and Central American countries to deliver FormBook data-stealing malware. The first campaign uses RAR attachments containing legitimate executables like Sandboxie ImBox.exe, TikTok desktop, Adobe PDF Preview Handler, and XZ Utils, exploiting DLL side-loading with malicious DLL files. The second campaign deploys heavily obfuscated JavaScript that drops encrypted PNG files, uses PowerShell with Base64 encoding, and leverages a custom .NET loader called Mandark to inject the payload into RegAsm process. Both campaigns deliver the same FormBook executable that employs advanced evasion by manually mapping ntdll.dll in memory to bypass user-mode monitoring and perform direct syscalls, enabling credential theft and data collection from browsers while avoiding detection mechanisms.

MediumMalwareGreeceSpainSlovenia+2#formbook#mandark#syscall evasion