An underground marketplace on Telegram facilitates unlocking stolen iPhones despite Apple's Activation Lock. Attackers use SMS phishing with lookalike domains to trick owners into revealing passcodes. Unlocking tools, sold for $5-50, can jailbreak older phones and gather data to improve phishing. Over 10,000 domains linked to these operations have been identified, with a significant increase in DNS traffic. The operation spans multiple countries and focuses on wiping devices for resale rather than data theft.
This intelligence analysis covers a malicious campaign deploying Remcos RAT, a commercially available remote access trojan. The infection starts with a weaponized Excel spreadsheet that uses VBA macros to execute PowerShell commands, which then download additional malicious scripts from attacker-controlled domains. The multi-stage attack culminates in the deployment of the Remcos RAT payload. The campaign uses social engineering with financial-themed lures to trick victims into enabling macros, facilitating the infection. Command and control infrastructure involves domains dvrlists[.]com and lbl[.]support.
Ahead of the Grand Theft Auto VI release on November 19, 2026, threat actors are exploiting consumer excitement through phishing campaigns and fraudulent schemes. These campaigns use fake downloads, false early access offers, nonexistent mobile versions, and free game promises to lure victims. Malicious sites distribute trojans, request cryptocurrency payments, use content lockers requiring survey completion, and harvest personal information. Tactics include fake storefronts impersonating Rockstar Games, fraudulent APK files with unsafe permissions, and giveaway scams with urgency counters. Post-launch threats are expected to include in-game currency fraud, credential phishing for Rockstar and gaming platform accounts, and malware through fake cheats and modifications.
A phishing campaign impersonates OpenAI by sending fake ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fraudulent payment pages hosted on compromised WordPress sites under Nexcess's nxcli.io infrastructure. Attackers monitor submitted credit card details in real time and dynamically request one-time passwords (OTPs) to complete fraudulent transactions. The campaign uses multiple redirect domains and identical client-side code across instances to steal credit card information and OTPs.
Attackers impersonated IT help desk personnel on Microsoft Teams to gain unauthorized access to Active Directory environments by social engineering users into sharing Quick Assist remote support session codes. They exploited misconfigured Active Directory Certificate Services using ESC1 and ESC8 attack paths, obtained certificates for privileged accounts, performed DCSync operations to harvest credentials, and exfiltrated data via Rclone to external SFTP servers. Another intrusion used PetitPotam to coerce domain controller authentication and relay NTLM credentials to obtain unauthorized certificates. These attacks did not exploit vulnerabilities in Microsoft Teams itself but relied on impersonation and legitimate remote access tools combined with Active Directory misconfigurations.
North Korean threat actors, identified as the Lazarus Group, conduct cryptocurrency thefts by initially compromising developers through social engineering on the open internet. They trick developers into running malicious projects, which leads to planting malware in cryptocurrency wallet interfaces, as seen in the February 2025 Bybit theft and a similar Binance compromise. These operations use pre-registered domains and US-registered front companies to deliver malware, including through fake job interviews. Preemptive defenses have identified numerous malicious domains mimicking Binance, enabling defenders to block infrastructure before attacks occur.
Two human-operated intrusions used Microsoft Teams to impersonate IT staff and socially engineer users into granting remote access via Quick Assist. Attackers deployed portable runtimes to perform network discovery and assessed Active Directory Certificate Services (AD CS) for authentication exploitation. One intrusion exploited an ESC1-vulnerable certificate template to obtain privileged authentication certificates and performed DCSync operations. The other used PetitPotam to coerce domain-controller authentication and relayed it via ESC8 to AD CS Web Enrollment, obtaining a domain-controller certificate for Kerberos authentication. Automated defenses limited the first intrusion except for an excluded privileged identity that enabled data exfiltration, while customer-led isolation stopped the second intrusion after Defender alerts.
Threat actors are abusing legitimate mobile device management (MDM) platforms such as Hexnode and Rippling by using social engineering techniques to trick users into enrolling devices or installing management agents. Once enrolled, attackers deploy unauthorized remote monitoring and management (RMM) tools like ScreenConnect, connecting to attacker-controlled relays to gain remote access. The MDM platforms themselves are not compromised but are misused through deception, making it difficult to distinguish legitimate from malicious activity.
This is a credential phishing campaign targeting professionals through fake business bid invitations. It uses password-protected PDF attachments to evade automated security scans. The PDFs contain a fake OneDrive button that redirects victims to a fraudulent document-sharing site, prompting them to enter their email and then credentials on a counterfeit Microsoft login page. The campaign exploits trusted business workflows and familiar brand interfaces to bypass technical and human defenses.
Threat actors are abusing Microsoft Teams' external chat feature to conduct social engineering attacks and deliver malicious payloads. They impersonate IT support using throwaway Microsoft 365 tenants with deceptive display names to bypass warnings. Attacks often start with email bombing, followed by Teams contact offering help, then use legitimate remote access tools to gain control quickly. This technique exploits collaboration features rather than software vulnerabilities.
A phishing campaign uses fake Calendly booking pages impersonating Meta Careers to steal Facebook and Google login credentials. Victims are tricked into selecting interview times, submitting personal data, and completing fake CAPTCHAs before being prompted to log into their accounts. The phishing kit captures credentials and bypasses two-factor authentication by relaying authentication codes in real-time. The fake pages include convincing replicas of legitimate login screens with fake address bars showing authentic URLs. Eleven domains with recruiting-related names are involved, and the infrastructure operates via Amazon API Gateway in Singapore. Code comments in Vietnamese suggest possible origins of the operation.
A phishing campaign distributes the AgentTesla infostealer via emails pretending to be business proposals. The attached ZIP file contains a malicious executable disguised as a café management program with Chinese-language UI. The malware uses multi-stage obfuscation and .NET payload loading to ultimately deploy AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP, and VPN applications. Stolen data is exfiltrated through FTP to a compromised server. The attack targets business users using social engineering and sophisticated loading techniques.
Cybercriminals are distributing remote access trojans (RATs) via phishing emails that mimic legitimate event invitations. These emails contain download buttons leading victims through fake CAPTCHA verification pages on newly created domains. After verification, users are prompted to download an eInvite file that contains a zipped folder with a weaponized ConnectWise Screen Connect installer acting as a RAT. Execution of this installer grants attackers full remote access to the victim's device, indicated by an inconspicuous taskbar icon. The campaign exploits user curiosity, especially during holiday seasons when event invitations are common.
A sophisticated phishing campaign targets YouTube content creators by impersonating well-known brands such as Hollyland, Nike, and Spotify. Attackers send personalized sponsorship emails referencing specific videos from the creators' channels, directing them to fake platforms that mimic legitimate campaign dashboards. The scam culminates in a Google sign-in prompt that either steals credentials directly or requests excessive permissions. Compromised accounts are then locked by changing recovery options and used to propagate further scams to followers. This modular campaign operates globally, with confirmed targeting in Peru, Japan, and English-speaking regions, using multiple domains with consistent design and functionality.
Threat actors are distributing legitimate Remote Monitoring and Management (RMM) tools such as ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able through phishing campaigns. These campaigns use social engineering tactics with fake Adobe Acrobat updates, DocuSign viewers, and document access prompts to trick victims into installing remote access tools disguised as business documents. Delivery methods include LNK files, BAT scripts, VBS files, and PDFs. The RMM tools contain embedded configuration data linking back to attacker infrastructure, enabling remote access while evading detection.
A sophisticated phishing campaign impersonates AI advertising products from major platforms using a Browser-in-the-Browser technique to steal credentials and bypass multi-factor authentication (MFA) in real-time. The campaign targets advertising account managers and recruiters, leveraging a shared backend infrastructure and reusing code across multiple fake brands. It also includes refund scams and fake recruitment sites connected to the same infrastructure.
In July 2026, phishing campaigns targeted organizations across multiple industries by distributing a masqueraded MSP360 Remote Monitoring and Management installer through meeting invitations, PDF-themed lures, and software update prompts. Once executed, the legitimate MSP360 installer established remote management access on affected devices, providing threat actors with an initial foothold using trusted administrative software. The MSP360 deployment was then used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel for redundant access to compromised systems. Following access establishment, threat actors deployed additional tools and conducted post-compromise activity, including information collection and credential-access operations. The campaigns utilized multiple delivery mechanisms including actor-controlled domains, compromised websites, and legitimate cloud services such as Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.
Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate models and lure victims via sponsored Google ads to malicious Custom GPTs named 'Plus 5.6'. Victims were shown fake service notices and redirected to Google Sites hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. They were tricked into running PowerShell commands that downloaded malicious MSI installers. The attack used DLL sideloading with legitimate Canon- and Stardock-signed executables to establish persistence via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and deployed a remote access trojan with capabilities including remote desktop access, browser hijacking, credential theft, and follow-on payload delivery. Approximately 40 incidents were investigated by Huntress.
A social engineering campaign targeting security professionals uses fake consultancy offers and job opportunities to exploit trust. Attackers create sparse social media profiles claiming to be consultants, offering $300 for simple consultations on topics like digital transformation. The initial phone call serves as screening to identify targets with valuable access or knowledge. If successful, targets are asked to provide increasingly sensitive information through written reports, requiring them to abuse trusted access, probe internal systems, or leverage professional relationships. Similar variants include fake recruiters offering prestigious positions while requiring installation of trojanised software. These attacks exploit professional flattery and overconfidence, manipulating security practitioners into compromising their most valuable asset: professional integrity and trusted relationships within the industry.
