Threats Tagged 'tycoon'

Cybercriminals are exploiting an AI-powered website creation platform called Lovable to generate fraudulent websites for credential phishing and malware delivery. The threat actors create or clone sites impersonating well-known brands, use CAPTCHA for filtering, and post stolen credentials to Telegram. Campaigns observed include Tycoon phishing, payment and personal data theft, cryptocurrency wallet draining, and malware distribution. The ease of use of such AI tools significantly lowers the barrier to entry for cybercriminals, allowing them to quickly create convincing phishing pages. While Lovable has implemented new security measures, organizations are advised to consider allow-listing policies for frequently abused tools.

MediumMalwareUnited KingdomGermanyFrance+4#ai-generated websites#malware delivery#cryptocurrency

Proofpoint has uncovered a sophisticated phishing campaign utilizing fake Microsoft OAuth applications to bypass multifactor authentication and steal credentials. The threat actors impersonate various enterprise apps like RingCentral, SharePoint, Adobe, and DocuSign to lure victims. The attack chain involves OAuth app creation, redirects to malicious URLs, and the use of attacker-in-the-middle phishing kits, predominantly Tycoon. This technique has been observed in email campaigns with over 50 impersonated applications, targeting multiple industries. The campaign's goal is to gain access to Microsoft 365 accounts, potentially for information gathering, lateral movement, malware installation, or further phishing attacks.

MediumMalwareUnited KingdomGermanyFrance+5#phishing#oauth#application impersonation