Dropbox Abused to Deliver Malicious Payloads
An early phishing page in the SMOKE#SCREEN campaign delivered its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox…
Tag: phishing
236,000 DCloud Uni-App Sites Fuel Global Crypto Scams and Phishing Operations
Infoblox has uncovered a massive network of over 236,000 websites built using the legitimate Chinese open-source framework DCloud Uni-App, which are being…
Ukraine and FBI Uncover Russian Intelligence Campaign Using Fake Support Texts to Steal Messaging Credentials
The Security Service of Ukraine (SSU), in coordination with the U.S. Federal Bureau of Investigation (FBI), has uncovered a long-running cyber espionage…
Star Blizzard: Russian Threat Actor Targeting Messaging Platforms
Star Blizzard is a Russian threat activity cluster known for phishing campaigns targeting messaging app users, including Signal and WhatsApp, to steal…
FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys
The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, adding a new tactic where attackers coax…
UNC4221 (UAC-0185): Russian Threat Actor in Messaging Phishing
UNC4221, also known as UAC-0185, is a Russian threat actor conducting phishing attacks on messaging applications to steal user credentials and sensitive…
Russian Intelligence Services (RIS): State-Sponsored Cyber Threat
Russian Intelligence Services (RIS) encompass multiple groups including FSB officers and Russian military personnel. They conduct cyber espionage campaigns targeting government officials,…
ITOCHU Reports on Hotel Phishing Campaign
ITOCHU documented the hotel phishing campaign and the infection chain involving Node.js implants.
Calendly Impersonated in RecruitTrap Phishing
The RecruitTrap campaign uses counterfeit Calendly-style scheduling pages to lure victims into entering credentials, with 96% of phishing pages adopting this theme.
SOC Prime Documents Hotel Phishing Campaign
SOC Prime documented the same hotel phishing campaign and the LNK-to-PowerShell-to-Node.js chain prior to Microsoft's report.