Russia Charges Telegram Founder Pavel Durov With Aiding Terrorist Activity
The Federal Security Service of the Russian Federation (FSB) has charged Telegram founder Pavel Durov with aiding terrorist activity and failing to…
Tag: social engineering
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate…
ClickFake Interview: North Korea-Aligned Threat Cluster
ClickFake Interview is a threat cluster tracked by Sekoia, associated with North Korea-aligned actors. It uses ClickFix-like lures to deceive targets into…
Calendly: Scheduling Platform
Calendly is an online scheduling platform used to arrange meetings. In the BlueNoroff campaign, attackers shared Calendly meeting links to lure victims…
TAG-127: Operator and Customer of TAG-195 Tooling
TAG-127 is an operator and customer of TAG-195's MaaS tooling. It has been observed deploying TinyEgg via ClickFix-style social engineering campaigns and…
Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are…
UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware
Russian state-sponsored threat actors from the UAC-0145 sub-cluster, linked to Sandworm and GRU, are using fake CAPTCHA checks on compromised websites to…
UAC-0145: Sandworm Subgroup Behind Social Engineering Campaigns
UAC-0145 is a threat cluster tracked by CERT-UA, identified as a subgroup within the Sandworm APT group. It has been active since…
Fake Coding Tests Deliver OtterCookie Malware Hidden in SVG Flag Images
North Korean threat actors linked to the Contagious Interview campaign have been observed using steganography in SVG image files to conceal malicious…
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
ACR Stealer, an infostealer active since 2024, is targeting enterprise networks by stealing saved browser passwords, live session tokens, PDFs, Microsoft 365…