Evilginx

Machine speed attacks require machine speed detection and response

bleepingcomputer.comOct 22, 2026extracted

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others

thehackernews.comOct 5, 2026extracted

Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing

A suspected Chinese espionage group impersonated AI policy figures, including a senior Anthropic employee and a former White House official, in phishing campaigns targeting AI policy experts at US universities, think tanks, and law firms, security researchers say. The bulk of these campaigns occurred in July, according to Proofpoint, which discovered the espionage attempts and attributed them to a China-aligned group it tracks as TA419. Proofpoint’s security alert comes a day after OpenAI accused China’s Moonshot AI of stealing the American models’ reasoning and other data in distillation attacks that began on July 1. “In July 2026, TA419 impersonated multiple individuals, including a former member of the White House Office of Science and Technology Policy leadership team, in credential phishing campaigns targeting AI policy experts in the US,” Proofpoint threat-intelligence analyst Mark Kelly said in a Thursday report. Beginning July 8, TA419 sent phishing emails spoofing Lynne Edwards Parker, the former principal deputy director of the White House Office of Science and Technology Policy, and then Heidi Crebo-Rediker, a prominent economist and foreign policy expert, to even more American AI policy experts at think tanks, universities, and law firms. The suspected spies’ emails invited their targets to join a fake AI policy advisory committee or contribute to a Senate foreign relations committee report on AI export controls and supply chains. If the American AI expert replied, the Beijing-linked crew responded with a shortened URL promising to share additional details, but in reality pointing to an attacker-controlled domain. This page conducts a Cloudflare Turnstile check behind a phony OneDrive loading screen, and then redirects the victim to an attacker-in-the-middle (AitM) credential phishing page that steals the victim’s cloud account login information. The July 2026 campaigns used driftshare[.]co as the first-stage domain and globalfileshareplatform[.]com as the second-stage domain. In February - as US military officials pressured Anthropic to remove Claude’s safeguards - the Chinese spies spoofed a senior Anthropic employee to phish an AI policy analyst at a US think tank. This email used the subject line: “Request for Feedback on Military Integration of Claude.” TA419’s phishing chain targets Microsoft 365/Entra ID through the first-party OfficeHome application (client_id=4765445b-32c6-49b0-83e6-1d93765276ca). It’s built on open source Frameless BitB, which contains a Browser-in-the-Browser (BitB) overlay, an Evilginx phishlet to intercept usernames, passwords, and session cookies for Microsoft 365, and server-side substitution rules that inject the kit into proxied pages. TA419 typically uses Cloudflare’s content delivery network to hide the backend hosting IP address for its domains, and its credential phishing domains are usually themed around file sharing sites and cloud services - such as msfile[.]online and onecloudfilesync[.]com. It also impersonates specific organizations, including the Japan-Taiwan Exchange Association (tw-koryu[.]org), The Heritage Foundation (heritiages[.]org and heritiage[.]org), and Japanese Minister of Defense Shinjirō Koizumi’s official website (shinjirou[.]info). In total, the crew uses dozens of phishing and spoofed-sender domains, and phony email addresses. Proofpoint includes all of the ones it discovered in 2026, plus the timeline of when they were registered or first seen, so check out those indicators, too. TA419 and other Beijing-aligned crews will likely continue targeting AI and other policy experts working on technologies of interest to the Chinese government, according to the threat hunters. “Organizations in the scope of TA419 activity should consider phishing-resistant, origin-bound authentication such as passkeys,” they recommend.®

theregister.comOct 1, 2026extracted

Know Your Enemy: Browser-Based Attack Techniques in 2026

Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser. Here are the six most dangerous techniques that should be on every security team's radar in 2026. 1.

thehackernews.comSep 30, 2026extracted

Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor

Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft. The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since January, mostly in the U.S. and U.K. At least one computer was infected, but the number of breached

thehackernews.comSep 29, 2026extracted

How AI-powered phishing killed blocklists for good

Blocklists were already losing ground before AI entered the picture. Phishing domains have been getting shorter-lived for years, campaigns have been burning infrastructure faster, and the gap between blocklists and attacker campaigns keeps getting wider. AI just finished the job. Attackers are using AI to generate phishing pages from screenshots in minutes, spin up and tear down infrastructure faster than any blocklist can track, and iterate on tooling at a cadence that makes indicator-based detection functionally useless. 89% of phishing domains are now active for fewer than two days, with just 6.5% surviving past 15 days. By the time a domain makes it onto a blocklist, the campaign has moved on and the infrastructure has been replaced. If your primary defense against attacks delivered via malicious webpages like AiTM phishing, device code phishing, ClickFix, file downloads, malvertising and more relies on matching known-bad indicators, you’re always two steps behind. Disposable by design The problem isn't just that phishing infrastructure rotates quickly. Modern attacks are designed to be disposable from the outset. Attackers aren't waiting to get caught and then pivoting. They're proactively tearing down pages and spinning up new ones to stay ahead of detection, treating each piece of infrastructure as single-use by default. Attackers are also making that infrastructure harder to analyze while it's live, combining trusted hosting platforms — Cloudflare Workers, Railway, Vercel, Microsoft Dynamics, SharePoint, Adobe, Google Firebase, Google Sites, Jotform, Linode, Azure, Cloudflare, Atlassian, and many more are commonly abused — with bot protection, screening checks, and complex redirect chains on top to filter out researchers and automated scanners. 95% of in-browser attacks that Push Security detects use some form of bot protection, often layered with referrer checks and browser fingerprinting. The page a crawler sees and the page a real victim sees are frequently not the same page. And by the time you get to a once-malicious page (whether spun up by attackers or by compromising an existing site) the malicious payload may no longer be active. AI has also collapsed the cost of creating the pages themselves, too. Attackers were already proficient at cloning pages, but they can now vibe-code entire phishing sites from a screenshot of a legitimate login page — a convincing frontend with a completely unique codebase that looks nothing like the real page it’s based on, and nothing for static analysis to fingerprint. And phishing delivery increasingly abuses legitimate services — AI chatbot sharing features, search ad placement, in-app messages and app-generated emails — to inherit the domain reputation of platforms no blocklist would ever flag. The result is an environment where adding indicators to a blocklist is a bit like playing whac-a-mole, in a game that’s rigged against you from the start. AI adoption has exploded, but every new app, integration and extension introduces new threats and risks. The latest webinar from Push Security uncovers the scale of Shadow AI in the enterprise, how attackers are taking advantage, and what security teams can do about it. Register Now The tools layer is crumbling too For years, the middle of David Bianco's Pyramid of Pain offered a more durable detection surface. Instead of blocking individual domains, you could fingerprint phishing kits — their JavaScript structure, HTML patterns, code signatures — and write detections that survived across dozens or hundreds of campaigns even as infrastructure rotated. That layer is eroding. The phishing kit ecosystem now fragments through forking, AI-assisted development, and open-source-style code sharing faster than anyone can track. Device code phishing is the clearest example. From early adoption in Russia-linked campaigns in 2024, it’s taken until 2026 to really take off — at which point adoption has exploded from zero criminal kits in the wild to 25+ distinct kits (and counting). Criminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability. Established AiTM vendors like Tycoon 2FA have added device code phishing alongside their existing credential-harvesting capabilities, and we’ve recently observed kits dynamically switching between payloads depending on the environment and target’s behavior. For example, attempting device code phishing first, then falling back to AiTM if it times out. These kits are often controlled by attacker-operated admin panels that give full control over the payload and when it’s delivered, used in conjunction with voice-based social engineering and only “activating” the malicious page when performed by an admin. This further reduces the chance that these pages can be flagged and blocked ahead of time — they may only be seen a couple of times in targeted attacks before being rotated out. In Push Security’s recent webinar (now available on-demand), VP R&D Luke Jennings showcased just how easy it is to vibe-code your own PhaaS kit. What actually survives: techniques Genuinely new attack techniques still require human creativity to discover — an attacker has to identify a gap in how a legitimate protocol or feature can be subverted and operationalize it. That kind of innovation hasn't been automated, and detections built around how those techniques work can survive infrastructure rotation, tool proliferation, and kit fragmentation. Take adversary-in-the-middle (AiTM) phishing. Every AiTM kit — Tycoon, Sneaky 2FA, Evilginx, or countless forks and derivatives (we’re tracking 75+ kits in the wild) implements fundamentally the same interception technique: proxy the victim's session through attacker-controlled infrastructure, relay credentials and MFA tokens in real time, and capture the authenticated session. The frontends vary and the infrastructure rotates, but the behavioral mechanics of the interception are the constant. ClickFix tells a similar story. Whether the lure is a fake CAPTCHA (up 563% per CrowdStrike), a fake browser update, or a fake error dialog, the underlying technique is the same: inject malicious commands into the user's clipboard and instruct them to paste and execute the payload. The social engineering wrapper changes; the behavioral signature doesn't. Device code phishing is the same again. You’re interacting with a legitimate device code login page and ultimately completing a device code auth grant. It doesn’t matter what kit the attacker uses or where they host the page polling for the code, the destination page and user behavior is the same. Detecting at the technique level targets the thing that's hardest for attackers to change — the mechanics of the attack itself. But it demands two things that most detection programs lack. First, you need visibility where these attacks actually execute. AiTM interception, ClickFix clipboard manipulation, OAuth consent abuse, device code phishing — these techniques play out inside browser sessions where network proxies see encrypted traffic and EDR sees nothing at all. If your detection stack can't observe the page at the moment the user interacts with it, technique-level detection isn't available to you. Second, you need research velocity. The window between technique discovery and industrialization into criminal toolkits is compressing — device code phishing took roughly a year to go from nation-state novelty to commodity PhaaS feature, and ClickFix followed a similar trajectory. Defenders who can extract a behavioral signature and deploy a detection before commoditization have a structural advantage that compounds over time. Waiting for indicators — even tool-level indicators — means chasing a curve that's accelerating away from you. The proof: a detection with zero IOC overlap Earlier this year, Microsoft published research documenting a novel technique that weaponized OAuth error-handling redirects as a phishing delivery mechanism — exploiting standards-compliant redirect behavior to route users from trusted identity provider domains to attacker-controlled pages. From a URL-filtering perspective, the initial link carried the domain reputation of login.microsoftonline.com. Push's agentic threat hunting pipeline — AI agents operating as a force multiplier for human researchers, continuously hunting across browser telemetry from 3+ million deployments — ingested that research and extracted the behavioral mechanics, not the published IOCs. The agents built a detection targeting the behavioral signature: the OAuth redirect. Months after creating the detection, later, it fired on a completely different campaign. A user at a Push customer had been targeted — but with different lures, different domains, different infrastructure, and a previously unseen phish kit behind the redirect, compared to the original (a malware download payload). The underlying technique was identical. None of the original IOCs appeared anywhere in the attack chain. A blocklist-based approach would have missed this entirely (the domains weren’t flagged as malicious at the time), and a tool-signature approach would have missed it too — the phish kit didn’t match any known samples. The only detection that survived was the behavioral technique itself. The OAuth redirect case isn't an isolated example. The same pipeline led to the discovery and detection of three novel browser-based attack techniques — InstallFix (malware delivery disguised as software installation prompts), ConsentFix (OAuth consent phishing combined with ClickFix-style user manipulation), and LLMShare (malware delivery via AI chatbot sharing features). In several cases, detections were blocking active campaigns before the technique had been publicly documented. So far, Push's agentic pipeline has protected 60+ customers in the last three months alone who were targeted with novel phishing techniques — intercepting ~225 threat instances before the attacker could compromise an account, or trick the user into interacting with a malware payload. What this means for security teams The industry spent decades building bigger blocklists. AI made that approach structurally obsolete — not just slow, but architecturally incapable of keeping pace. What remains durable is the top of the Pyramid: technique-level behavioral detection, built around how attacks work rather than the infrastructure or tooling that implements them. Defending at that level requires browser-session visibility and a research pipeline fast enough to stay ahead of the compressing timeline from technique discovery to criminal adoption. At Push Security, we've built that pipeline using AI agents as a force multiplier for human researchers, continuously hunting across browser telemetry and shipping technique-level detections that survive indicator rotation — tripling monthly detection output not by building bigger blocklists, but by operationalizing behavioral detection at the top of the Pyramid at machine speed. Book a demo to learn more. Sponsored and written by Push Security.

bleepingcomputer.comAug 5, 2026extracted

GitHubだけでMFA突破攻撃を量産できる時代に　現役フィッシング基盤の全貌が判明

��v�f�F��Ƃ��Ĉ��S�ł��鎞��ł͂Ȃ��Ȃ��B�ݒ�~�X�ŊO��J��ꂽ�U��҂̃T�[�o��͂��Ƃ��AGitHub�œ��ł��R�[�h�ƈ��ȃN��E�h�T�[�r�X��g�ݍ��킹�邾��ŁA��x�ȃt�B�b�V��O��Ղ��\�z��Ă��Ԃ��Ƃ��B ��̋L��͉��ł��B��o�^�i��j��ƑS�Ă��܂��B �@�Z�L��e�B��Ƃ�Lexfo��2026�N7��13��i��n��ԁj�A�ݒ�~�X�ɂ��ĊO��J��Ă��U��҂̃T�[�o��͂��A�ғ��3�̃t�B�b�V��O��ƁA��ꂼ��^�c��ʌ̍U��҂��肵��Ɣ��\��B �@��J��Ԃ��T�[�o�ɂ̓t�B�b�V��O�ݒ��F�؏��W��O�ARMM�iRemote Monitoring and Management�j�֘A�t�@�C��A�R��{��X�g�i��[�U�[ID�^�p�X��[�h�̑g�ݍ��킹��ꗗ��́j�A�uTelegram�v�Z�b�V��Ȃǂ��ۑ��Ă��A�U��Ղ̓��\��^�p��Ԃ��L�͈͂ɂ킽��ĘI�o��Ă��Ƃ��B �@��Ώۂ̃T�[�o�̓u�_�y�X�g��݂�VPS�iVirtual Private Server�F��z��p�T�[�o�j�ŁAPython��HTTP�T�[�o��f�B��N�g��ꗗ�\��L��ɂ��܂܃C��^�[�l�b�g�Ɍ��J��Ă��B��J�̈�ɂ́u.bash_history�v��uEvilginx�v�֘A�f�B��N�g��A�e��o�b�N�A�b�v�A�c�[��Q�Ȃǂ��c��Ă��A�^�p��AiTM�i��ԎҁFAdversary-in-the-Middle�j�^�t�B�b�V��O��Ղ�uSimpleHelp�v�̊Ǘ��m�F�ł��B �@Lexfo�̓T�[�o��̃f�[�^��͂��A�U��ҁucodemado�v�umail-argenta�v�usaroula01�v��3�҂��ʂ��B3�҂͌��J�uGitHub�v��|�W�g��R��́uEvilginx�v�h��łƂ��ʂ̃R�[�h��Ղ𗘗p��Ă��̂́A��ꂼ��Ɨ��Ċ��Ă��A�W�I��^�p��Ղɂ��Ⴂ��Ƃ��Ă��B �@codemado�ɂ��ẮA�u.bash_history�v�AGitHub��|�W�g��ATelegram�Z�b�V��A��J��ȂǕ��̍��Ղ��A�G�W�v�g�Ƃ̊֘A��m�F��B2018�N��납��n�b�L��O�֘A�R�~��j�e�B�[�Ŋ��Ă��Ղ��A�uMicrosoft 365�v��W�I�Ƃ��AiTM��ɉ��A�Ǝ��̑�ʑ��M�c�[��uMaDoO Blaster�v��^�c��Ă��B �@�T�[�o�ɂ͕��Evilginx�h��ł̑��A�uScreenConnect�v�uSimpleHelp�v�uSuperOps RMM�v�uGetScreen�v�uXEOX RMM�v�Ȃǂ̉��u�Ǘ��c�[��A�uPowerShell�v�uVBScript�v�̃h��b�p�[�A�F�؏��ގ�v��O��Ȃǂ��ۑ��Ă��B�uCloudflare Tunnel�v��A�ʐM�o�H�̔铽��}��Ă��B �@MaDoO Blaster�́uMicrosoft Entra�v�𗘗p��d�q��[��M��[��e��v��[�g��A�Y�t�t�@�C��쐬�AQR�R�[�h��ߍ��݁AHTML�{��̉摜��ȂǑ��l�ȋ@�\��Ă��B��p��@��Telegram�Ō��J��Ă��A��O�҂ւ̒�O��Ƃ��Ă��\��Ƃ��B �@mail-argenta�͕��T�[�r�X��̃t�B�b�V��O��Ղ�GitHub�Ō��J��Ă��BMicrosoft 365�AGitHub�A�Í��Y��uKraken�v�ASNS�uLinkedIn�v�Ȃǂ�W�I�Ƃ��h��ł�Ǘ��p�l��A�\�[�X�R�[�h�ɂ�Telegram�ݒ��uMySQL�v�̔F�؏��c��Ă��BLexfo�͘R��F�؏��Ƃ̏ƍ��A�i�C�W�F��A�Ƃ̊֘A��Ƃ��Ă��B �@��Asaroula01��Microsoft 365�́uDevice Code Flow�v��p��Evilginx�h��Łublack-queen�v�̊J��҂Ƃ݂��Ă��BDevice Code Flow�͐��K�̔F�؋@�\��A��p�҂𐳋K�̔F�y�[�W�ɗU��ăf�o�C�X�R�[�h��͂��邱�ƂŁA�U��҂��F�؍ς݃A�N�Z�X�g�[�N��擾�ł��Bblack-queen�ɂ�Web�Ǘ��ʂ�Cookie��@�\�A�uMicrosoft Graph API�v�𗘗p��[��{�b�N�X�{��@�\�Ȃǂ��ǉ��Ă��B �@�uGit�v�̗��͍폜�ς݂̐ݒ�t�@�C��g�[�N��A�uromnor.ca�v�z��̕��T�u�h��C��𗘗p��^�c��Ԃ��BTelegram��bot��VPS��܂܂�Ă��A2025�N6��ȍ~��p��Ă��Ƃ��L�^��c��Ă��B �@codemado�́upicis.net�v�z��ɑ��̃T�u�h��C��\�z��A�uMicrosoft Office�v�uMicrosoft OneDrive�v�uMicrosoft Authenticator�v�uAdobe�v�uDocuSign�v�uSharePoint�v��t�B�b�V��O�y�[�W��^�p��Ă��B�uCloudflare Tunnel�v��uNode.js�v��t�B��^�[��p��A��͂�W�Q��u��Ă��B �@mail-argenta��Kraken�𒆐S�ɕ��T�[�r�X��W�I�Ƃ��銈��W�J��ALinkedIn��E��}�b��O�T�C�g�ueHarmony�v��_��m�F��ꂽ�B��J��Ԃ��Cookie��ݒ��A�^�p�̈ꕔ��c��ł��Ƃ��B �@saroula01��3�҂̒��ōł��Ԋ��Ă��ALexfo��218��̔�Q�҂��m�F��B��Q�҂̖�94��͊�Ɨ��p�҂ŁA�p��A�I�[�X�g��A�A�č��A�X�y�C��A�|�[��h�A�J�i�_�ȂǕ��L��n��ɋy��ł��BGit��ɂ�97��Microsoft OAuth�g�[�N��c��A��X�V�ݒ��m�F��ꂽ�B �@Lexfo��3�҂�P��̑g�D�Ƃ͔��f��Ă��Ȃ��B��JGitHub��|�W�g��R��̃R�[�h��ՂƂ��Z�p�I�ȋ��ʓ_�͂��̂́A��Ղ�W�I�A�^�p��@�͂��ꂼ��Ɨ��Ă��ƌ��_�t��B �@�܂��A�uSOCRadar�v��uThe Quarry�v�G�R�V�X�e��Ƃ̐ړ_��m�F��BMaDoO Blaster�͊֘A�`��l��ŏЉ��Ă��A�uRockyBelling�v��^�c��T�[�r�X�Q�Ƃ̊֘A��F�߂�ꂽ�B��ŁAmail-argenta��saroula01�ɂ��Ă͒��ړI�ȊW�͊m�F�ł��Ȃ��B �@Lexfo�́A��JGitHub��|�W�g��ȃN��E�h�T�[�r�X��g�ݍ��킹�邾��ŁAAiTM�ɂ�鑽�v�f�F�ؓ˔j��ADevice Code Flow��p��ĔF�؍ς݃g�[�N��擾��U��Ղ��r�I�e�Ղɍ\�z�ł��ɂȂ��Ă��Ǝw�E��B��̏�ŁA��U��O��Ƃ��m�E�Ď��̐��C��V�f��g�Ή��̐��̋��K�v��Ƃ܂Ƃ߂Ă��B Copyright © ITmedia, Inc. All Rights Reserved.

atmarkit.itmedia.co.jpJul 14, 2026extracted

Open Directory Exposes Three Evilginx Phishing Operators

A single misconfigured server has exposed the complete toolkit of an active a three-actor phishing ecosystem. According to new research from French security firm Lexfo, the open directory was a Python HTTP server left running on a Budapest virtual private server in late April, with directory listing switched on. Phishing configurations, credential logs, remote management installers and the operator's own Telegram session files were all readable. Behind it was a threat actor tracked as codemado, running an Evilginx-based adversary-in-the-middle (AiTM) platform against corporate Microsoft 365 accounts. Three Actors, One Code Lineage Artefacts on the server tied codemado to an Egyptian operator active on hacking forums since 2018. Beyond the phishing proxy, the host held a seven-tool remote monitoring and management (RMM) arsenal for persistence, including ScreenConnect and SimpleHelp, plus a custom bulk-mailer of his own build, MaDoO Blaster. The other two actors surfaced through the Evilginx forks codemado had cloned. Their link is technical rather than operational: the repositories were public on GitHub, so Lexfo said shared code does not prove coordination. An operator called mail-argenta was traced through infostealer logs carrying his own reused credentials, notably a MySQL password hardcoded into a phishing panel, pointing to a Nigerian individual. A third, saroula01, built a framework abusing the OAuth Device Code Flow, a legitimate Microsoft feature the victim completes on a real Microsoft page while the attacker's backend claims the token. Device Code Campaign Ran Undetected For a Year Of the three, saroula01's operation was the largest. Lexfo reconstructed a deleted configuration file from git history, and internal bot timestamps dated the campaign to June 2025, meaning it had run for more than a year without apparent interruption. Over that window, it accumulated 218 confirmed victims across 12 countries, roughly 94% of them corporate, with captured tokens set to refresh automatically in the background. Recovered entries had been silently refreshed up to 25 times, maintaining access long after the initial phish. A thread running through all three operators is the use of generative AI to build the tooling, evidenced by AI co-author metadata on saroula01's commits and a saved development session in mail-argenta's repository. Lexfo also connected codemado's MaDoO Blaster to The Quarry, a phishing-as-a-service (PaaS) ecosystem documented by SOCRadar in June and run by an actor known as RockyBelling, who promoted the tool to his customers. The firm noted that the barrier to running a functional AiTM campaign has dropped close to zero, with components either free on GitHub or sold on Telegram for a few hundred dollars. It urged defenders to assume any actor can bypass MFA through session hijacking or Device Code Flow abuse, and to disable device code authentication where it is not needed.

infosecurity-magazine.comJul 13, 2026extracted

Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365

An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on. The command that did it: python3 -m http.server 8080, was still sitting in the readable .bash_history. From that one lapse, French security firm Lexfo lifted the operator's entire toolkit and pivoted through it to two more phishing operators, three campaigns in all. Each ran a custom fork of the open-source Evilginx proxy, cloned from public GitHub. The largest of the three had been running for more than a year, its victims overwhelmingly corporate mailboxes. The three got past MFA in two mechanically different ways, one by proxying the live login, one by abusing a legitimate Microsoft sign-in flow. The two need different defenses, which is the part that matters most if you run Microsoft 365. Directory listing on a working attack server is close to a full confession. The listing exposed phishing configs, credential-harvesting logs, RMM installers, combolists, backup archives, and the operator's own Telegram session files. Behind it ran an Evilginx adversary-in-the-middle proxy and a SimpleHelp remote console on the same host, at 185.163.204[.]7 in Budapest, cataloged in late April 2026 during a routine internet scan. The bash history and a set of public repos pointed straight at the operator: an Egyptian actor the firm tracks as codemado, active in VoIP and hacking forums since 2018, now running a Microsoft 365 AiTM platform on picis[.]net and monetizing access through a bulk mailer he wrote called MaDoO Blaster. His campaign went live on April 20 and kept running past the day the directory was found on April 30, with fresh subdomains and a renewed wildcard certificate turning up weeks later. His own bot logged captures against two corporate M365 accounts, one French, one North American. The repeated captures of the same accounts from different IPs are consistent, the firm says, with the operator refreshing stolen tokens as they aged out. Where the kits came from codemado did not build the framework he runs. He cloned it, and his bash history shows him comparing kits side by side. The server held four Evilginx variants pulled from two other GitHub developers, and both turned out to be active operators in their own right. The first, red-queen, comes from a Nigerian operator the report calls mail-argenta, and it shows how much polish gets bolted onto a public framework. His fork renames the crossorigin and integrity HTML attributes to defeat Subresource Integrity checks and adds a URL-rewriting engine to http_proxy.go to dodge path-based detection. It pre-fills the victim's email address to cut abandonment. It also sets a one-year TTL, 31,536,000 seconds, on the captured Microsoft session cookies. The report says an intercepted login can then outlast a password reset and, without a CAE-capable Conditional Access policy, stay usable for months. A pre-compiled evilginx2.exe is committed to the repo, so a buyer never has to build anything. One captured M365 cookie sitting in the repo carried an expiration date of June 30, 2027. mail-argenta got caught the way his own victims do. The firm found his email and a password in infostealer logs, the kind of harvested-credential data his phishing panels exist to produce. That leaked password matched the one hardcoded as the MySQL password in his Kraken panel and reused across his accounts. The quiet one The third fork, black-queen, logged far more captures than the other two, and it never touches a password. Its author, whom the researchers could not identify past the handle saroula01, built it around Microsoft's OAuth device code flow, a legitimate sign-in path meant for input-constrained devices. The attack generates a real device code, wraps it in an Authenticator-themed lure page, and tells the target to enter it at the genuine microsoft.com/devicelogin. The victim signs in on a real Microsoft page and clears MFA themselves. saroula01's backend polls the token endpoint and takes the token the moment they do. Calling this "MFA bypass" misses how it works: nothing gets bypassed. The lure page is Authenticator-themed and attacker-built, but the device code and the Microsoft page where the victim finishes are genuine, so the MFA prompt the victim satisfies is real. A passkey or FIDO2 key does not help either, because the victim clears it on genuine Microsoft infrastructure while authorizing the attacker's session; the origin binding that stops Evilginx passes cleanly when the origin really is Microsoft. Microsoft documented the technique in February 2025, in a campaign it assessed with medium confidence as Russia-aligned. It has since spread well past state-backed use, into campaigns hitting hundreds of Microsoft 365 organizations. saroula01's version ran quietly for over a year. The firm counted 218 distinct captured accounts in the campaign's Telegram bot logs across a dozen countries between June 2025 and July 2026, around 94 percent of them corporate mailboxes. Those are logged captures, not scan targets. A token file briefly committed to the repo and then deleted, still readable in the git history, held 97 live Microsoft tokens tied to three of those victims, every one set to autoRefresh and some refreshed as many as 25 times. The framework was keeping the sessions alive on its own. Both phishing domains, picis[.]net and romnor[.]ca, were offline when The Hacker News checked ahead of publication, though the report's timeline shows picis[.]net still provisioning new subdomains as late as May 2026. The Lexfo CTI team told THN that the domains had already gone offline before it took any action, and reads that as the operators rotating infrastructure or pulling back rather than a coordinated takedown, though it cannot confirm which. The three connect, loosely, to something larger. In June 2026, SOCRadar documented a phishing-as-a-service ecosystem it named The Quarry, run by a developer it calls RockyBelling and, by its count, sold to close to 200 operators. MaDoO Blaster shows up promoted inside The Quarry's Telegram channel as a third-party tool, flagged independently in both writeups, which the report frames as a supplier relationship, not membership in it. Whether mail-argenta or saroula01 has any direct tie cannot be shown from the artifacts. Their kits sat on public GitHub, and anyone could have taken them. Built with help The report found signs of AI-assisted development across all three operations, though they vary in strength. saroula01 left two git commits co-authored by Claude models. mail-argenta committed an instructions.txt that is a verbatim save of an AI coding session, references to earlier prompts and all, documenting how the URL-rewriting feature got built. codemado's is thinner: one of his scripts credits CyberNeurova, a paid "uncensored" code-generation API, the report says, which advertises itself with the prompt "Build me a keylogger in Python." Two of the three put a model directly in the code; the third is a credit line, and none of them shows how much of each build the model did. It is not confined to these three either. Microsoft has separately documented device-code phishing built on AI-driven backend automation and generative-AI lures. The Hacker News asked the report's authors how much of the tooling AI actually produced across the three operations. The Lexfo CTI team said the Evilginx forks carried only minor changes to the core, and that the clearer signs of AI use sat in the glue code around them, the scripts and phishlets, several of which read as direct model output. It was less the framework itself, the team said, than the code built around it. What defenders can actually do The two techniques do not share a fix. Phishing-resistant MFA, FIDO2, or passkeys still shut down the Evilginx side by binding the sign-in to the real domain. It does not stop device code abuse. For that, the lever is Conditional Access. Microsoft's own line is to block device code flow wherever possible. A handful of setups genuinely need it, mostly input-constrained hardware like Teams room devices and some command-line tools. Inventory that uses the sign-in logs, blocks the flow everywhere else, and tests the policy in report-only mode before enforcing. Layer IP-based Conditional Access location policies and Continuous Access Evaluation on top, so that on supported Microsoft 365 workloads, a stolen token seen from outside your allowed ranges gets reevaluated instead of riding out its lifetime. For detection, the report flags refresh-token grants from the Microsoft Office client ID d3590ed6-52b3-4102-aeff-aad2292ab01c in Entra sign-in logs as worth watching, where that desktop client is not in normal use; cross-check them against unfamiliar source IPs. The same Microsoft guidance flags a catch: a session that started with device code flow stays tagged on later refreshes even when the current event no longer shows it, so hunt on the sign-in's Original transfer method field, not just the live authentication protocol. On endpoints, hunt for the RMM tooling these operators drop for persistence; codemado's kit reaches for XEOX, so start with the agent at C:\Program Files (x86)\XEOX\xeox-agent_x64.exe and scheduled tasks matching *XEOX*Agent*Watchdog*. The domains and IPs are in the report, but that infrastructure rotates, so treat it as containment, not a fix. The Hacker News also asked Microsoft about the abuse of its device code flow, and had received no response by the time of publication. This story will be updated with any reply. None of this took much: three operators, none of whom built the frameworks they ran, stood up working campaigns off public repositories, kits that sell for a few hundred dollars, and a model helping with the custom parts. The report reads that the barrier to a working campaign has fallen to near zero, and the Lexfo CTI team expects this class of attack to become significantly more common over the coming months. One cheap ecosystem now supplies two ways around MFA, and that is the part that outlasts any single campaign here: a shop hardened against reverse-proxy phishing is still open to device-code abuse. Blocking that second path is one Conditional Access policy, no passkey rollout adds for you, and it exists only once someone writes it. Update (July 16, 2026) Lexfo has issued an erratum to the report. Three entries it originally listed as malicious indicators, agent01.xeox.com, ws01.xeox.com, and 80.80.250.0/24, are legitimate XEOX vendor infrastructure, shared across all XEOX customers. Anyone who blocked them off that list should reverse that. The corrected guidance is to alert and audit XEOX activity only where XEOX is not an authorized tool, and the same qualifier applies to the endpoint artifacts above: XEOX is a product some environments run on purpose.

thehackernews.comJul 13, 2026extracted

When attackers already have the keys, MFA is just another door to open

The Figure breach exposed 967,200 email records without a single exploit. Understanding what that enables — and why your MFA cannot contain it — is an architectural problem, not a user education problem. In February 2026, TechRepublic reported that Figure, a financial services company, exposed nearly 967,200 email records in a newly disclosed data breach. No vulnerability was chained. No zero-day was burned. The records were accessible, and now they are in adversary hands. Coverage of breaches like this tends to stop at the count. That is the wrong place to stop. The number of exposed records is not the event — it is the starting inventory for the event that follows. To understand the actual risk, you have to follow the attack chain that a credential exposure like this enables, step by step, and ask honestly whether the authentication controls in your environment can interrupt it at any point. Most cannot. Here is why. What Adversaries Do With 967,000 Email Records Exposed email addresses are not static data. They are operational inputs. Within hours of a record set like this becoming available, adversaries are running it through several parallel workflows simultaneously. The first is credential stuffing. Figure customers and employees almost certainly reused passwords across services. Adversaries combine the exposed addresses with breach databases from prior incidents — LinkedIn, Dropbox, RockYou2024 — and test the resulting pairs against enterprise portals, VPN gateways, Microsoft 365, Okta, and identity providers at scale. Automation handles the volume. Success rates on credential stuffing campaigns against fresh email lists routinely run at two to three percent. On 967,000 records, that is 19,000 to 29,000 valid credential pairs. The second workflow is targeted phishing. AI-assisted tooling can now generate personalized phishing campaigns from an email list in minutes. The messages reference the organization by name, impersonate internal communications, and are visually indistinguishable from legitimate correspondence. Recipient-specific targeting — using job title, department, or public LinkedIn data to tailor the lure — is standard practice, not a capability reserved for nation-state actors. The third is help desk social engineering. Armed with a valid email address and basic OSINT, adversaries impersonate employees in calls to IT support teams, requesting password resets, MFA device resets, or account unlocks. This attack vector bypasses authentication technology entirely — it targets the human process that exists to handle authentication failures. In each of these workflows, no technical vulnerability is required. The adversary’s goal is not to break in. It is to log in as a valid user. The breach does not create access. It creates the conditions under which access becomes achievable through the authentication system itself. Token’s Biometric Assured Identity platform is built for organizations where authentication failure is not an acceptable outcome. See how Token can strengthen identity assurance across your existing IAM, SSO & PAM stack. Learn More Why Legacy MFA Cannot Interrupt This Chain This is the part of the analysis that most incident post-mortems underweight. Organizations read about a credential exposure and conclude that their MFA deployment protects them. For the attack chain described above, that conclusion is structurally incorrect. Modern adversary tooling executes what security researchers call a real-time phishing relay, sometimes referred to as an adversary-in-the-middle (AiTM) attack. The mechanics are precise. An adversary builds a reverse proxy that sits between the victim and the legitimate service. When the victim enters credentials on the spoofed page, the proxy forwards those credentials to the real site in real time. The real site responds with an MFA challenge. The proxy forwards that challenge to the victim. The victim responds — because the page looks legitimate and the MFA prompt is real. The proxy forwards the response. The adversary receives an authenticated session. Push notification MFA, SMS one-time codes, and TOTP authenticator apps are all vulnerable to this relay. They authenticate the exchange of a code. They do not verify that the individual completing the exchange is the authorized account holder. They cannot distinguish a direct session from a proxied one. Toolkits that automate this attack — Evilginx, Modlishka, Muraena, and their derivatives — are publicly available, actively maintained, and require no advanced tradecraft to operate. The capability is not exotic. It is the baseline. MFA fatigue compounds this. Adversaries who obtain valid credentials but cannot relay the session in real time will instead trigger repeated push notifications until a user approves one out of frustration or confusion. This attack has been used successfully against organizations with mature security programs, including in incidents that received significant public coverage. The common thread across all of these techniques: legacy MFA places a human being at the final decision point of the authentication chain, then relies on that human to make the correct call under conditions specifically engineered to defeat it. The Structural Problem Legacy MFA Cannot Solve The security industry’s standard response to authentication failures is user education. Train people to recognize phishing. Teach them to verify unexpected MFA prompts. Remind them not to approve requests they did not initiate. This response is not wrong. It is insufficient, and the insufficiency is architectural, not motivational. A relay attack does not require a user to recognize a phishing page. The MFA prompt they receive is real, issued by the legitimate service, delivered through the same app they use every day. There is nothing anomalous for the user to detect. The attack is designed to be invisible to the human in the loop — and it is. The deeper problem is that the authentication architecture most organizations have deployed was not designed to answer the question that actually matters in a post-breach environment: was the authorized individual physically present and biometrically verified at the moment of authentication? Push notifications do not answer this question. SMS codes do not answer this question. TOTP does not answer this question. USB hardware tokens answer a related but different question — they prove the registered device was present, not the authorized person. Auditors, regulators, and cyber insurers are increasingly drawing this distinction explicitly. The question “can you prove the authorized individual was there?” is appearing in CMMC assessments, NYDFS examinations, and underwriter questionnaires. Device presence is no longer accepted as a proxy for human presence in high-stakes access contexts. What Phishing-Resistant Authentication Actually Requires FIDO2/WebAuthn gets cited frequently in this conversation, and it is a meaningful step forward — but it is not sufficient on its own. Standard passkey implementations bind the credential to a device or cloud account. Cloud-synced passkeys inherit the vulnerabilities of the cloud account: SIM swap attacks against the recovery phone number, account takeover via credential phishing, recovery flow exploitation. Device-bound passkeys prove device possession. They do not prove human presence. Phishing-resistant authentication that closes the relay attack vector requires three properties simultaneously: Cryptographic origin binding: the authentication credential is mathematically tied to the exact origin domain. A spoofed site cannot produce a valid signature because the domain does not match. The attack fails before any credential is transmitted. Hardware-bound private keys that never leave secure hardware: the signing key cannot be exported, copied, or exfiltrated. Compromise of the endpoint does not compromise the credential. Live biometric verification of the authorized individual: not a stored biometric template that can be replayed, but a real-time match that confirms the authorized person is physically present at the moment of authentication. When all three properties are present, a relay attack has no viable path. The adversary cannot produce a valid cryptographic signature from a spoofed site. They cannot relay a session because the cryptographic binding fails the moment the origin changes. They cannot use a stolen device because the biometric verification fails without the authorized individual. They cannot social-engineer an approval because there is no approval prompt — the authentication either completes with a live biometric match at the registered hardware, or it does not complete. Token: Cryptographic Identity That Verifies the Human, Not the Device TokenCore was built on a single, uncompromising principle: verify the human, not the device, credential, or session. Most authentication products add factors to a weak foundation. Token replaces the foundation. The platform combines enforced biometrics, hardware-bound cryptographic authentication, and physical proximity verification — three properties that must all be satisfied simultaneously for access to be granted. There is no fallback. There is no bypass code a user can enter in the field. The authorized individual is either present and verified, or access does not occur. This matters precisely because of the attack chain described above. Token’s Biometric Assured Identity platform eliminates each link: No Phishing. Every authentication is cryptographically bound to the exact origin domain. A spoofed login page produces no valid signature — Token simply refuses to authenticate. No Replay. The private signing key never leaves the hardware. A relayed session cannot be reconstructed because the cryptographic material it would need to replicate is physically inaccessible. No Delegation. A live fingerprint match is required for every authentication event. A colleague, an adversary with a stolen device, or a social engineering target cannot complete authentication on behalf of the authorized individual. No Exceptions. There is no code, no recovery flow, and no help-desk override that can substitute for biometric presence. The control is absolute because the risk is absolute. The form factor matters too. Token is wireless — Bluetooth proximity, no USB port required. Authentication takes one to three seconds: the user initiates a session, taps their fingerprint on the Token device, Bluetooth proximity confirms physical presence within three feet, and access is granted. For on-call administrators, trading floor operators, and defense contractors working across multiple workstations, this eliminates the friction that drives the shadow IT and workaround behavior legacy hardware tokens create. Unlike USB-based alternatives, Token is field-upgradeable over the air. As adversaries evolve their tooling, Token’s cryptographic controls can be updated remotely and immediately — without replacing hardware or reissuing devices. The investment does not expire when the threat landscape changes. Token verifies the human. Not the session. Not the device. Not the code. The human. The Honest Assessment The Figure breach will produce downstream authentication attacks. So will the next breach, and the one after that. The adversary infrastructure that runs credential stuffing, AI-generated phishing, and real-time relay attacks operates continuously against exposed email records. The question is not whether these attacks will be attempted against your environment. They will be. The relevant question is whether your authentication architecture requires human judgment to succeed — or whether it is designed so that human judgment is not the failure point. Legacy MFA, in all of its common forms, requires human judgment. A user must recognize the anomaly, question the prompt, and make the correct decision under adversarial pressure. That is a brittle dependency at a critical control point, and adversaries have built an entire toolchain to exploit it. Token removes that dependency. The device signs for the legitimate domain with a confirmed biometric match — or it does nothing. There is no prompt to manipulate. There is no decision to engineer. There are no exceptions. That is not a feature. It is the architectural requirement for authentication that holds under the conditions this breach, and every breach like it, creates. See How Token Closes the Gap Token’s Biometric Assured Identity platform is built for organizations where authentication failure is not an acceptable outcome — defense contractors, financial institutions, critical infrastructure, and enterprise environments with high-privilege access requirements. Cryptographic. Biometric. Wireless. No phishing. No replay. No delegation. No exceptions. Learn more. Visit tokencore.com. Sponsored and written by Token.

bleepingcomputer.comApr 9, 2026extracted

Researchers Uncover Service Providers Fueling Industrial-Scale Pig Butchering Fraud

Cybersecurity researchers have shed light on two service providers that supply online criminal networks with the necessary tools and infrastructure to fuel the pig butchering-as-a-service (PBaaS) economy. At least since 2016, Chinese-speaking criminal groups have erected industrial-scale scam centers across Southeast Asia, creating special economic zones that are devoted to fraudulent investment and impersonation operations. These compounds are host to thousands of people who are lured with the promise of high-paying jobs, only to have their passports and be forced to conduct scams under the threat of violence. INTERPOL has characterized these networks as human trafficking-fuelled fraud on an industrial scale. One of the crucial drivers of the pig butchering (aka romance baiting) scams is service providers who supply the networks with all the tools to run and manage social engineering operations, as well as swiftly launder stolen funds and cryptocurrencies and move ill-gotten proceeds to accounts that cannot be reached by law enforcement. "Large scam compounds such as the Golden Triangle Economic Zone (GTSEZ) are now using ready-made applications and templates from PBaaS providers," Infoblox said in a report published last week. "Compounding the situation further, what once required technical expertise, or an outlay for physical infrastructure, can now be purchased as an off-the-shelf service offering everything from stolen identities and front companies to turnkey scam platforms and mobile apps, dramatically lowering the barrier to entry." These services have been found to offer full packages and fraud kits that set the groundwork for launching scalable online scam operations without much effort. One such threat actor is Penguin Account Store, which also goes by the names Heavenly Alliance and Overseas Alliance. Penguin operates under a crimeware-as-a-service (CaaS) model, advertising fraud kits, scam templates, and "shè gōng kù" datasets comprising stolen personal information belonging to Chinese citizens. The group also peddles account data from various popular so-called media platforms like Twitter, Tinder, YouTube, Snapchat, Facebook, Instagram, Apple Music, OpenAI ChatGPT, Spotify, and Netflix, among others. It's believed that these credentials are likely obtained through information-stealing logs sold on the dark web. But it's presently not known if they operate the stealers themselves or whether they are merely acting as a broker of stolen data for other threat actors. Prices for pre-registered social media accounts start from just $0.10 and go up in value depending on the date of registration and authenticity. Also provided by Penguin are bulk pre-registered SIM cards, stolen social media accounts, 4G or 5G routers, IMSI catchers, and packages of stolen pictures (aka character sets) that are used to entrap victims. Besides these, the threat actor has developed a Social Customer Relationship Management (SCRM) platform dubbed SCRM AI to allow scam operators to facilitate automated victim engagement on social media. "The threat actor also advertises BCD Pay, a payment processing platform. BCD Pay, which links directly to the Bochuang Guarantee (博创担保自), is an anonymous peer-to-peer (P2P) solution à la HuiOne, with deep roots in the illegal online gambling space." A second service category that's central to the PBaaS economy is customer relationship management (CRM) platforms, which provide centralized control over several individual agents. UWORK, a seller of content and agent management tools, provides pre-made templates for creating investment scam websites. Many a scam offering also claims to have integration with legitimate trading platforms like MetaTrader to lend the sites a veneer of trust by displaying real-time financial information. These websites also come fitted with a Know Your Customer (KYC) panel that requires victims to upload proof of their identity. The websites' settings are configured by an administrator through a dedicated panel, granting them a high-level view of the entire operation, along with the ability to create profiles for agents, who likely interface with the victims. "The admin panel offers everything needed to run a pig butchering operation. Multiple email templates, user management, agent management, profitability metrics, as well as chat and email records," Infoblox said. "The management of agents is very complex, and agents can even be affiliates of one another." PBaaS suppliers have also been found to provide mobile applications for Android and iOS by distributing them in the form of APK files and enrolling a limited number of Apple devices into a testing program in order to bypass app store controls. Some threat actors have taken it a step further, opting to release such apps directly on app marketplaces while concealing their functionality by masquerading as seemingly harmless news apps. The trading panel is displayed only when a user enters a specific password in the search bar. Infoblox told The Hacker News that it identified about a dozen mobile apps for Android and iOS, adding many of the initially observed apps have since been removed from app stores. Website templates that include hosting can cost as little as $50. A complete pack, including a website with admin access, VPS hosting, mobile app, access to a trading platform, front company incorporation in a tax haven to mask their activities, and registration with the relevant local financial regulator, can start at around $2,500. "Sophisticated Asian crime syndicates have created a global shadow economy from their safe havens in Southeast Asia," researchers Maël Le Touz and John Wòjcik said. "PBaaS provides the mechanisms to scale an operation with relatively little effort and cost." Parked Domains as a Conduit for Scams and Malware The disclosure comes against the backdrop of a new study from the DNS threat intelligence firm, finding that the vast majority of parked domains – domain names that are mostly expired or dormant, or common misspellings of popular websites (aka typosquatting) – are being used to redirect visitors to sites that serve scams and malware. Infoblox revealed that visitors to a typosquat of the legitimate domain belonging to a financial institution from a virtual private network (VPN) are shown a normal parking page, but are redirected to scam or malware sites if they are visiting from a residential IP address. The parked pages, for their part, send visitors through a redirect chain, while simultaneously profiling their system using IP geolocation, device fingerprinting, and cookies to determine where to redirect them. "In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the 'click' was sold from the parking company to advertisers, who often resold that traffic to yet another party," the company said. "None of this displayed content was related to the domain name we visited." Malicious Evilginx AitM Infrastructure Drives Credential Harvesting In recent months, it has also emerged that threat actors are leveraging an adversary-in-the-middle (AitM) phishing toolkit named Evilginx in attacks targeting at least 18 universities and educational institutions across the U.S. since April 12, 2025, with an aim to steal login credentials and session cookies. As many as 67 domains have been identified as linked to the activity. "The low detection rates across the cybersecurity community highlight how effective Evilginx's evasion techniques have become," Infoblox said. "Recent versions, such as Evilginx Pro, add features that make detection even harder." "These include default use of wildcard TLS certificates, bot filtering through advanced fingerprinting like JA4, decoy web pages, improved integration with DNS providers (e.g., Cloudflare, DigitalOcean), multi-domain support for phishlets, and JavaScript obfuscation. As Evilginx continues to mature, identifying its phishing URLs will only become more challenging." Fraudulent Gambling Network Shows Signs of APT Operation Last month, researchers from security firm Malanta disclosed details of a sprawling infrastructure spanning more than 328,000 domains and subdomains, including over 236,000 gambling-related domains, that has been active since at least 2011 and is likely a dual operation run by a nation-state-sponsored group targeting victims in the U.S., Europe, and Southeast Asia. The network, primarily used to target Indonesian-speaking visitors, is assessed to be part of a larger operation that includes thousands of gambling domains, malicious Android applications, hijacking of domains and subdomains hosted on cloud services, and stealth infrastructure embedded inside enterprise and government websites worldwide, researchers Yinon Azar, Noam Yitzhack, Tzur Leibovitz, and Assaf Morag said. "Blending illegal gambling, SEO manipulation, malware distribution, and highly persistent takeover techniques, this campaign represents one of the largest and most complex Indonesian-speaking, well-funded, state-sponsored-level ecosystems observed to date," Malanta said. The activity involves systematic exploitation of WordPress, PHP components, dangling DNS, and expired cloud assets to hijack and weaponize trusted domains. The infrastructure has also been found to power a massive Android malware ecosystem hosted on Amazon Web Services (AWS) S3 buckets to distribute APK droppers with command-and-control (C2) and data-theft capabilities. The threat actors behind the scheme rely on social media and instant messaging platforms to advertise the gambling sites and direct users to install the Android apps. As many as 7,700 domains have been flagged containing links to at least 20 AWS S3 buckets staging the APK files (e.g., "jayaplay168.apk" or "1poker-32bit.apk"). Some aspects of the 14-year-old operation were previously highlighted by Imperva and Sucuri, with the latter tracking it as an online casino spam campaign dubbed Slot Gacor that was found hijacking existing pages on compromised WordPress websites by replacing them with casino spam pages. The longevity of the infrastructure, combined with the scale and sophistication, has raised the possibility that it's maintained by an Advanced Persistent Threat (APT) that is deeply embedded in the Indonesian cybercrime ecosystem while actively exploiting governmental virtual assets worldwide. (The story was updated after publication on January 15, 2026, to include a response from Infoblox.)

thehackernews.comJan 12, 2026extracted

27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials

Cybersecurity researchers have disclosed details of what has been described as a "sustained and targeted" spear-phishing campaign that has published over two dozen packages to the npm registry to facilitate credential theft. The activity, which involved uploading 27 npm packages from six different npm aliases, has primarily targeted sales and commercial personnel at critical infrastructure-adjacent organizations in the U.S. and Allied nations, according to Socket. "A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft," researchers Nicholas Anderson and Kirill Boychenko said. The names of the packages are listed below - adril7123 ardril712 arrdril712 androidvoues assetslush axerification erification erificatsion errification eruification hgfiuythdjfhgff homiersla houimlogs22 iuythdjfghgff iuythdjfhgff iuythdjfhgffdf iuythdjfhgffs iuythdjfhgffyg jwoiesk11 modules9382 onedrive-verification sarrdril712 scriptstierium11 secure-docs-app sync365 ttetrification vampuleerl Rather than requiring users to install the packages, the end goal of the campaign is to repurpose npm and package content delivery networks (CDNs) as hosting infrastructure, using them to deliver client-side HTML and JavaScript lures impersonating secure document-sharing that are embedded directly in phishing pages, following which victims are redirected to Microsoft sign-in pages with the email address pre-filled in the form. The use of package CDNs offers several benefits, the foremost being the ability to turn a legitimate distribution service into infrastructure that's resilient to takedowns. In addition, it makes it easy for attackers to switch to other publisher aliases and package names, even if the libraries are pulled. The packages have been found to incorporate various checks on the client side to challenge analysis efforts, including filtering out bots, evading sandboxes, and requiring mouse or touch input before taking the victims to threat-actor-controlled credential harvesting infrastructure. The JavaScript code is also obfuscated or heavily minified to make automated inspection more difficult. Another crucial anti-analysis control adopted by the threat actor relates to the use of honeypot form fields that are hidden from view for real users, but are likely to be populated by crawlers. This step acts as a second layer of defense, preventing the attack from proceeding further. Socket said the domains packed into these packages overlap with adversary-in-the-middle (AitM) phishing infrastructure associated with Evilginx, an open-source phishing kit. This is not the first time npm has been transformed into phishing infrastructure. Back in October 2025, the software supply chain security firm detailed a campaign dubbed Beamglea that saw unknown threat actors uploading 175 malicious packages for credential harvesting attacks. The latest attack wave is assessed to be distinct from Beamglea. "This campaign follows the same core playbook, but with different delivery mechanics," Socket said. "Instead of shipping minimal redirect scripts, these packages deliver a self-contained, browser-executed phishing flow as an embedded HTML and JavaScript bundle that runs when loaded in a page context." What's more, the phishing packages have been found to hard-code 25 email addresses tied to specific individuals, who work in account managers, sales, and business development representatives in manufacturing, industrial automation, plastics and polymer supply chains, healthcare sectors in Austria, Belgium, Canada, France, Germany, Italy, Portugal, Spain, Sweden, Taiwan, Turkey, the U.K., and the U.S. It's currently unknown how the attackers obtained the email addresses. But given that many of the targeted firms convene at major international trade shows, such as Interpack and K-Fair, it's suspected that the threat actors may have pulled the information from these sites and combined it with general open-web reconnaissance. "In several cases, target locations differ from corporate headquarters, which is consistent with the threat actor’s focus on regional sales staff, country managers, and local commercial teams rather than only corporate IT," the company said. To counter the risk posed by the threat, it's essential to enforce stringent dependency verification, log unusual CDN requests from non-development contexts, enforce phishing-resistant multi-factor authentication (MFA), and monitor for suspicious post-authentication events. The development comes as Socket said it observed a steady rise in destructive malware across npm, PyPI, NuGet Gallery, and Go module indexes using techniques like delayed execution and remotely-controlled kill switches to evade early detection and fetch executable code at runtime using standard tools such as wget and curl. "Rather than encrypting disks or indiscriminately destroying files, these packages tend to operate surgically," researcher Kush Pandya said. "They delete only what matters to developers: Git repositories, source directories, configuration files, and CI build outputs. They often blend this logic into otherwise functional code paths and rely on standard lifecycle hooks to execute, meaning the malware may never need to be explicitly imported or invoked by the application itself."

thehackernews.comDec 29, 2025extracted

2025’s Top Phishing Trends and What They Mean for Your Security Strategy

2025 saw a huge amount of attacker innovation when it comes to phishing attacks, as attackers continue to double down on identity-based techniques. The continual evolution of phishing means it remains one of the most effective methods available to attackers today — in fact, it’s arguably more effective than ever. Let’s take a closer look at the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026. #1: Phishing goes omni-channel We’ve been talking about the rise of non-email phishing for some time now, but 2025 was the year phishing truly went omni-channel. Although most of the industry’s data on phishing still comes from email security vendors and tools, the picture is starting to change. Roughly 1 in 3 phishing attacks detected by Push Security were delivered outside of email. There are many examples of phishing campaigns operated outside of email, with LinkedIn DMs and Google Search being the top channels we identified. Notable campaigns include: A targeted campaign against tech company Exec’s delivered via compromised accounts on LinkedIn from other employees of the same organization, framed as an investment opportunity. A campaign posing as a South American investment fund offering the opportunity to join the fund. Several malvertising campaigns capturing users searching for key search terms such as “Google Ads”, “TradingView” and “Onfido”. Phishing via non-email channels has a number of advantages. With email being the best protected phishing vector, it sidesteps these controls entirely. There’s no need to build up your sender reputation, find ways to trick content analysis engines, or hope your message doesn’t end up in the spam folder. In comparison, non-email vectors have practically no screening, your security team has no visibility, and users are less likely to anticipate possible phishing. It’s arguable that a company Exec is more likely to engage with a LinkedIn DM from a reputable account than a cold email. And social media apps do nothing to analyse messages for phishing links. (And because of the limitations of URL-based checks when it comes to today’s multi-stage phishing attacks, this would be extremely difficult even if they tried). Search engines also present a huge opportunity for attackers, whether they’re compromising existing, high reputation sites, spinning up malicious ads, or simply vibe coding their own SEO-optimised websites. This is an effective way to launch “watering hole” style attacks, casting a wide net to harvest credentials and account access that can be re-sold to other criminals for a fee, or leveraged by partners in the cybercriminal ecosystem as part of major cyber breaches (such as the recent attacks by the “Scattered Lapsus$ Hunters” criminal collective, all of which began with identity-based initial access). Check out the latest webinar from Push Security on December 17th to learn how phishing has evolved in 2025, as Push researchers break down the most interesting attacks they’ve dealt with in the field, and what security teams need to prepare for phishing in 2026. Register Now #2: Criminal PhaaS kits dominate The vast majority of phishing attacks today use a reverse proxy. This means they are capable of bypassing most forms of MFA because a session is created and stolen in real time as part of the attack. There is no downside to this approach compared to the basic credential phishing that was the norm more than a decade ago. These Attacker-in-the-Middle attacks are powered by criminal Phishing-as-a-Service (PhaaS) kits such as Tycoon, NakedPages, Sneaky2FA, Flowerstorm, Salty2FA, along with various Evilginx variations (nominally a tool for red teamers, but widely used by attackers). PhaaS kits are incredibly important to cybercrime because they make sophisticated and continuously evolving capabilities available to the criminal marketplace, lowering the barrier to entry for criminals running advanced phishing campaigns. This is not unique to phishing: Ransomware-as-a-Service, Credential Stuffing-as-a-Service, and many more for-hire tools and services exist for criminals to use for a fee. This competitive environment has fuelled attacker innovation, resulting in an environment in which MFA-bypass is table stakes, phishing-resistant authentication is being circumvented through downgrade attacks, and detection evasion techniques are being used to circumvent security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic. It also means that when new capabilities emerge — such as Browser-in-the-Browser — these are quickly integrated into a range of phishing kits. Some of the most prevalent detection evasion methods we’ve seen this year are: Widespread use of bot protection. Every phishing page today comes with either a custom CAPTCHA or Cloudflare Turnstile (legitimate and fake versions) designed to block web-crawling security bots from being able to analyse phishing pages. Extensive redirect chains between the initial link seeded out to the victim, and the actual malicious page hosting phishing content, designed to bury phishing sites among several legitimate pages. Multi-stage page loading performed client-side via JavaScript. This means that pages are conditionally loaded, and if conditions aren’t met, malicious content isn’t served — so the page looks clean. This also means that most of the malicious activity is happening locally, without creating web requests that can be analysed by network traffic analysis tools (e.g. web proxies). This contributes to an environment where phishing is going undetected for extended periods of time. Even when a page is flagged, it’s trivial for attackers to dynamically serve up different phishing pages from the same benign chain of URLs used in the attack. This is all to say that the old-school approach to URL blocking bad sites is becoming much harder and leaves you two steps behind attackers at all times. #3: Attackers find ways around phishing-resistant authentication (and other security controls) We already mentioned that MFA downgrade has been an area of focus for security researchers and attackers. But phishing-resistant authentication methods (i.e. passkeys) remain effective so long as the phishing-resistant factor is the only possible login factor, and there are no backup methods enabled for the account. (Though because of the logistical issues of having just one factor, this is fairly uncommon.) Equally, access control policies can be applied on larger enterprise apps and cloud platforms to reduce the risk of unauthorized access (although these can be tricky to implement and maintain without error). In any case, attackers are considering all eventualities and looking for alternative ways into accounts that are less well protected. This mainly involves attackers circumventing the standard authentication process, through techniques such as: Consent phishing: Tricking victims into connecting malicious OAuth apps into their app tenant. Device code phishing: The same as consent phishing, but authorizing through the device code flow designed for device logins that cannot support OAuth, by providing a substitute passcode. Malicious browser extensions: Tricking victims into installing a malicious extension (or hijacking an existing one) to steal credentials and cookies from the browser. Another technique that attackers are using to steal credentials and sessions is ClickFix. ClickFix was the top initial access vector detected by Microsoft last year, involved in 47% of attacks. While not a traditional phishing attack, this sees attackers socially engineer users into running malicious code on their machine, typically deploying remote access tools and infostealer malware. Infostealers are then used to harvest credentials and cookies for initial access to various apps and services. Push Security researchers have also discovered a brand new technique dubbed ConsentFix — a browser-native version of ClickFix that results in an OAuth connection being established to the target app, simply by copying and pasting a legitimate URL containing OAuth key material. This is even more dangerous than ClickFix as it is entirely browser-native — removing the endpoint detection surface (and strong security controls like EDR) from the equation entirely. And in the particular case spotted by Push, the attackers targeted Azure CLI — a first-party Microsoft app that has special permissions and can’t be restricted like third-party apps. Really, there are lots of different techniques attackers can use to take over accounts on key business applications — it’s outdated to think of phishing as being locked in to passwords, MFA, and the standard authentication flow. Guidance for security teams in 2026 To tackle phishing in 2026, security teams need to change their threat model for phishing, and acknowledge that: It’s not enough to protect email as your main anti-phishing surface Network and traffic monitoring tools aren’t keeping up with modern phishing pages Phishing-resistant authentication, even if perfectly implemented, doesn’t make you immune Detection and response is key. But most organizations have significant visibility gaps. Solving the detection gap in the browser One thing that these attacks have in common is that they all take place in the web browser, targeting users as they go about their work on the internet. That makes it the perfect place to detect and respond to these attacks. But right now, the browser is a blind-spot for most security teams. Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface. To learn more about Push, check out our latest product overview or book some time with one of our team for a live demo. Sponsored and written by Push Security.

bleepingcomputer.comDec 15, 2025extracted

Attackers have a new way to slip past your MFA

Researchers are warning about a rise in cases of attackers using Evilginx to steal session cookies among educational institutions—letting them bypass the need for a multi-factor authentication (MFA) token. Evilginx is an attacker-in-the-middle phishing toolkit that sits between you and the real website, relaying the genuine sign-in flow so everything looks normal while it captures what it needs. Because it sends your input to the real service, it can collect your username and password, as well as the session cookie issued after you complete MFA. Session cookies are temporary files websites use to remember what you’re doing during a single browsing session–like staying signed in or keeping items in a shopping cart. They are stored in the browser’s memory and are automatically deleted when the user closes their browser or logs out, making them less of a security risk than persistent cookies. But with a valid session cookie the attacker can keep the session alive and continue as if they were you. Which, on a web shop or banking site could turn out to be costly. Attack flow The attacker sends you a link to a fake page that looks exactly the same as, for example, a bank login page, web shop, or your email or company’s single sign-on (SSO) page. In reality, the page is a live proxy to the real site. Unaware of the difference, you enter your username, password, and MFA code as usual. The proxy relays this to the real site which grants access and sets a session cookie that says “this user is authenticated.” But Evilginx isn’t just stealing your login details, it also captures the session cookie. The attacker can reuse it to impersonate you, often without triggering another MFA prompt. Once inside, attackers can browse your email, change security settings, move money, and steal data. And because the session cookie says you’re already verified, you may not see another MFA challenge. They stay in until the session expires or is revoked. Banks often add extra checks here. They may ask for another MFA code when you approve a payment, even if you’re already signed in. It’s called step-up authentication. It helps reduce fraud and meets Strong Customer Authentication rules by adding friction to high-risk actions like transferring money or changing payment details. How to stay safe Because Evilginx proxies the real site with valid TLS and live content, the page looks and behaves correctly, defeating simple “look for the padlock” advice and some automated checks. Attackers often use links that live only for a very short time, so they disappear again before anyone can add them to a block list. Security tools then have to rely on how these links and sites behave in real time, but behavior‑based detection is never perfect and can still miss some attacks. So, what you can and should do to stay safe is: Be careful with links that arrive in an unusual way. Don’t click until you’ve checked the sender and hovered over the destination. When in doubt, feel free to use Malwarebytes Scam Guard on mobiles to find out whether it’s a scam or not. It will give you actionable advice on how to proceed. Use up-to-date real-time anti-malware protection with a web component. Use a password manager. It only auto-fills passwords on the exact domain they were saved for, so they usually refuse to do this on look‑alike phishing domains such as paypa1[.]com or micros0ft[.]com. But Evilginx is trickier because it sits in the middle while you talk to the real site, so this is not always enough. Where possible, use phishing-resistant MFA. Passkeys or hardware security keys, which bind authentication to your device are resistant to this type of replay. Revoke sessions if you notice something suspicious. Sign out of all sessions and re-login with MFA. Then change your password and review account recovery settings. Pro tip: Malwarebytes Browser Guard is a free browser extension that can detect malicious behavior on web sites. Let’s face it, an incognito window can only do so much. Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.

malwarebytes.comDec 3, 2025extracted

Evilginx’s creator reckons with the dark side of red-team tools

Evilginx’s creator reckons with the dark side of red-team tools Kuba Gretzky wanted to make the internet safer. Instead, he helped make it more dangerous. In 2017, from his home in Poland, the coder released a hacking tool called Evilginx – a program designed to help cybersecurity teams understand and defend against phishing attacks. It was meant as a teaching device, a way for companies to see how easily credentials could be stolen and to shore up their defenses before someone else did it for real.But once Evilginx went public, the line between defense and offense blurred. Hackers began using it to break into networks, steal passwords and sell access. Before long, even nation-state actors were folding Gretzky’s code into their operations. At the center of the story is one of cybersecurity’s oldest paradoxes: The same code that helps protect systems can also be turned against them. It’s the open-source dilemma at internet scale, where “ethical” and “criminal” hacking are separated not by the software itself, but by whoever’s sitting at the keyboard. When asked if he ever feels like Dr. Frankenstein, Gretzky chuckles. The comparison fits. Frankenstein created a monster he couldn’t control; Gretzky created code that escaped its laboratory. “The bad guys started using it,” Gretzky says, “to do evil.” From gamer to red teamer Long before Evilginx, Gretzky spent long nights in front of his computer, playing massively multiplayer online games — the kind where strangers from around the world battle in virtual forests. The problem, he came to believe, was that when he logged off, his character stopped accumulating points; and he wondered whether he could find a way to have the game just keep playing without him. So he reverse-engineered its code and built a bot that could do the work automatically — slaying monsters, gathering loot, leveling up while he slept. And all these years later he says it was never about money — it was about curiosity. That impulse — to take things apart and see how they worked — eventually led him into cybersecurity. He became an offensive-security developer, building tools for “red teams,” the ethical hackers hired to break into systems before criminals do so companies can patch their network vulnerabilities. Kuba Gretzky speaks with the Click Here podcast team. Image: Recorded Future News It turns out Evilginx was his most ambitious creation. It could quietly intercept the text messages or app notifications that make up multi-factor authentication — that extra step protecting online accounts. The software acted as a kind of digital pickpocket, grabbing a user’s session token mid-air and handing it to whoever controlled the proxy. To Gretzky, it was a teaching tool. If he could build something that bypassed multi-factor authentication, he reasoned, so could someone else. By showing how easy it was, companies would be forced to strengthen their systems. So in 2017, he made Evilginx open-source. Anyone could download it. Within weeks, attackers did. Unintended consequences By late 2023, the tool was everywhere. A hacking collective called Scattered Spider had used it. The group is known for breaching MGM Resorts, making hotel keycards fail and freezing up slot machines. Guests couldn’t check in or cash out. The company reported losses of more than $100 million. Investigators linked Scattered Spider to Russian ransomware gangs. Another group — a Russian espionage gang known as Void Blizzard or Laundry Bear — used Evilginx to target NGOs and defense contractors supporting Ukraine. “That was a pretty … not fun … thing to read,” Gretzky admitted. For a Polish coder whose country still bears the scars of Russian occupation, the revelation cut deep. “I would never want to aid this country,” he says. “We have a bad history with what Russia is capable of.” To blunt the damage, Gretzky offered a scaled-back public version of Evilginx available on GitHub. He removed its most dangerous features and inserted digital “Easter eggs” — bits of code that allow researchers to spot when Evilginx is being used in the wild. The public release, he said, was like a family recipe with one ingredient missing. The full version, called Evilginx Pro, is sold privately to vetted security firms. Gretzky personally screens buyers to confirm they work for legitimate companies. Still, the free version remains online, and the decision to put it there continues to weigh on him. “I know that I’m basically, by proxy, aiding the bad guys,” he says. “But I also want to support people who can’t afford the private version, to help them strengthen their defenses.” Ironically, Evilginx has also driven improvements across the industry. Engineers at Google contacted Gretzky after his release, seeking advice on hardening their authentication systems. He believes the openness of tools like his ultimately makes the internet safer. “Otherwise,” he says, “people would just be sitting in the dark, waiting for attacks to happen without anyone knowing the technique is out there.” Seven years later, Evilginx still straddles the line between innovation and threat — a living example of what happens when transparency collides with opportunism. Gretzky remains convinced that shining a light on flaws is better than pretending they don’t exist, even if that light sometimes spills into the wrong places. Security, he says, isn’t one person’s responsibility. It’s a chain — from the coder to the company to the person who clicks the link. And every link in that chain has to hold. Dina Temple-Raston is the Host and Managing Editor of the Click Here podcast as well as a senior correspondent at Recorded Future News. She previously served on NPR’s Investigations team focusing on breaking news stories and national security, technology, and social justice and hosted and created the award-winning Audible Podcast “What Were You Thinking.”

therecord.mediaOct 20, 2025extracted

Why You Need Phishing Resistant Authentication NOW., (Tue, Sep 16th)

The recent (and still ongoing) phishing of NPM developer accounts showed yet again that even technically sophisticated and aware users are falling for phishing lures. Anybody will fall for phishing if a well-targeted e-mail is used. All it took for the NPM phish to succeed was a well-written email and a convincing landing page. This case used "npmjs.help", but a few days later, someone also registered "npmjs.cam" (the TLD is .CAM, not .COM, a somewhat underused phishing trick). Luckily, npmjs.cam is currently not reachable: So if even experienced developers fall for these tricks, how do we protect people like HR, or worse, our sales team? More click-through security awareness training? Instructing them "not to click on links"? Or... triple-factor authentication? Training has been shown to be ineffective at best, and will not prevent the sales team from opening an updated commission schedule in panic [1][2]. If users are not supposed to click on a link, then why are we not just removing them at your mail gateway (instead of replacing them with a wrapper)? The real solution lies in how we authenticate, and it is not about multiple factors. Multifactor authentication addresses a different problem: Part of the authentication secrets may be compromised. Sophisticated, successful phishing may compromise all factors. Phishing works because users are unable to reliably identify websites. URLs and TLS certificates are technical means that identify websites, but they are not suitable for identification by most humans. It is too easy to come up with a look-alike domain, and often that isn't even needed. Multi-factor authentication does not work as an attacker may pass-through credentials, as implemented in tools like evilginx, asking the user to provide all the necessary authentication parameters. The only way to protect from tools like this is to not have the user in charge of selecting the right credentials. Any authentication mechanism that requires the user to make a decision as to what credential to use for a particular website is not fundamentally phishing-resistant. The simplest form of a "more phishing-resistant" authentication scheme is a password manager. Password managers are pretty good at figuring out which website a user is currently visiting and what credentials to use. Of course, users are often able to overwrite this decision, leading to phishing. A better way is cryptography, which only makes particular credentials accessible to specific sites. For example, Passkeys. Passkeys are selected automatically based on the origin of the site the user attempts to log in to. It is not possible for the user to select different credentials, ensuring phishing safety. TLS client certificates could work as well, but are technically more complex to properly implement and, as a result, not practical for most public sites. NIST in publication 800-63B specifically states: "Phishing resistance requires single- or multi-factor cryptographic authentication. Authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant because the manual entry does not bind the authenticator output to the specific session being authenticated." This defines popular authentication methods, like Microsoft's authenticator-based MFA, as not phishing-resistant. So in short: Stop blaming the user and instead get working on Passkeys for any site that you believe needs a little bit extra security. [1] https://arxiv.org/html/2506.19899v2 [2] https://cs.uchicago.edu/news/new-study-reveals-gaps-in-common-types-of-cybersecurity-training/ [3] https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63B-4.pdf -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|

isc.sans.eduSep 16, 2025extracted

Threat Actor Accidentally Exposes AI-Powered Operations

A threat actor has unintentionally revealed their methods and day-to-day activities after installing Huntress security software on their own operating machine. The unusual incident gave analysts a remarkable inside look into how attackers use artificial intelligence (AI), research tools and automation to refine their workflows. Inside The Attacker’s Workflows According to Huntress, the actor discovered the company through a Google advertisement while searching for security solutions. After starting a free trial and downloading the agent, their activities were logged in detail. Investigators were able to confirm the adversary’s identity through a previously known machine name and browser history, which showed active targeting behavior. Over the course of three months, Huntress observed the actor testing multiple security tools, adopting workflow automation platforms such as Make.com, and researching Telegram Bot APIs to streamline operations. The data also revealed an interest in AI-driven text and spreadsheet generators for crafting phishing messages and managing stolen information. The collected intelligence revealed several key behaviors: Use of Censys to search for active Evilginx servers Research into residential proxy services like LunaProxy and Nstbrowser to disguise traffic Reconnaissance on financial institutions, software providers and real estate firms Extensive reliance on Google Translate for phishing message preparation The actor also accessed dark web forums, such as STYX Market, browsed malware repositories and attempted to leverage the ROADtools Token eXchange for identity-related attacks. Lessons for Cyber Defenders Huntress analysts linked the adversary’s infrastructure, hosted on the Canadian provider VIRTUO, to at least 2471 compromised identities over two weeks. Many attempts were stopped by existing detections, including malicious mail rule creation and token theft defenses. “This incident gave us in-depth information about the day-to-day activities of a threat actor,” Huntress researchers explained. “From the tools they were interested in, to the ways they conducted research and approached different aspects of attacks.” The case highlights how mistakes by attackers can provide defenders with rare insight into adversarial tradecraft, offering valuable lessons for improving response strategies and detection accuracy.

infosecurity-magazine.comSep 9, 2025extracted

⚡ Weekly Recap: WhatsApp 0-Day, Docker Bug, Salesforce Breach, Fake CAPTCHAs, Spyware App & More

Cybersecurity today is less about single attacks and more about chains of small weaknesses that connect into big risks. One overlooked update, one misused account, or one hidden tool in the wrong hands can be enough to open the door. The news this week shows how attackers are mixing methods—combining stolen access, unpatched software, and clever tricks to move from small entry points to large consequences. For defenders, the lesson is clear: the real danger often comes not from one major flaw, but from how different small flaws interact together. ⚡ Threat of the Week WhatsApp Patches Actively Exploited Flaw — WhatsApp addressed a security vulnerability in its messaging apps for Apple iOS and macOS that it said may have been exploited in the wild in conjunction with a recently disclosed Apple flaw in targeted zero-day attacks. The vulnerability, CVE-2025-55177 relates to a case of insufficient authorization of linked device synchronization messages. The Meta-owned company said the issue "could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device." It also assessed that the shortcoming may have been chained with CVE-2025-43300, a vulnerability affecting iOS, iPadOS, and macOS, as part of a sophisticated attack against specific targeted users. WhatsApp said it sent in-app threat notifications to less than 200 users who may have been targeted as part of the spyware campaign. Level Up Your Auth for Not Only Your Users, But Also Your AI Agents Auth0 provides robust security and gives you control over the user experience, from sign-up flows to advanced authorization. Learn More ➝ 🔔 Top News U.S. Treasury Continues to Hit IT Worker Scheme with Sanctions — The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned a fraudulent IT worker network linked to the Democratic People's Republic of Korea (DPRK). This included Vitaliy Sergeyevich Andreyev, a Russian national who facilitated payments to Chinyong Information Technology Cooperation Company (Chinyong), also known as Jinyong IT Cooperation Company, which was sanctioned by OFAC and South Korea’s Ministry of Foreign Affairs (MOFA) in May 2023. Also included in the designation were Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd., and Korea Sinjin Trading Corporation. These actors were designated for their involvement in schemes that funnel DPRK IT worker-derived revenue to support DPRK weapons of mass destruction and ballistic missile programs. The cryptocurrency wallet linked to Andreyev has "received over $600,000 of payments and has source exposure back to the Atomic Wallet exploit of June 2023," which was attributed to the Lazarus Group, per Elliptic. The designation builds upon other actions OFAC has taken to disrupt the DPRK's IT worker schemes. Critical Docker Flaw Patched — Users of Docker Desktop on Windows and Mac are urged to upgrade to the latest version to patch a critical vulnerability that could allow an attacker to break the container isolation layer and potentially take over the host system. The vulnerability (CVE-2025-9074) stems from the fact that Docker Desktop exposes the Docker Engine API, which can be used to control Docker containers over a TCP socket without any authentication. As a result of this flaw, an attacker who gains access to a Docker container could leverage the API to create a new Docker container and mount the operating system's file system, gaining access to sensitive information or overwriting system-critical files, resulting in arbitrary code execution. However, mounting the file system administrator works only on Windows, as attempting this process on macOS would prompt the user for permission. Also, on macOS, Docker doesn't run with administrator privileges like it does on Windows. Critical Sectors Targeted by MixShell — Cybercriminals have targeted dozens of critical U.S. manufacturers and supply-chain companies, looking to steal sensitive data and deploy ransomware. The activity, dubbed ZipLine, dates back to the beginning of May 2025. Instead of emailing a malicious link in an unsolicited email, the miscreants initiate contact through the organization's public "Contact Us" form under the guise of partnership inquiries or other business pretexts, tricking the victim into starting the conversation and allowing the attackers to bypass email filters. The attacks led to the deployment of a stealthy implant called MixShell. By using website contact forms, the attack flips the phishing playbook by getting victims to make the first email contact with the attacker rather than the other way around. Salesforce Instances Targeted via Salesloft Drift — A threat activity cluster has committed a spate of data breaches of organizations' Salesforce instances by compromising OAuth tokens associated with the Salesloft Drift third-party application. UNC6395 has been carrying out a "widespread data theft" campaign by targeting Salesforce instances beginning as early as August 8 through at least August 18. UNC6395 "systematically exported large volumes of data from numerous corporate Salesforce instances" for the purpose of harvesting sensitive credentials, such as Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens. Once these credentials were exfiltrated, "the actor then searched through the data to look for secrets that could be potentially used to compromise victim environments," and then covered its tracks by deleting query jobs. Storm-0501 Linked to Cloud Extortion Attacks — Storm-0501 has sharpened its ransomware tactics by exploiting hijacked privileged accounts to move seamlessly between on-premises and cloud environments, exploiting visibility gaps to encrypt data and exfiltrate sensitive data, and carry out mass deletions of cloud resources, including backups. The threat actor checked for the presence of security software, suggesting a deliberate effort to avoid detection by targeting non-onboarded systems. The attackers also conducted reconnaissance activities to gain deep visibility into the organization’s security tooling and infrastructure. This evolution signals a technical shift and a change in impact strategy. Instead of just encrypting files and demanding ransom for decryption, Storm-0501 exfiltrates sensitive cloud data, destroys backups, and then extorts victims by threatening permanent data loss or exposure. UNC6384 Deploys PlugX via Captive Portal Hijack — Chinese state hackers have been hijacking captive portal checks to deliver malware couched as Adobe software. The activity, attributed to Mustang Panda, appears to have targeted Southeast Asian diplomats in particular, and other unidentified entities around the globe, between approximately March and July of this year. Around two dozen victims were likely compromised, although it's possible there were more. The trick to Mustang Panda's latest campaign involves hijacking captive portal checks to redirect users to a website under their control to distribute malware. It's believed that the hackers infected edge devices in the targets' networks, which they used to intercept the check made by the Google Chrome browser. Users who fell for the scheme ended up downloading an ostensibly innocuous binary that ultimately led to the deployment of PlugX. ShadowCapatcha Leverages ClickFix to Deliver Malware — A financially motivated campaign dubbed ShadowCaptcha is leveraging fake Google and Cloudflare CAPTCHA pages to trick victims into executing malicious commands using compromised WordPress sites as an infection vector. The attacks lead to the deployment of information stealers and ransomware, demonstrating a versatile monetization approach. The activity primarily focuses on three revenue streams: Data theft and subsequent sale, drop cryptocurrency miners, and infect machines with ransomware. This multi-pronged strategy ensures a sustained revenue generation mechanism, maximising their return on investment while also maintaining persistent access. 🔥 Trending CVEs Hackers act fast. They attack soon after a weakness is found. One missed update, a hidden error, or a forgotten security alert can let them in. A small problem can quickly turn into big trouble like stolen data or system crashes, before you even notice. Here are this week's serious risks. Check them, fix them fast, and stay safe before attackers do. This week's list includes — CVE-2025-55177 (WhatsApp), CVE-2025-34509, CVE-2025-34510, CVE-2025-34511 (Sitecore Experience Platform), CVE-2025-57819 (FreePBX), CVE-2025-26496 (Tableau Server), CVE-2025-54939 (LSQUIC QUIC), CVE-2025-9118 (Google Cloud Dataform API), CVE-2025-53118 (Securden Unified PAM), CVE-2025-9478 (Google Chrome), CVE-2025-50975 (IPFire 2.29), CVE-2025-23307 (NVIDIA NeMo Curator), CVE-2025-20241 (Cisco Nexus 3000 and 9000 Series switches), CVE-2025-20317 (Cisco Integrated Management Controller), CVE-2025-20294, CVE-2025-20295 (Cisco Unified Computing System Manager), CVE-2025-54370 (PhpSpreadsheet), CVE-2025-39245, CVE-2025-39246, CVE-2025-39247 (Hikvision HikCentral), CVE-2025-49146, CVE-2025-48976, CVE-2025-53506, CVE-2025-52520 (Atlassian), CVE-2025-50979 (NodeBB), and CVE-2025-8067 (Linux UDisks daemon). 📰 Around the Cyber World Microsoft RDP services Targeted by Malicious Scans — Microsoft's Remote Desktop Protocol (RDP) services have been hit with a torrent of malicious scans from tens of thousands of IP addresses in recent days, indicating a coordinated reconnaissance campaign. "The wave's aim was clear: test for timing flaws that reveal valid usernames, laying the groundwork for credential-based intrusions," GreyNoise said. The activity took place over two waves on August 21 and 24, with thousands of unique IP addresses simultaneously probing both Microsoft RD Web Access and Microsoft RDP Web Client authentication portals. Flaw in TheTruthSpy Spyware — A vulnerability in TheTruthSpy spyware app can allow bad actors to take over any account and retrieve collected victim data. The vulnerability exploits an issue with the app's password recovery process to change the password of any account. TheTruthSpy told TechCrunch it can't fix the bug because it "lost" the app's source code. Russia's Max App Logs User Activity — The Russian government's WhatsApp rival, Max, is constantly monitoring and logging all user activity. According to Corellium's technical analysis, the app doesn't use encryption and tracks user location in real-time and with high accuracy. Developed by Russian tech giant VK, the app has been made mandatory and must be installed on all mobile devices sold in Russia after September 1, 2025. The app was initially launched earlier this March. OpenSSH's PQC Play — OpenSSH said it will start showing warnings when users connect to an SSH server that does not have post-quantum cryptography protections starting with OpenSSH 10.1. "The ideal solution is to update the server to use an SSH implementation that supports at least one of these," the maintainers said. "OpenSSH versions 9.0 and greater support sntrup761x25519-sha512 and versions 9.9 and greater support mlkem768x25519-sha256. If your server is already running one of these versions, then check whether the KexAlgorithms option has disabled their use." Credential Harvesting Campaign Targets ScreenConnect Super Admin Accounts — A low-volume campaign is targeting ScreenConnect cloud administrators with fake email alerts warning about a potentially suspicious login event with the goal of stealing their credentials for potential ransomware deployment. The activity, ongoing since 2022, has been attributed by Mimecast to MCTO3030. "The campaign employs spear phishing emails delivered through Amazon Simple Email Service (SES) accounts, targeting senior IT professionals, including directors, managers, and security personnel with elevated privileges in ScreenConnect environments," the company said. "The attackers specifically seek super administrator credentials, which provide comprehensive control over remote access infrastructure across entire organizations." The attackers are using the open source Evilginx framework to provision these phishing pages and to act as a reverse proxy between the victim and the real site. The framework can capture both login credentials and session cookies. More ScreenConnect-Themed Campaigns Discovered — Another campaign has leveraged phishing emails with fake Zoom meeting invitations and Microsoft Teams calls to lead victims to malicious links that download the ScreenConnect software. "The weaponization of a legitimate IT administration tool – one designed to grant IT professionals deep system access for troubleshooting and maintenance – combined with social engineering and convincing business impersonation creates a multi-layered deception that provides attackers with the dual advantage of trust exploitation and security evasion," Abnormal AI said. The campaign has so far targeted more than 900 organizations, impacting a broad range of sectors and geographies. A separate campaign has also been observed using fake AI-themed content to lure users into executing a malicious, pre-configured ScreenConnect installer, which then acts as an entry point for the XWorm malware, per Trustwave. In a related development, attackers have been observed weaponizing Cisco's secure links ("secure-web.cisco[.]com") in credential phishing campaigns to evade link scanning and by-pass network filters. "Attackers compromise or create accounts within Cisco-protected organizations," Raven AI said. "They simply email themselves malicious links, let Cisco's system rewrite them into Safe Links, then harvest these URLs for their campaigns." A similar campaign exploiting Proofpoint links was disclosed by Cloudflare in July 2025. TRM Labs Warns of Scam Campaign Impersonating the Firm — Blockchain intelligence company said it's aware of individuals using false domains to impersonate TRM Labs and/or government agencies working in collaboration with TRM Labs. "These are not TRM Labs domains, and the actors behind these are scammers," the company said. "TRM Labs is not involved in fund recovery processes for victims and does not partner with government agencies for the purposes of fund recovery. Unfortunately, these types of scams deliberately target vulnerable people, often when they’re financially vulnerable, having potentially already lost funds to scams." The warning comes against the backdrop of an alert issued by the U.S. Federal Bureau of Investigation (FBI), urging cryptocurrency scam victims to be on the lookout for scams where fraudsters pose as lawyers representing fictitious law firms to help them assist with fund recovery, only to deceive them a second time. New Ransomware Strains Detected — A new ransomware strain going by the name of Cephalus has been spotted in the wild. In incidents observed around mid-August 2025, the group behind the locker used compromised RDP accounts for initial access and used the cloud storage service MEGA for likely data exfiltration purposes. The development comes as the Underground and NightSpire ransomware gangs have launched ransomware attacks against companies in various countries and industries, including South Korea. In another attack analyzed by eSentire, compromised third-party MSP SonicWall SSL VPN credentials served as an initial access pathway for Sinobi, a rebrand of the Lynx ransomware. "Using the compromised account, the threat actors executed commands to create a new local administrator account, set its password, and add it to the domain administrators group," eSentire said. "Both the initial compromised account and the newly created account were subsequently used for lateral movement throughout the network." Most Active Ransomware Groups — Akira, Cl0p, Qilin, Safepay, and RansomHub were the most active ransomware groups in the first half of 2025, per Flashpoint, which found that ransomware attacks increased by 179% compared to the 2024 midyear. The development comes amid notable changes in the ransomware ecosystem, where threat actors increasingly prefer extortion over encryption and have begun to incorporate LLMs in their tooling. The landscape has also continued to splinter, with new gangs and rebrands proliferating in the wake of law enforcement takedowns. MalwareBytes said it tracked 41 newcomers between July 2024 and June 2025, with more than 60 total ransomware gangs operating at once. Microsoft to Throttle Emails to Combat Spam — Microsoft said it will begin throttling emails starting October 15, 2025. The limit will be set to 100 external recipients per organization per 24-hour rolling window. From December 1, the tech giant will start rolling out the restrictions across tenants, starting with tenants with fewer than three seats and eventually reaching tenants with more than 10,001 seats by June 2026. "Despite our efforts to minimize abuse, spammers often exploit newly created tenants to send bursts of spam from '.onmicrosoft.com' addresses before we can intervene," Microsoft said. "This degrades this shared domain’s reputation, affecting all legitimate users. To ensure brand trust and email deliverability, organizations should establish and use their own custom domains for sending email." SleepWalk, a Physical Side-Channel Attack to Leak Data — A group of academics from the University of Florida has devised a new hardware side-channel attack dubbed SleepWalk that exploits context switching and CPU power consumption to leak sensitive data like cryptographic keys. "We introduce a physical power side-channel leakage source that exploits the power spike observed during a context switch, triggered by the inbuilt sleep function of the system kernel," the researchers said. "We observed that this power spike directly correlates with both the power consumption during context switching and the residual power consumption of the previously executed program. Notably, the persistence of residual power signatures from previous workloads extends the scope of this side-channel beyond extracting the data in registers during the context switch. Unlike traditional approaches that require analyzing full power traces, applying complex preprocessing, or relying on external synchronization triggers, this novel technique leverages only the amplitude of a single power spike, significantly simplifying the attack." AI Systems Vulnerable to Prompt Injection via Image Scaling Attack — In a novel form of prompt injection attacks aimed at artificial intelligence (AI) chatbots, attackers can hide malicious instructions inside large-scale images and have the prompts execute when the AI agent downscales them. The attacker's prompt is invisible to the human eye in the high-resolution image, but shows up when the image is downscaled by preprocessing algorithms. "This attack works because AI systems often scale down large images before sending them to the model: when scaled, these images can reveal prompt injections that are not visible at full resolution," Trail of Bits said. The cybersecurity company has released an open-source tool called Anamorpher to generate such crafted images. Social Media Accounts Launder News from Chinese State Media Sites — A network of 11 domains and 16 companion social media accounts across Facebook, Instagram, Mastodon, Threads, and X has been found laundering exclusively English-language articles originally published by the Chinese state media outlet CGTN. "The assets almost certainly used AI tools to translate and summarize articles from CGTN, likely in an attempt to disguise the content's origin," Graphika said. "The network assets disseminated primarily pro-China, anti-West content in English, French, Spanish, and Vietnamese." The findings came as the U.S. told Denmark to "calm down" over allegations of covert influence operations by U.S. citizens in Greenland to sow discord between Denmark and Greenland and to promote Greenland's secession from Denmark to the U.S. Analyzing Secret Families of VPN Apps — New research conducted by the Arizona State University and Citizen Lab has found that nearly two dozen VPN applications in Google Play contain security weaknesses impacting the privacy of their users, exposing transmitted data to decryption risks. Further analysis has determined that eight VPN applications from Innovative Connecting, Autumn Breeze, and Lemon Clove (Turbo VPN, Turbo VPN Lite, VPN Monster, VPN Proxy Master, VPN Proxy Master – Lite, Snap VPN, Robot VPN, and SuperNet VPN) share code, dependencies, outdated and unsafe encryption methods, and hard-coded passwords, potentially allowing attackers to decrypt the traffic of their users. Cumulatively, these apps have over 380 million downloads on Google Play. All three companies were found to have ties with Qihoo 360, a Chinese cybersecurity firm that the U.S. sanctioned in 2020. Security Risks in the eSIM Ecosystem — A new study undertaken by academics from Northeastern University has found that many providers associated with eSIMs route user data through foreign telecommunications networks, including Chinese infrastructure, regardless of user location. "Many travel eSIMs route user traffic through third-party infrastructure, often located in foreign jurisdictions," the researchers said. "This may expose user metadata and content to networks outside the user’s country, raising concerns about jurisdictional control and surveillance." What's more, the digital provisioning model creates new opportunities for phishing and spoofing. Malicious actors can distribute fake eSIM profiles via fraudulent QR codes or websites, tricking users into installing unauthorized configurations. ComfyUI Flaw Exploited to Deliver Pickai Backdoor — Threat actors have exploited vulnerabilities in an artificial intelligence (AI) platform called ComfyUI to deliver a backdoor called Pickai. "Pickai is a lightweight backdoor written in C++, designed to support remote command execution and reverse shell access," XLab said, adding that it "includes anti-debugging, process name spoofing, and multiple persistence mechanisms." Pickai samples have been observed hosted on the official site of Rubick.ai, a commercial AI-powered platform serving the e-commerce sector across the U.S., India, Singapore, and the Middle East. Early versions of the malware were uploaded to VirusTotal as far back as February 28, 2025. The activity has compromised nearly 700 infected servers worldwide, mainly in Germany, the U.S., and China. Flaw in LSQUIC QUIC Disclosed — Cybersecurity researchers have discovered a vulnerability dubbed QUIC-LEAK (CVE-2025-54939) in the LSQUIC QUIC implementation, allowing threat actors to smuggle malformed packets to exhaust memory and crash QUIC servers even before a connection handshake is established, thereby bypassing QUIC connection-level safeguards. The issue has been fixed in OpenLiteSpeed 1.8.4 and LiteSpeed Web Server 6.3.4. Fake Sites Pushing YouTube Downloads Serve Proxyware — Proxyware programs are being distributed through YouTube sites that allow users to download videos. Attackers who previously installed DigitalPulse and HoneyGain Proxywares are also installing Infatica Proxyware. Similar to coin miners, Proxyware malware profits by utilizing the system’s resources, and many systems in South Korea have recently become the targets of these attacks. U.S. Senator Castigates Federal Judiciary for Negligence — U.S. Senator Ron Wyden accused the federal judiciary of "negligence and incompetence" following a recent hack, reportedly by hackers with ties to the Russian government, that exposed confidential court documents. The breach of the judiciary’s electronic case filing system first came to light in a report by Politico three weeks ago, which went on to say that the vulnerabilities exploited in the hack were known since 2020. The New York Times, citing people familiar with the intrusion, said that Russia was "at least partly responsible" for the hack. "The federal judiciary’s current approach to information technology is a severe threat to our national security," Wyden wrote. "The courts have been entrusted with some of our nation's most confidential and sensitive information, including national security documents that could reveal sources and methods to our adversaries, and sealed criminal charging and investigative documents that could enable suspects to flee from justice or target witnesses." Law Enforcement Freezes $50M in Crypto Assets Tied to Romance Baiting Scams — Several cryptocurrency companies, including Chainalysis, OKX, Binance, and Tether, have come together to freeze nearly $50 million stolen via "romance baiting" scams in collaboration with APAC-based authorities. "Once funds were transferred, scammers then sent proceeds to a consolidation wallet which transferred $46.9 million in USDT [Tether] to a collection of three intermediary addresses," Chainalysis said. "The funds then moved to five different wallets." The funds were frozen by Tether in July 2024. South Korea Extradites Chinese National for Cyber Attacks — South Korean authorities have successfully extradited a 34-year-old Chinese national suspected of orchestrating one of the most sophisticated hacking operations targeting high-profile individuals and financial institutions. He is alleged to have stolen 38 billion won from financial accounts and virtual asset accounts. Anthropic and OpenAI Test Each Other's AI — OpenAI has called on AI firms to test their rivals' systems for safety, as the company and Anthropic conducted safety evaluations of each other's AI systems to tackle risks like prompt injection and model poisoning. The development came as Anthropic revealed that a cybercriminal abused its agentic AI coding tool to automate a large-scale data theft and extortion campaign, marking a "new evolution" in how AI is super-charging cybercrime. The chatbot then analyzed the companies' hacked financial documents to help arrive at a realistic amount of bitcoin to demand in exchange for not leaking the stolen material. It also wrote suggested extortion emails. "The operation demonstrates a concerning evolution in AI-assisted cybercrime, where AI serves as both a technical consultant and active operator, enabling attacks that would be more difficult and time-consuming for individual actors to execute manually," the the company said. Where years of specialized training once throttled the ability of bad actors to pull off attacks at scale, the new wave of AI-assisted cybercrime could further lower technical barriers, allowing even novices and unskilled operators to carry out complex activities with ease. Separately, Anthropic has announced a policy change to train its AI chatbot Claude with user data, giving existing users until September 28, 2025, to either opt in or opt out to continue using the service; it says it will enable the company to deliver "even more capable, useful AI models" and strengthen safeguards against harmful usage like scams and abuse. Plex Servers Susceptible to New Flaw — Plex has addressed a security vulnerability (CVE-2025-34158), stemming from incorrect resource transfer between spheres, affecting Plex Media Server versions 1.41.7.x to 1.42.0.x. It has been patched in versions 1.42.1.10060 or later. According to data from Censys, there are 428,083 devices exposing the Plex Media Server web interface, although not all of them are necessarily vulnerable. Fake Recipe and Guide Sites Drop Malware — Bogus sites masquerading as image, recipe, and educational guide finders have been found to harbor stealthy code to issue stealthy commands and drop malware on users' systems that can steal sensitive information. It’s assessed that these sites reach targets via malvertising campaigns. 🎥 Cybersecurity Webinars What Every AppSec Leader Must Learn About Code-to-Cloud Security - Modern AppSec is no longer just about spotting risks—it’s about learning how they emerge and spread from code to cloud. Without visibility across that journey, teams face blind spots, noise, and delayed fixes. Code-to-cloud context changes the game, giving security and engineering teams the clarity to learn faster, act sooner, and protect what matters most. Practical Steps to Keep AI Agents Safe from Cyberattacks - AI agents are rapidly reshaping business—automating decisions, streamlining operations, and unlocking new opportunities. But with innovation comes risk. Join our upcoming webinar with Auth0’s Michelle Agroskin to uncover the security challenges AI agents introduce and learn actionable strategies to protect your organization. Discover how to stay ahead of threats while confidently embracing the future of AI-driven innovation. From Fingerprints to Code Traces: How Experts Hunt Down Shadow AI - AI Agents are multiplying in your workflows, clouds, and business processes—often without approval. These “shadow agents” move faster than governance, fueled by hidden identities and one-click deployments. The result? Security teams are left chasing ghosts. Join our expert panel to uncover where shadow AI hides, who’s behind it, and how to take back control—without slowing down innovation. 🔧 Cybersecurity Tools PcapXray - Investigating packet captures can be slow and messy. PcapXray speeds up the process by turning raw PCAP files into clear, visual network diagrams. It highlights hosts, traffic flows, Tor usage, and potential malicious activity—helping investigators and analysts quickly see what’s happening inside the data without digging line by line. Kopia - It is an open-source backup and restore tool that creates encrypted snapshots of selected files and directories. Instead of imaging an entire machine, it lets you back up what matters most—whether to local storage, network drives, or cloud providers like S3, Azure, or Google Cloud. With built-in deduplication, compression, and end-to-end encryption, Kopia helps ensure backups are efficient, secure, and under your full control. Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards. 🔒 Tip of the Week How to Lock Down Your MCP Servers — AI tools like GitHub Copilot are getting smarter every day. With the Model Context Protocol (MCP), they can connect to outside tools and services—running code, pulling data, or even talking to internal systems. That’s powerful, but it’s also risky: if a bad actor sneaks in with a fake or compromised MCP server, your AI could be tricked into leaking secrets, exposing credentials, or executing harmful commands. The solution isn’t to avoid MCP. It’s to secure it properly. Here’s a practical way to do that using free tools. 1. Test Before You Trust: Before turning on any MCP server, run an audit. Tool to try: MCPSafetyScanner What it does: Scans MCP definitions, runs test attacks, and reports if something looks unsafe. 2. Wrap Servers with a Safety Net: Don’t expose servers directly. Add a guard layer. Tool to try: MCP Guardian (open-source prototype from research). What it does: Adds authentication, logs all activity, and blocks suspicious requests. 3. Stress-Test Like an Attacker: Simulate real-world threats to see how your setup holds up. Tool to try: MCPSecBench What it does: Launches different known MCP attack patterns and measures resilience. 4. Enforce Rules as Code: Add guardrails for what AI can and can’t do. Tools to try: Open Policy Agent (OPA) or Kyverno What they do: Define policies (e.g., “only read from X API, never write”) and enforce them automatically. 5. Go Zero-Trust on Access: Every connection should be verified and limited. Use OAuth 2.1 for authorization. Add mTLS (mutual TLS) so both client and server prove who they are. Send all logs to your SIEM (e.g., Elastic or Grafana Loki) for monitoring. AI + MCP is moving fast. The line between “helpful automation” and “security hole” is thin. By auditing, stress-testing, enforcing rules, and monitoring, you’re not just protecting against today’s risks—you’re preparing for tomorrow’s. Think of it like this: MCP gives your AI superpowers. Your job is to make sure those powers don’t get hijacked. Conclusion Quantum-safe encryption, AI-driven phishing, identity without passwords—these are not distant theories anymore. They are already shaping the security landscape quietly, underneath the day-to-day headlines. The closing lesson: the biggest shocks often arrive not as breaking news, but as trends that grow slowly until suddenly they cannot be ignored.

thehackernews.comSep 1, 2025extracted

ScreenConnect admins targeted with spoofed login alerts

ScreenConnect admins targeted with spoofed login alerts ScreenConnect cloud administrators across all region and industries are being targeted with fake email alerts warning about a potentially suspicious login event. The goal of the attackers is to grab the login credentials and MFA tokens of Super Admins: users who have full control over their organization’s ScreenConnect deployment. The campaign ScreenConnect, by US company ConnectWise, is a popular remote support and access solution tailored for IT departments and managed service providers (MSPs). The platform can be hosted by ConnectWise (in their cloud) or self-hosted by organizations (on-prem or in their own private cloud). The attack campaign spotted by Mimecast is a low-volume spear-phishing operation. The emails are sent from Amazon Simple Email Service accounts to senior IT professionals with elevated privileges in ScreenConnect environments. The spoofed ScreenConnect alert (Source: Mimecast) If the recipient falls for the ruse, they are taken to a legitimate-looking login portal using ConnectWise / ScreenConnect branding. The attackers are using the open source EvilGinx framework to provision these phishing pages and to act as as a reverse proxy between the victim and the real site (in this case, the organization’s ScreenConnect portal). The framework can capture both login credentials and session cookies. The latter are necessary if the attackers want to skirt the protection provided by multi-factor authentication (MFA). Advice for potential targets “What makes this campaign particularly concerning is its apparent connection to ransomware operations. [Previous] research from Sophos indicates similar ScreenConnect targeting by Qilin ransomware affiliates, suggesting these credential harvesting activities serve as initial access vectors for subsequent ransomware deployment,” Mimecast researchers warn. “The harvested super admin credentials enable attackers to push malicious ScreenConnect clients or instances to multiple endpoints simultaneously, facilitating rapid lateral movement and ransomware distribution.” Managed service providers are likely a coveted target, as they offer support to many other businesses. Attackers can use the gained access to “reach” into those organizations and deploy ransomware to many organizations without having to work on compromising each of them separately. Organizations should conduct targeted training for IT staff on ScreenConnect-themed phishing campaigns, Mimecast advises, and: Deploy conditional access policies restricting ScreenConnect admin access to organization-managed devices Implement phishing-resistant MFA methods for ScreenConnect accounts Enable comprehensive logging for ScreenConnect authentication events and admin activities Monitor for unusual admin activities, including new client deployments or configuration changes. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

helpnetsecurity.comAug 25, 2025extracted

New downgrade attack can bypass FIDO auth in Microsoft Entra ID

Security researchers have created a new FIDO downgrade attack against Microsoft Entra ID that tricks users into authenticating with weaker login methods, making them susceptible to phishing and session hijacking. These weaker login channels are vulnerable to adversary-in-the-middle phishing attacks that employ tools like Evilginx, enabling attackers to snatch valid session cookies and hijack the accounts. Although the attack doesn't prove a vulnerability in FIDO itself, it shows that the system can be bypassed, which is a crucial weakness. This is especially worrying considering the increased adoption of FIDO-based authentication in critical environments, a consequence of the technology being touted as extremely phishing-resistant. FIDO passkeys are a passwordless authentication method based on the FIDO2 and WebAuthn standards, designed to eliminate the weaknesses of passwords and traditional multi-factor authentication (MFA). When a user registers a passkey, their device generates a pair of keys (private + public), which are used for solving a random, unique challenge during login onto online services, verifying the user's identity. As only the user's device holds the correct private key, which isn't transmitted anywhere during the login process, there's nothing phishing actors can intercept. Downgrading and bypassing FIDO The new downgrade attack created by Proofpoint researchers employs a custom phishlet within the Evilginx adversary-in-the-middle (AiTM) framework to spoof a browser user agent that lacks FIDO support. Specifically, the researchers spoof Safari on Windows, which is not compatible with FIDO-based authentication in Microsoft Entra ID. "This seemingly insignificant gap in functionality can be leveraged by attackers," explains Proofpoint researcher Yaniv Miron. "A threat actor can adjust the AiTM to spoof an unsupported user agent, which is not recognized by a FIDO implementation. Subsequently, the user would be forced to authenticate through a less secure method. This behavior, observed on Microsoft platforms, is a missing security measure." When the target clicks a phishing link delivered via email, SMS, or an OAuth consent prompt, they are directed to a phishing site running the custom phishlet. As this is an AiTM attack, the legitimate Microsoft Entra ID form is proxied by the phishing platform and shown to the targeted user. Because the phishlet spoofs an unsupported browser user agent, Microsoft Entra ID turns off FIDO authentication and instead returns an error. This error prompts the user to choose an alternate verification fallback method, such as the Microsoft Authenticator app, SMS code, or OTP. If the user uses one of the alternative methods, the AiTM proxy intercepts both their account credentials and the MFA token or session cookie. The attacker then imports the stolen cookie into their own browser, granting full access to the victim's account, which was theoretically phishing-resistant. Proofpoint says it has observed no cases of this technique being used by hackers in the wild yet, as threat actors still focus on easier targets such as accounts lacking MFA protection. Still, the risk is significant, especially in limited, highly targeted attacks. To mitigate risks from this emerging threat, consider turning off fallback authentication methods for your account or activating additional checks and confirmations when such processes are triggered. If a login process suddenly asks for a different method instead of a registered passkey, it's a red flag, and users should abort and verify via official, trusted channels. In July, Expel researchers presented a different FIDO downgrade attack dubbed 'PoisonSeed,' where a phishing site stole the target's credentials and initiated a cross-device authentication flow, generating a QR code on the real service's login page, tricking the target to scan it to approve a login request from a rogue device. Although the concept was interesting, the researchers later discovered that it was practically infeasible due to proximity requirements, which led to the fraudulent authentication requests failing. Update 8/15/25: Microsoft shared the following statement regarding Proofpoint's research. "The campaign is not the result of a product vulnerability and - instead - relies on a targeted phishing attack. This social engineering technique requires an attacker to convince a user to click on a malicious link, leading to an unsafe site," a Microsoft spokesperson told BleepingComputer. "We recommend customers deploy phishing-resistant authentication methods, enforced by Conditional Access authentication strength, which prevents this type of attack. We encourage customers practice good computing habits online including exercising caution when clicking on links to unknown web pages." Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comAug 13, 2025extracted

Cybercriminals are getting personal, and it’s working

Cybercriminals are getting personal, and it’s working Cybercriminals are deploying unidentifiable phishing kits (58% of phishing sites) to propagate malicious campaigns at scale, indicating a trend towards custom-made or obfuscated deployments, according to VIPRE Security. These phishing kits can’t easily be reverse-engineered, tracked, or caught. AI makes them affordable, too. Among the most prevalent are Evilginx (20%), Tycoon 2FA (10%), 16shop (7%), with another 5% attributed to other generic kits. Manufacturing is the top target sector For the sixth quarter in a row, the manufacturing sector remains the prime target for cybercriminals. In Q2 2025, manufacturers faced the highest volume of email-based attacks, 26% of all incidents, encompassing BEC, phishing, and malspam threats. Retail follows, accounting for 20% of attacks, with healthcare close behind at 19%, reflecting a consistent trend observed since last year and through Q1 2025. According to the 2025 Verizon Data Breach Investigations Report, phishing was the entry point in 16% of cases. Credential theft led with 22%, followed by vulnerability exploitation at 20%. While phishing may not be the top method on paper, it often plays a major role in how attackers steal credentials in the first place. This means its impact is larger than it may appear. By focusing on reducing email-based threats, manufacturers could lower their overall risk of cyber compromise. BEC targets Scandinavia Scandinavian countries, known for their sophisticated economies and digital infrastructures, have become prime targets for business email compromise (BEC) attacks. Cybercriminals are increasingly focusing on executives in this region, leveraging language and localisation for greater effectiveness. While English-speaking executives remain the most targeted for BEC emails (42%), a significant portion are Danish (38%), with the Swedish and Norwegian comprising a combined 19%. The strategic use of Danish, Swedish, and Norwegian languages in BEC scams highlights a growing trend toward regional targeting. Although English proficiency is high in Scandinavia, critical corporate communications, especially within HR, finance, and executive teams, often take place in native languages, making localised attacks more convincing. Impersonation is the most common technique used in BEC scams, with 82% of attempts targeting CEOs and executives. The remaining impersonation efforts are aimed at directors and managers, HR personnel, IT staff, and school heads. Malware family of the quarter Lumma Stealer is the most encountered malware family found in the wild during Q2. Analysis shows that it is often delivered via malicious .docx, .html, or .pdf attachments, or through phishing links hosted on compromised or legitimate-looking cloud services such as OneDrive, and Google Drive. Lumma Stealer is sold as Malware-as-a-Service (MaaS), making it accessible to a broad range of cybercriminals. With active developer support and low cost, it is proving attractive to both novices and experienced cybercriminals. How attackers lure us in? Financial lures representing 35% of the samples, emails regarding money, financial errors, fiduciary imperatives, and such, are the number one ploy used by cybercriminals to get users to open malicious emails. Urgency-based messaging is the second most tried approach, followed by account verification and updates, travel-themed messages, package delivery, and legal or HR notices. For phishing delivery, 54% of cybercriminals leveraged open redirect mechanisms, with legitimate-looking links hosted on marketing services, email tracking systems, and even security platforms to mask the true malicious destination. Compromised websites (30%) are the next most prevalent link delivery method, followed by the use of URL shorteners (7%). While PDFs (64%) remain the preferred vehicle for delivering malicious attachments, an increasing number now feature embedded QR codes designed to carry out attacks. Finally, cybercriminals are finishing off their attacks with various exploitation mechanisms, the most observed being HTTP POST to remote server accounting (52%) and email exfiltration (30%). “Threat actors are outsmarting humans through hyper-personalised phishing techniques using the capability of AI and deploying at scale,” said Usman Choudhary, Chief Product and Technology Officer, VIPRE Security Group.

helpnetsecurity.comAug 7, 2025extracted

Pro-Iran Hackers Aligned Cyber with Kinetic War Aims

A new report has laid bare the sudden surge in cyber-threat activity from pro-Iran hacking groups which accompanied the 12-day war against Israel earlier this summer. SecurityScorecard said it analyzed 250,000 Telegram messages to uncover various activity including intelligence gathering, propaganda and direct attacks on critical infrastructure and public entities. This came from a diverse set of groups, including state-backed hackers, proxies and looser collectives of “ideologically aligned hacktivists” supporting Iran’s war aims. Among these activities were: Pro-Iran propaganda across at least 178 Telegram groups which blended “ideologically driven messaging with coordinated cyber-operations.” Channels included “Islamic Hacker Army group,” “Resistance Toast” and “Al-Qassam Toast” DDoS campaigns, phishing operations and data dumps “under the banner of local grievance narratives” from Palestinian-linked hacktivists Cyber Islamic Resistance and Cyber Fattah team, Afghanistan’s Fatimion cyber team, Tunisia’s Maskers Cyber Force and Islamic outfits like Islamic Hacker Army group and sharp333 Web defacement and DDoS by pro-Iran hacktivists Fatimion Cyber Team Data theft and dumping of thousands of records including PII from the Saudi Games by state-aligned cyber-resistance group Cyber Fattah team. This was achieved by scanning for and exploiting web vulnerabilities Website defacements, service disruptions, propaganda broadcasts and “morale messaging” from hacktivist group Cyber Islamic Resistance Website defacements, data exfiltration operations and the sale of zero-day vulnerabilities by financially motivated collective Tunisian Maskers Cyber Force State-Backed APT Strikes This activity came alongside more traditional state-sponsored attacks by APT group Tortoiseshell (aka Cuboid Sandstorm, Yellow Liderc and Imperial Kitten). “Only a few days after the conflict between the two nations flared, the actor began purchasing domain names from NameCheap that revolve around themes of the conflict, such as nowsupportisrael[.]com, supportisraelfunding[.]com or stoprirannukes[.]com. The actor then purchased a few virtual servers to host their domain,” SecurityScorecard explained. “The threat actor used these VPSs alongside the Evilginx phishing framework, to lure Hebrew speaking victims with petition forms offering support for Israel while focusing on the October 7th attack, when Hamas attacked Israel in 2023.” The group then deployed the RemCosRAT remote access Trojan malware to selected targets. The report claimed threat actors in this conflict displayed varying degrees of sophistication and alignment with the Islamic Revolutionary Guard Corps (IRGC). “Understanding the difference between state-sponsored and opportunistic groups is crucial for making sense of increasingly complex and interlinked cyber and kinetic conflicts,” it said. “Key recommendations include emphasizing employee awareness to the dangers of phishing and social engineering at times of conflict and asking your security vendors to assess whether your organization might fall within the scope of a targeted camp.”

infosecurity-magazine.comAug 5, 2025extracted

How attackers are still phishing "phishing-resistant" authentication

As awareness grows around many MFA methods being “phishable” (i.e. not phishing resistant), passwordless, FIDO2-based authentication methods (aka. passkeys) like YubiKeys, Okta FastPass, and Windows Hello are being increasingly advocated. This is a good thing. The most commonly used MFA factors (like SMS codes, push notifications, and app-based OTP) are routinely bypassed, with modern reverse-proxy “Attacker-in-the-Middle” phishing kits the most common method (and the standard choice for phishing attacks today). These work by intercepting the authenticated session created when a victim enters their password and completes an MFA check. To do this, the phishing website simply passes messages between the user and the real website — hence “Attacker-in-the-Middle”. In contrast, passkey-based logins can’t be phished. Because passkey-based logins are domain-bound, trying to use a passkey for microsoft.com on phishing.com simply won’t generate the correct value to pass the authentication check, even when proxied using an AitM kit. But attackers haven’t given up that easily. As passkeys become more popular, we’re seeing a number of techniques designed to downgrade or otherwise circumvent the authentication process to make it vulnerable to phishing attacks. So, here’s all the techniques that attackers have used to get around passkeys (so far). Downgrade attacks Downgrade attacks are the go-to method used by attackers to get around phishing-resistant MFA. MFA downgrade functionality has been observed in a number of criminal AitM kits and is even possible using commodity kits like Evilginx. When conducting an Attacker-in-the-Middle phishing attack, the attacker doesn’t need to relay 100% of the messages accurately. Instead, they can alter some of them. The app might ask the user “You need to MFA — do you want to use your passkey, or your backup authenticator code?”, but the phishing website might modify this page to say “You need to MFA — use your backup authenticator code” not giving you the option to use your secure passkey. This is called a downgrade attack. This can also be applied to accounts that use SSO as the default login method. In this scenario, the phish kit can select a backup username and password option to allow the phishing attack to proceed. Here’s an example of Evilginx with a custom phishlet to downgrade authentication for a Microsoft account using Windows Hello. So, you have a situation where even if a phishing-resistant login method exists, the presence of a less secure backup method means the account is still vulnerable to phishing attacks. Check out the latest blog post from Push Security to see MFA downgrade in action, real excerpts from criminal phishing kits. Learn more about how Push detects and blocks MFA downgrade attacks as they happen — in the victim’s browser. Read our Research Device code phishing To get around phishing-resistant authentication methods, attackers are also using device code phishing attacks that take advantage of alternative authentication flows for devices which do not support passkey-based logins, e.g. because they don’t have web browsers, or have limited input capabilities. This alternative login flow operates by supplying a user with a unique code and instructing them to visit a webpage in a browser on a different device to enter the code in order to authorize the device. This can be used by an adversary to conduct a phishing attack against a target by convincing them to visit their authentication provider website and enter a code supplied by the adversary, thereby granting access to their account. This attack has the advantage of linking the target to a legitimate URL, with no prompt to consent to explicit permissions beyond entering the device code and signing in. Additionally, verified apps can be impersonated in some cases. This technique has been observed in a number of recent campaigns, including repeated Russia-sponsored targeting of M365 accounts (1) (2). Consent phishing Consent phishing was one of the first techniques added to the SaaS attacks matrix and has been around for some time, but with a recent uptick in malicious activity. OAuth allows users to grant third-party apps permissions to access their data. Adversaries can abuse this functionality by tricking users into authorizing access for malicious OAuth apps. In a consent phishing attack, an adversary sends a phishing link to a target that requests permissions to access sensitive data or permissions to perform dangerous actions. If the target grants consent for the permissions, the adversary gains that level of access over the target’s account. This level of access will bypass MFA and persist through password changes. Consent phishing is most commonly associated with attacks aimed at getting access to Microsoft Azure or Google Workspace tenants. However, it has become more common for SaaS apps to implement their own OAuth-authenticated APIs and app stores that can be targeted in the same way — as seen in this recent example targeting GitHub users. Once authorized, the attacker has extensive access to the account. In this example affecting GitHub, the attacker would be able to modify repositories to conduct further attacks against users (e.g. by infecting them with malware), poison the repos and services connected to the repository, and exfiltrate any sensitive data the account has access to. Verification phishing Email verification is sometimes used as a control, such as when registering new accounts. This is typically implemented by emailing the target user with either a clickable link for them to verify or a verification code that they need to enter. Verification phishing is when an adversary uses phishing, or some other type of social engineering, to convince a user to click a verification link or pass them the verification code in order to defeat this control. An example of this technique being used to bypass MFA is with cross-IdP impersonation. This is where an attacker simply registers a new IdP account to the victim’s corporate email domain. In many cases, this allows you to log in via SSO using the new IdP without any further checks — in fact, 3 in 5 apps were found to allow this behavior. When you consider the large number of apps that can function as an IdP for the purposes of SSO, there are quite a few possible targets (depending on the app, and the login methods it supports). Managed IdPs can be administered centrally by the organization (which owns and operates the IdP and the identities on it), whereas unmanaged ‘social’ IdPs are controlled by the vendor, and identities are owned and administered by the user. You can see an example of this in the video below, or read an analysis of two in-the-wild examples here. App-specific password phishing App-Specific password phishing is a social engineering technique where an adversary tricks a user into generating an "app-specific password" for their account and then sharing it with the attacker. These legacy passwords are a feature in some major SaaS providers (like Google and Apple) designed to allow older applications that do not support modern authentication (like OAuth 2.0) to access account data. The attack flow typically involves a pretext where the attacker, posing as a trusted entity (e.g., tech support, a service provider), directs the user to their account's security settings. The user is then guided through the process of creating a new app-specific password and is instructed to paste this password into a form or chat window controlled by the attacker. Because app-specific passwords are designed for use in environments that do not support MFA, once the attacker possesses this password, they can gain persistent, programmatic access to the user's account data (e.g., emails, contacts, files) via APIs, often without triggering the same level of security alerts as a traditional interactive login from an unrecognized device. This makes the access stealthier and more durable than a session token, as these passwords typically remain valid until manually revoked by the user. A recent example of this was disclosed where an expert on Russian information operations was targeted with a sophisticated and personalized social engineering attack, where the attacker was able to establish persistent access to the victim’s mailbox using ASPs by logging into a mail client. This involved a sophisticated lure impersonating the US Department of State instructing the victim on how to create and share an ASP with the attacker, granting access to their Google mailbox. Bonus: Targeting local accounts not using passkeys Possibly the easiest way to get around passkeys, though, is to target apps that don’t support passkeys natively. Passkeys are typically used in combination with SSO, where you log into your primary IdP provider with a secure, passkey-protected login, and then on to connected apps via SSO. Many apps do not allow passkey logins directly. As a result, apps like Slack, Mailchimp, Postman, GitHub, and other commonly-used business apps are being increasingly targeted directly — bypassing IdPs (MS, Google, Okta, etc.) that typically have more robust authentication controls in place. Just like backup MFA methods are often registered alongside passkeys, local “ghost login” methods are often registered alongside SSO, meaning that accounts have multiple possible entry points. In many cases, they don’t have MFA deployed at all — making them equally susceptible to attacks using stolen credentials (as seen in the Snowflake attacks last year, and Jira attacks this year). This results in a vast and vulnerable identity attack surface for organizations to manage. Conclusion Most of the time, attackers don’t have to do anything different to get around passkeys. Simply using the same phishing tools and techniques they usually apply will get the job done in the likely event that a backup, non-passkey MFA method is registered to the account. The only accounts that are truly secure are those with only passkeys, and no backup methods OR conditional access policies preventing non-passkey authentication. But the devil is in the detail here too (such as this recent example of Microsoft-provided CA templates setting “risky” sign-ins as false positives and allowing them to proceed). And auditing your app and identity sprawl is no mean feat when you consider the varying levels of visibility and control available to security teams per app (and the fact that many apps are simply not centrally adopted or known to begin with). Prevent and intercept phishing attacks with Push Security Downgrade attacks using AitM phishing kits make up the vast majority of passkey-bypassing phishing attacks. Push Security’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AitM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more. If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, book some time with one of our team for a live demo. Sponsored and written by Push Security.

bleepingcomputer.comJul 29, 2025extracted