proofpoint

Since February, we’ve grown AWS Security Hub Extended from 14 curated partners across 9 categories to 23 partners across 10. At Black Hat this month, 14 of those partners were at the Amazon Web Services (AWS) booth demoing live. Four of those partners delivered theater talks and ten were featured on SecurityLive streaming. We hosted a partner reception that brought our leadership together with partner executives to plan what comes next. These are companies investing real engineering and real go-to-market (GTM) alongside us, and increasingly with each other, because the model resonates with the customers they’re talking to every day. The most common question we heard at the booth was when Supply Chain Security was coming. It’s here. And that’s the thing I want to spend the most time on today, because it’s the category customers keep asking us about. Supply Chain Security: The category customers have been asking for Software supply chain risk has moved from a security-team concern to a board-level conversation. SolarWinds showed what happens when a build system is compromised. Log4j showed what a single transitive dependency vulnerability can do at global scale. The xz utils backdoor showed the patience of a maintainer-compromise attack executed over years. Each demonstrated a different dimension of the same problem, and the pace is accelerating. Attackers know that a fast way into an enterprise is through the open source packages that enterprise unknowingly trust. Every customer I talked to at Black Hat had this on their risk register. Most still hadn’t operationalized a solution, because doing so meant a standalone deployment, a new contract, a new console, and integration work their security team couldn’t prioritize. That’s the friction we aim to remove. Security Hub Extended now offers Supply Chain Security with Chainguard and Socket as the curated partners. Supply Chain Security uses the same model as everything else in Extended. Every offering has pay-as-you-go pricing, one bill, no required long-term commitment. For enterprises that prefer to continue using the procurement process they always have, Security Hub Extended Private Offers are also available. These are committed term agreements with deeper discounts, the ability to aggregate spend across partners on a single AWS bill, and both monthly and annual payment options throughout the term. You pick the path that fits how you buy. What Chainguard does Chainguard gives you open source dependencies rebuilt from source in a hardened, verified build process, so what enters your environment is malware-resistant and provenance-backed. Their research shows that rebuilding from source would have stopped 98% of known malicious packages from ever reaching production. If you can’t verify the source, it never appears in the Chainguard repository. That’s the filter between the public registry and your developers. What Socket does Socket analyzes the actual behavior of open source packages to block malicious dependencies at the time of install. Not after a Common Vulnerability and Exposures (CVE) is published days or weeks later. At the moment the package tries to land in your environment, Socket flags it based on what it does, not what a database says about it. Its reachability analysis then tells you which vulnerabilities are exploitable from your code instead of drowning your team in noise. You pay for the distinct packages you check, not for how often your builds run. Why they work together Together, Chainguard and Socket cover the two questions that matter: Can I trust what I’m pulling in? Can I stop malicious components before they get built into my applications? Chainguard helps secure the foundation your code is built on. Socket secures the packages you pull into it. Both help protect your software supply chain regardless of where you deploy—across clouds or on-premises. Activate both through Security Hub Extended and their findings flow into Security Hub in OCSF (Open Cybersecurity Schema Framework) alongside everything else, so a supply chain risk is correlated and prioritized next to your endpoint, identity, and cloud signals. From there, it routes out to the downstream tools you’ve already integrated, so it fits the pipeline your builders run today. 23 partners, 10 categories. Built on what customers asked for Every partner in Security Hub Extended is here because customers told us they needed that capability and that specific solution was already working for them. We add categories because the threat landscape evolves, and we add partners because customers point us to who’s solving those problems well. The goal is straightforward: Simplify adopting the security solutions your peers are already succeeding with, through the AWS relationship you already have. The full set today spans endpoint, identity, email, network, data, browser, cloud, AI, security operations, and now supply chain. The 23 curated partners are 7AI, Britive, Chainguard, CrowdStrike, Cyera, Island, LayerX, Native Security, Noma, Okta, Oligo, Opti, Palo Alto Networks, Proofpoint, SailPoint, SentinelOne, Socket, Splunk, Sublime, Upwind, Varonis, Zenity, and Zscaler. Our focus now is deepening integrations and reducing activation friction so these solutions work together, not in isolation. That’s where the real value compounds. What we’re building next Everything I’ve described so far is the commercial model working: Customers buying best-of-breed security through one AWS relationship with the flexibility they expect. But the bigger vision is the integration layer that makes these tools genuinely better together, not just easier to buy together. The integration we’re most focused on is cross-partner correlation, turning signals from an endpoint solution, an identity solution, and a cloud solution into one exposure and one attack path instead of three disconnected alerts. Right alongside that, we’re dramatically reducing the activation, deployment, and integration friction so customers go from subscribing to seeing value in hours rather than weeks. Both efforts enable the curated solutions you already trust to deliver stronger outcomes together than they do apart. That’s the build we’re accelerating with our partners now, and you’ll hear more leading into re:Invent. Explore what’s available If you’re running open source in production and don’t yet have supply chain visibility, start there. Activate Chainguard and Socket through the Security Hub console today. If you’re managing multiple security vendor relationships and want to understand what consolidation looks like with Security Hub Extended, talk to your AWS account team. Pricing for every partner is published on our pricing page , no sales call required. And if you’re already using Security Hub for posture management and threat detection, the Extended plan is available in the same console you already use. We’re just getting started. If you have feedback about this post, submit comments in the Comments section below. Michael Fuller Michael has been with AWS for 16 years and led product for AWS Security Services for 11 years. Michael has 29 years in the industry and held several roles in product management, business development, and software development for IBM, Cisco, and Amazon. Michael has a Bachelor’s of Science in Computer Engineering from the University of Arizona and an MBA from the University of Washington.

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote access trojans (RATs) and information stealer malware. "Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts," the enterprise security company said in an analysis published last week. "These include using indirect system calls, API and Import Address Table (IAT) unhooking, bring-your-own-vulnerable-driver (BYOVD)-based EDR tampering, privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting used to execute payloads while minimizing forensic artifacts." Crypters (also spelled cryptors) play an important role in the cybercriminal ecosystem as they allow bad actors to obfuscate their payloads, avoid detection, and improve malware delivery success rates. An emphasis on payload protection notwithstanding, Cruciferra supports various custom encryption routines that appear to be dynamically derived and assembled from established cryptographic algorithms, thereby introducing variations between samples and complicating static analysis as well as signature-based detections. "The algorithm used to encrypt payloads and strings in each set of samples is different, and there is such a large variance of these algorithms, which means it is probably randomly generated (polymorphically) from elements of well-known hashing, PRNG, and cipher algorithms," per researchers Chris Wakelin, Georgi Mladenov, and Kyle Cucci. The service has been advertised on the cybercrime underground as the "most lethal crypter" for $450 to $2,000 a month. It was first made available for sale in fall 2025. Some of the commodity malware families distributed via Cruciferra include Agent Tesla, AsyncRAT, DarkCloud Stealer, Formbook, Phantom Stealer, Remcos RAT, Snake Keylogger, ValleyRAT, XLoader, XWorm, and zgRAT. Campaigns leveraging the crypter have leveraged phishing as the primary initial access vector, with the tool incorporating the flexibility to either drop an encrypted payload to disk or download it from a staging server. The activity is assessed to be opportunistic, reaching anywhere between hundreds and thousands of messages per campaign. The primary targets include financial services, healthcare, government, education, and manufacturing sectors. One such campaign has been attributed to Chinese-speaking cybercrime actor TA4922, which shares some level of overlap with another prolific threat group called Silver Fox. This involves employing tax-themed lures to drive victims to attacker-controlled landing pages hosting ZIP files to deliver malware. Four such campaigns have been identified between April and early June 2026. It's worth mentioning here that this attack was documented in detail earlier this month by Seqrite Labs and Cyderes Howler Cell. Seqrite Labs is tracking the activity under the moniker Operation DragonReturn. Other campaigns that have been observed using Cruciferra are below - Emails impersonating the U.S. Social Security Administration (SSA) to deliver XWorm and AdaptixC2 (May 2026) Email using themes related to bed bugs and guest complaints to target organizations in the hospitality and travel industries and deliver zgRAT (late June 2026) Regardless of the campaign, Cruciferra is always executed via DLL side-loading, while leveraging evasion and anti-analysis techniques to fly under the radar. This includes hiding console windows, unhooking Windows API functions to reduce visibility, indirect system calls, disabling user notifications, and the abuse of the "GoFlyDrv.sys" driver as part of a BYOVD attack to terminate security processes. "Cruciferra checks if it is running with Administrator privileges, and if not, attempts to elevate its privileges by bypassing UAC using the COM Elevation Moniker," Proofpoint explained. "Additionally, Cruciferra establishes persistence by writing to the registry Software\Microsoft\Windows\CurrentVersion\Run key with a default value of 'putty.' This ensures Cruciferra runs after system reboot." The final payload is loaded into memory using a variant of Process Ghosting, which, at a high level, refers to an advanced malware evasion technique on Windows where malicious code is executed from a temporary file that is deleted from the disk before the process starts. This, in turn, blinds security products as there is no "file" to scan. Cruciferra adds an extra layer of sophistication by patching ZwQueryVirtualMemory hooks and by attempting to tamper with the NtManageHotPatch routine to hide the deletion of the file and neutralize integrity checks. "While crypters have long been used to evade detection and increase malware delivery and execution success rates, Cruciferra distinguishes itself through its extensive and unique defense-evasion capabilities, modular design, and highly customized and varied approach to payload protection," Proofpoint concluded.

SYSTEMS What Nvidia's first Groq 3 LPU benchmarks tell us about its $20B gambleGemma 4 31B performance tests offer a best-case scenario for next-gen dataflow accelerators ON-PREM US datacenters tripled their water footprint in 10 years... and those are figures from the start of the AI boom. It can only be worse now. Silo-ed reporting isn't helping ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career Emperor Penguin Linus Torvalds banishes a bug – with a botThe lad himself finds and fixes a tricky one… or does he? FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan

A crypter service used by multiple unrelated cyber-criminal groups has been documented cloaking commodity malware with process ghosting, kernel-driver abuse and more than 90 mix-and-match encryption routines. According to new research from Proofpoint published on July 20, the crypter, marketed as Cruciferra, was first offered for sale on the Exploit forum in autumn 2025 and now underpins dozens of campaigns delivering AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger. Tiered access runs from $450 to $2,000 a month. Proofpoint identified both production and apparent testing samples, suggesting active development. On dark web forums, Cruciferra calls itself “the underground's most lethal crypter.” Kernel Drivers and Custom Cryptography In the observed campaigns, Proofpoint said Cruciferra always executed through DLL side-loading. Victims received a ZIP pairing a legitimate executable with a malicious DLL. Running the executable side-loaded the DLL, which inspected the environment before dropping the payload. The DLL contained hundreds of decoy exported functions pointing to junk code, with only one or two calling into the real routine. Before executing, the crypter unhooked endpoint detection and response (EDR) monitoring at multiple levels. It patched the Import Address Table, read a clean copy of ntdll.dll to source indirect syscalls, and disabled kernel-level telemetry by loading a vulnerable signed driver such as GoFlyDrv.sys, then issuing IOCTL commands to terminate security processes. This bring-your-own-vulnerable-driver (BYOVD) approach mirrors techniques seen in the GentleKiller framework, which the Gentlemen ransomware gang distributes to affiliates. Payloads sat in the binary's .reloc section and were unpacked using one of over 90 encryption routines, each assembled from parts of established algorithms including Keccak, Threefish and Feistel variants, so the cipher covering one sample rarely matched the next. Process Ghosting With Kernel Anti-Peek For the final execution step, Cruciferra employed a modified form of process ghosting. The classic technique creates a temporary file marked for deletion, fills it with the payload, and uses it as the backing image for a suspended process, leaving a running process backed by a PE image that no longer exists on disk in scannable form. Cruciferra added two anti-inspection layers. It patched ZwQueryVirtualMemory so EDR queries against the ghosted memory returned a sanitized result, and neutered NtManageHotPatch, the kernel function that can validate a loaded image against its on-disk counterpart. Proofpoint attributed multiple campaigns using the malware to the Chinese-speaking group TA4922, which used tax-themed lures impersonating the Indian Income Tax Department to deliver AsyncRAT via Cruciferra between late April and early June. Separate May campaigns spoofed the US Social Security Administration to deliver XWorm, and a late-June operation used bed-bug guest-complaint lures against hospitality organizations to drop zgRAT. Financial services accounted for 34% of observed targets, followed by healthcare at 25% and government at 10%, though Proofpoint characterized the targeting as opportunistic. The company said new Cruciferra-packed samples appeared on VirusTotal every few minutes on July 9.

ClickFix is changing the economics of social engineering ClickFix has moved from a one-off social engineering trick into an industrialized attack ecosystem that is outpacing conventional antivirus and endpoint defenses, according to ReversingLabs. The technique first showed up in late 2023 and early 2024, and Proofpoint named it in mid-2024. The method skips exploits and vulnerabilities entirely. A fake webpage, styled as a CAPTCHA check, browser update notice, or meeting error, instructs a visitor to open the Windows Run dialog or macOS Terminal, paste a command, and press Enter. JavaScript on the page has already copied a malicious command to the clipboard before the visitor sees any instructions. The command runs through PowerShell, mshta, or curl, tools already trusted on the system. Victims reach ClickFix lure pages through compromised websites acting as watering holes, malvertising placed through legitimate ad networks, SEO poisoning that ranks malicious pages for common search terms, and phishing campaigns impersonating vendors or internal IT teams. The MaaS economy “ClickFix’s rapid proliferation is not accidental,” ReversingLabs noted. “Behind the campaign diversity and payload variety is a structured Malware-as-a-Service (MaaS) economy that has industrialized the production, distribution, and operation of ClickFix.” Complete ClickFix kits sell on underground forums for $250 per month to $1,800 for a lifetime license, with software updates included. Higher-priced packages add pre-built lure templates for major targets like Cloudflare CAPTCHAs, browser and OS update screens, SSL certificate errors, font install pages, and meeting errors. Buyers also get domain rotation services, AV-bypass guarantees marketed as a standard feature, and support channels on Telegram. “This structure means that ClickFix campaigns can be launched by individuals with no meaningful malware development capability,” researchers added. “The sophistication is rented, not built. The practical consequence for defenders is a dramatic increase in campaign volume with no corresponding increase in the skill threshold of the attacker.” In April 2026, Netskope Threat Labs exposed the backend of one ClickFix MaaS platform after the operators’ own security lapse leaked server-side admin panel details. The backend managed multiple operators at once and tracked cryptocurrency wallet assets across victims. Its payload, a Node.js-based RAT, loaded stealing modules directly into memory after a command-and-control connection and routed traffic over gRPC through the Tor network. Payloads keep expanding Lumma Stealer is the most prolific ClickFix payload, but the payload catalog is expanding well beyond it, researchers found. Remote access trojans including DarkGate, XWorm, AsyncRAT, NetSupport, and SectopRAT are also in the ClickFix rotation, enabling hands-on-keyboard activity such as lateral movement, persistence, and data exfiltration. ClickFix attacks evolve and accelerate In January 2026, researchers at Huntress and Microsoft Defender Experts identified a new variant called CrashFix. It deliberately crashes the victim’s browser, then deploys a social engineering lure offering to restore it. That disruption raises compliance and cuts reliance on traditional exploit paths, since the user is reacting to a browser that has genuinely stopped working. “Security teams should treat CrashFix as evidence of an active development cycle behind ClickFix infrastructure.” NetSecurity documented a wider family of “fix-type” attacks. FileFix manipulates the Windows File Explorer address bar, PromptFix targets AI tooling, and ConsentFix abuses OAuth consent screens to hijack accounts. Early ClickFix campaigns went after everyday consumers. Lately the lures have gotten more corporate, mimicking Microsoft 365 prompts, VPN errors, and internal IT portals. Researchers expect AI-generated lure content to spread further. Fighting ClickFix with structural analysis ReversingLabs has come up with a fix for ClickFix’s evasion of common security tools, and that is to identify the attack before users ever paste a command into the Run dialog or Terminal, according to the report. To do this, Threat Analyst Toni Dujmović built a structural YARA rule that reads the lure page itself rather than the payload, then ran it against the company’s file collection. The rule, which ReversingLabs is releasing as open source, flagged 123 confirmed ClickFix lures that had evaded every antivirus engine tested. Of 4,062 matched samples, those 123 broke down into 105 flagged clean and 18 left unclassified, with several first observed within 48 hours. Researchers advise hardening systems at more than one point. PowerShell Constrained Language Mode limits what a script can do even when someone launches it directly, and script block logging leaves a record for when prevention fails. Windows Defender Application Control or AppLocker keeps living-off-the-land binaries from running outside their normal context. The social engineering layer is where a person still gets a say, and training employees to recognize fake browser updates, CAPTCHA pages, and IT support prompts also helps defend against ClickFix, ReversingLabs concluded.

SYSTEMS What Nvidia's first Groq 3 LPU benchmarks tell us about its $20B gambleGemma 4 31B performance tests offer a best-case scenario for next-gen dataflow accelerators ON-PREM US datacenters tripled their water footprint in 10 years... and those are figures from the start of the AI boom. It can only be worse now. Silo-ed reporting isn't helping ai and ML AI slop is good for business if you know what you're doingYour irresponsibility is someone else's opportunity SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career Emperor Penguin Linus Torvalds banishes a bug – with a botThe lad himself finds and fixes a tricky one… or does he? FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan

A China-linked threat cluster has been exploiting vulnerable Roundcube servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. The campaign has been observed since May and focuses on physics and engineering departments, administrators and professors, as well as organizations involved in astrophysics, particle physics, or national security-related research. Researchers at cybersecurity company Proofpoint are tracking the activity under the name ‘UNK_MassTraction’ and believe to be associated with a new threat cluster. The attack begins with a malicious email sent from compromised accounts or spoofed domains, using a generic lure. Opening the email in a vulnerable Roundcube webmail client triggers exploitation of a cross-site scripting flaw tracked as CVE-2024-42009, which executes JavaScript code inside the victim’s browser, loading a payload called IceCube. According to the researchers, IceCube "is a fully-featured Roundcube stealer" that can harvest usernames, passwords, cookies, two-factor authentication (2FA) data, and browser information. Proofpoint says that the malware uses "helpers" to exploit a Roundcube deserialization flaw tracked as CVE-2025-49113 and attempts to install SquareShell, a PHP webshell that includes remote code execution capabilities. If successful, the attacker gains remote code execution on the mail server; otherwise, the malware downloads a shell script that loads another payload, VShell, directly in memory. VShell is a commodity Go-based backdoor that supports interactive shell access and port forwarding, which is commonly used by Chinese threat actors. Based on several observations, Proofpoint assesses that UNK_MassTraction is likely a China-aligned espionage actor. First, the infrastructure used in the attacks overlaps with a covert VPS network previously associated with multiple China-linked actors. Another clue is the presence of Chinese-language artifacts in earlier phishing emails. Finally, the tactic of targeting internet-facing mail servers as a foothold for accessing internal networks is a hallmark of Chinese attacks. Taking everything into account, Proofpoint emphasizes that attribution in this case is just an assessment and definitely not a high-confidence one. An interesting finding regarding the specific targeting of this campaign is that UNK_MassTraction appears to have selected servers previously deemed vulnerable to CVE-2024-42009 and CVE-2025-49113, so some reconnaissance was performed prior to the attacks. Administrators of Roundcube systems are advised to apply the latest security updates that address the two flaws and treat mail servers with the same diligence they show for VPNs and other remote access nodes. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Law enforcement hits StealC and Amadey malware networks Operation Endgame, the largest international law enforcement operation aimed at disrupting ransomware and cybercrime infrastructure across the world, has claimed its latest targets: StealC and Amadey. The notice on disrupted websites (Source: Microsoft) While developed by separate criminal groups, those two malware families work in tandem to compromise devices and harvest sensitive data. Law enforcement and private sector partners, including Microsoft and Proofpoint, coordinated action against the infrastructure delivering both threats. Infrastructure dismantled, millions in crypto seized On 18 June 2026, law enforcement agencies from the Netherlands, Canada, the United States, and Germany, supported by Europol and Eurojust, announced the successful disruption of the infrastructure behind the SocGholish malware framework. Worldwide, 106 servers and domains were taken down and nearly 15,000 compromised websites were remediated. Today, a follow-up action targeting StealC and Amadey was announced. “During this action, 326 servers and 142 domains were actioned by law enforcement and the private sector partners, severely crippling the malware’s distribution network,” Europol stated. Law enforcement has also managed to identify and freeze over 41 million euros (approximately 47 million US dollars) in related crypto assets. Additionally, Microsoft’s Digital Crimes Unit filed a lawsuit against multiple alleged enablers involved in StealC and Amadey and took down associated infrastructure. These individuals include Amadey and StealC malware-as-a-service operators, as well as affiliates. Microsoft targets operators and affiliates “Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information,” noted Steven Masada, Assistant General Counsel with Microsoft’s Digital Crimes Unit. According to data collected by the company in the first two weeks of May 2026, Amadey and StealC were linked to 140,000+ infected computers worldwide. With the help of AI, investigators were able to discover that even though the two threats were developed by separate cybercriminals, they relied on the same infrastructure. “Those insights allowed the legal team to treat both malware families as part of a single conspiracy. Instead of going after each tool separately, as we have done in the past, we used [the Racketeer Influenced and Corrupt Organizations Act (RICO)] to charge multiple complicit enablers involved across the operation,” Masada added. He also shared that Microsoft pinpointed over 18,000 victim computers, has severed criminal control of those devices, and is helping telecoms protect affected customers. How researchers cracked StealC Proofpoint and IBM X-Force researchers revealed today their part in the operation. They identified a vulnerability in the StealC C2 panel, which was exploited to help with the disruption operation, and they extracted configurations from many StealC samples. These configurations contained URLs used to connect to and communicate with the C2 panel, campaign and affiliate IDs, unique client/bot IDs, and C2 communication encryption keys, and were used to track StealC operations and affiliate groups. They also built a StealC bot emulator, which allowed them to simulate the network activity that occurs in a normal StealC infection, and retrieve and analyze the additional malicious payloads that criminals delivered via this infostealer-cum-dropper. “In some cases, the StealC client was delivered only one payload, such as another stealer or a remote access trojan (RAT). In many cases, however, the StealC client received another loader malware, which subsequently downloaded the final payload,” the researchers shared. In one case, StealC downloaded XTinyLoader, which then downloaded a LockBit Black ransomware payload. Microsoft’s threat analysts also detailed the two Malware-as-a-service operations and shared indicators of compromise pointing to Amadey and StealC infections. Compromised credentials According to Europol, nearly 27 million stolen login credentials have been tracked down as part of this operation. Following the SocGholish infrastructure disruption, compromised credentials have been added to the Have I Been Pwned database, allowing users check whether theirs are among those. It’s currently unclear whether the same will happen with the latest batch. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Proofpoint�́A�k���N�n�A�N�^�[�uUNK_DeadDrop�v���J���҂�W�I�ɂ�����K�̓t�B�b�V���O������W�J���Ă���ƕ����B�U���҂́A��6�T�Ԃ�250�ʂ���U�����[���𑗐M���A100�ȏ�̑g�D���W�I�ɂȂ��Ă���Ƃ����B ���̋L���͉������ł��B����o�^�i�����j����ƑS�Ă������������܂��B �@Proofpoint��2026�N6��8���i���n���ԁj�A�k���N�n�̉\�����������ЃA�N�^�[�uUNK_DeadDrop�v�ɂ��J���ҁE�G���W�j�A��W�I�ɂ����t�B�b�V���O�����ɂ��Ē������ʂ�����B �@�U���҂͍̗p������R�[�h���Lj˗������d�q���[���𑗂�A�s���ȁuGitHub�v���|�W�g���o�R�Ń}���E�F�A��z�z���A�Í����Y�֘A�f�[�^��F�؏��̐ގ��_���Ƃ����B �@���Ђ̋��ЃC���e���W�F���X��[���uProofpoint Threat Research�v�ɂ��ƁA������2026�N4�5���ɂ����Ċm�F���ꂽ�B��6�T�Ԃ�250�ʒ��̓d�q���[�������M����A���Z��Í����Y�A����A�Z�p����Ȃǖ�100�g�D�̊W�҂��W�I�ƂȂ����B�W�I�̑����͕č����݂̑g�D���������A�Ώےn��͐��E�e�n�ɋy�B �@�k���N�n�U���҂�2022�N���납��A�Í����Y�╪�U�^���Z���삾���łȂ��A�J���҂��̂��̂�_���������p�����Ă����B�U�̗̍p�S���҂ɂȂ肷�܂����ڐG�A�s����npm��PyPI�p�b�P�[�W�A������ς݈Í����Y����A�v���Ȃǂ𗘗p���AAPI�g�[�N���A�E�H���b�g�A�F�؏��̎擾��_����@���m�F����Ă����B �@UNK_DeadDrop�́A���m�̖k���N�֘A�̋��ЃA�N�^�[�Ƌ��ʓ_�������̂́AProofpoint�͓Ɨ����������Q�Ƃ��ĒǐՂ��Ă���B �@�U�����[���ɂ�GitHub��uGitLab�v��URL���܂܂�Ă����B��M�҂͋Z�p�ۑ��R�[�f�B���O�e�X�g�A�I�[�v���\�[�X�v���W�F�N�g�̍��Lj˗��Ȃǂ����A�Ώۃ��|�W�g�����擾���āuVisual Studio Code�v�iVS Code�j��uCursor�v�ŊJ���悤�U�����ꂽ�B �@�m�F���ꂽ�Ȃ肷�܂���Ƃɂ́AOndo Finance��Empower Pharmacy�ANXLog�AOnePlan�AHypen Connect�AValon�ANourish���܂܂��B����̊����ł�Pulsynk��Trixauvex�ȂLjÍ����Y�֘A��Ƃ��A�R�[�h���Lj˗��𑗕t���Ă����BERC-4626�{�[���g�̃e�X�g�˗���AAI�G�[�W�F���g�p�̌��σV�X�e���J���Č���������m�F���ꂽ�B �@���͑ΏۂƂȂ���10����GitHub���|�W�g���́A�Í����Y�v���b�g�t�H�[���A�Ǝ�i�������Ⴍ�j�����؎����A�uMicrosoft Foundry�v�̃e�X�g���AAI���ϊ�Ղ�4����ɕ��ނ��ꂽ�B����������݂���W���d�l��t���[�����[�N�ւ̎Q�Ƃ��܂݁A�����I�ȃf�B���N�g���\����X�N���v�g������Ă������߁A���K�v���W�F�N�g�̂悤�Ɍ�������ƂȂ��Ă����B �@Proofpoint�ɂ��ƁA�����̋N�_�̓��|�W�g�����̉B���t�H���_�ɔz�u���ꂽtasks.json�Ƃ����B���̃t�@�C����VS Code�̎������s�@�\�𗘗p���A�t�H���_���J�����Ƃ��ɃV�F���X�N���v�g��R�}���h���N������BCursor�ł͐M���m�F��ʂ��\�����ꂸ�A�t�H���_���J�������ŏ������n�܂�P�[�X���m�F���ꂽ�B �@�N�������X�N���v�g�͕s����VSIX�g���@�\���C���X�g�[������B���̊g���@�\�͐��K��Google�֘A�T�[�r�X���A�i�����@�\��S���B�U���҂�VS Code�̃^�X�N�������@�\�Ɗg���@�\�@�\�����p���A�}���E�F�A���s�ƈێ������������B �@���̑��A�uLinux�v�ƁumacOS�v�ɂ����āA�I�[�v���\�[�X��Go���R�}���h���R���g���[���iC2�j�t���[�����[�N�uOverlord�v����ՂƂ���RAT�iRemote Access Trojan�j���W�J���ꂽ�B�U���҂�Web�u���E�U�F�؏��ގ��Í����Y�E�H���b�g�ގ�A���Ս폜�̋@�\��lj����Ă����B�}���E�F�A��C2�T�[�o�Ƃ̌p���I�ȒʐM���m�����A���u������t����B �@macOS�ł̓E�H���b�g�����W��A�U�̃V�X�e���_�C�A���O��\�����ė��p�҂̃p�X���[�h���͂𑣂��B�擾�����F�؏��𗘗p���AWeb�u���E�U�̕ۑ�����L�[��F�[�����̃f�[�^���擾������ŊǗ��Ҍ������l�����A�lj��������W����d�g�݂ł������B �@Linux�łł����l�ɃE�H���b�g�֘A�����擾��A�uZenity�v�𗘗p�����_�C�A���O�ŔF�؏������W�����B�uGNOME Keyring�v���̏��擾�����݁A�������i��ɒlj��̔F�؏������W�����B �@�uWindows�v�ł�Go���o�C�i�����g�p�����A�uElectron�v����Node.js�R�[�h�����s����������̗p�����BVSIX�g���@�\�̓�����A�Í����ς݃y�C���[�h��W�J���AWeb�u���E�U��Í����Y�E�H���b�g�̏������W����B35��ނ̃E�H���b�g�g���@�\�A18��ނ̃E�H���b�g�A�v���P�[�V�����A�uMozilla Firefox�v��uChromium�v�n��Web�u���E�U���ΏۂƂȂ��Ă����B �@�F�؏��ގ�@�\��Chromium�nWeb�u���E�U��Mozilla Firefox����p�X���[�h��Cookie���擾���A�ی�@�\��������݂�B���W�����f�[�^��HTTP�ʐM��ʂ���C2�T�[�o�ɑ��M���ꂽ�B �@�C���t���ʂł͑����̃h���C����2026�N4�5���ɓo�^����A�o�^���ォ��d�q���[�����M�ɗ��p���ꂽ�B�h���C�����͍̗p�����Ŏg�p�����ˋ��Ɩ��Ɏ����č쐬����Ă����B�ꕔ�ł͖�������AI�֘A�T�C�g�����J����Ă����B �@Proofpoint�́A�J���҂�_���_��GitHub���p�AVS Code�@�\�̈��p�A�Í����Y�ގ�Ȃǂ̓������A�k���N�n�����uContagious Interview�v�Ƌ��ʂ���Ǝw�E�����B�������A�d�q���[����̂̐N����@�A��ʂ̃��|�W�g�������A�����I�ɓ��삷��y�C���[�h�A�قȂ�C���t���\���Ȃǂ̍��ق��m�F���ꂽ�B �@���Ђ́AUNK_DeadDrop�����������̔��W�`�ł���\����ے肵�Ă��Ȃ����A�����_�ł͓Ɨ����������Q�Ƃ��ĒǐՂ��p�����Ă���B����̎���́A�k���N�n�U���҂ɂ��J���ҕW�I�����̋K�͊g��Ǝ�@�̍��x������������Ƃ��Ĉʒu�t�����Ă���B Copyright © ITmedia, Inc. All Rights Reserved.

Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview (aka Famous Chollima, HexagonalRodent, and Void Dokkaebi). According to a report published by Proofpoint, the threat actor has been found orchestrating phishing campaigns using developer role recruitment or code review themes to target nearly 100 organizations in finance, cryptocurrency, education, technology, and several other sectors. The activity has been codenamed UNK_DeadDrop. "The infection chain begins with emails containing links to actor-controlled GitHub repositories hosting malicious scripts that result in the execution of cross-platform malware for macOS, Linux, and Windows, including an open-source Go framework named Overlord," Proofpoint researchers Saher Naumaan and Carlos Rubio said. A crucial aspect connecting the campaign to Pyongyang is the use of Microsoft Visual Studio Code (VS Code) projects that employ the "runOn: folderOpen" technique to trigger the execution of malicious code every time the code editor is opened without requiring any user interaction. This approach has been adopted by the Contagious Interview actors since December 2025. The activity documented by the enterprise security company involved more than 250 emails that were sent during a six-week period to individuals in almost 100 organizations. Over 75% of the targeted entities are located in the U.S., followed by the U.K., Australia, France, Brazil, Germany, India, Israel, Japan, and the Netherlands. The emails contain links to GitHub repositories masquerading as technical assignments or cryptocurrency-related projects, instructing recipients to clone the repository and open it in VS Code or Cursor, resulting in the execution of operating system-specific malware loaders for Linux, macOS, and Windows. Subsequent lures observed in May 2026 have pivoted their approach by requesting targets to review their open-source projects. The loader - a shell script for macOS and Linux and a VBScript for Windows systems - is designed to install a malicious VS Code extension (VSIX) that masquerades as a legitimate Google service, while communicating with an external server to facilitate remote command execution, system reconnaissance, and data exfiltration from browser wallet extensions, credentials, and desktop wallet apps. The Linux and macOS infection chains lead to a custom version of the open-source Overlord framework with capabilities to enable data theft. It also prompts users to enter their system password using a fake security pop-up. The Windows attack chain, on the other hand, relies on the VBScript payload to run a CMD file, which then installs the extension. The end goal remains the same: to steal credentials and data from wallet browser extensions and applications, and exfiltrate the results to the server ("23.137.105[.]75:5173") via an HTTP POST request. "Unlike the Linux/macOS agent, the Windows pipeline does not maintain a persistent connection; it uploads the ZIP files, performs cleanup, and terminates," Proofpoint said. Further analysis has uncovered that the threat actor previously distributed a Windows Go binary of Overlord, but has since shifted to the new method, likely in an attempt to avoid detection. Proofpoint said it's tracking UNK_DeadDrop as distinct from Contagious Interview due to differences in initial access methods (LinkedIn vs. email) and the use of the Overlord framework, which is different from the custom malware families the North Korean hacking group has traditionally deployed, including BeaverTail, InvisibleFerret, and OtterCookie. "UNK_DeadDrop activity suggests North Korea-aligned operations targeting developers for financial gain are maturing and evolving," the company said. "The shift from active social engineering over social media platforms to conduct fake interviews to large campaigns of recruitment-themed phishing emails distributing links to malicious repositories could indicate an actor industrializing and scaling operations." The disclosure comes as Yeeth Security said it discovered three malicious VS Code extensions named "ByteBinTools.jupyter-powerdev-2026.6.8.vsix," ToolCraft.jupyter-powertools-3.21.0.vsix," and "OLDev.markdown-mode-devtools-2.1.0.vsix" on the official marketplace that are dressed up as seemingly harmless Jupyter Notebook productivity tools, but are, in fact, a "sophisticated, multi-stage backdoor" engineered to bypass endpoint defenses. The malware supports the following functions - A SharePoint site functioning as a command queue, victim registry, and exfiltration channel A JavaScript layer that handles all command-and-control (C2) communication via Microsoft Graph API and SharePoint to Components enabling arbitrary file read, write, and exfiltration, as well as code execution using a Windows executable and a Python script for Linux and macOS The C2 channel, besides running commands or scripts, can issue a third command type called "host_action," which facilitates file system operations like pwd, ls, cd, and cat, along with file upload and downloads. Although there exists no direct overlap with any publicly documented North Korean campaign, Yeeth Security said the developer tooling split between JavaScript and Python has its echoes in Contagious Interview, and that the malicious artifacts' Microsoft Graph API authentication mechanism shares some similarities with the Lazarus Group's Dream Job attacks detailed by S2 Grupo LAB52 in October 2025. The findings dovetail with the discovery of multiple campaigns linked to the North Korean threat actors in recent months - A follow-up to the Axios supply chain attack using three malicious npm packages ([email protected], [email protected], and [email protected]) that deliver an information stealer that exfiltrates harvested data to a different C2 infrastructure. The packages are listed as dependencies on GitHub projects disguised as cryptocurrency trading bots. "Less than 18 hours after the Axios malicious packages were removed from NPM, the first secondary payload was already live on the registry," OpenSourceMalware said. "This suggests the threat actor had prepared backup infrastructure and was ready to immediately deploy alternative delivery mechanisms." An attack campaign codenamed TaskJacker has been observed dropping malicious VS Code task files into unsuspecting GitHub users' existing repositories, spreading in a worm-like fashion. "By weaponizing VS Code's tasks.json auto-execution feature, attackers have created a scenario where simply opening a cloned repository in your IDE can compromise your system," the OpenSourceMalware team said. "No user interaction required beyond a git clone and opening the folder." Contagious Interview's use of Git hooks (".githooks/pre-commit") to fire the execution of malicious code when a target clones a "coding assessment" repository, marking a shift from hiding the malicious code within .vscode/tasks.json or package.json files. Contagious Interview's use of a compromised Packagist package ("roberts/leads") to target PHP developers with a JavaScript malware loader that reaches out to blockchain and public RPC infrastructure in order to fetch, decrypt, and execute a next-stage JavaScript payload. The adversary has also leveraged its access to compromised developer systems to tamper with commits and inject multi-stage obfuscated JavaScript code to the source code files in their repositories. The final payload is a variant of the DEV#POPPER RAT. "Void Dokkaebi's operations do not end with a single infected developer," Trend Micro said. "The compromised machine becomes a launchpad, with the threat actor weaponizing the victim's own repositories and turning their code contributions into infection vectors for downstream developers. The result is a self-sustaining propagation chain resembling a worm's behavior rather than a traditional targeted attack." Contagious Interview's migration of InvisibleFerret from readable Python scripts to Cython-compiled binaries, distributing the malware as .pyd files on Windows and .so files on macOS. "The update gives the intrusion set an additional layer of evasion while preserving InvisibleFerret's core capabilities, including backdoor access, browser credential theft, clipboard monitoring, keylogging, and cryptocurrency wallet targeting," Trend Micro said. "BeaverTail has also expanded beyond its original downloader and stealer role into a broader malware with overlapping functions, including credential harvesting and wallet trojanization." A malicious npm package named "terminal-logger-utils" has been found to target Telegram data, SSH keys, crypto wallets, cloud configurations, and environment variables. The package was published by "jpeek895," an account flagged for publishing a similar package called "terminal-logger-pack" in late April 2026. Another npm package named "js-logger-pack" has been found to deliver an ELF binary with infostealer and remote access trojan (RAT) capabilities. BlueNoroff's (aka Sapphire Sleet and UNC1069) targeting of macOS environments within high-value financial sectors to deliver infostealer malware as part of a targeted social engineering against individuals in the cryptocurrency, investment, and Web3 space. Some of these efforts also make use of fake Zoom and Microsoft Teams meeting-themed lures and ClickFix-style prompts and instructions to install supposed "missing" meeting SDKs and deliver malicious payloads. The attacks led to the deployment of updated variants of Cabbage RAT (aka CageyChameleon), PowerShell implants capable of credential and data theft, or a newly identified data-stealing macOS toolkit known as Mach-O Man. "By persuading users to manually execute AppleScript or Terminal-based commands, Sapphire Sleet shifts execution into a user-initiated context, allowing the activity to proceed outside of macOS protections such as Transparency, Consent, and Control (TCC), Gatekeeper, quarantine enforcement, and notarization checks," Microsoft said. Contagious Trader's use of over 50 malicious packages embedded across more than 100 GitHub repositories targeting developers in the cryptocurrency space to deliver three malware families: PromptMink, OtterCookie, and a new Windows clipboard stealer called ClipViper. "The malicious repositories are promoted through verified accounts on X and Reddit, use spoofed developer identities and bot-inflated star counts to appear legitimate, and are distributed across 40+ GitHub users and organizations as redundant delivery fronts," Panther said. A cluster of obfuscated malicious npm packages published by multiple throwaway accounts has been found to deliver variants of the OtterCookie infostealer by means of a postinstall hook. Another malicious npm package named "node-env-resolve" has been identified as making use of six runtime dependencies that match the OtterCookie toolkit. Contagious Interview's use of generative artificial intelligence to assist with the development of loaders responsible for launching BeaverTail and OtterCookie, and to set up front companies used for listing job openings and social engineering outreach via fake LinkedIn accounts. According to data shared by Expel, these campaigns are likely carried out by multiple teams, each comprising several members. The attacks have resulted in the theft of $12 million in cryptocurrency in the first three months of 2026. "The threat actor's campaigns exfiltrated a total of 26,584 cryptocurrency wallets from 2,726 infected developers' systems," Expel's Marcus Hutchins said. A supply chain attack campaign codenamed jsonspack has used 27 malicious npm packages to deliver a JavaScript RAT and infostealer, or drop a loader that fetches an unspecified payload. Another malicious npm package named "sleek-pretty" has been found to target developers running Polymarket trading bots to carry out system fingerprinting, SSH backdoor installation, filesystem exfiltration, and targeted theft of Polymarket CLOB API credentials. A sustained npm malware campaign spanning 108 malicious packages and 261 package versions targeted developers between March 20 and April 20, 2026, with an aim to steal credentials, Telegram Desktop sessions, and wallet keys, and establish persistent access using malware families like BeaverTail and OtterCookie. "Whilst financially motivated cybercrime is highly unappealing to almost every nation-state, since the monetary loss from the resulting sanctions would far outweigh any financial gain, this is not the case for North Korea," Expel said. "The heavy sanctions already levied against the country mean there is little more that can be done to deter them, but a lot to be gained for a nation whose economic activity is severely constrained."

Ferve l’attesa per il calcio d’inizio dei Mondiali di calcio 2026, già nel mirino delle frodi via e-mail. Secondo Proofpoint, più di un terzo dei partner ufficiali ha già esposto il pubblico al rischio cyber. Secondo Sandro Sana, Ethical Hacker e membro Comitato Scientifico Cyber 4.0, “la Coppa del Mondo 2026 conferma un principio ormai evidente: i grandi eventi non attirano solo pubblico, sponsor e media, ma anche ecosistemi criminali già strutturati mesi prima del calcio d’inizio”. “La puntualità dei criminali non dovrebbe più sorprenderci. Senza dubbio non aspettano il fischio d’inizio e hanno già preparato il campo”, commenta Alessandro Curioni, Presidente e fondatore di DI.GI Academy. Indice degli argomenti I Mondiali di calcio 2026 si svolgeranno dall’11 giugno al 19 luglio 2026, ma, da uno studio di Proofpoint emerge che ben il 36% fra sponsor ufficiali, fornitori, partner e sostenitori associati non si avvale delle misure di sicurezza email, utili a proteggersi dall’impersonificazione del dominio, esponendo così tifosi, clienti e partner a un’escalation del rischio cyber di frodi via email in grado di sfruttare la fama e la fiducia di questi marchi. “Il dato dei domini malevoli, degli account fake e delle credenziali esposte dimostra che non siamo davanti a truffe improvvisate, ma a campagne industrializzate che sfruttano emozione, urgenza e fiducia nel brand“, evidenzia Sandro Sana. Infatti, tra gennaio e maggio 2026, si conta la registrazione di oltre 13.000 nuovi domini a tema FIFA World Cup 2026. Circa l’8,8% di questi domini è risultato malevolo o sospetto. “Il tifoso cerca un biglietto, uno streaming o un’offerta di viaggio; l’attaccante cerca il momento in cui abbassa la guardia”, continua Sana. industrializzate FortiGuard Labs ha inoltre rilevato più di 1.700 account e canali sospetti legati alla FIFA su piattaforme social e di messaggistica e identificato oltre 4.600 URL collegati alla FIFA presenti nei log degli infostealer, connessi a famiglie malware come Vidar, LummaC2 e RedLine. Da sempre, i cyber criminali puntano a trarre beneficio dai grandi eventi sportivi globali, per sferrare truffe di social engineering per fingersi sponsor, compagnie aeree, brand legati all’hospitality, servizi di delivery o brand consumer, sfrttando domini dall’aspetto affine ed email di spoofing. “Biglietti, streaming, merchandising, offerte di lavoro: ogni desiderio diventa una porta socchiusa, un’opportunità per applicare tecniche di ingegneria sociale”, avverte Curioni. Ad attirare i criminal hacker è il picco significativo di viaggi, la fame di biglietti, l’interesse per promozioni e attività di merchandising. “La Coppa del Mondo sarà una festa, ma in rete le feste attirano anche i borseggiatori”, sottolinea Curioni. Le aziende dovrebbero potenziare la sicurezza dell’intero ecosistema contro le minacce diffuse via email, principale vettore di attacco per le frodi. Inoltre l’AI aumenta il rischio di cadere vittime, attraverso messaggi credibili. Per esempio, stanno anche crescendo le truffe su WhatsApp, alimentate dall’aumento dell’uso dell’AI per spedire messaggi più convincenti, accompagnati perfino da deepfake e voci clonate. In appena mezz’ora le frodi via messaggio telefonico possono costare salatissime: secondo Kaspersky, le perdite ammontano in media a 770 euro per truffa. Per effettuare una verifica dello stato attuale delle difese dal rischio di impersonificazione, Proofpoint ha messo sotto la lente il livello di adozione del protocollo DMARC (Domain-based Message Authentication, Reporting and Conformance), la prima linea difensiva dalle frodi via email, su una lista di domini degli sponsor della Coppa del Mondo. Negli ultimi anni, infatti, Proofpoint ha osservato i criminal hacker sfruttare sempre più frequentemente una gamma di tattiche per fingersi organizzazioni legittime, allo scopo di centrare i propri obiettivi, invece di compromettere ed infiltrarsi in reti e infrastrutture tecniche delle loro vittime. Secondo l’indagine di Proofpoint, dei 25 domini esaminati, 24 (96%) hanno pubblicato un record DMARC a livello base: significa che la maggior parte delle aziende ha iniziato la fase di implementazione di protezioni dall’impersonificazione dei domini email. Però, soltanto 16 dei 25 domini (64%) hanno implementato la protezione attiva del proprio nome con la policy DMARC più solida “reject”, per impedire la consegna di email non autenticate e spoofed. Dunque, oltre un terzo (il 36%) non riesce ancora a bloccare in modo proattivo le email fraudolente dedicate all’impersonificazione del proprio marchio. DMARC rappresenta un protocollo di autenticazione delle email, nato per tutelare i nomi di dominio dall’abuso da parte di attaccanti, tramite la convalida dell’identità del mittente prima di consentire a un messaggio di raggiungere la propria destinazione. Infatti DMARC dispone ditre livelli di difesa: monitoraggio, quarantena e reject (che costituisce la modalità più sicura per impedire a messaggi sospetti di arrivare nella casella di posta). L’adozione di DMARC permette a un’azienda di delineare l’applicazione del trattamento giusto ai messaggi email che sfruttano il suo nome di dominio, nonché della policy in caso di fallimento durante la verifica: accettare il messaggio email (p=nessuna, dove “p” sta per policy), classificarlo come spam (p=quarantena), o eliminarlo (p=reject). “Per aziende, operatori turistici, media, hospitality e infrastrutture coinvolte, la sicurezza non può partire il giorno dell’evento: deve essere già attiva ora, con monitoraggio del brand, threat intelligence, protezione delle identità e awareness mirata. Chi aspetta la partita inaugurale è già in ritardo”, conclude Sandro Sana. Conviene comunque diffidare di richieste urgenti, non effettuare clic su link ricevuti in messaggi inattesi e verificare sempre l’autenticità delle comunicazioni mediante i canali ufficiali. Inoltre, l’uso dell’autenticazione a più fattori e di password uniche per i servizi online aiuta a ridurre il rischio di violazioni successive. I tifosi dovrebbero dunque dimostrare particolare cautela in occasione del torneo e adottare i seguenti suggerimenti: Il modo più sicuro per l’acquisto dei biglietti è sul sito ufficiale della FIFA, che ha già adottato una policy DMARC completa di tipo ‘reject’.” Occorre essere diffidenti verso e-mail, SMS o chiamate non sollecitate, specialmente quelle che imprimono un senso di urgenza o spingono ad eseguire pagamenti immediati. Non bisogna mai effettuare condivisioni di informazioni finanziarie o password via email o SMS; nel dubbio, occorre contattare l’azienda tramite i canali ufficiali. Impostare una password unica per ogni account ed attivare l’autenticazione multi-fattore (MFA). “Al di là dei controlli, di canali ufficiali, vale molto di più la diffidenza verso l’occasione troppo perfetta. Per restare in una metafora calcistica, nel digitale il gol più pericoloso è quello che subiamo prima ancora di essere scesi in campo”, conclude Curioni.

A likely North Korean threat actor has phished software developers at almost 100 organizations with fake job and code-review lures to steal cryptocurrency and credentials. According to new analysis from Proofpoint, which tracks the cluster as UNK_DeadDrop, the campaign sent more than 250 emails in April and May 2026. Targets were mostly US-based and worked in technology, education or finance, with a focus on cryptocurrency firms. Each email linked to a GitHub or GitLab repository dressed up as a coding assignment, with instructions to clone it and open the folder in an editor such as VS Code or Cursor. The pretexts shifted across the weeks: jobs for full-stack and "agent lead" developer roles, requests to peer-review open-source code, a task to test an ERC-4626 smart-contract vault in Foundry and a project building AI payment agents. Inside each repository sits a hidden tasks.json file rigged to run the instant the folder opens, abusing a legitimate editor feature. VS Code at least shows a trust prompt; Cursor shows none, running the payload silently with no interaction. The script installs a malicious VS Code extension posing as a Google service, which relaunches the malware whenever the editor reopens on macOS or Linux. The chains then split, with Linux and macOS getting a Go remote access trojan from the open-source Overlord framework, while the Windows version runs as JavaScript inside the editor itself, leaving no file on disk. Fake Prompts and Drained Wallets Whatever the platform, the goal is the same: drain cryptocurrency and credentials. The malware scans for browser data and a long list of cryptocurrency wallets, including: Browser-based wallet extensions such as MetaMask, Phantom and Keplr Desktop wallet apps including Exodus, Electrum and Ledger Live Saved passwords and cookies from Chrome, Brave, Edge and Firefox To reach protected secrets, the macOS and Linux versions show a fake password dialog, then reuse the captured password to relaunch as root and dump the keychain or keyring. The Windows variant instead bypasses Chrome's app-bound encryption. After uploading the haul, the loader deletes its files to cover its tracks. Proofpoint said they saw clear echoes of Contagious Interview, the long-running North Korean operation that baits developers with fake recruiters, but is tracking UNK_DeadDrop separately. The team cited the campaign's email-led delivery, the industrial scale of repository creation and a self-contained payload that survives infrastructure takedowns as key differentiators. "While attribution to a known actor remains unconfirmed, Proofpoint continues to track this ongoing activity as an independent cluster," the company concluded. North Korea-aligned crews have targeted developers this way since at least 2022, using fake recruiter personas and poisoned developer tools.

A new Chinese-speaking cybercrime group has expanded its reach from East Asia into Europe and Africa, while rapidly overhauling the malware it uses to break into corporate networks. According to new analysis from Proofpoint, the actor, tracked as TA4922, is financially motivated and focused on gaining remote access to victim systems for data theft, fraud and the resale of access. The group runs more distinct campaigns than any other cybercrime actor Proofpoint currently tracks. Its operations are unusually varied, mixing malware delivery, credential phishing and outright fraud such as credit card theft across different campaigns. From East Asia to Europe and Africa Historically concentrated on Japan, the actor also targets organizations in Taiwan, Korea, Singapore and India. In recent months its campaigns have reached the UK, Germany, Italy and South Africa. The lures are carefully localized, impersonating tax authorities, finance departments and human resources teams in the target's own language and themed around payroll, invoicing and HR notices. TA4922 also tries to move victims off email and onto messaging apps such as LINE, WhatsApp and Microsoft Teams, where it can continue the social engineering beyond the view of email security. A Fast-Changing, AI-Assisted Arsenal The group's tooling has reportedly shifted quickly. Recent campaigns delivered a newly identified backdoor, Atlas RAT, alongside two fresh loader families Proofpoint named RomulusLoader and SilentRunLoader, in addition to long-used malware such as ValleyRAT, also known as Winos 4.0. Payloads were typically installed through DLL sideloading and staged from consumer file-sharing services. TA4922 also blends in with legitimate software, using RomulusLoader to drop remote management tools (RMT) such as AnyDesk. Proofpoint assessed with high confidence that the group is using large language models (LLMs) to quickly build its Python malware, citing telltale signs such as an unchanged placeholder key left in the code. Proofpoint ties TA4922 to the same broad ecosystem as the Silver Fox and Void Arachne clusters, which other researchers have linked to espionage, but assesses it as a distinct, crime-focused group. Even so, the surveillance features in its malware, including audio, webcam and keylogging capture, could be sold to or used by espionage actors. "The global nature of this actor shows how organizations should be aware of emerging and complex threats, regardless of geographic targeting," the company wrote. "These types of actors can quickly expand and scale their tactics to include more targets at any time." To reduce exposure, Proofpoint urged organizations to enforce application allowlisting, monitor programs running from temporary user directories and limit local administrator rights.

A new China-linked cybercrime group known as TA4922 has expanded its targeting focus to target European organizations in the U.K., Germany, Italy, and South Africa. These efforts have been complemented by a "rapid operational tempo" and a continually evolving malware arsenal comprising known families like ValleyRAT (aka Winos 4.0) and Atlas RAT (aka AtlasCross RAT), as well as previously undocumented tools called RomulusLoader and SilentRunLoader, according to Proofpoint. The enterprise security company is keeping tabs on the activity under the moniker TA4922, describing it as a Chinese-speaking threat actor largely targeting East Asia. TA4922 is assessed to share some level of overlap with Silver Fox, with the threat actor's tradecraft more focused on cybercriminal objectives than espionage. "The actor is likely financially motivated and focused on obtaining remote access to victim environments for financial gain, such as data theft, fraud, access resale, or persistent access," the company said, characterizing it as an adversary conducting "more unique campaigns" than any other threat actor it tracks. In recent months, however, attacks mounted by the hacking group have relied on phishing campaigns using human resources- and business-themed lures for credential phishing, fraud, and malware delivery, including Atlas RAT, RomulusLoader, and SilentRunLoader. Another notable shift involves attempts to move conversations from emails to out-of-band communication channels like LINE, WhatsApp, and Microsoft Teams, allowing the attackers to bypass enterprise security controls and steal data or deliver malware. Details of some of the recently observed TA4922 phishing campaigns are below - March 6, 2026: Using human resources-related lures in attacks targeting Japanese organizations to deliver Atlas RAT via DLL side-loading March 23, 2026: Using corporate- and human resources-themed lures in attacks targeting Japanese organizations to deliver a C-based loader called RomulusLoader via DLL side-loading March 30, 2026: Using tax authority-related lures in attacks targeting organizations in the U.K. to deliver a vibe-coded Python-based loader and stealer called SilentRunLoader, which then drops an executable to harvest sensitive data from Google Chrome including stored credentials, cookies, and browsing information April 2, 2026: Using human resources communication lures in attacks targeting organizations in the U.K. and Germany to deliver Atlas RAT via DLL side-loading April 7, 2026: Using invoice-related lures in attacks targeting Japanese organizations to deliver Atlas RAT via DLL side-loading April 10, 2026: Using benefits- and compliance-themed lures in attacks targeting organizations across Southeast Asia and the U.K. to deliver SilentRunLoader via DLL side-loading and exfiltrate Chrome data Mid-April 2026: Using business- and tax-related themes in attacks targeting organizations in Japan and Germany to deliver RomulusLoader, which is then used to deploy AnyDesk and SyncFuture via DLL side-loading "While the actor is assessed to be financially motivated, the capabilities of the malware include the potential for surveillance, which could be used by or sold to espionage groups," Proofpoint said. "The global nature of this actor shows how organizations should be aware of emerging and complex threats, regardless of geographic targeting. These types of actors can quickly expand and scale their tactics to include more targets at any time."

A Chinese-speaking cybercrime group tracked as TA4922 has been escalating activities and expanding to new geographies, Proofpoint reports. Relying on social engineering, the hacking group has been continually updating its arsenal, distributing multiple malware families and also engaging in credential phishing and fraud schemes such as credit card theft. While some of TA4922’s activities overlap with those of the threat actors tracked as Silver Fox and Void Arachne, the group does not appear to engage in espionage, unlike those clusters. “The campaigns attributed to TA4922 align more closely with cybercriminal objectives despite the actor’s advanced tradecraft,” Proofpoint says. The cybersecurity firm has been tracking TA4922 malicious email campaigns for over a year and believes that its focus is to obtain remote access to victim organizations for data theft, access resale, fraud, and other financially motivated activities. Using HR, payroll tax, and invoicing themes, the hacking group attempts to lure victims into clicking on malicious links to download malicious payloads or unwittingly share their credentials. Historically, the cybercrime gang has sent hundreds to a few thousand messages per campaign, tailored to specific regions or business functions, targeting organizations in Japan, Taiwan, Korea, Singapore, and India. Recently, the group also started targeting European organizations in the UK, Germany, and Italy, as well as entities in South Africa. TA4922 was also seen launching credential-phishing and imposter campaigns, looking to shift communication from email to out-of-band channels, including messaging platforms such as LINE, WhatsApp, or Microsoft Teams. “Once communication moves to those platforms, the actor is better positioned to extend social engineering, harvest contact information, or deliver malware beyond traditional email security visibility,” Proofpoint says. In March, the threat actor used HR lures in campaigns targeting organizations in Japan with the Atlas RAT backdoor and the RomulusLoader malware loader. In April, the group used HR lures and previous infrastructure in Atlas RAT attacks against organizations in the UK and Germany, but switched to customer service communications lures in another campaign. Multiple April campaigns attributed to TA4922 relied on RomulusLoader to install legitimate Remote Monitoring and Management (RMM) tools, including AnyDesk and SyncFuture. At the end of March, the group targeted UK organizations with the SilentRunLoader Python‑based loader and stealer to exfiltrate credentials, cookies, and browsing information from Google Chrome. In April, SilentRunLoader was used in attacks against entities in Southeast Asia and the UK. According to Proofpoint, the cybercrime gang has also been observed using the ValleyRAT (Winos4.0) backdoor and other malware families in attacks. “TA4922 currently conducts more unique campaigns than any other tracked cybercrime threat actor in Proofpoint threat data, demonstrating high operational tempo, a variety of lures, and multiple objectives. While the actor is assessed to be financially motivated, the capabilities of the malware include the potential for surveillance which could be used by or sold to espionage groups,” Proofpoint notes. Related: Chinese APTs Expand Targets, Update Backdoors in Recent Campaigns Related: Alleged Chinese State Hacker Extradited to US Related: Chinese Hackers Caught Deep Within Telecom Backbone Infrastructure

A Chinese-speaking cybercrime group has expanded its targeting to the European space, deploying previously undocumented malware and the Atlas backdoor. Tracked as TA4922, the threat actor is associated with financially motivated attacks aimed at breaching target networks for fraud, data theft, and the sale of access. TA4922 has previously targeted organizations in East Asia, but recent campaigns have focused on entities in Germany, Italy, the United Kingdom, and South Africa. Researchers at cybersecurity company Proofpoint note that TA4922 shares overlaps with activity previously reported as ‘Silver Fox’ and ‘Void Arachne. However, the activity cluster is tracked separately as it is more consistent with cybercrime than espionage. Since March, TA4922’s activity has increased sharply, and since April, it has shown unprecedented operational diversity and high tempo. “TA4922 currently conducts more unique campaigns than any other tracked cybercrime threat actor in Proofpoint threat data, demonstrating high operational tempo, a variety of lures, and multiple objectives,” Proofpoint says in a report today. “While the actor is assessed to be financially motivated, the capabilities of the malware include the potential for surveillance, which could be used by or sold to espionage groups.” The attacker uses localized phishing lures crafted to appear as payroll notices, tax audits, VAT filings, government compliance notices, invoices, and human resources communications. The threat group also attempts to contact victims via WhatsApp, the LINE messenger, and Microsoft Teams. Atlas RAT and custom loaders Proofpoint reports that TA4922 has significantly expanded its malware arsenal and believes the hackers may be using large language models (LLMs) to accelerate malware development. This conclusion is based on the presence of placeholder values, code comments, and patterns commonly associated with AI-generated code. Proofpoint’s report highlights Atlas RAT, a recently identified remote access trojan that offers attackers the following capabilities: System reconnaissance Targeted file theft Plugin and payload downloads Keylogging Screenshot capturing Audio and webcam recording System shutdown/reboot commands The malware features several anti-sandbox and anti-analysis checks, including looking for usernames and registry keys associated with Microsoft Defender Application Guard, the “CExecSvc” service, and OS UUID. The researchers also discovered a new malware loader named RomulusLoader, which downloads and executes additional payloads using process hollowing, shellcode injection, and direct execution. RomulusLoader was deployed to launch legitimate remote management tools such as AnyDesk and SyncFuture, a remote monitoring software tool popular in China. Weirdly, the latter was used in attacks targeting German entities. Proofpoint also identified a Python-based loader and information stealer called SilentRunLoader, which steals from Google Chrome credentials, cookies, and browsing data. That malware was deployed against organizations in the United Kingdom and Southeast Asia, using lures that impersonated government services. Finally, the researchers spotted the deployment of Winos4.0, a previously documented malware family that Proofpoint tracks as ValleyRAT and which provides operators with a full set of remote access features. According to Proofpoint, TA4922 is responsible for "more unique campaigns" than any other threat actor the company tracks. The group is moving quickly and uses multiple lures. According to the researchers, the capabilities of the malware used by this actor have "the potential for surveillance which could be used by or sold to espionage groups." Proofpoint's report includes indicators of compromise for the malware and command-and-control (C2) infrastructure used in TA4922's attacks. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

After a quiet period since 2023, Chinese state-backed group TA416 has reemerged with a vengeance, launching a fresh wave of cyber espionage campaigns against European governments. Proofpoint researchers detected the group’s renewed activity in mid-2025, with multiple malware delivery campaigns targeting EU and NATO diplomatic missions across a range of European countries. TA416 regularly altered its infection chain, including abusing Cloudflare Turnstile challenge pages, abusing OAuth redirects and using C# project files, as well as frequently updating its custom PlugX payload, noted the Proofpoint researchers in an April 1 report. In March 2026, Proofpoint also observed in the weeks following the outbreak of conflict in Iran TA416 expand its targets to include diplomatic and government entities in the Middle East. TA416 in 2025-2026: Europe-Focused Espionage Campaigns From mid-2025 to early 2026, Proofpoint researchers said TA416 conducted both "broad web bug" and malware delivery campaigns. According to the researchers, web bugs, also known as ‘tracking pixel,’ refer to tiny invisible objects embedded in an email that triggers an HTTP request to a remote server when opened, revealing the recipient's IP address, user agent. and time of access. This allows the threat actor to assess whether the email was opened by the intended target. The TA416 web bug campaigns used freemail sender accounts and a range of thematic lures, such as Europe sending troops to Greenland to perform delivery and engagement reconnaissance. Malware delivery campaigns used both attacker-controlled freemail accounts and compromised government and diplomatic mailboxes to send links to malicious archives hosted on Microsoft Azure Blob Storage, actor-controlled domains, Google Drive and compromised SharePoint instances. TA416 repeatedly altered its initial infection chains while maintaining a consistent goal of loading the group's customized PlugX backdoor via DLL sideloading triads. Initial access techniques changed over the course of the campaign, with several distinct approaches observed across different time periods: September 2025 – January 2026: The group used spoofed Cloudflare Turnstile challenge pages that gated access to ZIP archives December 2025 – January 2026: TA416 abused Microsoft Entra ID third‑party applications that redirected users to attacker-controlled malware delivery domains From February 2026: Campaigns shifted to using archives containing a renamed Microsoft MSBuild executable and malicious C# project files In each case, TA416 relied on either ZIP smuggling using Microsoft shortcut (LNK) files or CSPROJ-based downloaders to deliver a signed executable, malicious DLL and encrypted payload triad that ultimately loaded PlugX into memory. TA416 or Mustang Panda? TA416 is the codename attributed to a Chinese-backed advance persistent threat (APT) group also know by many names, the most common is Mustang Panda. According to MITRE ATT&CK, Mustang Panda was first discovered in 2012 and has been targeting government, diplomatic and non-governmental organizations, including think tanks, religious institutions and research entities, across the US, Europe and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan and Vietnam. However, Proofpoint researchers track Mustang Panda under two primary clusters: TA416 (aka Vertigo Panda, RedDelta, Red Lich, UNC6384, SmugX, DarkPeony) and a second group tracked under the temporary designator UNK_SteadySplit (aka CerenaKeeper, Red Ishtar). Prior research by Trend Micro had identified technical overlaps between TA416 and UNK_SteadySplit, most notably through a UNK_SteadySplit TONESHELL command-and-control (C2) IP address embedded in a filepath within two LNK files used in TA416 campaigns. The latest Proofpoint report suggested that these connections imply some form of organizational, personnel or hierarchical link between the two groups. However, Proofpoint clarified that while such overlaps were documented in earlier operations, the nature of the relationship remains unclear and no similar connections have been observed in recent campaigns. Proofpoint also highlighted those other aliases for Mustang Panda, including Twill Typhoon, Temp.HEX, Earth Preta, Stately Taurus, HoneyMyte and Hive0154, likely refer to campaigns where TA416 and UNK_SteadySplit were working together. TA416’s Infrastructure TA416 uses a steady supply of re-registered, formerly legitimate domains for C2, malware delivery and web bugs, often first using domains within days after re-registering them, a tactic that allows the group to evade domain reputation-based security controls. Proofpoint noted that the 2025 and 2026 TA416 campaigns were leveraging virtual private server (VPS) providers Evoxt Enterprise (AS149440), XNNET LLC (AS6134) and Kaopu Cloud HK Limited (AS138915). The group typically also uses the Cloudflare Content Delivery Network (CDN) to obscure backend hosting IP addresses used for malware delivery and C2 and deploys minimal fake websites on its C2 domains, likely to hinder signaturing and tracking efforts and to make these domains appear legitimate. In October 2025, Arctic Wolf reported about a cyber espionage campaign targeting Belgian and Hungarian diplomats that it attributed to Mustang Panda.

A Russian state-sponsored hacking group tracked as Star Blizzard has adopted the DarkSword iOS exploit kit in an ongoing campaign, Proofpoint reports. On Friday, investigation platform Malfors warned that a Russian threat actor has been using Atlantic Council lures in an email campaign delivering the DarkSword-linked GhostBlade malware. Shortly after, Proofpoint attributed the campaign to Star Blizzard, an APT associated with the Russian intelligence service FSB and which is also tracked as Callisto, ColdRiver, SeaBorgium, and TA446. According to the cybersecurity firm, the messages were observed on March 26 and originated from multiple compromised sender addresses. Over the past two weeks, Proofpoint says, Star Blizzard has significantly increased the volume of malicious emails compared to its normal operational tempo. The March 26 activity represented a similar spike in volume and marked another shift in attack tradecraft: the emails contained links instead of malicious attachments. “Proofpoint automated analysis was redirected to a benign decoy PDF, likely because of server-side filtering to only redirect iPhone browsers to the exploit kit,” the cybersecurity firm says. It also notes that it has found evidence that Star Blizzard has added the DarkSword iOS exploit kit to its arsenal, pointing out that this is the first time the APT has been seen targeting iCloud accounts and Apple devices. The evidence, Proofpoint notes, includes a DarkSword loader uploaded to VirusTotal that references a second-stage domain associated with the hacking group, and a submission on @URLScan showing the use of the exploit. The known Star Blizzard domain was “serving the DarkSword exploit kit, including the initial redirector, exploit loader, RCE, and PAC bypass components. The sandbox escapes were not observed,” Proofpoint says. The cybersecurity firm has not observed the exploit kit’s delivery, but believes that the Russian APT has adopted it for credential harvesting and intelligence collection after someone leaked it on GitHub. The Atlantic Council-themed campaign has targeted financial, government, higher education, and legal entities, as well as think tanks, “indicating that this new capability led TA446 to attempt to use DarkSword opportunistically against a broader target set,” Proofpoint notes. Related: Coruna iOS Exploit Kit Likely an Update to Operation Triangulation Related: Russian APT Exploits Zimbra Vulnerability Against Ukraine Related: Ex-US Defense Contractor Executive Jailed for Selling Exploits to Russia

Proofpoint has disclosed details of a targeted email campaign in which threat actors with ties to Russia are leveraging the recently disclosed DarkSword exploit kit to target iOS devices. The activity has been attributed with high confidence to the Russian state-sponsored threat group known as TA446, which is also tracked by the broader cybersecurity community under the monikers Callisto, COLDRIVER, and Star Blizzard (formerly SEABORGIUM). It's assessed to be affiliated with Russia's Federal Security Service (FSB). The hacking group is known for spear-phishing campaigns aimed at harvesting credentials from targets of interest. However, attacks mounted by the threat actor over the past year have targeted victims' WhatsApp accounts, as well as leveraged various custom malware families to steal sensitive data. The latest activity, highlighted by Proofpoint and Malfors, involves using fake "discussion invitation" emails spoofing the Atlantic Council to facilitate the delivery of GHOSTBLADE, a dataminer malware, via the DarkSword exploit kit. The emails were sent from compromised senders on March 26, 2026. One of the email recipients was Leonid Volkov, a prominent Russian opposition politician and the political director of the Anti-Corruption Foundation. An automated analysis triggered by Proofpoint's security tools is said to have redirected to a benign decoy PDF document, likely because of server-side filtering put in place to only lead iPhone browsers to the exploit kit. "We have not previously observed TA446 target users' iCloud accounts or Apple devices, but the adoption of the leaked DarkSword iOS exploit kit has now enabled the actor to target iOS devices," Proofpoint said. The enterprise security firm also noted that the volume of emails from the threat actor has been "significantly higher" in the last two weeks, adding that these attacks lead to the deployment of a known backdoor referred to as MAYBEROBOT via password-protected ZIP files. The group's use of DarkSword has also been corroborated by the fact that a DarkSword loader uploaded to VirusTotal has been found to reference "escofiringbijou[.]com," a second-stage domain attributed to the threat actor. A urlscan.io result has revealed that the TA446-controlled domain has served the DarkSword exploit kit, including the initial redirector, exploit loader, remote code execution, and Pointer Authentication Code (PAC) bypass components. However, there is no evidence that sandbox escapes were delivered. It's suspected that the TA446 is repurposing the DarkSword exploit kit for credential harvesting and intelligence collection, with Proofpoint noting that the targeting observed in the email campaign was "much wider than usual" and that it included government, think tank, higher education, financial, and legal entities. This, in turn, has raised the possibility that the threat actor is leveraging the new capability afforded by DarkSword as part of an opportunistic campaign against a broader target set. Greg Lesnewisch, staff threat researcher at Proofpoint, told The Hacker News that the attack likely leveraged a leaked version of DarkSword, which was taken directly from one of UNC6353's watering holes and uploaded to GitHub, and that "TA446 is using the same version of the exploit kit UNC6353 was using." It's currently not known if any of these attacks were successful. However, Proofpoint said all messages targeting its customers were blocked. The development comes as Apple has begun sending Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS to alert users of web-based attacks and urging them to install the update to block the threat. The unusual step signals that the company is treating it as a broad enough threat requiring users' immediate attention. Apple's warning also coincides with the leak of a new version of DarkSword on GitHub, raising concerns that they could democratize access to nation-state exploits, fundamentally shifting the mobile threat landscape. Justin Albrecht, principal researcher at Lookout, said the leaked, plug-and-play version allows even unskilled threat actors to deploy the advanced iOS espionage kit, turning it into commodity malware. "DarkSword refutes the common belief that iPhones are immune to cyber threats, and that advanced mobile attacks are only used in targeted efforts against governments and high-ranking officials," Albrecht added.

Cybersecurity researchers are calling attention to an active device code phishing campaign that's targeting Microsoft 365 identities across more than 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany. The activity, per Huntress, was first spotted on February 19, 2026, with subsequent cases appearing at an accelerated pace since then. Notably, the campaign leverages Cloudflare Workers redirects with captured sessions redirected to infrastructure hosted on a platform-as-a-service (PaaS) offering called Railway, effectively turning it into a credential harvesting engine. Construction, non-profits, real estate, manufacturing, financial services, healthcare, legal, and government are some of the prominent sectors targeted as part of the campaign. "What also makes this campaign unusual is not just the device code phishing techniques involved, but the variety of techniques observed," the company said. "Construction bid lures, landing page code generation, DocuSign impersonation, voicemail notifications, and abuse of Microsoft Forms pages are all hitting the same victim pool through the same Railway.com IP infrastructure." Device code phishing refers to a technique that exploits the OAuth device authorization flow to grant the attacker persistent access tokens, which can then be used to seize control of victim accounts. What's significant about this attack method is that the tokens remain valid even after the account's password is reset. At a high level, the attack works as follows - Threat actor requests a device code from the identity provider (e.g, Microsoft Entra ID) via the legitimate device code API. The service responds with a device code. Threat actor creates a persuasive email and sends it to the victim, urging them to visit a sign-in page ("microsoft[.]com/devicelogin") and enter the device code. After the victim enters the provided code, along with their credentials and two-factor authentication (2FA) code, the service creates an access token and a refresh token for the user. "Once the user has fallen victim to the phish, their authentication generates a set of tokens that now live at the OAuth token API endpoint and can be retrieved by providing the correct device code," Huntress explained. "The attacker, of course, knows the device code because it was generated by the initial cURL request to the device code login API." "And while that code is useless by itself, once the victim has been tricked into authenticating, the resulting tokens now belong to anyone who knows which device code was used in the original request." The use of device code phishing was first observed by Microsoft and Volexity in February 2025, with subsequent waves documented by Amazon Threat Intelligence and Proofpoint. Multiple Russia-aligned groups tracked as Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, have been attributed to these attacks. The technique is insidious, not least because it leverages legitimate Microsoft infrastructure to perform the device code authentication flow, thereby giving users no reason to suspect anything could be amiss. In the campaign detected by Huntress, the authentication abuse originates from a small cluster of Railway.com IP addresses, with three of them accounting for roughly 84% of observed events - 162.220.234[.]41 162.220.234[.]66 162.220.232[.]57 162.220.232[.]99 162.220.232[.]235 The starting point of the attack is a phishing email that wraps malicious URLs within legitimate security vendor redirect services from Cisco, Trend Micro, and Mimecast so as to bypass spam filters and trigger a multi-hop redirect chain featuring a combination of compromised sites, Cloudflare Workers, and Vercel as intermediaries before taking the victim to the final destination. "The observed landing sites prompt the victim to proceed to the legitimate Microsoft device code authentication endpoint and input a provided code in order to read some files," Huntress said. "The code is rendered directly on the page when the victim arrives." "This is an interesting iteration of the tactic, as, normally, the adversary must produce and then provide the code to the victim. By rendering the code directly on the page, likely by some code generation automation, the victim is immediately provided with the code and pretext for the attack." The landing page also comes with a "Continue to Microsoft" that, when clicked, spews a pop-up window rendering the legitimate Microsoft authentication endpoint ("microsoft[.]com/devicelogin"). Almost every device code phishing site has been hosted on a Cloudflare workers[.]dev instance, illustrating how the threat actors are weaponizing the trust associated with the service in enterprise environments to sidestep web content filters. To combat the threat, users are advised to scan sign-in logs to hunt for Railway IP logins, revoke all refresh tokens for affected users, and block authentication attempts from Railway infrastructure if possible. Huntress has since attributed the Railway attack to a new phishing-as-a-service (PhaaS) platform known as EvilTokens, which made its debut last month on Telegram. Besides advertising tools to send phishing emails and bypass spam filters, the EvilTokens dashboard provides customers with open redirect links to vulnerable domains to obscure the phishing links. "In addition to rapid growth in tool functionality, the EvilTokens team has spun up a full 24/7 support team and a support feedback channel," the company said. "They also have customer feedback." The disclosure comes as Palo Alto Networks Unit 42 also warned of a similar device code phishing campaign, highlighting the attack's use of anti-bot and anti-analysis techniques to fly under the radar, while exfiltrating browser cookies to the threat actor on page load. The earliest observation of the campaign dates back to February 18, 2026. The phishing page "disables right-click functionality, text selection, and drag operations," the company said, adding it "blocks keyboard shortcuts for developer tools (F12, Ctrl+Shift+I/C/J) and source viewing (Ctrl+U)" and "detects active developer tools by utilizing a window size heuristic, which subsequently initiates an infinite debugger loop." Update In a follow-up analysis published on March 30, 2026, Sekoia described EvilTokens as a new turnkey Microsoft device code phishing kit that's sold under a PhaaS model since mid-February 2026. It also offers customers self-hosted phishing templates that include - A decoy page that impersonates a Microsoft service or trusted application (e.g., Adobe Acrobat, DocuSign, or SharePoint) as part of phishing emails bearing financial, meeting, logistics, or payroll-related lures. A verification code for the user to copy. Instructions to complete identity verification via Microsoft. A "Continue to Microsoft" button that redirects to the legitimate Microsoft device login page. Thus, when a user copies the verification code and clicks on the "Continue to Microsoft" button, the phishing page launches the legitimate Microsoft device sign-in page in a pop-up window. Once the verification code is entered, they are redirected to the standard Microsoft authentication login page. As soon as the sign-in is complete, the attacker gains access to the victim's account for the targeted service. Campaigns leveraging the PhaaS service have targeted organizations across North, Central, and South America, Europe, the Middle-East, Asia, and Oceania. Among the most affected are the U.S., Australia, Canada, France, India, Switzerland, and the U.A.E. The extensive reach and diversity of these campaigns reflect the rapid adoption of EvilTokens, Sekoia added. "EvilTokens provides a turnkey Microsoft device code phishing kit and a range of advanced features to conduct BEC attacks, including access weaponisation, email harvesting, reconnaissance capabilities, a built-in webmail interface, and AI-powered automation," the French cybersecurity company said. "The EvilTokens PhaaS operates through fully featured bots on Telegram and continuously improves its phishing kit with new capabilities. In the near future, the operator intends to extend support to Gmail and Okta phishing pages." (The story was updated after publication on March 31, 2026, to include additional details of EvilTokens.)

Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories. This edition covers a mix of issues: supply chain attacks hitting CI/CD setups, long-abused IoT devices being shut down, and exploits moving quickly from disclosure to real attacks. There are also new malware tricks showing attackers are becoming more patient and creative. It’s a mix of old problems that never go away and new methods that are harder to detect. There are quiet state-backed activities, exposed data from open directories, growing mobile threats, and a steady stream of zero-days and rushed patches. Grab a coffee, and at least skim the CVE list. Some of these are the kind you don’t want to discover after the damage is done. ⚡ Threat of the Week Trivy Vulnerability Scanner Breached in for Supply Chain Attack — Attackers have backdoored the widely used open-source Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions used by thousands of CI/CD workflows. The breach has triggered a cascade of additional supply-chain compromises stemming from impacted projects and organizations not rotating their secrets, resulting in the distribution of a self-propagating worm referred to as CanisterWorm. Trivy, developed by Aqua Security, is one of the most widely used open-source vulnerability scanners, with over 32,000 GitHub stars and more than 100 million Docker Hub downloads. The Trivy compromise is the latest in a growing pattern of attacks targeting GitHub Actions and developers in general. GitHub changed the default behavior of pull_request_target workflows in December 2025 to reduce the risk of exploitation. BAS vs Automated Pentesting: What Each Actually Covers (and Doesn't) Most teams pick one without knowing what the other misses. This guide breaks down both by use case across blue, red, and purple teams so you can see where each fits and where the gaps are. Download Now ➝ 🔔 Top News DoJ Takes Down DDoS Botnets — A cluster of IoT botnets behind some of the largest DDoS attacks ever recorded -- AISURU, Kimwolf, JackSkid, and Mossad -- were wiped as part of a broad law enforcement operation. The botnets largely spread across routers, IP cameras, and digital video recorders that are often shipped with weak credentials and rarely patched. Authorities removed the command-and-control servers used to commandeer the infected nodes. Together, operators of the four botnets had amassed more than 3 million devices, which they then sold access to other criminal hackers, who then used them to target victims with DDoS attacks to knock websites and internet services offline or mask other illicit activity. Some of these DDoS attacks were aimed at U.S. Department of Defense systems and other high-value targets. No arrests were announced, but two suspects associated with AISURU/Kimwolf are said to be based in Canada and Germany. All four botnets disrupted by the operation are variants of Mirai, which had its source code leaked in 2016 and has served as the starting point for other botnets. The U.S. Justice Department said some victims of the DDoS attacks lost hundreds of thousands of dollars through remediation expenses or ransom demands from hackers who would only stop overloading websites for a price. Google Debuts New Advanced Flow for Sideloading on Android — Google's advanced flow for Android changes how apps from unverified developers are installed, adding friction to combat scams and malware. The feature is aimed at experienced users and allows sideloading through a one-time setup. The advanced flow adds a 24-hour delay and verification steps intended to disrupt coercive pressure and give users time to make decisions. It’s designed to address scenarios where attackers pressure individuals to install unsafe software and play on the urgency of the operation to push them to bypass security warnings and disable protections before they can pause or seek help. Critical Langflow Flaw Comes Under Attack — A critical security flaw impacting Langflow has come under active exploitation within 20 hours of public disclosure, highlighting the speed at which threat actors weaponize newly published vulnerabilities. The security defect, tracked as CVE-2026-33017 (CVSS score: 9.3), is a case of missing authentication combined with code injection that could result in remote code execution. Cloud security firm Sysdig said that the attacks weaponize the vulnerability to steal sensitive data from compromised systems. "The real-world proof is definitive: threat actors exploited it in the wild within 20 hours of the advisory going public, with no public PoC code available," Aviral Srivastava, who discovered the vulnerability, told The Hacker News. "They built working exploits just from reading the advisory description. That's the hallmark of trivial exploitation when multiple independent attackers can weaponize a vulnerability from a description alone, within hours." Interlock Ransomware Exploited Cisco FMC Flaw as 0-Day — An Interlock ransomware campaign exploited a critical security flaw in Cisco Secure Firewall Management Center (FMC) Software as a zero-day well over a month before it was publicly disclosed. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root on an affected device. "This wasn't just another vulnerability exploit; Interlock had a zero-day in their hands, giving them a week's head start to compromise organizations before defenders even knew to look," Amazon, which spotted the activity, said. Yet Another iOS Exploit Kit Comes to Light — A new watering hole attack against iPhone users has been found to deliver a previously undocumented iOS exploit kit codenamed DarkSword. While some of the attacks targeted users in Ukraine, the kit has also been put to use by two other clusters that singled out Saudi Arabian users in November 2025, as well as users in Turkey and Malaysia. It's worth noting that these exploits would not be effective on devices where Lockdown Mode is active or on the iPhone 17 with Memory Integrity Enforcement (MIE) enabled. The kit used a total of six exploits in iOS to deliver various malware families designed for surveillance and intelligence gathering. Apple has since addressed all of them. "Completely written in JavaScript, DarkSword comprises six vulnerabilities across two exploit chains that were patched in stages ending with iOS 26.3," iVerify said. "Starting in WebKit and moving down to the kernel, it achieves full iPhone compromise with elegant techniques never publicly seen before." The discovery of DarkSword makes it the second mass attack targeting iOS devices. What's more, the Russian threat actor that deployed DarkSword demonstrated poor operational security. They left the full JavaScript code unobfuscated, unprotected, and easily accessible. The findings also point to a secondary market where such exploits are being acquired by threat actors of varied motivations to actively infect unpatched iOS users on a large scale. Perseus Banking Malware Targets Android — A newly discovered Android malware is masking itself within television streaming apps in order to steal users' passwords and banking data and spy on their personal notes, researchers have found. The malware, dubbed Perseus by researchers at ThreatFabric, is being actively distributed in the wild and primarily targets users in Turkey and Italy. To infect devices, attackers disguise the malware inside apps that appear to offer IPTV services — platforms that stream television content over the internet. These apps are also widely used to stream pirated content and are often downloaded outside official marketplaces like Google Play, making users more accustomed to installing them manually and less likely to view the process as suspicious. Once installed, Perseus can monitor nearly everything a user does in real time. It uses overlay attacks — placing fake login screens over legitimate apps — and keylogging capabilities to capture credentials as they are entered. The malware's most unusual feature is its focus on personal note-taking applications. "Notes often contain sensitive information such as passwords, recovery phrases, financial details, or private thoughts, making them a valuable target for attackers," ThreatFabric said. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-21992 (Oracle), CVE-2026-33017 (Langflow), CVE-2026-32746 (GNU InetUtils telnetd), CVE-2026-32297, CVE-2026-32298 (Angeet ES3 KVM), CVE-2026-3888 (Ubuntu), CVE-2026-20643 (Apple WebKit), CVE-2026-4276 (LibreChat RAG API), CVE-2026-24291 aka RegPwn (Microsoft Windows), CVE-2026-21643 (Fortinet FortiClient), CVE-2026-3864 (Kubernetes), CVE-2026-32635 (Angular), CVE-2026-25769 (Wazuh), CVE-2026-3564 (ConnectWise ScreenConnect), CVE-2026-22557, CVE-2026-22558 (Ubiquiti), CVE-2025-14986 (Temporal), CVE-2026-31381, CVE-2026-31382 (Gainsight Assist), CVE-2026-26189 (Trivy), CVE-2026-4439, CVE-2026-4440, CVE-2026-4441 (Google Chrome), CVE-2026-33001, CVE-2026-33002 (Jenkins), CVE-2026-21570 (Atlassian Bamboo Center), and CVE-2026-21884 (Atlassian Crowd Data Center). 🎥 Cybersecurity Webinars Learn How to Automate Exposure Management with OpenCTI & OpenAEV → Discover how to automate continuous, threat-informed testing using open-source tools like OpenCTI and OpenAEV to validate your security controls against real attacker behavior without increasing your budget. See a live demo on how to verify your security works, identify real gaps, and integrate it into your SOC workflow at no extra cost. Identity Maturity Cracking in 2026: See the New Data + How to Catch Up Fast → Identity programs are under massive pressure in 2026 - disconnected apps, AI agents, and credential sprawl are creating real risks and audit challenges. Join this webinar for new Ponemon Institute 2026 research from over 600 leaders, showing the scale of the problem and practical steps to close gaps, reduce friction, and catch up quickly. 📰 Around the Cyber World WhatsApp Tests Usernames Instead of Phone Numbers — WhatsApp is planning to introduce usernames and unique IDs instead of phone numbers, allowing users to send messages and make voice or video calls without sharing numbers. The optional privacy feature is expected to roll out globally by June 2026, with users and businesses able to reserve unique handles. "We're excited to bring usernames to WhatsApp in the future to help people connect with new friends, groups, and businesses without having to share their phone numbers," the company said in a statement shared with The Economic Times. The feature has been under test since early January 2026. Signal introduced a similar feature in early 2024. FBI Details SE Asia Scam Centers — The U.S. Federal Bureau of Investigation (FBI) detailed its work with Thai authorities to shut down scam centers proliferating in Southeast Asia. The schemes, which primarily target retirees, small-business owners, and people seeking companionship, have been described as a blend of cyber fraud, money laundering, and human trafficking, causing billions of dollars in annual losses. These scam centers operate in a manner that's similar to how legitimate corporations do. "Recruiters advertise high-paying jobs abroad. Workers are flown to foreign countries only to discover that the positions do not exist," the FBI said. "Passports are confiscated. Armed guards patrol the grounds. Under threat of violence, workers are forced to pose as potential romantic partners or savvy investment advisers, cultivating trust with victims over weeks or months." Recent crackdowns in countries like Cambodia have freed thousands of workers from scam compounds, but the FBI warned that these breakthroughs can be temporary, as criminal networks always tend to relocate, rebrand, or shift tactics in response to law enforcement actions. APT28 Exposed Server Leaks SquirrelMail XSS Payload — A second exposed open directory discovered on a server ("203.161.50[.]145") associated with APT28 (aka Fancy Bear) has offered insights into the threat actor's espionage campaigns targeting government and military organizations across Ukraine, Romania, Bulgaria, Greece, Serbia, and North Macedonia. According to Ctrl-Alt-Intel, the directory contained command-and-control (C2) source code, scripts to steal emails, credentials, address books, and 2FA tokens from Roundcube mailboxes, telemetry logs, and exfiltrated data. The stolen data consists of 2,870 emails from government and military mailboxes, 244 sets of stolen credentials, 143 Sieve forwarding rules (to silently forward every incoming email to an attacker-controlled mailbox), and 11,527 contact email addresses. One of the newly identified tools is an XSS payload targeting the SquirrelMail webmail software, highlighting the threat actor's continued focus on leveraging XSS flaws to steal data from email inboxes. It's worth noting that the server was attributed to APT28 by the Computer Emergency Response Team of Ukraine (CERT-UA) as far back as September 2024. "Fancy Bear developed a modular, multi-platform exploitation toolkit where a victim simply opening a malicious email – with no further clicks – could result in their credentials stolen, their 2FA bypassed, emails within their mailbox exfiltrated, and a silent forwarding rule established that persists indefinitely," Ctrl-Alt-Intel said. Analysis of a Beast Ransomware Server — An analysis of an open directory on a server ("5.78.84[.]144") associated with Beast, a ransomware-as-a-service (RaaS) that's suspected to be the successor to Monster ransomware, has uncovered the various tools used by the threat actors and the different stages of their attack lifecycle. These included Advanced IP Scanner and Advanced Port Scanner to map internal networks and find open remote desktop protocol (RDP) or server message block (SMB) ports. Also identified were programs to locate sensitive files for exfiltration and flag which servers hold the most data, as well as Mimikatz, LaZagne, and Automim (for credential harvesting), AnyDesk (for persistence), PsExec (for lateral movement), and MEGASync (for data exfiltration). Beast ransomware operations paused in November 2025 and resumed in January 2026. GrapheneOS Opposes the Unified Attestation Initiative — GrapheneOS has come out strongly against Unified Attestation, stating it "serves no truly useful purpose beyond giving itself an unfair advantage while pretending it has something to do with security." The Unified Attestation initiative is an open-source, decentralized alternative to the Google Play Integrity API to provide device and app integrity checks for custom ROMs without requiring Google Play Services. "We strongly oppose the Unified Attestation initiative and call for app developers supporting privacy, security, and freedom on mobile to avoid it," GraphenseOS said. "Companies selling phones should not be deciding which operating systems people are allowed to use for apps." VoidStealer Uses Chrome Debugger to Steal Secrets — An information stealer known as VoidStealer has observed using a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the "v20_master_key" directly from browser memory and use it to decrypt sensitive data stored in the browser. VoidStealer is a malware-as-a-service (MaaS) infostealer that began being marketed on several dark web forums in mid-December 2025. The ABE bypass technique was introduced in version 2.0 of the stealer announced on March 13, 2026. "The bypass requires neither privilege escalation nor code injection, making it a stealthier approach compared to alternative ABE bypass methods," Gen Digital said. VoidStealer is assessed to have adopted the technique from the open-source ElevationKatz project. FBI Says it is Buying Americans' location Data — FBI director Kash Patel admitted that the agency is buying location data that can be used to track people's movements without a warrant. "We do purchase commercially available information that’s consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us," Patel said at a hearing before the Senate Intelligence Committee. Iranian Botnet Exposed via Open Directory — An Open Directory on "185.221.239[.]162:8080" has been found to contain several payloads, including a Python-based botnet script, a compiled DDoS binary, multiple C-language denial-of-service files, and IP addresses associated with SSH credentials. "A Python script called ohhhh.py reads credentials in a host:port|username|password format and opens 500 concurrent SSH sessions, compiling and launching the bot client on each host automatically," Hunt.io said. "The exposed .bash_history captured three distinct phases of work: standing up the tunnel network, building and testing DDoS tooling against live targets, and iterative botnet development across multiple script versions." The activity has not been linked to any state-directed campaign. OpenClaw Developers Targeted in Phishing Attack — OpenClaw's combination of flexibility, local control, and a fast-growing ecosystem has made it popular among developers in a very short time. While that unprecedented adoption speed has exposed organizations to new security risks of its own (i.e., vulnerabilities and the presence of malicious skills on ClawHub and SkillsMP), threat actors are also capitalizing on the brand name and reputation to set up fake GitHub accounts for a phishing campaign that lures unsuspecting developers with promises of free $CLAW tokens and trick them into connect their cryptocurrency wallet. "The threat actor creates fake GitHub accounts, opens issue threads in attacker-controlled repositories, and tags dozens of GitHub developers," OX Security researchers Moshe Siman Tov Bustan and Nir Zadok said. "The posts claim that recipients have won $5,000 worth of CLAW tokens and can collect them by visiting a linked site and connecting their crypto wallet." The linked site ("token-claw[.]xyz") is a near-identical clone of openclaw.ai rigged with a wallet-draining "Connect your wallet" button designed to conduct cryptocurrency theft. New Campaign Targets Energy Operations Personnel in Pakistan — A targeted campaign against operations personnel at energy firms linked to projects in Pakistan has leveraged phishing emails mimicking invitations to the upcoming Pakistan Energy Exhibition & Conference (PEEC). The messages, sent from compromised accounts from a Pakistani university and a government organization, aim to deceive victims into opening PDF attachments with a fake Adobe Acrobat Reader update prompt. Clicking the update leads to the download of a ClickOnce application resource that drops the Havoc Demon C2 framework. "The redirect chain was also wrapped in geofencing and browser fingerprinting, limiting access to intended targets," Proofpoint said. "That likely reduced the exposure to automated analysis while keeping the delivery path tightly scoped." The activity has been codenamed UNK_VaporVibes. It's assessed to share overlaps with activity publicly associated with SloppyLemming. Over 373K Dark Web Sites Down — International law enforcement agencies announced the takedown of one of the largest known networks of fraudulent platforms on the dark web, uncovering hundreds of thousands of fake websites used to scam users seeking child sexual abuse content. A 10-day international operation led by German authorities and supported by Europol shut down more than 373,000 dark web domains run by a 35-year-old man based in China, who had been operating a sprawling network of fraudulent platforms since at least 2021. While the sites advertised child abuse material and cybercrime-as-a-service offerings, nothing was actually delivered after victims made a payment in Bitcoin. The fraudulent scheme netted the operator an estimated €345,000 from around 10,000 people. Authorities from 23 countries participated in the operation, and have since identified 440 customers whose purchases are now under active investigation. Malicious npm Packages Steal Secrets — Two malicious npm packages, sbx-mask and touch-adv, have been found to steal secrets from victims' computers. While one invokes the malicious code via the postinstall script, the other executes it when application code is invoked by the developer after importing it. "The evidence strongly suggests account takeover of a legitimate publisher, rather than intentional malicious activity," Sonatype said. "Hijacked publisher accounts are particularly concerning as, over time, maintainers build trust with the users of their components. Attackers aim to take advantage of that trust in order to steal valuable, or profitable, information." China to Have Its Own Post-Quantum Cryptography in 3 Years — China is reportedly planning to develop its own national post-quantum cryptography standards within the next three years, according to a report from Reuters. The U.S. finalized its first set of post-quantum cryptography standards in 2024 and is aiming to achieve full industry migration by 2035. What's Next for Tycoon2FA? — A recent law enforcement operation dismantled the infrastructure associated with the Tycoon2FA phishing-as-a-service (PhaaS) platform. However, a new analysis from Bridewell has revealed that some of the 2FA phishing CAPTCHA pages are still live. The lingering activity, the cybersecurity company noted, stems from the fact that these pages operate on a massive network of compromised third-party sites, legitimate SaaS platforms, and thousands of disposable domains. "Operators and affiliates are highly agile and will attempt to rebuild, migrate to new infrastructure, or pivot to competing PhaaS platforms," it added. "The live CAPTCHA pages we are seeing may belong to surviving criminal affiliates attempting to keep their individual campaigns breathing on secondary proxy networks." 🔧 Cybersecurity Tools MESH → It is an open-source tool from BARGHEST that enables remote mobile forensics and network monitoring over an encrypted, peer-to-peer mesh network resistant to censorship. It connects Android/iOS devices behind firewalls or CGNAT using a modified Tailscale-like protocol (no central servers needed), supports ADB wireless debugging, libimobiledevice, PCAP capture, and Suricata IDS—allowing secure, direct access for live logical acquisitions in restricted or hostile environments. enject → It is a lightweight Rust tool that protects .env secrets from AI assistants like Copilot or Claude. It replaces real values in your .env file with placeholders (e.g., en://api_key). Secrets stay encrypted in a per-project store (AES-256-GCM, master password protected). When you run enject run -- , it decrypts them only in memory at runtime, then wipes them—never leaving plaintext on disk. Open-source, macOS/Linux, perfect for safe local development. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion And that’s the week. The real pattern isn’t any one story; it’s the gap. The gap between a flaw and detection. Between a patch and a deployment. Between knowing and doing. Most of this week’s damage happened in that gap, and it’s not new. Before you move on: update your mobile devices, review anything touching your CI/CD pipeline, and don’t store crypto wallet recovery phrases in notes apps.

Microsoft has warned of fresh campaigns that are capitalizing on the upcoming tax season in the U.S. to harvest credentials and deliver malware. The email campaigns take advantage of the urgency and time-sensitive nature of emails to send phishing messages masquerading as refund notices, payroll forms, filing reminders, and requests from tax professionals to deceive recipients into opening malicious attachments, scanning QR code, or interacting with suspicious links. "Many campaigns target individuals for personal and financial data theft, but others specifically target accountants and other professionals who handle sensitive documents, have access to financial data, and are accustomed to receiving tax-related emails during this period," the Microsoft Threat Intelligence and Microsoft Defender Security Research teams said in a report published last week. While some of these efforts direct users to sketchy pages designed through Phishing-as-a-service (PhaaS) platforms, others result in the deployment of legitimate remote monitoring and management tools (RMMs), such as ConnectWise ScreenConnect, Datto, and SimpleHelp, enabling the attackers to gain persistent access to compromised devices. The details of some of the campaigns are below - Using Certified Public Accountant (CPA) lures to deliver phishing pages associated with the Energy365 PhaaS kit to capture victims' email and password. The Energy365 phishing kit is estimated to be sending hundreds of thousands of malicious emails on a daily basis. Using QR code and W2 lures to target approximately 100 organizations, mainly in the manufacturing, retail, and healthcare industries located in the U.S., to direct users to phishing pages mimicking the Microsoft 365 sign-in pages and built using the SneakyLog (aka Kratos) PhaaS platform to siphon their credentials and two-factor authentication (2FA) codes. Using tax-themed domains for use in phishing campaigns that trick users into clicking on bogus links under the pretext of accessing updated tax forms, only to distribute ScreenConnect. Impersonating the Internal Revenue Service (IRS) with a cryptocurrency lure that specifically targeted the higher education sector in the U.S., instructing recipients to download a "Cryptocurrency Tax Form 1099" by accessing a malicious domain ("irs-doc[.]com" or "gov-irs216[.]net") to deliver ScreenConnect or SimpleHelp. Targeting accountants and related organizations, asking for help to file their taxes by sending a malicious link that leads to the installation of Datto. Microsoft said it also observed a large-scale phishing campaign on February 10, 2026, in which more than 29,000 users across 10,000 organizations were affected. About 95% of the targets were located in the U.S., spanning industries like financial services (19%), technology and software (18%), and retail and consumer goods (15%). "The emails impersonated the IRS, claiming that potentially irregular tax returns had been filed under the recipient's Electronic Filing Identification Number (EFIN). Recipients were instructed to review these returns by downloading a purportedly legitimate 'IRS Transcript Viewer,'" the tech giant said. The emails, which were sent through Amazon Simple Email Service (SES), contained a "Download IRS Transcript View 5.1" button that, when clicked, redirected users to smartvault[.]im, a domain masquerading as SmartVault, a well-known document management and sharing platform. The phishing site relied on Cloudflare to keep bots and automated scanners at bay, thus ensuring that only human users are served the main payload: a maliciously packaged ScreenConnect that grants the attackers remote access to their systems and facilitates data theft, credential harvesting, and further post‑exploitation activity. To stay safe against these attacks, organizations are recommended to enforce 2FA on all users, implement conditional access policies, monitor and scan incoming emails and visited websites, and prevent users from accessing the malicious domains. The development coincides with the discovery of several campaigns that have been found to drop remote access malware or conduct data theft - Using fake Google Meet and Zoom pages to lure users into fraudulent video calls that ultimately deliver remote-access software like Teramind, a legitimate employee monitoring platform, by means of a bogus software update. Using a fraudulent website that leverages the Avast branding to trick French-speaking users into handing over their full credit card details as part of a refund scam. Using a typosquatted website impersonating the official Telegram download portal ("telegrgam[.]com") to distribute trojanized installers that, in addition to dropping a legitimate Telegram installer, execute a DLL responsible for launching an in-memory payload. The malware then initiates communication with its command-and-control infrastructure to receive instructions, download updated components, and maintain persistent access. Abusing Microsoft Azure Monitor alert notifications to deliver callback phishing emails that use invoice and unauthorized-payment lures. "Attackers create malicious Azure Monitor alert rules, embedding scam content in the alert description, including fake billing details and attacker-controlled support phone numbers," LevelBlue said. "Victims are then added to the Action Group linked to the alert rule, causing Azure to send the phishing message from the legitimate sender address [email protected]." Using quotation-themed lures in phishing emails to deliver a JavaScript dropper that connects to an external server to download a PowerShell script, which launches the trusted Microsoft application "Aspnet_compiler.exe" and injects into it an XWorm 7.1 payload via reflective DLL injection. The updated malware comes with a .NET-developed component engineered for stealth and persistence. Similar requests for quotation lures have also been used to trigger a fileless Remcos RAT infection chain. Using phishing emails and ClickFix ploys to deliver NetSupport RAT and gain unauthorized system access, exfiltrate data, and deploy additional malware. Using Microsoft Application Registration Redirect URI's ("login.microsoftonline[.]com") in phishing emails to abuse trust relationships and bypass email spam filters to redirect users to phishing websites that capture victims' credentials and 2FA codes. Abusing legitimate URL rewriting services from Avanan, Barracuda, Bitdefender, Cisco, INKY, Mimecast, Proofpoint, Sophos, and Trend Micro to conceal malicious URLs in phishing emails evades detection. "Threat actors have increasingly adopted multi-vendor chained redirection in their phishing campaigns," LevelBlue said. "Earlier activity typically relied on a single rewriting service, but newer campaigns stack multiple layers of already‑rewritten links. This nesting makes it significantly harder for security platforms to reconstruct the full redirect path and identify the final malicious destination." Using malicious ZIP files impersonating a wide range of software, including artificial intelligence (AI) image generators, voice-changing tools, stock-market trading utilities, game mods, VPNs, and emulators, to deliver Salat Stealer or MeshAgent, along with a cryptocurrency miner. The campaign has specifically targeted users in the U.S., the U.K., India, Brazil, France, Canada, and Australia. Using digital invitation lures sent via phishing emails to divert users to a fake Cloudflare CAPTCHA page that delivers a VBScript, which then runs PowerShell code to fetch an evasive .NET loader dubbed SILENTCONNECT from Google Drive to eventually deliver ScreenConnect. The findings follow an uptick in RMM adoption by threat actors, with the abuse of such tools surging 277% year-over-year, according to a recent report published by Huntress. One notable tactic involves the daisy-chaining of distinct RMM tools to fragment telemetry, distribute persistence, and complicate attribution and containment efforts, the company added. "As these tools are used by legitimate IT departments, they are typically overlooked and considered 'trusted' in most corporate environments," Elastic Security Labs researchers Daniel Stepanic and Salim Bitam said. "Organizations must stay vigilant, auditing their environments for unauthorized RMM usage."

Proofpoint unifies email, data, and AI security to reduce enterprise blind spots Proofpoint has unveiled innovations across its Collaboration Security and Data Security portfolios, strengthening protection for the agentic workspace, where people and AI agents interact across communication and data environments to execute business-critical work. As organizations deploy AI assistants and autonomous agents, they are delegating authority at scale. AI systems now draft communications, access sensitive data, and take action at machine speed. Unlike deterministic systems built on fixed rules, AI generates outcomes based on prediction rather than certainty. This shift changes the enterprise risk model, where verifying identity and enforcing static access controls are no longer sufficient. Security teams must understand how activity unfolds across communication, how data is accessed, and whether behavior aligns with legitimate business intent. Email remains the primary entry point for cyberattacks, giving threat actors a foothold to move across systems and access sensitive data. As AI agents accelerate the scale and speed of data interactions, organizations face growing challenges in maintaining visibility and control. Proofpoint connects layered email defense, AI-driven data access governance, and hybrid data visibility within a single platform, helping security teams reduce blind spots, strengthen behavioral insight, and act on risk with greater precision and less operational friction. Strengthening collaboration security across email Proofpoint is bringing together its two email security approaches, Secure Email Gateway (SEG) and API-based protection, into a single, integrated architecture. They create a coordinated protection model in which SEG secures north-south traffic at the perimeter, while API-based protection extends defense to east-west internal email activity. Shared threat intelligence and behavioral signals flow across pre-delivery and post-delivery controls to improve detection over time, while a unified workbench provides customers a single place to manage protection across inbound, outbound, and internal email. Organizations gain expanded coverage for internal-to-internal compromise and direct send vulnerabilities, an increasingly exploited attack path in cloud environments. Correlating detection insights across layers provides deeper visibility into anomalous activity, whether from compromised accounts or automated agents operating within collaboration systems. An integrated administrative experience streamlines policy management, investigation, and response, reducing console switching and analyst fatigue. “Email remains the front door to the enterprise, especially in environments where people and AI agents act on shared information,” said Tom Corn, EVP and GM, Threat Protection Group at Proofpoint. “As organizations delegate more operational decisions to AI systems, security must connect signals across detection layers to understand not just isolated events, but patterns of behavior and underlying intent. We’re advancing collaboration security to reflect how work actually happens, protecting both human users and AI agents operating inside the same communication fabric. Only Proofpoint brings this level of integrated, end-to-end email security to market to deliver 99.999% detection efficacy,” Corn continued. Governing data access across humans and AI agents Proofpoint’s AI Data Access Governance capabilities provide unified visibility into who and what can access sensitive data across SaaS, cloud, and on-prem environments, spanning human users, service accounts, and AI agents. Security teams can identify stale entitlements, orphaned accounts, and over-permissioned access, while automated remediation workflows reduce exposure without manual, ticket-driven processes. By correlating identity activity, data sensitivity, access patterns, data loss prevention (DLP) signals, and risk indicators within the Data Security Graph, organizations move beyond static discovery toward continuous risk reduction, prioritizing governance decisions based on behavioral context and inferred intent rather than entitlement lists alone. Extending AI-native DSPM across hybrid environments As AI becomes embedded in business processes, sensitive data increasingly flows between legacy systems and cloud applications. Without consistent discovery and classification models, security teams lack the context needed to govern how both people and AI agents interact with that data. To address persistent hybrid blind spots, Proofpoint is extending its AI-native Data Security Posture Management (DSPM) capabilities to on-premises environments, delivering intelligent data discovery and classification across the full enterprise environment. Organizations gain consistent visibility into sensitive data regardless of where it resides. This expansion supports more accurate risk prioritization and reduces exposure created by fragmented tooling across cloud and on-prem systems. “Data risk no longer sits in one place. It moves across cloud services, on-prem systems, human users, and AI agents,” said Mayank Chaudhary, EVP and GM, Data Security Group at Proofpoint. “We’re bringing data access governance and hybrid DSPM together within a single platform so organizations can see where sensitive data lives, understand who and what can access it, and take action based on meaningful behavioral signals. In the AI era, data governance ultimately depends on understanding not only the access, but also the intent behind it.”

A method that could enable code execution through manipulated installation links in an AI development environment has been identified by security researchers. The technique, dubbed CursorJack by Proofpoint Threat Research, centres on the abuse of Model Context Protocol (MCP) deeplinks within the Cursor Integrated Development Environment (IDE), potentially allowing attackers to install malicious components or execute arbitrary commands under certain conditions. The findings, based on controlled testing as of January 19, 2026, show that exploitation is not automatic. Instead, it depends on user interaction and system configuration. A single click on a crafted link, followed by approval of an installation prompt, may be sufficient to trigger the behaviour in some environments. Manipulating MCP Deeplinks Cursor uses a custom URL scheme to streamline MCP server installation, embedding configuration data directly into deeplinks that launch the IDE when clicked. Proofpoint found that this process can be exploited through social engineering as malicious links can be crafted to appear legitimate while containing harmful configurations. When users click these links and approve the installation prompt, the IDE may execute commands with the same privileges as the user. Because the installation dialogue does not differentiate between trusted and untrusted sources, attackers can disguise their payloads as routine tools. This creates a pathway for both local code execution and the installation of remote malicious servers, depending on the configuration. Security Implications For Developers The research highlights risks for developers, who often operate with elevated permissions and access sensitive assets such as API keys, credentials and source code. While no zero-click exploitation was observed, the reliance on user approval introduces a human factor that attackers may exploit. The study also noted that modern development workflows, particularly those involving AI tools, may condition users to accept prompts without thorough review. This behaviour increases exposure to deceptive installation requests that appear routine. Researchers recommend several mitigation strategies: Introduce verification mechanisms for trusted MCP sources Implement stricter permission controls for command execution Improve visibility into installation parameters Treat deeplinks from unknown origins with caution "The MCP ecosystem requires fundamental security improvements embedded directly into the framework architecture," Proofpoint wrote, "rather than relying on additional security tools or user vigilance as the primary defense." Proofpoint published its own proof-of-concept cod on . The researchers notified Cursor through its vulnerability‑reporting channel. Image credit: bella1105 / Shutterstock.com

Proofpoint addresses AI threats with intent-based security Proofpoint has announced Proofpoint AI Security, the newest security solution that combines intent-based detection, multi-surface control points, and a comprehensive implementation framework to secure how humans and AI agents use AI across the enterprise. Based on the Agent Integrity Framework, which defines how an AI agent operates with integrity, Proofpoint is introducing a five-phase maturity model for implementation, from initial discovery through runtime enforcement. As organizations rapidly deploy autonomous AI agents to browse the web, access internal systems, send emails, execute code, and orchestrate workflows, risks such as agentic privilege escalation and zero-click prompt injection attacks are becoming real-world threats. A single AI request can trigger dozens of autonomous actions across multiple systems, often at machine speed and without human oversight. Existing security tools can see traffic and permissions, but they don’t evaluate whether AI behavior aligns with the original user intent. Research from Acuvity, recently acquired by Proofpoint, indicates that 70% of organizations lack optimized AI governance, and 50% reported expectations of AI-related data loss within 12 months, highlighting the urgent need to secure agentic AI environments. “AI is now embedded in how work gets done, and security must evolve with it,” said Sumit Dhawan, CEO of Proofpoint. “Humans and AI agents share similar risks: both can be manipulated and both can take actions that diverge from their intended purpose, yet traditional security was never designed to validate intent. Proofpoint is uniquely positioned as a unified cybersecurity platform built to protect people, defend data, and govern AI agents together, providing continuous, intent-based verification that behavior aligns with policy and intent in the agentic workspace.” Intent-based detection models across all AI interactions Security tools lack visibility into the semantic content of AI interactions, where risk often resides. They can see traffic, identities, or permissions, but they cannot determine whether an AI’s actions are appropriate in context or aligned to the intent of the user or agent. Proofpoint AI Security closes this gap by applying intent-based detection models, continuously evaluating whether AI behavior, initiated by a human or an autonomous agent, aligns with the original request, defined policies, and intended purpose. By analyzing the semantic context of AI interactions, the solution flags misaligned or high-risk actions in real time, before damage occurs, such as non-compliant communication or data loss. Protecting against the full spectrum of autonomous AI risks Delivered through a unified architecture for the agentic workspace, Proofpoint AI Security operates across the surfaces where AI is used, including endpoints, browser extensions, and MCP connections, giving organizations the visibility and control needed over AI usage and risks. This is particularly critical in developer environments, where agent-connected coding assistants, plugins, and MCP-integrated tools are accelerating adoption and increasing the need for visibility and policy enforcement. Through these control points, organizations can: Discover sanctioned and unsanctioned AI tools such as OpenClaw, Ollama, ChatGPT, and MCP servers used by humans and agents Observe prompts, responses, and data flows during AI tool usage Apply access controls and guardrails on AI usage Implement runtime inspection and enforce policies during live AI interactions Structured path to implementation with Agent Integrity Framework To provide enterprises with a structured roadmap to safely govern AI, Proofpoint is also introducing the Agent Integrity Framework, a comprehensive guide that defines what it means for an AI agent to operate with integrity and provides a five-phase maturity model for implementation, from initial discovery through runtime enforcement. The framework defines Agent Integrity as the assurance that an AI agent operates within the boundaries of its intended purpose, authorized permissions, and expected behavior, across every interaction, tool call, and data access. It outlines five pillars: Intent Alignment, Identity and Attribution, Behavioral Consistency, Auditability, and Operational Transparency, to help customers operationalize AI governance without needing to overhaul their existing security architecture. “Humans are expected to operate with integrity when using business systems, and AI agents must be held to the same standard,” said Ryan Kalember, EVP of cybersecurity strategy at Proofpoint. “Agent Integrity means ensuring that AI agents act within the boundaries of their intended purpose, authorized permissions, and expected behavior across every interaction, tool call, and data access. With Proofpoint AI Security and the Agent Integrity Framework, we can provide a clear blueprint to help enterprises comprehensively address the full spectrum of risks that emerge when AI agents operate autonomously across enterprise systems.”

INTERPOL on Friday announced the takedown of 45,000 malicious IP addresses and servers used in connection with phishing, malware, and ransomware campaigns, as part of the agency's ongoing efforts to dismantle criminal networks, disrupt emerging threats, and safeguard victims from scams. The effort is part of an international law enforcement operation that involved 72 countries and territories. It also led to the arrest of 94 people, with another 110 individuals still under investigation. A total of 212 electronic devices and servers were seized during raids at various key locations. One such operation in Bangladesh saw 40 suspects arrested and 134 electronic devices confiscated pertaining to a wide range of cybercrime offences, including loan and job scams, identity theft, and credit card fraud. In Togo, authorities apprehended 10 suspects accused of running a fraud ring from a residential area. While some were involved in hacking into social media accounts, others conducted social engineering schemes, including romance scams and sextortion. The fraudsters, after gaining unauthorized access to a victim's account, reached out to their online contacts, impersonating the account holder to engage in fake romantic relationships and deceive friends and family members. The ultimate objective of the scam was to trick the secondary victims into making money transfers. Lastly, Macau law enforcement officials identified more than 33,000 phishing and fraudulent websites related to fake casinos and critical infrastructure, such as banks, governments, and payment services. These websites were set up to defraud victims by instructing them to top up their balances or enter personal information. The cybercrime crackdown marks the third phase of Operation Synergia, which took place between July 18, 2025, and January 31, 2026. The previous two phases took place in 2023 and 2024, identifying thousands of malicious servers and scores of arrests. India's CBI Targets Transnational Fraud Case The disclosure comes as India's Central Bureau of Investigation (CBI) said it conducted coordinated searches at 15 locations across Delhi, Rajasthan, Uttar Pradesh, and Punjab as part of a large-scale organized online investment and part-time job fraud primarily involving a Dubai-based fintech platform called Pyypl. "It was alleged that thousands of unsuspecting Indian citizens were cheated of crores of rupees through deceptive online schemes operated by an organized transnational fraud syndicate," the CBI said. The criminal network is said to have leveraged social media platforms, mobile applications, and encrypted messaging services to lure victims with promises of high returns from online investments and part-time job opportunities. As highlighted by Proofpoint in October 2024, these scams aim to gain victims' trust by convincing them to deposit small amounts and show fictitious profits on fake sites, after which they are persuaded to invest larger sums of money. As soon as the funds are deposited, they are quickly transferred through multiple mule bank accounts to cover up the money trail and then cashed out through offshore ATM withdrawals using debit cards enabled for international transactions and via wallet top-ups on overseas fintech platforms like Pyypl using Visa and Mastercard payment networks. These withdrawals, per the CBI, appeared as point-of-sale (PoS) transactions in banking systems to fly under the radar. Some of the stolen money has also been converted to cryptocurrency, and consolidated into accounts linked to 15 shell companies and routed through two entities. "These entities converted the proceeds into USDT through India-based virtual asset exchanges and transferred the cryptocurrency to their white-listed wallets," the CBI added. The crime investigating agency has identified Ashok Kumar Sharma and other unnamed co-conspirators as key members of the syndicate. Sharma has been taken into custody. It also said various bank accounts used by the entities have been frozen, and incriminating documents and digital evidence related to the syndicate's day-to-day operations have been seized.

Another Thursday, another pile of weird security stuff that somehow happened in just seven days. Some of it is clever. Some of it is lazy. A few bits fall into that uncomfortable category of “yeah… this is probably going to show up in real incidents sooner than we’d like.” The pattern this week feels familiar in a slightly annoying way. Old tricks are getting polished. New research shows how flimsy certain assumptions really are. A couple of things that make you stop mid-scroll and think, “wait… people are actually pulling this off?” There’s also the usual mix of strange corners of the ecosystem doing strange things — infrastructure behaving a little too professionally for comfort, tools showing up where they absolutely shouldn’t, and a few cases where the weakest link is still just… people clicking stuff they probably shouldn’t. Anyway. If you’ve got five minutes and a mild curiosity about what attackers, researchers, and the broader internet gremlins were up to lately, this week’s ThreatsDay Bulletin on The Hacker News has the quick hits. Scroll on. OAuth consent abuseCloud security firm Wiz has warned of the dangers posed by malicious OAuth applications, highlighting how "consent fatigue" could open the door for attackers to gain access to a victim's sensitive data by giving their malicious apps a legitimate-looking name. By accepting the permissions requested by a rogue OAuth application, the user is "adding" the attacker's app into their company's tenant. "Once 'Accept' is clicked, the sign-in process is complete," Wiz said. "But instead of going to a normal landing page, the access token is sent to the attacker's Redirect URL. With that token, the attacker now has access to the user's files or emails without ever needing to know their password." The Google-owned company also said it detected a large-scale campaign active in early 2025 that involved 19 distinct OAuth applications impersonating well-known brands such as Adobe, DocuSign, and OneDrive, and targeted multiple organizations. Details of the activity were documented by Proofpoint in August 2025. Messaging account takeoverRussian-linked hackers are trying to break into the Signal and WhatsApp accounts of government officials, journalists, and military personnel globally with an aim to get unauthorized access – not by breaking encryption, but by simply tricking people into handing over the security verification codes or PINs. "The most frequently observed method used by the Russian hackers is to masquerade as a Signal Support chatbot in order to induce their targets to divulge their codes," the Netherlands Defence Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) said. "The hackers can then use these codes to take over the user's account. Another method used by the Russian actors takes advantage of the 'linked devices' function within Signal and WhatsApp." It's worth noting that a similar warning was issued by Germany last month. "These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users' accounts," Signal said. Google warned last year that Signal's widespread use among Ukrainian soldiers, politicians, and journalists had made it a frequent target for Russian espionage operations. Cloud breach via software flawsGoogle has revealed that threat actors are increasingly exploiting vulnerabilities in third-party software to breach cloud environments. "The window between vulnerability disclosure and mass exploitation collapsed by an order of magnitude, from weeks to days," the tech giant's cloud division said. "While software-based exploits increased, initial access by threat actors using misconfiguration, which accounted for 29.4% of incidents in the first half of 2025, dropped to 21% in H2 2025. Similarly, exposed sensitive UI or APIs continued a downward trend, falling from 11.8% in H1 to 4.9% in H2. This decline suggests that automated guardrails are making identity and configuration errors harder to exploit and that threat actors are being driven toward more sophisticated and costly vectors that specifically target software vulnerabilities to gain a foothold." In most attacks investigated by Google, the actor's objective was silent exfiltration of high volumes of data without immediate extortion and long-term persistence. Microcontroller debug bypassNew research from Quarkslab has found that it's possible to bypass the 16-byte password protection required for debug access on several variants of the RH850 microcontroller family using voltage fault injection in under one minute. "Voltage glitching technique is performed by underpowering or overpowering the chip for a controlled amount of time to alter its behavior," the security company said. "The crowbar attack is a specific type of voltage glitch where the power supply is shorted to the ground instead of injecting a specific voltage, using a MOSFET, for example." Solar Spider suspects arrestedTwo Nigerian nationals have been arrested by authorities in the Indian state of Uttar Pradesh for their alleged involvement in an e-crime operation known as Solar Spider. The suspects are believed to have been planning to siphon large amounts of money by leveraging security flaws in Indian cooperative banking systems. According to a report from The420.in, the individuals have been identified as Okechukwu Imeka and Chinedu Okafor. The duo is suspected to be part of an international fraud syndicate involved in targeting financial institutions. Solar Spider has a history of targeting banking systems across India and the Middle East, often through spear-phishing campaigns. In a report published in July 2025, Tata Communications revealed that threat actors leverage their initial access to steal credentials, tamper with NEFT/RTGS transactions, and focus on Structured Financial Messaging System (SFMS) and Host-to-Host (H2H) infrastructures. The group is also known for deploying a sophisticated attack framework dubbed JSOutProx since at least 2019. PlugX malware campaignCheck Point has disclosed targeted campaigns against entities in Qatar using conflict-related content as lures to deliver malware families like PlugX and Cobalt Strike. The attack chain uses Windows shortcut (LNK) files contained within ZIP archives, which, when opened, cause it to download a next-stage payload from a compromised server. The payload then displays the decoy document while using DLL side-loading to deploy PlugX. The activity, detected on March 1, 2026, has been attributed to Mustang Panda (aka Camaro Dragon). A second attack has been observed using a password-protected archive to execute a previously undocumented Rust loader that's responsible for deploying Cobalt Strike using DLL side-loading. "This loader exploits DLL hijacking of nvdaHelperRemote.dll, a component of the open-source screen reader NVDA. Abuse of this component has previously been observed in only a limited number of Chinese-nexus campaigns, including China-aligned activity associated with a campaign delivering Voldemort backdoor, as well as a wave of attacks targeting the Philippines and Myanmar back in 2025," Check Point said. While this attack is assessed as China-aligned, it has not been attributed to a specific threat actor. "The attackers leveraged the ongoing war in the Middle East to make their lures more credible and engaging, demonstrating the ability to rapidly adapt to major developments and breaking news," the company said. Teen DDoS kit sellersPolish police have referred seven suspected minor cybercriminals to family court over an alleged scheme to sell distributed denial-of-service (DDoS) kits online. The suspects, aged between 12 and 16 at the time of the alleged offenses, face charges related to selling DDoS tools as part of a profit-driven scheme designed to target popular websites, including auction and sales portals, IT domains, hosting services, and accommodation booking sites. "Using the tools they administer, popular websites such as auction and sales portals, IT domains, hosting services, and accommodation booking services were attacked," Poland's Central Bureau for Combating Cybercrime (CBZC) said. Phishing-resistant Windows loginMicrosoft is rolling out passkey support for Microsoft Entra on Windows devices, adding phishing-resistant passwordless authentication via Windows Hello. "We're introducing Microsoft Entra passkeys on Windows to enable phishing-resistant sign-in to Entra-protected resources. This update allows users to create device-bound passkeys stored in the Windows Hello container and authenticate using Windows Hello methods (face, fingerprint, or PIN)," Microsoft said. "It also expands passwordless authentication to Windows devices that aren't Entra-joined or registered, helping organizations strengthen security and reduce reliance on passwords." Sysmon built into WindowsMicrosoft has natively integrated System Monitor (Sysmon) functionality directly into Windows 11 and Windows Server 2025 as an optional built-in feature as of Windows 11's March feature update (KB5079473). It's disabled by default. The company announced the integration in November 2025. "You no longer need to package it dynamically; you can simply enable it programmatically via PowerShell," Nick Carroll, cyber incident response manager at Nightwing, said. "Coupled with Microsoft's simultaneous announcement that Windows Intune will enable 'hotpatching' by default in May 2026, this drastically lowers the barrier to entry for deep endpoint visibility and represents a massive operational win for network defenders." Canada phishing campaignAn active phishing campaign is targeting Canadian residents (and possibly present in other countries) using fraudulent domains impersonating trusted institutions, including the Government of British Columbia and Hydro-Québec, with the goal of collecting personal information and credit card details, Flare said. The hosting infrastructure behind this campaign is linked to RouterHosting LLC (aka Cloudzy), a provider that was publicly accused in 2023 of supplying services to at least 17 state-sponsored hacking groups from countries including Iran, China, Russia, and North Korea. Private link safety in chatsMeta has detailed the workings of Advanced Browsing Protection (ABP) in Messenger, which protects the privacy of the links clicked on within chats while still warning people about malicious links. "In its standard setting, Safe Browsing uses on-device models to analyze malicious links shared in chats," the company said. "But we've extended this further with an advanced setting called Advanced Browsing Protection (ABP) that leverages a continually updated watchlist of millions more potentially malicious websites." ABP leverages an approach called private information retrieval (PIR) to implement a privacy-preserving "URL-matching" scheme between the client's query and the server hosting the database, along with Oblivious HTTP, AMD SEV-SNP, and Path ORAM for added privacy guarantees. BlackSanta EDR killerA sophisticated attack campaign targeting HR departments and job recruiters has combined social engineering with advanced evasion techniques to stealthily compromise systems by avoiding analysis environments and leveraging a specialized module designed to kill antivirus and endpoint detection software. The attack begins with a resume-themed ISO file delivered likely through spam or phishing emails, which then drops next-stage payloads, including a DLL that's launched via DLL side-loading to gather basic system information, initiate communication with a remote server, run sandbox checks, employ geographic filtering to avoid running in restricted regions, and drop additional payloads, such as BlackSanta EDR that employs legitimate but vulnerable kernel drivers to impair system defenses, a known tactic referred to as Bring Your Own Vulnerable Driver (BYOVD). "Rather than functioning as a simple auxiliary payload, BlackSanta acts as a dedicated defense-neutralization module that programmatically identifies and interferes with protection and monitoring processes prior to the deployment of follow-on stages," Aryaka said. "By targeting endpoint security engines alongside telemetry and logging agents, it directly reduces alert generation, limits behavioral logging, and weakens investigative visibility on compromised hosts." It's currently not known what the follow-on payloads are or how widespread the campaign is. Phishing campaigns don't just target HR teams, but also impersonate them in attacks. "Impersonating HR provides many benefits to threat actors. Tasks from HR are typically mandatory, so HR emails carry authority," Cofense said. "Legitimate HR tasks can also have strict deadlines, which a threat actor can use to impose urgency. Finally, regular HR tasks are expected by employees." ZIP evasion techniqueA new technique dubbed Zombie ZIP allows attackers to conceal payloads in specially crafted compressed files that can bypass security tools. "Malformed ZIP headers can cause antivirus and endpoint detection and response software (EDR) to produce false negatives," the CERT Coordination Center (CERT/CC) said. "Despite the presence of malformed headers, some extraction software is still able to decompress the ZIP archive, allowing potentially malicious payloads to run upon file decompression." The vulnerability, tracked as CVE-2026-0866, has been codenamed Zombie Zip by researcher Christopher Aziz, who discovered it. The technique was demonstrated by Bombadil Systems security researcher Chris Aziz. AI agent breaches platformResearchers at autonomous offensive security startup CodeWall said their AI agent hacked McKinsey's internal AI platform Lili and gained full read and write access to the chatbot platform in just two hours. This enabled access to the entire production database, including 46.5 million chat messages about strategy, mergers and acquisitions, and client engagements, all in plaintext, along with 728,000 files containing confidential client data, 57,800 user accounts, and 95 system prompts controlling the AI's behavior. The development is an indicator that agentic AI tools are becoming more effective for conducting cyber attacks. The agent said it found over 200 endpoints that were totally exposed, out of which 22 were unprotected. One of these endpoints, which wrote user search queries to the database, suffered from an SQL injection that could have made it possible to access sensitive data and rewrite the system prompts silently. McKinsey has since addressed the problem. There is no evidence that the issue was exploited in the wild. Teams social engineering malwareHackers have contacted employees at financial and healthcare organizations over Microsoft Teams to trick them into granting remote access through Quick Assist and deploy a new piece of malware called A0Backdoor. The modus operandi, which aligns with the playbook of Storm-1811 (aka STAC5777 or Blitz Brigantine), employs social engineering to gain the employee's trust by first flooding their inbox with spam and then contacting them over Teams, pretending to be the company's IT staff and offering assistance with the problem. To obtain access to the target machine, the threat actor instructs the user to start a Quick Assist remote session, which is used to deploy a malicious toolset that includes digitally signed MSI packages, some of which were hosted on Microsoft cloud storage tied to personal accounts. The installers serve as a conduit for launching a DLL that, in turn, decrypts and runs shellcode responsible for running anti-analysis checks and dropping A0Backdoor, which establishes contact to a remote server using DNS tunnelling to receive commands. The activity has been active since at least August 2025 through late February 2026. Industrialized disinformation networkThe Russian influence operation known as Doppelgänger has been described as industrialized and prioritizing infrastructure resilience, scalability, and operational continuity over short-term visibility. "Rather than functioning as a loose collection of spoofed websites or transient propaganda outlets, the network exhibits the hallmarks of a coordinated, professionally managed influence apparatus," DomainTools said. "At its core, the ecosystem relies on systematic media brand impersonation executed at scale." Campaigns mounted as part of the operation exhibit deliberate geographic micro-targeting across European Union member states and the U.S. Pentagon AI disputeAnthropic has filed a lawsuit to block the Pentagon from placing it on a national security blocklist, stating the supply chain risk designation was unlawful and violated its free speech and due process rights. The development comes after the Pentagon formally branded the artificial intelligence (AI) company a supply chain risk after it refused to remove guardrails against using its technology for autonomous weapons or domestic surveillance. In its own statement, Anthropic said "we had been having productive conversations with the Department of War over the last several days, both about ways we could serve the Department that adhere to our two narrow exceptions, and ways for us to ensure a smooth transition if that is not possible." However, the Pentagon said there is no active negotiation happening with Anthropic. It also reiterated that the department "does not do and will not do domestic mass surveillance." The development follows OpenAI's own deal with the U.S. Department of Defense, with CEO Sam Altman stating the defense contract would include protections against the same red lines that Anthropic had insisted on. The company has since amended its contract to ensure "the AI system shall not be intentionally used for domestic surveillance of U.S. persons and nationals." Anthropic's CEO Dario Amodei has called OpenAI's messaging "safety theater" and "straight up lies." GitHub SEO malwareA new information stealer campaign distributing BoryptGrab is leveraging a network of more than 100 public GitHub repositories that claim to offer software tools for free, using search engine optimization (SEO) keywords to lure victims. The multi-stage infection chain begins when a ZIP file is downloaded from a fake GitHub download page. BoryptGrab can harvest browser data, cryptocurrency wallet information, and system information. It's also capable of capturing screenshots, collecting common files, and extracting Telegram information, Discord tokens, and passwords. Also delivered as part of the attack is a backdoor called TunnesshClient that establishes a reverse SSH tunnel to communicate with the attacker and acts as a SOCKS5 proxy. The earliest ZIP file dates back to late 2025. Certain iterations of the campaign have been found to deliver Vidar Stealer or a Golang downloader dubbed HeaconLoad, which then downloads and runs additional payloads. RAT campaign against IndiaThe Pakistan-aligned threat actor known as Transparent Tribe has been attributed to a fresh set of attacks targeting Indian government entities to infect systems with a RAT that enables remote command execution, process monitoring and termination, remote program execution, file upload/download, file enumeration, screenshot capture, and live screen monitoring capabilities. "The campaign primarily relies on social engineering techniques, distributing a malicious ZIP archive disguised as examination-related documents to persuade recipients to interact with the files," CYFIRMA said. "Upon extraction, the archive delivers deceptive shortcut files along with a macro-enabled PowerPoint add-in, which collectively initiate the infection chain. The threat actors employ multiple layers of obfuscation and redundant execution mechanisms to enhance the probability of successful compromise while reducing the likelihood of user suspicion." Signed phishing malwareMicrosoft is warning of multiple phishing campaigns using workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. The activity, observed in February 2026, has not been attributed to a specific threat actor or group. "Phishing emails directed users to download malicious executables masquerading as legitimate software," the company said. "The files were digitally signed using an Extended Validation (EV) certificate issued to TrustConnect Software PTY LTD. Once executed, the applications installed remote monitoring and management (RMM) tools that enabled the attacker to establish persistent access on compromised systems." Some of the deployed RMM tools include ScreenConnect, Tactical RMM, and MeshAgent. The use of the TrustConnect branding was disclosed by Proofpoint last week. Furthermore, the deployment of multiple RMM frameworks within a single intrusion indicates a deliberate strategy to ensure continuous access and ensure operational resilience even if one access mechanism is detected or removed. "These campaigns demonstrate how familiar branding and trusted digital signatures can be abused to bypass user suspicion and gain an initial foothold in enterprise environments," Microsoft added. TikTok allowed in CanadaFollowing a national security review of TikTok, Canada's Minister of Industry, Mélanie Joly, said the company can keep its business operational. "TikTok will implement enhanced protection for Canadians’ personal information, including new security gateways and privacy-enhancing technologies to control access to Canadian user data in order to reduce the risk of unauthorized or prohibited access," the government said. "TikTok will implement enhanced protections for minors." The development marks a complete 180 from a 2024 decision, when it was ordered to shut down its operations, citing unspecified "national security risks." However, that order was paused in early 2025. Vulnerabilities rise 12%Flashpoint said it catalogued 44,509 vulnerability disclosures in 2025, a 12% increase year-over-year (YoY). Of those, 466 were confirmed as exploited in the wild. Nearly 33%, or 14,593 vulnerabilities, had publicly available exploit code. Ransomware attacks also increased 53% YoY in 2025, with 8,835 total attacks recorded. The top RaaS groups by attack volume in 2025 were Qilin at 1,213 attacks, Akira at 1,044, Cl0p at 529, Safepay at 452, and Play at 395. Manufacturing was the most targeted industry with 1,564 attacks, followed by technology at 987 and healthcare at 905. The U.S. accounted for approximately 53% of named victim organizations. Botnet exploiting 174 flawsThe RondoDox DDoS botnet has been found to implement 174 different exploits between May 25, 2025, and February 16, 2026, peaking at 15,000 exploitation attempts in a single day between December 2025 and January 2026. It's believed that the threat actors are using compromised residential IP addresses as hosting infrastructure. "The operators of RondoDox have been using a shotgun approach, where they send multiple exploits to the same endpoint, hoping for one to work," Bitsight said. Of the 174 different vulnerabilities, 15 have a public proof-of-concept (PoC), but no CVE, and 11 do not have PoC code at all. RondoDox is notable for its fast addition of recently disclosed vulnerabilities, in some cases incorporating the PoC even before the CVE was published (e.g., CVE-2025-62593). Memory-only keylogger attackPhishing emails bearing purchase order lures are being used to distribute an executable within RAR archives. Once launched, the binary extracts and runs VIP Keylogger in memory without touching the disk. "This keylogger captures either browser cookies, logins, credit card details, autofills, visited URLs, downloads, or top sites from the appropriate files in each of the application's designated folders," K7 Labs said. It's also capable of targeting a wide range of web browsers, stealing the email accounts from Outlook, Foxmail, Thunderbird, and Postbox, and collecting Discord tokens. Cloudflare-shielded phishingA new Microsoft 365 credential harvesting campaign has been observed abusing Cloudflare's services to delay detection and risk profiling. The gatekeeping is designed to ensure the visitor is a real target and not a security scanner or bot. "The campaign implemented multiple anti-detection techniques, including the use of CloudFlare human verification, hardcoded IP block lists, user agent checks, and multiple sites and redirects," DomainTools said. Some of the stuff in this week’s list feels a little too practical. Not big flashy hacks — just simple tricks used in the right place at the right time. The kind of things that make defenders sigh because… yeah, that’ll probably work. There’s also a bit of the usual theme: tools and features doing exactly what they were designed to do… just not for the people who built them. Add some creative thinking, and suddenly normal workflows start looking like attack paths. Anyway — quick reads, strange ideas, and a few reminders that security problems rarely disappear… they just change shape. Scroll on.

AWS Security Hub is expanding to unify security operations across multicloud environments After talking with many customers, one thing is clear: the security challenge has not gotten easier. Enterprises today operate across a complex mix of environments, including on-premises infrastructure, private data centers, and multiple clouds, often with tools that were never designed to work together. The result is enterprise security teams spend more time managing tools than managing risk, making it harder to stay ahead of threats across an increasingly complex environment. At Amazon Web Service (AWS), we believe security should be simple, integrated, and built for the way enterprises actually operate. This belief is what drove us to reimagine AWS Security Hub, delivering full-stack security through a single experience, and this vision is driving our next chapter. Building on a foundation of unified security We transformed Security Hub into a unified security operations solution by bringing together AWS security services, including Amazon GuardDuty, Amazon Inspector, AWS Security Hub Cloud Security Posture Management (Security Hub CSPM), and Amazon Macie, into a single experience that automatically and continuously analyzes security signals across threats, vulnerabilities, misconfigurations, and sensitive data. Security Hub delivers a common foundation, bringing together findings from across your AWS environment so your security team spends less time translating signals and more time acting on them. Built on top of that foundation, a unified operations layer gives security teams near real-time risk analytics, automated analysis, and prioritized insights, helping them focus on what matters most, at scale. We also introduced new capabilities (the Extended plan) that simplify how enterprises procure, deploy, and integrate a full-stack security solution across endpoint, identity, email, network, data, browser, cloud, AI, and security operations. Now, customers can use Security Hub to expand their security portfolio through a curated selection of AWS Partner solutions (at launch: 7AI, Britive, CrowdStrike, Cyera, Island, Noma, Okta, Oligo, Opti, Proofpoint, SailPoint, Splunk (a Cisco company), Upwind, and Zscaler), all through one unified experience. With AWS as the seller of record, you benefit from pay-as-you-go pricing, a single bill, and no long-term commitments. Our goal is simple: unified security, everywhere your enterprise operates. Freedom to innovate, wherever your workloads are At AWS, interoperability means giving customers the freedom to choose solutions that best suit their needs, and the ability to use them wherever their workloads run. But freedom to innovate across multicloud environments also means that it is critical to secure them consistently, and without adding operational complexity. What’s coming for Security Hub In the coming months, we are expanding Security Hub with new multicloud capabilities that extend unified security operations beyond AWS. The foundation of this expansion is a common data layer that unifies security signals from wherever your workloads run. On top of that, a unified policy and operations layer delivers consistent posture management, exposure analysis, and risk prioritization, so your security team operates from a single view of risk rather than a fragmented collection of consoles. Security Hub will deliver unified risk analytics that surface critical risks across your multicloud estate. You’ll be able to manage cloud security posture with Security Hub CSPM checks that give you consistent posture visibility, and extend vulnerability management with expanded Amazon Inspector capabilities, including virtual machine scanning, container image scanning, and serverless scanning. Security Hub will also deliver external network scanning that enriches security findings with context about internet-facing exposure across your multicloud environment, including for resources not running in AWS. The result is more comprehensive risk coverage across your enterprise. It’s about giving your security team a single, unified experience to detect and respond to risks, wherever you operate. Security as a business enabler The security leaders I speak with aren’t just asking for better tools. They’re asking for a way to get ahead of risk, not just manage it. They want security that keeps pace with the business, not security that slows it down. That’s the vision behind AWS Security Hub: unified security through a single, integrated security operations experience, built on a common data foundation, powered by intelligent analytics, and delivered through a consistent operations layer, to help reduce security risk, improve team productivity, and strengthen security operations across AWS and beyond. Our multicloud expansion is underway, and we are just getting started. You can learn more at aws.amazon.com/security-hub, or visit us at the AWS booth (S-0466) at RSA Conference, March 23–26 in San Francisco.

Forty-two cybersecurity-related merger and acquisition (M&A) deals were announced in February 2026. For a detailed view of the more than 420 acquisitions announced in 2025, check out SecurityWeek’s annual M&A report. Here are some of the most important cybersecurity M&A deals announced in February 2026: SOC provider Arctic Wolf acquired US cybersecurity company Sevco Security, with no financial details disclosed. The acquisition aims to enhance Arctic Wolf’s attack surface management capabilities and provide customers with more comprehensive visibility and risk reduction in managed security operations. Technology consulting giant Booz Allen Hamilton acquired cybersecurity services and consulting firm Defy Security. The acquisition aims to expand Booz Allen’s cybersecurity capabilities, as well as support its growing business in the UK and the European Union. Check Point announced three strategic acquisitions to accelerate its push into AI-driven security and exposure management: Cyata, Cyclops, and Rotate. Cyata will help Check Point enhance its end-to-end AI security platform, while Cyclops helps the company strengthen exposure management with AI-driven asset discovery. Rotate brings talent and capabilities to accelerate workspace momentum. Software security company Endor Labs acquired application security firm Autonomous Plane. The acquisition aims to enhance Endor Labs’ reachability capabilities across applications and container images. Experian has acquired identity and data intelligence solutions provider AtData. The acquisition aims to strengthen Experian’s capabilities in identity verification and fraud detection, with a focus on email. Palo Alto Networks has entered into a definitive agreement to acquire endpoint security company Koi. Financial details have not been officially disclosed, but the deal is reportedly valued at $400 million. Palo Alto Networks said it’s buying Koi for its agentic endpoint security technology, aiming to enhance its Prisma AIRS AI security platform and Cortex XDR endpoint security solution. Proofpoint acquired AI security and governance company Acuvity. The integration of Acuvity’s technology will allow Proofpoint to provide real-time visibility and granular controls over how employees and systems interact with AI applications. This deal aims to prevent the accidental exposure of sensitive data while ensuring compliance. Quantum eMotion (QeM) is acquiring SKV Technology (SecureKey), a developer of specialized cryptographic software and hardware. The deal integrates SecureKey solutions into QeM’s portfolio to deliver quantum-resistant security, rapid PQC migration, and policy-driven P2P communication. Sophos has acquired UK-based Arco Cyber, a cybersecurity assurance company that helps organizations improve their security posture. Sophos said the acquisition enables it to deliver AI-powered cybersecurity governance capabilities, through its CISO Advantage offering, to organizations that lack dedicated security leadership. Data security company Varonis Systems has acquired AllTrue.ai for its AI trust, risk, and security management (TRiSM) solutions. The deal has been valued at $150 million. By integrating AllTrue.ai’s capabilities into its own platform, Varonis will enable customers to monitor and control AI behavior, reduce risks, and maintain and demonstrate compliance. Zscaler announced that it has acquired browser security firm SquareX for an undisclosed sum. With the technology provided by SquareX, Zscaler will extend security to unmanaged devices, enabling organizations to secure users within their preferred browser without the need for a full agent or the limitations of a separate, third-party browser. Other cybersecurity M&A deals announced in February 2026: TruthScan acquires Imagedetector.com Related: Zurich Acquires Beazley in $11 Billion Deal to Lead Cyberinsurance Related: Cybersecurity M&A Roundup: 34 Deals Announced in January 2026

Another week in cybersecurity. Another week of "you've got to be kidding me." Attackers were busy. Defenders were busy. And somewhere in the middle, a whole lot of people had a very bad Monday morning. That's kind of just how it goes now. The good news? There were some actual wins this week. Real ones. The kind where the good guys showed up, did the work, and made a dent. It doesn't always happen, so when it does, it's worth noting. The bad news? For every win, there's a fresh headache waiting right behind it. New tricks, old tricks dressed up in new clothes, and a few things that'll make you want to go touch grass and never log back in. But you will. We all do. So here's everything that mattered this week — the wins, the warnings, and the stuff you really shouldn't ignore. ⚡ Threat of the Week Tycoon 2FA and LeakBase Operations Dismantled — The infrastructure hosting the Tycoon2FA service, which Europol said was among the largest adversary-in-the-middle (AitM) phishing operations worldwide, has been dismantled by a coalition of security companies and law enforcement agencies. "Taking down infrastructure associated with Tycoon 2FA and identifying the individual allegedly responsible for creating this prolific hacking tool will have a significant impact on overall MFA credential phishing, and hopefully strike a blow to the world's most prolific AitM phishing-as-a-service," Proofpoint said in a statement shared with The Hacker News. Phishing kits and PhaaS platforms have become an Achilles' heel in recent years, streamlining and democratizing phishing attacks for less technically savvy hackers by providing them with a suite of tools to create convincing emails and phishing pages that unsuspecting victims will engage with. For a relatively modest fee, aspiring cybercriminals can subscribe to these services and carry out phishing attacks at scale. In a similar development, authorities also took down LeakBase, one of the world's largest online forums for cybercriminals to buy and sell stolen data and cybercrime tools. While the disruption is a positive development, it's known that such takedowns typically create only short-term disruptions, as the ecosystem adapts by migrating to other forums or more resilient distribution channels, like Telegram. Shadow AI Is EVERYWHERE. Here's How You Can Find and Secure It Shadow AI is quietly accessing sensitive data across your SaaS environment. Learn how to close AI blind spots and get ahead of data exposure risks with this new guide. Get Answers Now ➝ 🔔 Top News Anthropic Finds 22 Firefox Vulnerabilities in Firefox — Anthropic said it discovered 22 new security vulnerabilities in the Firefox web browser using its Claude Opus 4.6 large language model (LLM)as part of a security partnership with Mozilla. Of these, 14 have been classified as high, seven have been classified as moderate, and one has been rated low in severity. The issues were addressed in Firefox 148, released late last month. The vulnerabilities were identified over a two-week period in January 2026. The company noted that the cost of identifying vulnerabilities is cheaper than creating an exploit for them, and the model is better at finding issues than at exploiting them. Qualcomm Flaw Exploited in the Wild — A high-severity security flaw impacting Qualcomm chips used in Android devices has been exploited in the wild. The vulnerability in question is CVE-2026-21385 (CVSS score: 7.8), a buffer over-read in the Graphics component that could result in memory corruption and arbitrary code execution. There are currently no details on how the vulnerability is being exploited in the wild. However, Google acknowledged in its monthly Android security bulletin that "there are indications that CVE-2026-21385 may be under limited, targeted exploitation." Coruna iOS Exploit Kit Uses 23 Exploits Against Older iOS Devices — Google disclosed details of a new and powerful exploit kit dubbed Coruna (aka CryptoWaters) targeting Apple iPhone models running iOS versions between 13.0 and 17.2.1. The exploit kit featured five full iOS exploit chains and a total of 23 exploits, the company said. What makes it different is that it started with a commercial surveillance vendor in February 2025, got picked up by what seems like a Russian espionage group targeting Ukrainians in July 2025, and ended up in the hands of financially motivated attackers in China going after crypto wallets by the end of the year. Coruna began its life as a surveillance exploit kit, but by the time it reached the Chinese cybercrime gang, it was heavily focused on financial theft. It's not known how the exploit kit got passed between multiple threat actors of varied motivations. This has raised the possibility of a secondhand market where it's resold to other threat actors, who end up repurposing them for their own objectives. Transparent Tribe Unleases Vibeware Against Indian Entities — In a new attack campaign detected by Bitdefender, the Pakistan-aligned threat actor known as Transparent Tribe has leveraged artificial intelligence (AI)-powered coding tools to vibe-code malware and use them to target the Indian government and its embassies in multiple foreign countries. These tools are written in niche programming languages like Nim, Zig, and Crystal so as to evade detection. "Rather than a breakthrough in technical sophistication, we are seeing a transition toward AI-assisted malware industrialization that allows the actor to flood target environments with disposable, polyglot binaries," the company said. Iranian Hackers Target U.S. Entities Amid Conflict — The Iranian hacking group tracked as MuddyWater (aka Seedworm) targeted several U.S. companies, including banks, airports, non-profit, and the Israeli arm of a software company, as part of a campaign that began in early February 2026, and continued after the joint U.S.-Israel military strikes on Iran towards the end of the month. The development comes against the backdrop of hacktivist-fueled cyber attacks, with wiper campaigns targeting Israeli energy, financial, government, and utilities sectors. "The trajectory is clear: what began as nation-state-level ICS capability in 2012 [with Shamoon wiper] has become, by 2026, something any motivated actor can attempt with free tools and an internet connection," CloudSEK said in a report last week. "The technical barrier has collapsed. The threat pool has expanded. And the US attack surface has never been larger." Another targeted campaign has distributed a trojanized version of the Red Alert rocket warning Android app to Israeli users via SMS messages impersonating official Home Front Command communications. Once installed, the malware monitors and abuses the granted permissions to collect sensitive data, including SMS messages, contacts, location data, device accounts, and installed applications. The campaign is believed to be the work of a Hamas-affiliated actor known as Arid Viper. There are currently no details available on the scope of the campaign and whether any of the infections were successful. Acronis said it highlights how trusted emergency services can be weaponized during periods of geopolitical tension using social engineering. ️🔥 Trending CVEs New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical — high-severity, widely used software, or already drawing attention from the security community. Check these first, patch what applies, and don't wait on the ones marked urgent — CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025–64712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE). 🎥 Cybersecurity Webinars Automating Real-World Security Testing to Prove What Actually Works → Running a security test once a year and hoping for the best? That's not a strategy anymore. This webinar shows you how to continuously test your defenses using real attack techniques — so you actually know what holds up and what quietly breaks when no one's looking. When AI Agents Become Your New Attack Surface → AI tools aren't just answering questions anymore — they're browsing the web, hitting APIs, and touching your internal systems. That changes everything about how you think about risk. This webinar breaks down what that means for security, and what you actually need to do before something goes wrong. 📰 Around the Cyber World New AirSnitch Attack Shows Wi-Fi Client Isolation May Not Be Enough — A group of academics has developed a new attack called AirSnitch that breaks the encryption that separates Wi-Fi clients. Xin'an Zhou, the lead author of the research paper, told Ars Technica that AirSnitch bypasses worldwide Wi-Fi encryption and that it "might have the potential to enable advanced cyber attacks." The attack, at its core, leverages three weaknesses in client isolation implementations: (1) It abuses the group key(s) that are shared between all clients in the same Wi-Fi network, (2) It bypasses client isolation by tricking the gateway into forwarding packets to the victim at the IP layer by taking advantage of the fact that many networks only enforce client isolation at the MAC/Ethernet layer, and (3) It allows an adversary to manipulate internal switches and bridges to forward the victim's uplink and downlink traffic to the adversary. As a result, they enable the attacker to restore AitM capabilities even if client isolation protections exist. "We found that Wi-Fi client isolation can often be bypassed," Mathy Vanhoef said. "This allows an attacker who can connect to a network, either as a malicious insider or by connecting to a co-located open network, to attack others." Google Tracked 90 Exploited 0-Days in 2025 — Google said it tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025, up from 78 in 2024 and down from 100 in 2023. "Both the raw number (43) and proportion (48%) of vulnerabilities impacting enterprise technologies reached all-time highs, accounting for almost 50% of total zero-days exploited in 2025," the company said. Of these, vulnerabilities in security and networking appliances made up about half (21) of the enterprise-related zero-days in 2025. Mobile zero-days rebounded from nine in 2024 to 15 in 2025, with commercial surveillance vendors (15, plus likely another three) leading the charge in exploiting zero-day vulnerabilities than state-sponsored cyber espionage groups (12) for the first time. The names of the commercial spyware companies were not disclosed. Microsoft had the largest number of actively exploited flaws at 25, followed by Google (11), Apple (8), Cisco (4), Fortinet (4), Ivanti (3), and Broadcom VMware (3). Memory safety issues accounted for 35% of all exploited zero-day vulnerabilities last year. Financially motivated threat groups, including ransomware gangs, also targeted enterprise technologies and accounted for nine zero-days in 2025, double the five attributed to them in 2024. Velvet Tempest Deploys ClickFix Attack — Velvet Tempest (aka DEV-0504) has been observed using a ClickFix lure, followed by hands-on-keyboard activity consistent with Termite ransomware tradecraft. According to a report by Deception.Pro, the attack used the social engineering technique to drop payloads like DonutLoader and CastleRAT. "Follow-on activity included Active Directory reconnaissance (domain trusts, server discovery, user listing) and attempted browser credential harvesting via a PowerShell script downloaded from 143.198.160[.]37," it said. "Telemetry and infrastructure in this chain align with a modern initial-access playbook: rapid staging, heavy use of living-off-the-land binaries (LOLBins), and long-lived command-and-control (C2) traffic that blends into normal browser noise." No ransomware was deployed in the attack that took place between February 3 and 16, 2026. Ghanaian National Pleads Guilty to Role in $100M Romance Scam — A Ghanaian national pleaded guilty to his role in a massive fraud ring that stole over $100 million from victims across the U.S. through business email compromise attacks and romance scams. 40-year-old Derrick Van Yeboah pleaded guilty to conspiracy to commit wire fraud and agreed to pay more than $10 million in restitution. "Van Yeboah personally perpetrated many of the romance scams by impersonating fake romantic partners in communications with victims," the U.S. Justice Department said. "Many of the conspiracy’s victims were vulnerable older men and women who were tricked into believing that they were in online romantic relationships with persons who were, in fact, fake identities assumed by members of the conspiracy." The conspirators, part of a criminal organization primarily based in Ghana, also committed business email compromises to deceive businesses into wiring funds to the enterprise. In total, the scheme stole and laundered more than $100 million from dozens of victims. After stealing the money, the fraud proceeds were laundered to West Africa. The defendant is scheduled to be sentenced in June 2026. Taiwan Indicts 62 People for Cyber Scams — Prosecutors in Taipei indicted 62 people and 13 companies for their involvement in cyber scam operations organized throughout Asia by the Prince Group. Chen Zhi, the founder of the Prince Group, was indicted by U.S. prosecutors last year on money laundering charges. Taipei prosecutors said those associated with Prince Group laundered at least $339 million into Taiwan and used the stolen funds to buy 24 properties, 35 vehicles, and other assets amounting to approximately $1.7 million. In all, authorities seized about $174 million in cash and assets. Prince Group "effectively controlled 250 offshore companies in 18 countries, holding 453 domestic and international financial accounts. By creating fictitious transaction contracts between these offshore companies, the group laundered money through foreign exchange channels," they added. Ransomware Actors Use AzCopy — Ransomware operators are ditching the usual tools like Rclone for Microsoft's own AzCopy, turning a trusted Azure utility into a stealthy data exfiltration mechanism and blending into normal activity. "The adoption of AzCopy and other familiar tools by attackers represents a similar logic to living-off-the-land in the final and most critical phase of an operation: exfiltrating data out of an organization," Varonis said. "Spinning up an Azure storage account takes minutes and requires only a credit card or compromised credentials. The attacker gains the benefits of Microsoft's global infrastructure while security teams struggle to distinguish between malicious uploads and legitimate traffic." Threat Actors Exploit Critical Flaw in WPEverest Plugin — Threat actors are exploiting a critical security flaw in WPEverest's User Registration & Membership plugin (CVE-2026-1492, CVSS score: 9.8) to create rogue administrator accounts. The vulnerability affects all versions of User Registration & Membership through 5.1.2. The issue has been addressed in version 5.1.3. Wordfence said the plugin is susceptible to improper privilege management, which enables the creation of bogus admin accounts. "This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist," it said. "This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration." MuddyWater Evolves Its Tactics — The Iranian hacking group known as MuddyWater has been observed leveraging Shodan and Nuclei to identify potential vulnerable targets, as well as using subfinder and ffuf to perform enumeration of target web applications. The findings come from an analysis of the threat actor's VPS server hosted in the Netherlands. MuddyWater is also said to be attempting to scan and/or exploit recently disclosed CVEs related to BeyondTrust (CVE-2026-1731), Ivanti (CVE-2026-1281), n8n (CVE-2025-68613), React (CVE-2025-55182), SmarterMail (CVE-2025-52691), Laravel Livewire (CVE-2025-54068), N-Central (CVE-2025-9316), Citrix NetScaler (CVE-2025-5777), Langflow (CVE-2025-34291), and Fortinet (CVE-2024-55591, CVE-2024-23113, CVE-2022-42475), along with SQL injection vulnerabilities in BaSalam and an unspecified Postgres development platform for initial access. One of the custom tools identified in the server is KeyC2, a command-and-control (C2) framework that allows operators to remotely control compromised Windows machines over a custom binary protocol on port 1269 from a Python script. Two C2 tools used by the adversary are PersianC2, which relies on standard HTTP polling to receive commands and files via JSON API endpoints, and ArenaC2, a Python-based program that operates over HTTP POST requests. Also detected is a PowerShell loader that leads to the execution of obfuscated Node.js payloads that appear similar to Tsundere Botnet. The infrastructure is assessed to have been used to target entities in Israel, Egypt, Jordan, the U.A.E., and the U.S. Some aspects of the activity overlap with Operation Olalampo. 2,622 Valid Certificates Exposed — A new study undertaken by Google and GitGuardian found over a million unique private keys leaked across GitHub and Docker Hub, out of which 40,000 were mapped to 140,000 real TLS certificates. "As of September 2025, 2,600 of these certificates were valid, with more than 900 actively protecting Fortune 500 companies, healthcare providers, and government agencies," GitGuardian said. "Our disclosure campaign achieved 97% remediation, but at the cost of 4,300 emails sent, 1,706 entities contacted, 9 bug bounty submissions, countless follow-ups, and days of meticulous attribution work employing multiple OSINT techniques. The high success rate masks the extraordinary effort required to protect organizations that fail to protect themselves." Context7 MCP Server Suffers from ContextCrush — A critical security flaw in Upstash's Context7 MCP Server, a widely used tool for delivering documentation to AI coding assistants, has been discovered. Dubbed ContextCrush, the vulnerability could allow attackers to inject malicious instructions into AI development tools through a trusted documentation channel. Noma Security, which disclosed details of the flaw, said it's rooted within the platform's "Custom Rules" feature, which allows library maintainers to provide AI-specific instructions to help assistants better interpret documentation. "Context7 operates both as the registry, where anyone can publish and manage library documentation, and as the trusted delivery mechanism that pushes content directly into the AI agent's context," security researcher Eli Ainhorn said. "The attacker never needs to reach the victim's machine. Instead, the attacker can plant malicious custom rules in Context7's registry, and Context7’s infrastructure delivers them through the MCP server to the AI agent running in the developer's IDE. As agents are execution machines and run whatever is loaded into their context, all the victim’s agent does is execute the attacker's instructions on the victim’s machine, using its own tool access (Bash, file read/write, network). In this scenario, the agent has no way to distinguish between legitimate documentation and attacker-controlled content because they arrive through the same trusted channel and from the same trusted source." German Court Sentences Key Person Behind Call Center Scam — A German court has sentenced a suspected central figure in the so-called Milton Group call-center fraud network to seven-and-a-half years in prison. Although the court did not publicly name the defendant, court records reviewed by the Organized Crime and Corruption Reporting Project (OCCRP) indicate the person convicted was Mikheil Biniashvili, a citizen of Georgia and Israel. In addition to the prison sentence, the court ordered the confiscation of €2.4 million ($2.8 million) linked to the operation. Between 2017 and 2019, the defendant ran a call-center operation in Albania that used trained agents to persuade victims to invest in fraudulent online trading schemes. The scheme caused losses of about €8 million ($9.4 million) to victims, mostly in German-speaking countries. The operation employed up to 600 people at its peak. Call-center agents allegedly posed as investment advisers, building trust with targets before persuading them to deposit funds into fake trading platforms controlled by the network by promising large investment returns. Biniashvili was arrested in Armenia in 2023 and extradited to Germany in 2024. Multiple Flaws in Avira Internet Security — Three vulnerabilities have been disclosed in Avira Internet Security that could allow for arbitrary file deletion (CVE-2026-27748) in the Software Updater component, an insecure deserialization (CVE-2026-27749) in System Speedup, and an arbitrary folder deletion over TOCTOU (CVE-2026-27748) in the Optimizer. "The file delete primitive is useful on its own," Quarkslab said. "The other two both result in Local Privilege Escalation to SYSTEM." Russian Ransomware Operator Pleads Guilty in U.S. — Evgenii Ptitsyn, a 43-year-old Russian national, has pleaded guilty in a U.S. court to running the Phobos ransomware outfit that targeted more than 1,000 victims globally and extorted ransom payments worth over $39 million. Ptitsyn was extradited from South Korea in November 2024. "Beginning in at least November 2020, Ptitsyn and others conspired to engage in an international computer hacking and extortion scheme that victimized public and private entities through the deployment of Phobos ransomware," the Justice Department said. "As part of the scheme, Ptitsyn and his co-conspirators developed and offered access to Phobos ransomware to other criminals or 'affiliates' to encrypt victims' data and extort ransom payments from victims. The administrators operated a darknet website to coordinate the sale and distribution of Phobos ransomware to co-conspirators and used online monikers to advertise their services on criminal forums and messaging platforms." Ptitsyn faces a maximum penalty of 20 years in prison for wire fraud charges. Fake Google Security Check Leads to RAT — A bogus website resembling the Google Account security page is being used to deliver a Progressive Web App (PWA) capable of harvesting one-time passcodes and cryptocurrency wallet addresses, and proxying attacker traffic through victims' browsers. "Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push notification access, the device's contact list, real-time GPS location, and clipboard contents – all without installing a traditional app," Malwarebytes said. "For victims who follow every prompt, the site also delivers an Android companion package introducing a native implant that includes a custom keyboard (enabling keystroke capture), accessibility-based screen reading capabilities, and permissions consistent with call log access and microphone recording." Phishing Campaign Abuses Google Infrastructure — A new email phishing campaign is leveraging legitimate Google infrastructure to bypass standard security filters. The activity uses Google Cloud Storage (GCS) to host initial phishing URLs that, when clicked, redirect unsuspecting users to a malicious site designed to capture their financial information or deploy malware. "By hosting the initial link on Google's servers, the attackers ensure the email passes authentication checks like SPF and DKIM," security researcher Anurag Gawande said. Client-Side Injection Conducts Ad Fraud — A new malicious client-side injection originating from a malicious browser extension impersonating Microsoft Clarity has been found to overwrite referral tokens to redirect affiliate revenue to unknown threat actors. "A browser extension is injecting obfuscated JavaScript from msclairty[.]com, a typosquatted domain impersonating Microsoft Clarity," c/side's Simon Wijckmans said. "The domain is not serving analytics. It is delivering an obfuscated JavaScript payload that performs affiliate cookie stuffing, tracking cookie deletion, and Fetch API hijacking inside the visitor's browser. This prevents a competing tracking service from recording the real traffic source. The attacker does not just want credit for the visit. They actively block other trackers from capturing any attribution data that would conflict with their fraudulent cookie." The script has affected sites across multiple unrelated sectors, including transportation, SaaS platforms, sports management, and government payment portals. Impacted visitors primarily span Chrome versions 132, 138, and 145, and originate from U.S.-based IP addresses on the East and West coasts. Illinois Man Charged with Hacking Snapchat Accounts to Steal Nudes — U.S. prosecutors have charged a 26-year-old Illinois man, Kyle Svara, with conducting a phishing operation that made it possible to break into the Snapchat accounts of approximately 570 women to steal private photos and sell them online. "From at least May 2020 to February 2021, Svara used social engineering and other resources to collect his targets' emails, phone numbers, and/or Snapchat usernames," the Justice Department said. "He then used those means of identification to access his targets' Snapchat accounts, which prompted Snap Inc. to send account security codes to those women. Using anonymized phone numbers, Svara posed as a representative of Snap Inc. and sent more than 4,500 text messages to hundreds of women, requesting those Snapchat access codes." Svara is alleged to have accessed the Snapchat accounts of at least 59 women without permission to download their nude or semi-nude images and sell them on internet forums. Meta Sued Over AI Smart Glasses' Privacy Concerns — Meta is facing a new class action lawsuit over its AI-powered Ray-Ban Meta glasses, following a report from Swedish newspapers Svenska Dagbladet and Goteborgs-Posten that employees at Kenya-based subcontractor Sama are reviewing intimate, personal footage filmed from customers' glasses. Meta said subcontracted workers might sometimes review content captured by its AI smart glasses for the purpose of improving the "experience," as stated in its Privacy Policy. It also claimed that data is filtered to protect people's privacy. But the investigation found that this step did not always consistently work. "Unless users choose to share media they've captured with Meta or others, that media stays on the user's device," Meta told BBC News. "When people share content with Meta AI, we sometimes use contractors to review this data for the purpose of improving people's experience, as many other companies do." Total Ransomware Payments Stagnated in 2025 — The total ransomware payments in 2025 stagnated, even if the number of attacks increased. According to blockchain analysis firm Chainalysis, total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%. "While aggregate revenue stagnated, the median ransom payment grew 368% year-over-year to nearly $60,000," the company said. "The 2025 total is likely to approach or exceed $900 million as we attribute more events and payments, just as our 2024 total grew from our initial $813 million estimate this time last year." The decline in payment rates from 63% in 2024 to just 29% last year indicates that fewer victims are yielding to attackers' ransom demands, it added. The development comes amid increased fragmentation of the ransomware ecosystem and threat actors shifting towards more stealthy methods, such as defense evasion and persistence techniques, to prioritize data theft and prolonged, low-noise access. Mobile Blockchain Wallet Found Vulnerable to Severe Flaws — An unnamed mobile blockchain wallet app for Android has been found susceptible to two independent severe vulnerabilities, allowing untrusted deep links to trigger sensitive wallet flows and trick users into approving phishing-driven transactions, as well as retain cryptographic private keys from the device despite deleting an account. This meant that an attacker with later device access could re-import the account using its public address and regain full signing authority without re-entering the keys. According to LucidBit Labs, the vulnerabilities have been patched by the developer. "The main strength of crypto wallets lies in their cryptographic foundations," security researcher Assaf Morag said. "However, when these wallets are implemented as user-facing applications, the overall orchestration of the system becomes just as critical as the cryptography itself. As the saying goes, a system’s security posture is defined by its weakest link. In this case, the two vulnerabilities demonstrate how flaws at the application layer can undermine the entire security model, despite the strength of the underlying cryptography." Kubernetes RCE Via Nodes/Proxy GET Permission — New research has identified an authorization bypass in Kubernetes Role-based access control (RBAC) that allows a service account with nodes/proxy GET permissions to execute commands in any Pod in the cluster. The issue exploits a bug in how Kubernetes API servers handle WebSocket connections. "Nodes/proxy GET allows command execution when using a connection protocol such as WebSockets," security researcher Graham Helton said. "This is due to the Kubelet making authorization decisions based on the initial WebSocket handshake's request without verifying CREATE permissions are present for the Kubelet's /exec endpoint, requiring different permissions depending solely on the connection protocol. The result is anyone with access to a service account assigned nodes/proxy GET that can reach a Node's Kubelet on port 10250 can send information to the /exec endpoint, executing commands in any Pod, including privileged system Pods, potentially leading to a full cluster compromise." The Kubernetes project has declined to address the issue, stating its intended behavior. However, it's expected to release Fine-Grained Kubelet API Authorization (KEP-2862) next month to address the attack. "A targeted patch would require coordinated changes across multiple components with special-case logic," Edera said. "This is the kind of complexity that could lead to future vulnerabilities. Once KEP-2862 reaches GA and sees adoption, nodes/proxy can be deprecated for monitoring use cases." Other Key Stories on the Radar — The Israeli government is working on the country's first cybersecurity law, the U.S. National Security Agency (NSA) published Zero Trust Implementation Guidelines (ZIGs) to help organizations safeguard sensitive data, systems, and services against sophisticated cyber threats, Google Project Zero found multiple vulnerabilities that could be used to bypass a new Windows 11 feature called Administrator Protection and obtain admin privileges, threat actors are continuing to abuse Microsoft Teams functionality by leveraging guest invitations and phishing-themed team names to impersonate billing and subscription notifications, and a loader named PhantomVAI has been used in the wild over the past year to deploy other payloads, such as Remcos RAT, XWorm, AsyncRAT, DarkCloud, and SmokeLoader. 🔧 Cybersecurity Tools DetectFlow → It is an open-source detection pipeline from SOC Prime that matches streaming log events against Sigma rules in real time — before they ever reach your SIEM. Instead of relying on your SIEM to do the heavy lifting, it tags and enriches events in-flight using Apache Kafka and Flink, then passes the results downstream to wherever you need them. Built on 11 years of detection intelligence, it's designed for teams who want faster detection, more rule coverage, and less dependency on SIEM-imposed limits. ADTrapper → It is an open-source platform that analyzes Windows Active Directory authentication logs and flags threats using 54+ built-in detection rules — covering everything from brute force to AD CS attacks. It runs in Docker, deploys with one command, and supports SharpHound data for deeper AD analysis. Disclaimer: For research and educational use only. Not security-audited. Review all code before use, test in isolated environments, and ensure compliance with applicable laws. Conclusion That's your week. A lot happened. Some of it was bad, some of it was worse, and a little bit of it was actually good. The scoreboard is messy, like it always is. Same time next week — and if history is any guide, we'll have plenty more to talk about. Stay patched, stay skeptical, and maybe don't click that link.

L’infrastruttura di Tycoon 2FA, una delle piattaforme di phishing-as-a-service (PhaaS) più diffuse tra i criminali informatici e la minaccia adversary-in-the-middle (AiTM) con il più elevato volume di attività rilevata, è stata smantellata, grazie alla collaborazione tra partner pubblici e privati, tra cui spiccano Proofpoint, Microsoft, Europol. “L’azione di oggi si concentra su un importante attore del crimine informatico, Tycoon 2FA, responsabile del più alto volume di campagne di credential phishing AiTM secondo i dati Proofpoint”, commenta Selena Larson, Staff Threat Researcher di Proofpoint. Indice degli argomenti La collaborazione tra partner pubblici e privati ha visto cooperare Proofpoint, Microsoft, Europol, Cloudflare, Coinbase, Crowell, eSentire, Health-ISAC, Intel 471, Resecurity, The Shadowserver Foundation, SpyCloud e TrendAI, oltre ad altre forze dell’ordine europee, per neutralizzare Tycoon 2FA. In particolare, Proofpoint ha offeryo un importante contributo nelle indagini delle forze dell’ordine e del settore privato sull’attività di Tycoon 2FA, sostenendo l’azione di Microsoft con dati che comprendono domini malevoli e informazioni sulle campagne Tycoon 2FA. “Gli attacchi Tycoon hanno portato alla compromissione di decine di migliaia di account, e Proofpoint ha osservato come questi attacchi prendano di mira organizzazioni critiche in settori quali sanità, istruzione, pubblica amministrazione e difesa“, sottolinea Selena Larson. L’azione di disruption contro Tycoon 2FA – e la causa legale che identifica il suo creatore – avranno un impatto significativo sulla piattaforma stessa, sulla relativa infrastruttura e sull’attività dei threat actor. Tycoon 2FA opera come un kit di phishing AiTM. La sua funzione principale è sottrarre username, password e cookie di sessione di Microsoft 365 e Gmail. Gli aggressori utilizzano questi cookie per aggirare i controlli di autenticazione a più fattori (MFA) nelle sessioni successive, ottenendo così il takeover completo dell’account (ATO) e accesso non autorizzato agli account, ai sistemi e ai servizi cloud dell’utente, inclusi quelli protetti dall’MFA come misura di sicurezza ulteriore. “Secondo dati di Proofpoint, nel 2025 il 99% delle organizzazioni ha subito tentativi di account takeover, riusciti nel 67% dei casi. Tra questi, il 59% degli account compromessi aveva l’MFA attivo”, mette in guardia Selena Larson: “Sebbene non tutti questi attacchi siano riconducibili a Tycoon 2FA, i dati dimostrano l’impatto del phishing AiTM sulle aziende”. Sebbene non tutte le campagne ATO che bypassano l’MFA siano attribuibili a Tycoon 2FA, quest’ultima resta la minaccia phishing AiTM con il più alto volume rilevato da Proofpoint. I volumi variano in base all’attività dei criminali informatici: nel solo febbraio 2026, Proofpoint ha scoperto oltre tre milioni di messaggi riconducibili a Tycoon 2FA. “Questi attacchi informatici, che consentono il takeover completo degli account, possono avere conseguenze devastanti, tra cui attacchi ransomware o la perdita di dati sensibili. Mentre i criminali informatici continuano a prendere di mira le identità digitali, l’accesso agli account email aziendali rappresenta spesso il primo passo di una catena di attacchi dalle conseguenze distruttive. (…) Smantellare l’infrastruttura associata a Tycoon 2FA e identificare il presunto responsabile della creazione di questo prolifico strumento di hacking avrà un impatto significativo sul credential phishing che bypassa l’MFA e, si spera, infliggerà un duro colpo alphishing-as-a-service AiTM più prolifico al mondo”, conclude Selena Larson. In coordinamento con Europol, le forze dell’ordine di Lettonia, Lituania, Portogallo, Polonia, Spagna e Regno Unito hanno sequestrato l’infrastruttura ed altre misure operative. Microsoft e il co-ricorrente Health-ISAC hanno inoltre depositato una causa legale contro il presunto creatore di Tycoon 2FA, Saad Fridi, e alcuni associati non identificati. L’azione di disruption e il procedimento civile, depositato presso il Southern District of New York, avranno un effetto rilevante sulle operazioni di Tycoon 2FA e sull’attività complessiva della minaccia. Proofpoint ha offerto supporo all’azione di Microsoft fornendo dati sulle minacce tratti dalla propria visibilità, inclusi domini malevoli e informazioni sulle campagne Tycoon 2FA, e ha depositato una dichiarazione a supporto della causa. Il 4 marzo 2026, Microsoft ha annunciato la causa legale e l’azione di disruption contro il creatore di Tycoon 2FA e diversi associati non identificati. Proofpoint sostiene il procedimento civile fornendo una dichiarazione sull’attività di Tycoon, con dettagli sull’infrastruttura e sulle campagne. Microsoft ha posto sotto sequestro 330 domini del pannello di controllo associati a Tycoon 2FA. Azione che avrà un impatto sulle operazioni, interrompendo l’attività criminale in corso. I takeover di account di successo possono causare danni ingenti alle organizzazioni colpite, tra cui perdite finanziarie e reputazionali, sottrazione di dati proprietari e potenziali attacchi successivi come il ransomware, con conseguenze distruttive per l’intera organizzazione.

Some weeks in cybersecurity feel routine. This one doesn’t. Several new developments surfaced over the past few days, showing how quickly the threat landscape keeps shifting. Researchers uncovered fresh activity, security teams shared new findings, and a few unexpected moves from major tech companies also drew attention. Together, these updates offer a useful snapshot of what is happening behind the scenes in the cyber world right now. From new tactics and campaigns to security and policy changes that could affect millions of users, there is a lot unfolding at once. Below is a quick roundup of the most notable stories making headlines this week. Phishing Campaign Deploys Multiple Malware StrainsThe Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a hacking campaign targeting Ukrainian government institutions using phishing emails containing a ZIP archive (or a link to a website vulnerable to cross-site scripting attacks) to distribute SHADOWSNIFF and SALATSTEALER information-stealing malware and a Go backdoor called DEAFTICKK. The agency attributed the activity to a threat actor tracked as UAC-0252. The development comes as a suspected Russian espionage campaign is targeting Ukraine with two previously undocumented malware strains, BadPaw and MeowMeow, according to ClearSky. While the campaign is likely said to be the work of APT28, the cybersecurity company did not identify the targets of the campaign or say whether the attacks were successful. Fake RMM Service Spreads RAT via PhishingA new malware-as-a-service (MaaS) dubbed TrustConnect ("trustconnectsoftware[.]com") masqueraded as a legitimate remote monitoring and management (RMM) tool for $300 per month. It's assessed that the threat actor behind TrustConnect was also a prominent user of RedLine Stealer. According to email security firm Proofpoint, multiple threat actors have been observed distributing the malware via phishing emails as of January 27, 2026. The emails claim to be event invites or bid proposals, tricking recipients into clicking on links that lead to the download of bogus executables that install TrustConnect RAT. The RAT backdoors users' machines and gives attackers full mouse and keyboard control, allowing them to record and stream the victim's screen. Some campaigns have also been observed delivering legitimate remote access software like ScreenConnect and LogMeIn Resolve alongside TrustConnect between January 31 and February 3, 2026. Customers who purchase the toolkit are granted access to a dashboard to remotely commandeer infected devices and generate branded installers containing the malware. After Proofpoint took steps to disrupt some of the malware's infrastructure on February 17, 2026, the threat actor resurfaced with a rebranded version of the malware platform called DocConnect. "Disruptions to MaaS operations like RedLine, Lumma Stealer, and Rhadamanthys have created new opportunities for malware creators to fill gaps in the cybercrime market," Proofpoint said. "Although TrustConnect only masqueraded as a legitimate RMM, the lures, attack chains, and follow-on payloads (which include RMMs) show overlap with techniques and delivery methods that are frequently observed in RMM campaigns and used by multiple threat actors." The development comes amid skyrocketing abuse of legitimate RMM software in cyber attacks. Chrome Moves to Two-Week Release CycleGoogle has announced that new Chrome iterations will be released every two weeks, moving away from the current four-week release cycle. Since 2021, Google has been shipping major Chrome versions every four weeks, and since 2023, it has been delivering security updates every week for a reduced patch gap and improved quality. "The web platform is constantly advancing, and our goal is to ensure developers and users have immediate access to the latest performance improvements, fixes, and new capabilities," Google said. The new release cycle will also apply to beta releases, starting with Chrome 153, which will arrive on September 8, 2026. TPMS Signals Allow Covert Vehicle TrackingResearchers at IMDEA Networks Institute have found that Tire Pressure Monitoring System (TPMS) sensors inside each car wheel broadcast unencrypted wireless signals containing persistent identifiers. While the feature is designed for vehicle safety, each sensor transmits a unique ID that does not change, allowing the same car to be recognized again and tracked over time. This, in turn, opens the door to a low-cost monitoring network that uses software-defined radio receivers near roads (at a distance of up to 40m from the car) and parking areas to collect TPMS messages from thousands of vehicles and build profiles of their movements over time. "Malicious users could deploy passive receivers on large scales and track citizens without their knowledge. The advantage of such a system, over more traditional camera-based ones, is that no direct line-of-sight is needed with the TPMS sensors, and spectrum receivers could be placed in covert or hidden locations, making them harder to spot by victims," the researchers warned. "Our results show that TPMS transmissions can be used to systematically infer potentially sensitive information such as the presence, type, weight, or driving pattern of the driver." The disclosure adds to a growing body of research demonstrating how various components fitted into modern vehicles can become unintended conduits for surveillance and exploits. Telegram Emerges as Cybercrime Command HubA new analysis from CYFIRMA has pointed out how Telegram's structure offers threat actors a way to extend their reach globally without the need for specialized tooling, enable frictionless onboarding of buyers and affiliates, support payment options, and facilitate audience growth. The emergence of the platform has fundamentally changed the way cyber operations are coordinated, monetized, and publicized. "For financially motivated actors, Telegram functions as a scalable storefront and customer support hub," the company said. "For hacktivists, it serves as a mobilization and propaganda amplifier. For state-aligned operations, it offers a rapid distribution channel for narratives and leaks. In many cases, telegram complements and increasingly replaces traditional Tor-based ecosystems by removing technical friction while maintaining operational flexibility." AuraStealer Infrastructure RevealedA new analysis of AuraStealer from Intrinsec has uncovered 48 command-and-control (C2) domain names linked to the stealer's operations. The threat actor behind the malware has been found to use .shop and .cfd top-level domains, in addition to routing all traffic through Cloudflare as a reverse proxy to conceal the real server. AuraStealer first appeared on underground hacker forums in July 2025, shortly after the disruption of the Lumma Stealer as part of a law enforcement operation. It was advertised by a user named AuraCorp on the XSS forum. It comes in two subscription packages: $295/month for Basic and $585/month for Advanced. One of the primary mechanisms through which the stealer is distributed is ClickFix. Malvertising Pushes New Atomic Stealer VariantA malvertising campaign is using bogus ads on Google Search results pages to redirect users looking for ways to free up macOS storage to fraudulent web pages hosted on Medium, Evernote, and Kimi AI to serve ClickFix-style instructions that drop a new variant of the Atomic Stealer called malext to steal a wide range of data from compromised macOS systems. The campaign uses more than 50 compromised Google Ads accounts that push "over 485 malicious landing pages, ultimately leading to a ClickFix attack that deployed a potentially new version of AMOS Stealer onto infected systems," security researcher Gi7w0rm said. Bots Hammer DRAM Pages for DDR5 InventoryA large-scale data gathering operation has submitted more than 10 million web scraping requests to hit DRAM product pages on e-commerce sites in an effort to find sellers carrying desirable DRAM stock. The bots have been found to check the stock of specific RAM kits every 6.5 seconds by using a technique called cache busting to ensure they get the most up-to-date information, DataDome said. "These bots aggressively target the entire supply chain, from consumer RAM to B2B industrial memory providers and raw hardware components like DIMM sockets," the company said. "Scrapers attempt to avoid detection by adding cache-busting parameters to every request and calibrating their speed to stay just below volumetric alarm thresholds. By rapidly snapping up the limited DDR5 memory inventory for profitable resale, these bots further deplete the consumer supply, effectively boxing out legitimate customers and driving market prices even higher." Reddit Fined Over Children's Data HandlingThe U.K. Information Commissioner's Office (ICO) has fined Reddit £14.47 million for unlawfully processing the personal information of children under the age of 13 and for failing to properly check the age of its users, thereby putting them at risk of being exposed to inappropriate and harmful content online. In July 2025, Reddit introduced age assurance measures that include age verification to access mature content and asking users to declare their age when opening an account. Reddit said it would appeal the decision, stating it doesn't require users to share information about their identities, regardless of age, to ensure users' online privacy and safety. Samsung Restricts TV Data Collection in TexasTexas Attorney General Ken Paxton announced that Samsung will no longer collect Automated Content Recognition (ACR) data without consumers' express consent. The development comes in the wake of a lawsuit filed against the South Korean electronics giant for its data collection practices and over allegations that the collected ACR information could be used to serve targeted ads. "Additionally, it compels Samsung to promptly update its smart TVs and implement disclosures and consent screens that are clear and conspicuous to ensure that Texans can make an informed decision regarding whether their data is collected and how it's used," the Office of the Attorney General said. Samsung has denied it spies on users. NATO Clears Consumer iPhones and iPadsApple iPhones and iPads have been approved to handle classified information in NATO networks. They are the first consumer-grade devices to be approved for NATO use without additional special software or settings. iPhone and iPad previously received approval to handle classified German government data on devices using native iOS and iPadOS security measures following a security evaluation conducted by Germany's Federal Office for Information Security. TikTok Rejects End-to-End Encryption for DMsByteDance's TikTok said it has no plans to add end-to-end encryption (E2EE) to direct messages because it would prevent law enforcement and safety teams from reading messages if necessary. In a statement shared with the BBC, the company said it wanted to protect users, especially young people, from harm. Multi-Stage Phishing Attack Spreads Agent TeslaA new phishing campaign using purchase order lures has leveraged a multi-stage attack chain to deliver Agent Tesla, allowing threat actors to harvest sensitive data, while taking steps to evade detection using techniques like obfuscation and in-memory execution. "From the initial obfuscated JSE loader to the reflective loading of .NET assemblies and process hollowing of legitimate Windows utilities, Agent Tesla is designed to stay invisible," Fortinet FortiGuard Labs said. "Its extensive anti-analysis checks further ensure that it only reveals its true nature when it’s certain it isn't being watched." Attackers Abuse Infrastructure-Only .arpa DomainWith organizations taking steps to tighten their traditional email and web filters, new research from Infoblox has found a novel campaign where actors are abusing the .arpa top-level domain, a space strictly reserved for network infrastructure, to host malicious content and bypass standard blocklists. The development shows cybercriminals are finding "impossible" hiding spots within the internet’s core infrastructure to bypass security, the DNS threat intelligence firm said. Elsewhere, threat actors are also abusing LNK shortcut files and WebDAV to download malicious files on targets' systems. "Because being able to remotely access things on the internet via File Explorer is a relatively unknown functionality to most people, WebDAV is an exploitable way to make people download files without going through a traditional web browser file download," Cofense said. Spoofed Email Chains Target LastPass UsersA new phishing campaign that commenced on March 1, 2026, is using lures related to unauthorized access to individuals' accounts to trick recipients into visiting fake LastPass login pages to take control of their accounts. The attack takes advantage of the fact that many email clients, especially mobile, show only the display name, hiding the real sender address unless users expand it. "Attackers are forwarding fake email chains to make it appear as though another individual is trying to take unauthorized action on their LastPass account (i.e., export vault, full account recovery, new trusted device registered, etc.)," LastPass said. "Attackers use display name spoofing so that the name portion of the sender field is manipulated to impersonate LastPass, while the actual sending email address is unrelated." Experts Warn Against Blind Trust in AI Coding AgentsWith the emergence of tools like Claude Code Security, OX Security is urging users to resist the temptation to outsource judgment, architecture, and validation to a single artificial intelligence (AI) model. "AI doesn't invent fundamentally new code patterns," it said. "It reproduces the most common ones it has seen before. That means it scales not only productivity, but also existing weaknesses in software engineering practice." The cybersecurity company also warned that AI systems may be prone to false positives and may not reliably inform a user if an issue flagged in a single repository is actually exploitable in a complex and unique environment. A pipeline that relies on the same AI system for both writing and reviewing code is not ideal, it added. LLMs Enable Automated Internet DeanonymizationA team of academics from Anthropic, ETH Zurich, and MATS Research has developed large language models (LLMs) that can deanonymize internet users based on past comments or other digital clues they leave behind. "Given two databases of pseudonymous individuals, each containing unstructured text written by or about that individual, we implement a scalable attack pipeline that uses LLMs to: (1) extract identity-relevant features, (2) search for candidate matches via semantic embeddings, and (3) reason over top candidates to verify matches and reduce false positives," the researchers said. The method works even if targets use different pseudonyms across multiple platforms. The researchers said using their LLMs outperforms classical research methods, where digital footprints are examined manually by a human operator. This, in turn, enables fully automated deanonymization attacks that can work on unstructured data at scale, while also reducing the cost and effort that goes into intelligence gathering. "Our results show that the practical obscurity protecting pseudonymous users online no longer holds and that threat models for online privacy need to be reconsidered," the researchers said. "The average online user has long operated under an implicit threat model where they have assumed pseudonymity provides adequate protection because targeted deanonymization would require extensive effort. LLMs invalidate this assumption." That wraps up this week’s quick look at what has been happening across the cybersecurity landscape. Each update on its own may seem small, but together they show how quickly things continue to change. New techniques appear, old tactics evolve, and security decisions from major companies can shift the wider ecosystem. For security teams, researchers, and anyone who follows the threat landscape, keeping track of these signals helps make sense of the bigger picture. Stay tuned for the next edition of the ThreatsDay Bulletin with more developments from the cyber world.

Tycoon 2FA, one of the prominent phishing-as-a-service (PhaaS) toolkits that allowed cybercriminals to stage adversary-in-the-middle (AitM) credential harvesting attacks at scale, was dismantled by a coalition of law enforcement agencies and security companies. The subscription-based phishing kit, which first emerged in August 2023, was described by Europol as one of the largest phishing operations worldwide. The kit was sold via Telegram and Signal for a starting price of $120 for 10 days or $350 for access to a web-based administration panel for a month. Tycoon 2FA's primary developer is alleged to be Saad Fridi, who is said to be based in Pakistan. The panel serves as a hub for configuring, tracking, and refining campaigns. It features pre‑built templates, attachment files for common lure formats, domain and hosting configuration, redirect logic, and victim tracking. Operators can also configure how the malicious content is delivered through attachments, as well as keep tabs on valid and invalid sign-in attempts. The captured information, such as credentials, multi-factor authentication (MFA) codes, and session cookies, can be downloaded directly within the panel or forwarded to Telegram for near‑real‑time monitoring. "It enabled thousands of cybercriminals to covertly access email and cloud-based service accounts," Europol said. "At scale, the platform generated tens of millions of phishing emails each month and facilitated unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions." As part of the coordinated effort, 330 domains that formed the backbone of the criminal service, including phishing pages and control panels, have been taken down. Characterizing Tycoon 2FA as "dangerous," Intel 471 said the kit was linked to over 64,000 phishing incidents and tens of thousands of domains, generating tens of millions of phishing emails each month. According to Microsoft, which is tracking the operators of the service under the name Storm-1747, Tycoon 2FA became the most prolific platform observed by the company in 2025, prompting it to block more than 13 million malicious emails linked to the crimeware service in October 2025. In total, Tycoon 2FA accounted for approximately 62% of all phishing attempts blocked by Microsoft as of mid-2025, including more than 30 million emails in a single month. The service has been linked to an estimated 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers, the tech giant added. Geographic analysis of victim log data by SpyCloud indicates that the U.S. had the largest concentration of identified victims (179,264), followed by the U.K. (16,901), Canada (15,272), India (7,832), and France (6,823). "The overwhelming majority of targeted accounts were enterprise-managed or otherwise associated with paid domains, reinforcing the conclusion that Tycoon 2FA is primarily directed at business environments rather than individual consumer accounts," the cybersecurity company said. Data from Proofpoint shows that Tycoon 2FA accounted for the highest volume AiTM phishing threats. The email security company said it observed over three million messages associated with the phishing kit in February 2026 alone. Trend Micro, which was one of the private sector partners in the operation, noted that the PhaaS platform had approximately 2,000 users. Campaigns leveraging Tycoon 2FA have indiscriminately targeted almost all sectors, including education, healthcare, finance, non-profit, and government. Phishing emails sent from the kit reached over 500,000 organizations each month worldwide. "Tycoon 2FA's platform enabled threat actors to impersonate trusted brands by mimicking sign-in pages for services like Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail," Microsoft said. "It also allowed threat actors using its service to establish persistence and to access sensitive information even after passwords are reset, unless active sessions and tokens were explicitly revoked. This worked by intercepting session cookies generated during the authentication process, simultaneously capturing user credentials. The MFA codes were subsequently relayed through Tycoon 2FA's proxy servers to the authenticating service." The kit also employed techniques like keystroke monitoring, anti-bot screening, browser fingerprinting, heavy code obfuscation, self-hosted CAPTCHAs, custom JavaScript, and dynamic decoy pages to sidestep detection efforts. Another key aspect is the use of a broader mix of top-level domains (TLDs) and short-lived fully qualified domain names (FQDNs) to host the phishing infrastructure on Cloudflare. The FQDNs often only last for 24 to 72 hours, with the rapid turnover a deliberate effort to complicate detection and prevent building reliable blocklists. Microsoft also attributed Tycoon 2FA's success to closely mimicking legitimate authentication processes to stealthily intercept user credentials and session tokens. To make matters worse, Tycoon 2FA customers leveraged a technique called ATO Jumping, whereby a compromised email account is used to distribute Tycoon 2FA URLs and attempt further account takeover activities. "Using this technique enables emails to look like they are authentically coming from a victim’s trusted contact, increasing the likelihood of a successful compromise," Proofpoint noted. Phishing kits like Tycoon are designed to be flexible so that it's accessible to less technically savvy actors while still offering advanced capabilities for more experienced operators. "In 2025, 99% of organizations experienced account takeover attempts in 2025, and 67% experienced a successful account takeover," Selena Larson, staff threat researcher at Proofpoint, said in a statement shared with The Hacker News. "Of these, 59% of the taken-over accounts had MFA enabled. While not all of these attacks were related to Tycoon MFA, this shows the impact of AiTM phishing on enterprises." "These cyberattacks that enable full account takeovers can lead to disastrous impacts, including ransomware or the loss of sensitive data. As threat actors continue to prioritize identity, gaining access to enterprise email accounts is often the first step in an attack chain that can have destructive consequences."

Europol, Microsoft, and cybersecurity companies on Wednesday announced a joint effort to take down the widely used phishing-as-a-service platform Tycoon 2FA. Tycoon 2FA is a subscription-based platform that enables threat actors to impersonate users, create phishing pages, and bypass multi-factor authentication (MFA). It has allowed malicious hackers to intercept authentication sessions and gain access to targeted email and cloud accounts without triggering alerts. “Tycoon 2FA combined convincing phishing templates, realistic landing pages, and real‑time capture of credentials and authentication codes into an easy‑to‑use package that scaled quickly. By lowering the technical barrier to entry, it allowed criminals with limited expertise to run sophisticated impersonation campaigns,” Microsoft said. According to the tech giant, Tycoon 2FA accounted for roughly 62% of the phishing attempts it blocked last year. The platform had been used to send out tens of millions of phishing emails to 500,000 organizations every month. “Despite extensive defenses, the service is linked to an estimated 96,000 distinct phishing victims worldwide since 2023, including more than 55,000 Microsoft customers,” Microsoft said. The disruption of the cybercrime platform involved court orders, intelligence from major cybersecurity firms, and the seizure of 330 active Tycoon 2FA domains, including control panels and phishing pages. Law enforcement agencies in Latvia, Lithuania, Portugal, Poland, Spain, and the UK were involved in disrupting Tycoon 2FA, Europol said. The list of security companies that also participated in the operation includes Cloudflare, Proofpoint, Intel471, TrendAI, Resecurity, SpyCloud, and eSentire, along with the cryptocurrency exchange Coinbase, the law firm Crowell, and cybersecurity organizations Shadowserver and Health-ISAC. In addition to the takedown of the Tycoon 2FA infrastructure, legal action has been taken against multiple individuals suspected of running the operation, including Saad Fridi, based in Pakistan and believed to be the platform’s main developer. Related: RaccoonO365 Phishing Service Disrupted, Leader Identified Related: SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Related: 1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium

An international law enforcement operation coordinated by Europol has disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) platform linked to tens of millions of phishing messages each month. In total, 330 domains part of the criminal service's backbone infrastructure (including control panels and phishing pages) were seized and taken offline during this joint action. "The technical disruption was led by Microsoft with the support of a coalition of private partners, while seizure of infrastructure and other operational measures were carried out by law enforcement in Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom – all of this coordinated by Europol," Europol said on Wednesday. "The investigation began after intelligence was shared by Trend Micro. Europol disseminated this information through its EC3 Advisory Groups and operational networks, enabling a coordinated operational strategy to be developed." The action was also supported by Cloudflare, Coinbase, Intel471, Proofpoint, Shadowserver Foundation, SpyCloud, eSentire, Crowell, Resecurity, and Health-ISAC. Tycoon2FA (also known as Tycoon 2FA and operated by a threat group tracked as Storm-1747) has been active since at least August 2023 and was used by cybercriminals to bypass multi-factor authentication (MFA) protections and compromise accounts belonging to nearly 100,000 organizations worldwide, including government institutions, schools, and healthcare organizations. According to Microsoft, Tycoon2FA was generating tens of millions of phishing emails each month by mid-2025, reaching more than 500,000 organizations and accounting for 60% of all blocked phishing attempts. It operated as an adversary-in-the-middle platform, using a reverse proxy server to intercept victims' login credentials and session cookies in real time, in attacks targeting Microsoft and Google customers. However, it allowed attackers to hijack authenticated sessions and circumvent MFA protections, even though the login process appeared to succeed normally from the victims' perspective. "Tycoon2FA's platform enabled threat actors to impersonate trusted brands by mimicking sign-in pages for services like Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail. It also allowed threat actors using its service to establish persistence and to access sensitive information even after passwords are reset, unless active sessions and tokens were explicitly revoked," Microsoft said today. "This worked by intercepting session cookies generated during the authentication process, simultaneously capturing user credentials. The MFA codes were subsequently relayed through Tycoon2FA's proxy servers to the authenticating service." Sold through Telegram for $120 for 10 days of access, Tycoon2FA lowered the barrier for low-skilled criminals to launch sophisticated, MFA-bypassing attacks at scale. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Investigators claimed today to have taken out another key player in the global cybercrime supply chain after seizing infrastructure linked to phishing-as-a-service (PhaaS) operation Tycoon 2FA. The effort was led by Microsoft and Europol and supported by a range of industry partners, including TrendAI, Cloudflare, Coinbase, Crowell, eSentire, Health-ISAC, Intel471, Proofpoint, Resecurity, The Shadowserver Foundation, and SpyCloud. Over 300 domains linked to Tycoon2FA were seized in the operation, according to TrendAI. Tycoon2FA offered subscription-based PhaaS that used adversary-in-the-middle techniques to intercept live authentication sessions, and capture credentials, one-time passcodes and active session cookies in real time. This enabled threat actors using it to bypass multi-factor authentication (MFA) and access countless enterprise accounts in large-scale attacks on corporate inboxes. Tycoon2FA had around 2000 users and used more than 24,000 domains since its launch in August 2023. “This was not a single phishing campaign. It was an industrialized service built to make MFA bypass accessible to thousands of criminals,” said Robert McArdle, director for cybercrime research at TrendAI. “Identity is now the primary attack surface. When session hijacking can be packaged and sold as a subscription, the risk shifts from isolated incidents to systemic exposure.” More Work Still to Do TrendAI and other industry partners passed on crucial threat intelligence to law enforcement regarding Tycoon2FA infrastructure and campaigns. They assessed the primary operator to be a threat actor using the online identities “SaaadFridi” and “Mr_Xaad.” However, with the perpetrator and many more like him still at large, security experts urged network defenders to build resilience against PhaaS. TrendAI recommended that organizations: Adopt phishing-resistant authentication and enforce strict conditional access controls Deploy advanced email and collaboration security that can detect lateral phishing and brand impersonation Enable real-time URL inspection and web content analysis to identify fake login infrastructure Monitor identity risk posture continuously and take action quickly when anomalous session behavior is detected Conduct regular phishing simulations and security awareness training

Gli agenti AI sono tra noi da decenni. Se, sul piano teorico, esistono dagli anni Cinquanta del secolo scorso, il concetto di agente intelligente è stato formalizzato circa 30 anni fa. Nei primi anni del decennio corrente, invece, sono stati introdotti gli agenti AI basati sui Large Language Model (LLM). Durante le ultime settimane sono tornati alla ribalta per via di una loro (assai teorica) democratizzazione avvenuta grazie a OpenClaw, assistente AI Open source orientato all’automazione di task dal quale è disceso Moltbook, il social network sul quale soltanto i bot possono postare contenuti. Ora, al di là di quanto siano attendibili e solidi OpenClaw e Moltbook, è indubbio che hanno contribuito a rilanciare l’argomento degli agenti AI e della loro sicurezza. Qui ci concentriamo sui rischi e i rimedi per le aziende al cui interno gli agenti svolgono compiti determinanti. Indice degli argomenti Una spiegazione esaustiva è più complessa della definizione degli agenti AI, secondo la quale sono sistemi di Intelligenza artificiale progettati per eseguire compiti in autonomia. Una descrizione assai dozzinale che non include, almeno in superficie, che gli agenti AI osservano un contesto, decidono cosa fare per raggiungere l’obiettivo prefissato e agiscono seguendo passi concreti e non si limitano, dunque, alla generazione di testo o di contenuti multimediali. Quindi, a differenza di una chatbot canonica (quale ChatGpt, Claude o Gemini) che risponde a domande specifiche, non prende iniziative e non interagisce con strumenti esterni, gli agenti AI rappresentano un paradigma diverso perché hanno comportamenti dinamici e adattivi. Per fare qualche esempio banale ma lineare e chiaro, un agente AI legge un’email, la classifica e risponde seguendo regole. È anche in grado di estrarre una tipologia prestabilita di dati da una risorsa web e inserirla in un database o, ancora, è in grado di automatizzare un processo, sia questo il monitoraggio e la misurazione di un flusso aziendale, la preparazione di un report oppure la prenotazione di un biglietto aereo. Il comportamento adattivo di un agente può essere riassunto così: capisce un obiettivo, pianifica il modo di raggiungerlo, esegue i passi necessari, valuta il risultato ottenuto e, se necessario, ripete la catena fino a quando l’obiettivo è pienamente centrato. Gli agenti AI rappresentano un cambio di paradigma nell’automazione aziendale, passando dalla semplice generazione di contenuti all’ esecuzione autonoma di azioni complesse attraverso sistemi interconnessi. Questa evoluzione introduce una superficie di attacco completamente nuova che richiede approcci di sicurezza fondamentalmente diversi rispetto ai tradizionali sistemi AI. Per spiegare meglio come si amplia la superficie d’attacco e che cosa vuole dire che un agente AI esegue compiti in autonomia, ritorniamo all’esempio della prenotazione di un biglietto aereo. Un agente AI può prenotarne uno a patto che abbia accessi e autorizzazioni sufficienti. Nello specifico: Accesso a sistemi di prenotazione: deve interagire con API di compagnie aeree e con sistemi Global Distribution System (GDS) che si occupano della distribuzione di tariffe e inventari di vettori di viaggio, hotel, autonoleggi, eccetera Capacità di esecuzioni transazionali: l’agente deve compilare moduli web, interrogare API, gestire le procedure di autenticazione ed effettuare pagamenti mediante gateway appropriati Gestione dei vincoli: confrontare prezzi, numero di scali, orari e durata del viaggio, gestire errori o intoppi (pagamenti rifiutati, esaurimento dei posti prenotabili durante il processo di prenotazione, eccetera) e avere memoria della sessione di prenotazione in corso. Un simile agente AI già palesa la necessità di autorizzazioni esplicite e di misure per la sicurezza dei pagamenti, così come esplicita la necessità di accedere a dati personali e quindi di sottostare alla compliance normativa. Questi tanti step, qui citati in modo generale, si moltiplicano e assumono spessore diverso quando, al posto di prenotare un biglietto aereo, un agente AI viene usato all’interno di flussi aziendali complessi. Se, per esempio, si immagina un agente AI in un ambiente di produzione industriale, non è avulso dalla realtà pensare che debba monitorare continuamente dati operativi (stato macchine, tempi ciclo, qualità, ordini, scorte), correlarli con modelli predittivi e vincoli aziendali, individuare anomalie o rischi (guasti, ritardi, colli di bottiglia), simulare scenari alternativi e prendere o proporre decisioni operative come, per esempio, ripianificare la sequenza dei lotti, anticipare la manutenzione o riallocare risorse con l’obiettivo di massimizzare l’efficienza, ridurre i tempi di fermo e rispettare le scadenze, operando come un livello decisionale automatizzato sopra i sistemi gestionali e di controllo esistenti. In questo scenario subentrano le linee di assemblaggio, macchine a controllo numerico e robot industriali, sistemi Manufacturing Execution System (EMS), Enterprise Resource Planning (ERP), i sensori IoT sui macchinari e tutti i dispositivi IoT usati per la produzione, la gestione del magazzino e parametri terzi quali i vincoli di consegna. Sempre facendo riferimento all’esempio qui sopra, un agente AI e le tecnologie su cui poggia apre a esposizioni di API, al furto di token di autenticazione (OAuth), ad attacchi man-in-the-middle, all’abuso di rate limit e alle tecniche di prompt injection. Non di meno, c’è il rischio di escalation di privilegi e di movimenti laterali, oltre ai noti rischi di poisoning che attanagliano tutto l’emisfero dei prodotti potenziati dalle intelligenze artificiali. Le minacce sono tendenzialmente molte di più ma, a fare stato, sono l’aumento del numero degli endpoint, la dipendenza da servizi di terze parti e – oltre alla già citata necessità di concedere all’automazione privilegi elevati – il fatto che gli agenti AI gestiscono dati ad alta sensibilità. Sono diversi i casi in cui la violazione di agenti AI ha portato a conseguenze gravi. Non è demonizzazione, ci sono molti motivi per introdurli nelle aziende (qui un approfondimento) ma non a discapito della sicurezza. Più che parlare di casi singoli, nominando quindi organizzazioni vittime di attacchi, è opportuno parlare delle possibili crisi di sicurezza aziendale. In tempi recenti, siamo a metà del 2025, è emersa con un certo fragore la vulnerabilità nota con il nome di EchoLeak e catalogata come CVE-2025-32711. È un caso di studio di rilievo perché non è un bug ma un’esposizione strutturale che colpisce Microsoft Copilot, dimostrando come l’autonomia degli agenti è in grado di trasformare la vulnerabilità di divulgazione delle informazioni in catene di compromissioni attive e automatizzate. Fino a due anni fa gli assistenti AI erano reattivi e ora ci si trova davanti ad agenti che operano in modo indipendente e pianificano interi flussi di lavoro. Questa autonomia crea un nuovo tipo di rischio: se qualcuno inserisce istruzioni malevole dentro dati che l’agente legge (email, documenti, database), l’agente le interpreta come comandi veri e le esegue automaticamente. EchoLeak sfrutta esattamente questo: l’agente non distingue tra “dato” e “istruzione” e, di conseguenza, un contenuto apparentemente innocuo può trasformarsi in un ordine operativo che l’agente porta a termine senza chiedere conferma. Nella fattispecie, la vulnerabilità CVE-2025-32711 si inserisce in un tessuto di minacce la cui crescita, in difetto degli accorgimenti del caso sui quali ci concentriamo più vanti, rischia di tendere a crescere in modo proporzionale all’adozione di agenti AI da parte delle organizzazioni. L’aspetto più critico di CVE-2025-32711 è che l’intera compromissione avviene senza che l’utente clicchi su link, scarichi allegati o accetti come validi link sospetti. L’autonomia dell’agente trasforma il contenuto passivo in un vettore di esecuzione attiva. La sequenza dell’attacco si articola così: Iniezione silente: l’attaccante invia o pubblica un messaggio di posta elettronica contenente prompt appositamente ingegnerizzati e spesso invisibili all’occhio umano (utilizzando, per esempio, font microscopici o dello stesso colore dello sfondo). Indicizzazione contestuale: Microsoft Copilot, nel perseguire la sua funzione, indicizza automaticamente il contenuto delle email per arricchire la propria base di conoscenza operativa Attivazione latente: i prompt nascosti rimangono inerti finché l’utente legittimo non effettua una query correlata. In quel momento, l’agente richiama il contenuto dell’email infetta, interpretando le istruzioni dell’attaccante come direttive di sistema valide Esfiltrazione autonoma: una volta attivato, Copilot esegue le istruzioni di esfiltrazione, inviando dati sensibili (come credenziali, segreti aziendali o altri dati sensibili) verso endpoint controllati dall’attaccante. EchoLeak dimostra il fallimento dei controlli di sicurezza canonici. I firewall per applicazioni web (WAF) e le difese perimetrali sono inefficaci poiché l’attacco opera al layer semantico, sfruttando l’intenzionale capacità dei modelli linguistici di interpretare il linguaggio naturale in modo creativo. OpenAI stessa ha ammesso, a dicembre del 2025, che fornire garanzie di sicurezza deterministiche contro la prompt injection è una sfida fondamentale dovuta al design intrinseco dei modelli, che non possono distinguere in modo affidabile tra istruzioni di sistema e dati che sembrano istruzioni. Inoltre, EchoLeak rende obsoleta la formazione tradizionale sulla sicurezza informatica: nessuna consapevolezza dell’utente può prevenire un attacco in cui l’agente processa autonomamente contenuti malevoli in background. Uscendo dal dominio degli agenti AI di Microsoft Copilot, analisi pubblicate da specialisti del settore mostrano come gli agenti autonomi integrati in sistemi di procurement, infrastrutture operative e piattaforme di orchestrazione possono diventare vettori privilegiati per attacchi complessi fondati su manipolazioni dei dati ed escalation dei privilegi. Una tecnica di attacco a manipolazioni incrementali ribattezzata Salami Slicing Attack Pattern (descritta nel link sopra) dimostra come un agente con accesso a strumenti e API possa essere indotto a eseguire micro-azioni malevole non rilevabili singolarmente, ma devastanti nel loro effetto cumulativo. Per dare corpo alla generica locuzione “effetto cumulativo”, è utile disegnare alcuni scenari. Per esempio, un agente AI compromesso può esfiltrare un intero database o cancellare file critici senza compiere azioni palesemente ostili, svolgendo operazioni minime che non superano soglie di detection e non attivano alert specifici. Altro scenario è la manipolazione graduale di file di configurazioni. L’agente AI controllato dagli attaccanti cambia, uno alla volta, i parametri di sicurezza utili ad allentare le policy di Identity and Access Management (IAM) o a compromettere la rotazione di chiavi. Tutte modifiche che, singolarmente, non appaiono critiche fino a quando non creano una superficie d’attacco difficile da gestire. In un altro scenario, un agente AI compromesso può effettuare micro-transazioni finanziarie al di sotto delle soglie antifrode. Ognuna di queste è irrilevante ma, nel loro insieme, possono costituire un danno economico di rilievo. Possiamo quindi dedurre che questi scenari, pure se differenti tra loro, fanno appello a sistemi di difesa nei quali: La detection è basata su soglie statiche o regole isolate L’analisi degli eventi non è correlata in longitudine Vige l’assenza di modelli comportamentali cumulativi sul lungo periodo. Tutto ciò richiama gli attacchi low and slow già noti nell’emisfero della cybersecurity tradizionale e che ora sbarcano nei meandri dei sistemi autonomi dotati di capacità decisionali e di persistenza operativa. OWASP, ossia Open Web Application Security Project, è una fondazione che si occupa di redigere linee guida sulla sicurezza delle applicazioni. Tra la letteratura che mette a disposizione vi sono ampi riferimenti agli agenti AI e alle vulnerabilità più pericolose o diffuse, così come alle strategie di difesa. Nel caso specifico, l’assetto difensivo appoggia su quattro diversi pilatrsi: Implementazione del principio di “Least agency”: a differenza del semplice Least privilege, questo approccio minimizza non solo i permessi tecnici (API, database), ma anche l’autonomia decisionale e l’ambito di azione dell’agente Isolamento dei contesti: è fondamentale utilizzare contesti separati e isolati per le istruzioni di sistema rispetto ai contenuti forniti dagli utenti o da fonti esterne non fidate come le email. Monitoraggio a runtime e Guardian agent: poiché la prevenzione totale è da considerare di complessa attuazione, le imprese devono investire in sistemi di monitoraggio comportamentale e agenti capaci di rilevare anomalie semantiche e violazioni delle policy a velocità di macchina. I Guardian agent sono, in definitiva, agenti AI che controllano l’operato di sistemi AI Validazione degli output: implementare controlli rigorosi sugli output dell’agente per intercettare tentativi di esfiltrazione di dati sensibili prima che lascino il perimetro aziendale. Più in generale, non ha senso parlare dei pericoli a cui si espongono le organizzazioni che fanno uso di uno o di un altro agente AI, perché una corretta profilassi si concentra sui rischi potenziali a 360 gradi. Infatti, il rischio in quanto tale non è figlio delle AI ma dell’orchestrazione operativa che viene concessa agli agenti ai quali, con l’aumentare delle capacità esecutive, deve coincidere una più rigorosa osservanza della governance di sicurezza. Ciò coincide con politiche Zero Trust, segmentazione, least privilege ma anche auditing e monitoraggio comportamentale continuo. La necessità di un framework unificato non è un optional, come abbiamo scritto qui, identificando minacce dirette e sottolineando che servono standard condivisi. Abbiamo selezionato alcune piattaforme che coprono aspetti fondamentali della cybersecurity per agenti AI aziendali quali: Il rilevamento di agenti non autorizzati e shadow AI La protezione delle identità agentiche e privilegi La governance delle azioni AI con controlli adattivi La prevenzione della perdita di dati causata da agenti La protezione runtime e posture di sicurezza AI. Cisco mette a disposizione Skill Scanner, strumento Open source prelevabile qui progettato per valutare la sicurezza delle skill degli agenti AI. Il riferimento è ai moduli che potenziano gli agenti messi a disposizione da Claude o OpenClaw e che possono introdurre vulnerabilità di diverso tipo, tra le quali le già citate prompt injection, esfiltrazione dati, esecuzione di script non autorizzati e bypass di controlli di sicurezza interni. Skill Scanner di Cisco AI Threat and Security Research combina analisi statica, analisi comportamentale e analisi semantica assistita da AI per evidenziare comportamenti sospetti o rischiosi nelle skill prima che vengano adottate in ambienti di produzione, con indicazioni su gravità, file coinvolti e azioni correttive. CrowdStrike Falcon Secure Your AI è una piattaforma di sicurezza unificata che estende la protezione a modelli, agenti e infrastrutture AI, con rilevamento di shadow AI, protezione dagli exploit adversarial e governance delle identità. Offre visibilità su agenti non autorizzati e strumenti per mitigare minacce su dati, modelli e identità. Proofpoint mette a disposizione una soluzione focalizzata su protezione dei dati e collaborazione sicura tra persone e agenti AI, con controlli per impedire perdita di dati (data exfiltration) da agenti, governance delle azioni AI e strumenti per automatizzare operazioni di sicurezza. IBM Guardium AI Security è una piattaforma per la protezione di modelli AI, agenti e casi d’uso generativi, inclusa visibilità, rilevamento di shadow AI e protezione da prompt pericolosi e vulnerabilità di configurazione. Offre monitoraggio continuo e mapping delle esposizioni su framework di sicurezza riconosciuti Operant AI Agent Protector è un prodotto dedicato alla sicurezza degli agenti AI che fornisce visibilità completa, protezione inline, scoperta di agenti non autorizzati (shadow agents). Mette l’enfasi su least privilege e blocco di escalation di privilegi o tentativi di esfiltrazione. Include enclave sicure per agenti interni e monitoraggio cloud native.

AWS has launched a new version of its Security Hub that solves the massive workload involved in cross domain security solution correlation and management. The original AWS Security Hub was announced in 2018, designed to aggregate and prioritize alerts from AWS and third-party security tools. In late 2025, AWS announced a ‘re-imagined’ Security Hub. It unified several of its own security tools, including Inspector and GuardDuty, effectively into a mini-SOC. Inspector is vulnerability scanning; GuardDuty is threat detection. In the re-imagined Security Hub, they can now integrate under a single pane of glass to map activity against vulnerabilities to highlight the most urgent threats and help customers prioritize and respond to their most critical security risks. Now, in early 2026, AWS announced Security Hub Extended. This allows customers to bring third party solutions into the same mini-SOC. It is, writes AWS, “A plan of Security Hub that simplifies how you procure, deploy, and integrate a full-stack enterprise security solution across endpoint, identity, email, network, data, browser, cloud, AI, and security operations.” For now, this full integration is limited to a range of curated vendors, selected from AWS customers’ own preferences. The current vendors include 7AI, Britive, CrowdStrike, Cyera, Island, Noma, Okta, Oligo, Opti, Proofpoint, SailPoint, Splunk, Upwind, and Zscaler. The intent is to offer integrated full stack security within AWS. “The selection was customer-driven,” explains Michael Fuller, director of security services at AWS. “Over the last four months, we went directly to our largest and fastest-growing enterprise customers and asked them which specific solutions they wanted us to prioritize in each category for the initial launch. We are committed to listening to customers and expanding the partner set over time.” The integration is made possible by the partner vendors all providing their findings in the open cybersecurity schema framework (OCSF). The data brought into the Security Hub Extended framework is consequently pre-normalized, and Security Hub Extended can perform instant and automatic cross-domain correlation to detect and highlight more granular threats. The new Hub goes beyond simplifying output correlation – it also simplifies product management whenever one of the partner vendors is used. AWS becomes the seller of record, and no matter how many of the partner vendors are used, there is only one invoice combined within the single AWS monthly bill. “AWS is the seller of record, with pre-negotiated pricing and a single bill covering all selected curated partner solutions,” explains Fuller. “Customers select only the solutions they need. A customer using multiple curated partner solutions would pay for each solution selected.” But always within the single invoice. He continues, “Security Hub Extended plan offers flexible pay-as-you-go pricing with no upfront investments and no long-term commitments. Flat-rate pricing is also available.” Customers are not required to use third-party vendors from the curated partners list. “Security Hub already supports multiple third-party partner integrations through its standard program,” adds Fuller, “so a customer’s existing vendor can already send findings into Security Hub today.” But this would require additional work from the customer and would not qualify for the single invoice structure. The triple benefit of Security Hub Extended is intended to be an easier correlation of security findings within the Hub’s mini SOC offering automated and improved full stack security; no additional coding required from the customer; and drastically reduced administrative overhead in finding, negotiating and on-going payment for multiple separate third party solutions. Related: Hundreds of FortiGate Firewalls Hacked in AI-Powered Attacks: AWS Related: AWS Trusted Advisor Tricked Into Showing Unprotected S3 Buckets as Secure Related: AWS Launches Incident Response Service Related: AWS Using MadPot Decoy System to Disrupt APTs, Botnets

As the cybersecurity market continues to mature, SecurityWeek’s annual M&A report provides an essential roadmap for understanding how corporate consolidation is reshaping the digital defense sector. SecurityWeek’s M&A tracker cataloged 426 deals in 2025, including 334 involving pure-play companies. The 2025 figure of 426 represents a 5% increase over 2024, signaling that the sector is once again on an upward trajectory after two years of consecutive decline. While the total number of deals is lower than the 2022 peak (455), the value and complexity of the deals appear to be higher. In addition, the market continues to move away from the ‘buying everything’ trend observed in 2021/2022 to a more strategic, international consolidation. Regional dynamics and global footprint The 2025 data shows that the market has become significantly more globalized. At 288 participations for 426 deals, the US remains involved in roughly 67% of all global cybersecurity M&A. This is a slight recovery from the 63% low in 2023, but still well below the 80% dominance seen in 2021. The UK saw a decline from 70 deals (2021) to 48 (2023). However, it rebounded to 67 in 2024 and maintained that momentum with 64 deals in 2025. The UK has solidified its position as the clear #2 global hub for cybersecurity M&A. After being overtaken in the rankings in 2024, Israel has reclaimed the 3rd position with 34 deals in 2025. Ireland and Sweden saw fewer than 10 deals in 2024 after a strong 2023. In 2025, they bounced back to 12 and 11 deals respectively. Capital allocation and valuation trends Financial details were disclosed for 74 deals for a total disclosed value of $92.5 billion. This includes 63 deals involving pure-play cybersecurity companies, with a total disclosed value of $84 billion. The total disclosed deal value has surged by approximately 82% year-over-year, which can largely be attributed to Google’s planned acquisition of cloud security giant Wiz for $32 billion. The industry has sustained its appetite for billion-dollar acquisitions, with 11 deals exceeding the $1 billion mark. In addition to Google-Wiz, seven deals involving pure-play cybersecurity firms surpassed $1 billion, including Palo Alto Networks acquiring CyberArk ($25B) and Chronosphere ($3.3B), ServiceNow’s acquisition of Armis ($7.7B) and Veza ($1B), Francisco Partners buying Jamf ($2.2B), Veeam Software acquiring Securiti AI ($1.7B), and Proofpoint acquiring Hornetsecurity ($1.8B). This suggests that large-scale platform consolidation is now a permanent fixture of the landscape. The $100M-$999M range was the primary engine of growth in 2025. This indicates that acquirers are focusing on mature, established cybersecurity companies rather than early-stage startups. This also suggests that the industry is currently in a phase of strategic scaling, where medium-sized specialized leaders are being swallowed by larger platforms to create all-in-one security suites. There has been a noticeable decline in the number of disclosed deals under $100M (down to 26 in 2025 from 32 in 2024). This implies that ‘tuck-in’ acquisitions of very small startups are either becoming less frequent or are less likely to have their financial terms disclosed compared to larger, more impactful deals. Sector deep-dive and domain expertise SecurityWeek data shows that 125 deals involved managed security solutions providers (MSSPs) in 2025, including 60 pure cybersecurity providers. This includes product distributors and companies that offer other products and services in addition to cybersecurity. While activity involving MSSPs has increased from 119 deals in 2024, it remains significantly lower than the 150+ seen in 2022 and 2023. After a sharp drop in 2024, the 2025 figure suggests the market has found its new normal. It is no longer in a freefall, but it hasn’t returned to the frantic buying spree of 2022-2023. The strategic value remains high as managed services continue to be the primary way small-to-medium enterprises consume security. While it’s important to keep track of MSSP deals, we are tracking them separately in an effort to get a better view of the other categories. Several core security sub-sectors experienced significant upward momentum in 2025, as acquirers seem to prioritize data sovereignty, identity integrity, and regulatory compliance. With 82 deals, GRC (governance, risk, and compliance) reached a five-year peak in 2025. While it has always been a top category (averaging 65 deals from 2021-2024), the jump to 82 suggests that companies are prioritizing regulatory requirements over purely technical defenses. Data protection recorded aggressive growth, surging from 44 deals in 2024 to 63 deals in 2025. This reflects an industry shift toward data-centric security. While still a smaller category, AI security is showing a clear upward trajectory. It recorded 8 deals in 2024 and has increased to 13 deals in 2025, mirroring the broader tech industry’s focus on securing LLMs and AI pipelines. After a significant slump in 2024 (dropping to 28 deals), identity has bounced back to 43 deals in 2025, returning to its historical levels from 2022 and 2023. While several sectors saw record growth, four categories experienced a cooling in M&A activity, reflecting a pivot away from reactive tools toward long-term governance and data resilience. One of them is incident response, which has seen a notable decline, dropping from a peak of 38 deals in 2024 to 25 deals in 2025. Private equity-led acquisitions have also cooled significantly. They spiked to 37 in 2023 but dropped to 18 in 2025, returning to the levels seen in 2021 and 2022. After a strong 2024 (16 deals), interest in companies specializing in industrial/OT cybersecurity appears to have leveled off, dropping back to 9 deals, the same number recorded in 2023. Application security saw a steady rise in M&A deals through 2024 (reaching 31), but dipped slightly to 26 in 2025. Two types of companies stand out for remaining steady throughout the years. Network security remains the most consistent category in the dataset. It has hovered almost exactly at the same level for four years, with roughly 40 deals announced every year between 2022 and 2025. The government contractors segment is also remarkably stable, consistently recording between 36 and 38 deals annually (except for a slight outlier of 43 in 2021). It sits at 36 deals for 2025. The 2025 data indicates a market shift away from reactive tools (incident response) and toward resilience and compliance infrastructure (GRC and data protection). While 2024 was a year of diversifying into specialized niches, 2025 appears to be a year of consolidation around the core pillars of governance and data privacy. Monthly summaries of 2025 cybersecurity M&A deals: January, February, March, April, May, June, July, August, September, October, November, December. Methodology: The data was collected through news distribution services, Google searches and pitches from PR companies. The data includes companies that issued press releases announcing or mentioning acquisitions, as well as deals that have been privately reported to SecurityWeek. All deals that had a cybersecurity component have been taken into account for this study. Mergers and acquisitions that did not have an English-language announcement may not be included. The data could also include some deals that may have not been completed after they were announced. The GRC category includes governance, compliance, risk management, audit, assessment, vulnerability management, penetration testing, attack surface management, offensive security, and cyber insurance. Network security includes endpoint security, MDR, XDR, NDR, and SASE. Identity includes IAM, PAM, secure access, authentication, and authorization. Incident response includes SOAR, SIEM, SOC, and forensics. ‘Other (specialized)’ includes hardware, quantum, media and events, healthcare, brand protection, financial, online safety, SAP, recruiting, real estate, and automotive. Data protection includes encryption/cryptography, VPN, privacy, backup and blockchain. MSSP includes cybersecurity solution distributors and companies that do not develop their own products or solutions. The AI category only includes companies specializing in securing AI.

Phishing operation with links to Russia, Armenia compromised Western cargo companies, researchers find Researchers have uncovered and taken down the infrastructure of a phishing operation run by Russian cybercriminals targeting freight companies in the U.S. and Europe. Over a five-month period, the group, dubbed Diesel Vortex, stole more than 1,600 login credentials from accounts at logistics platforms, which allowed thieves to intercept and divert freight shipments and commit check fraud. The researchers with the domain protection platform Have I Been Squatted discovered an exposed .git directory, which revealed the ins and outs of the operation, including messages sent between the cybercriminals. The leaked repository exposed a phishing-as-a-service platform that was in the works to be marketed to customers as “MC Profit Always,” a likely reference to “motor carriers.” The Diesel Vortex cybercriminals built phishing infrastructure targeting users of the platforms that power the freight and logistics industries, like load boards — marketplaces where shippers, brokers and carriers connect — fleet management portals and fuel card systems. They impersonated carriers and brokers and were able to access freight systems. Messages seem to show them engaged in “double-brokering,” when loads are booked with a stolen carrier identity before the freight is reassigned to a different carrier. The researchers were able to find the outfit’s organizational map, revealing a sophisticated operation including a call center, mail support and employees responsible for connecting with drivers and other logistics contacts. “This blueprint only reinforced what the codebase had already made clear: this was not an opportunistic campaign. It was a deliberate, structured criminal enterprise with defined roles, revenue targets, and a long-term growth strategy,” Have I Been Squatted researchers wrote. The company worked in collaboration with the cyber threat research outfit Ctrl-Alt-Int3l, which discovered in the phishing panel source code mention of a domain registered through a Russian provider and linked to a Russian-registered email address. That email was then linked through corporate records to several Russian companies working in warehousing, transportation and wholesale trade. Recorded Future News reached out to the email address for comment and as of press time had not received a reply. Along with clear links to Russia, Armenian-speaking operators were also involved in the operation, with one of the criminals telling another he was located in Yerevan. In one chat, a member of the group asks in Armenian if they have the credentials of a carrier with “250k cargo” — in other words, one insured to carry high-value freight. According to the researchers, Google Threat Intelligence Group, Cloudflare, GitLab, IPInfo and Ping Identity were involved in taking down the infrastructure. Cargo theft has exploded in recent years, driven by the increasingly digital nature of the business, with annual losses estimated to be around $35 billion. In November, researchers at Proofpoint documented a hacking campaign with links to organized crime targeting trucking and logistics companies with remote monitoring tools. Last month, the House Judiciary Committee advanced the “Combatting Organized Retail Crime Act of 2025,” a bill to establish a coordinated federal response to cargo theft. It would also create new criminal penalties for the laundering of illicit proceeds or the sale of stolen goods. James Reddick has worked as a journalist around the world, including in Lebanon and in Cambodia, where he was Deputy Managing Editor of The Phnom Penh Post. He is also a radio and podcast producer for outlets like Snap Judgment.