ThreatLabz found a phishing campaign using fraudulent Google ads and fast-changing Vercel redirects to impersonate Ledger and steal users’ secret recovery phrases. The campaign sent victims through Google Cloud Storage and Google Sites, then used a fake device-verification flow to collect wallet credentials. #Ledger #GoogleAds #GoogleCloudStorage #Vercel #GoogleSites
Category: Threat Research
Netskope Threat Labs tracked a cloud-hosted tech-support-scam kit that uses fake loading screens, browser full-screen tricks, and runtime decryption to display bogus Microsoft Defender or Apple alerts and push victims to call a scam support number. The campaign was distributed through paid Google Ads, affected at least 619 organizations, and used anti-analysis tradecraft to hide its hidden C2 and encrypted payloads. #Netskope #GoogleAds #MicrosoftDefender #Apple #ShopEase
A nested archive named my new program called 2.rar ultimately revealed TokenGrabberBuilder.zip, which contained a Python-based builder and an embedded infostealer payload targeting Windows systems. The malware uses MaaS-style customization, anti-analysis checks, persistence, browser and Discord credential theft, Wi-Fi password harvesting, and webhook-based exfiltration to steal data. #TokenGrabberBuilder #stealer.py #Discord #Roblox
The article explains how software supply chain attacks are increasingly targeting developer endpoints, IDEs, build pipelines, package registries, and CI/CD systems to steal secrets, manipulate artifacts, and poison trusted workflows. It recommends a defense-in-depth strategy across the full SDLC, including secret scanning, hardened identities, immutable provenance, isolated runners, and runtime protections. #GitHubActions #OIDC #MCP #YubiKey #FIDO2 #SLSA #SBOM #GoogleArtifactRegistry #CSPM #CNAPP
CERT-AGID identified and disrupted a new MintsLoader campaign that abused compromised PEC mailboxes to send convincing fake invoice-payment messages to other certified email addresses. The attack chain delivered a ZIP file containing HTML, JavaScript, PowerShell, and MintsLoader components, with rotating infrastructure and DGA-based domains leading to final payloads such as RATs and stealers. #CERT-AGID #MintsLoader #PEC
Datadog Security Labs discovered GHSA-632h-h47v-g4x4 in OpenCode, where a content-type confusion bug in the /global/upgrade endpoint let attackers trigger remote code execution by serving a malicious npm tarball through a crafted cross-origin HTML form submission. OpenCode 1.18.22 fixes the issue, which affected versions 1.14.30 through 1.18.21 when installed via npm, pnpm, or Bun. #OpenCode #GHSA-632h-h47v-g4x4 #Anomaly #DatadogSecurityLabs
Malicious releases of MemTensor’s @memtensor/memos-cloud-openclaw-plugin and MemoryOS package were published on npm and PyPI, respectively, and they drop a cross-platform Go payload named sckit that searches developer home directories for secrets and sends them to C2 infrastructure under skyleen[.]fr. The compromise spans GitHub repository commits, registry releases, and release-tooling changes, putting users, CI runners, and developer machines at risk while exposing tokens and credentials from services such as GitHub, GitLab, AWS, Vault, SSH, and PyPI. #MemTensor #MemOS #OpenClaw #MemoryOS #sckit #skyleenfr
Huntress researchers investigated an intrusion that began with exploitation of a Samsung MagicINFO vulnerability, followed by repeated AnyDesk installation attempts, local account creation, and Defender tampering. The attacker then compiled a SilentXMRMiner-based Monero miner directly on the victim endpoint and connected it to C3Pool for mining. #SamsungMagicINFO #AnyDesk #SilentXMRMiner #C3Pool
MacSync is a rapidly evolving macOS infostealer family that has shifted from AppleScript-based payloads to binary droppers and executables written in Objective-C and Swift, with a new infection chain first observed in September 2026. The campaign uses fake apps, malicious DMG images, iCloud calendar abuse, and layered persistence and exfiltration mechanisms to steal browser, wallet, Telegram, keychain, and system data. #MacSync #AMOS #Toria #iCloud #curve25519_donna
FBI and CISA issued guidance for critical infrastructure owners and operators on reducing risk when using third-party ICS integrators, with emphasis on least privilege, secure contracts, and monitoring remote access. The fact sheet cites a 2025 incident in which foreign cyber actors accessed a U.S. industrial automation company, searched for SCADA-related…
Socket identified a malicious Firefox extension, [email protected], that stays clean until after installation and then downloads a remote payload to automate Google account takeover. The campaign targets Portuguese- and Spanish-speaking users by hijacking Google sessions, stealing oauth_token cookies, and, when needed, forcing password resets through attacker-controlled infrastructure. #[email protected] #pdf.gusercontent.com #accounts.google.com
CERT-AGID identified a phishing campaign abusing the name, logo, and graphics of the Automobile Club d’Italia (ACI) to trick users into paying a fake annual vehicle tax debt. The fraudulent sites acitalia[.]info and acitalia[.]click collect personal data and card details while CERT-AGID has requested their takedown and shared the indicators with accredited organizations. #CERTAGID #AutomobileClubdItalia #ACI #acitaliainfo #acitaliaclick
A sideloaded AppX package can abuse WWAHost.exe and WindowsRuntimeAccess=”all” to open a real Microsoft login flow, capture OAuth authorization codes, and steal access plus refresh tokens even when MFA is completed. The article also shows that the abuse is detectable with a proxy rule for MSAppHost/3.0 traffic to non-Microsoft destinations and highlights Developer Mode as the key prerequisite. #WWAHost #WebAuthenticationBroker #MSAppHost #DeveloperMode #EntraID #MicrosoftOffice
Varonis Threat Labs uncovered AvisLoader, a Windows loader delivered through a ClickFix lure and designed to communicate over the Tox peer-to-peer network for command-and-control. The recovered tooling included shortcut-persistence artifacts, a UAC bypass helper, and a process-hiding DLL, with exposed management features in the AvisLoader Command Center. #AvisLoader #Tox #ClickFix #UACME…
Proofpoint identified UNK_CondorFiltration, an active TeamFiltration campaign that targeted more than 5,700 Microsoft 365 accounts across 28 tenants in Latin America, with a strong focus on Chilean organizations. All seven successful compromises were dormant service accounts with default or predictable passwords and no MFA, and at least one case showed follow-on…