/
attack_type:credential_harvesting × limpar

Resultados

6 casos · pág. 1/1

greynoise.io · exploit público medium

Scanners spoofing OpenAI, Anthropic, Google and Perplexity AI crawlers probe for .env files, cloud keys and credentials

GreyNoise observed automated scanners impersonating the web crawlers of OpenAI, Anthropic, Google, Perplexity, DeepSeek and Amazon while requesting environment files, cloud access keys, private keys and password stores. A cluster of 13 forged AI crawler names from eight companies was seen; six names (belonging to Anthropic, OpenAI, Google…

itsecurityguru.org · high

SEO-poisoning campaign uses fake WatchGuard VPN download site to steal SSL VPN credentials, then serves the genuine signed client

Huntress researchers detailed an SEO-poisoning campaign on 13 October that harvests SSL VPN credentials through a lookalike WatchGuard download page, watchguard-vpn.net, and then delivers the legitimate, validly signed Mobile VPN with SSL installer. Earlier waves used trojanised installers, but this iteration contains no malware, so endpo…

cisa.gov · high

CISA advisory links Flax Typhoon-style actors to Integrity Tech, detailing XSS, SoftEther persistence and mass email theft in Southeast Asia

A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…

blog.checkpoint.com · medium

Q3 2026 brand phishing: Microsoft hits 33% of impersonation; lures target Claude, Antigravity, Apple, Docusign users

Check Point Research's Q3 2026 Brand Phishing Report finds Microsoft was the most impersonated brand, at 33% of all attempts (up from 23% in Q2) and roughly four times the share of any other brand. Apple, Google, LinkedIn and Amazon completed the top five, together accounting for more than half of attempts. Dropbox (up ten places to eight…

Iranian-aligned CL-STA-1178 'Blinder Tunnel' campaign hits Iraqi critical infrastructure with trojanized Dubai Airports coding lures

Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department an…