6 casos · pág. 1/1
Cisco Talos disclosed an APT spear-phishing and quishing campaign, tracked as UAT-11985, that targets individuals affiliated with Taiwan research organizations. First seen in mid-2026, it uses fake event invitations to lead victims to an adversary-in-the-middle (AitM) phishing framework that harvests Google account credentials and MFA cod…
Attackers took over more than 300 Tor exit relays in early October 2026 and changed their exit policies so SSH (TCP port 22) traffic was redirected to 12 attacker-controlled interception servers that harvested passwords and attempted to install the Ebury 1.8.3 backdoor. Researcher kaba found 333 redirecting exits (roughly 10% of about 3,0…
The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, …
Researchers at SafeDep analyzed a macOS implant recovered from a compromised workstation. Infection began on 2026-07-26 with a paid YouTube video ad impersonating TradingView that led to a fake .pkg installer. The malware is a remote-controlled task runner, not a single-purpose stealer. It persists via a LaunchAgent that re-fetches a shel…
SentinelOne reports observing APT29 (Midnight Blizzard / Cozy Bear, Russia's SVR) running the CaptiveCrunch campaign, disclosed by Microsoft in July 2026, across multiple customer environments in three regions. The operation abuses captive-portal behaviour and forged name resolution to push fake browser updater downloads to roaming Window…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
