Advertisement
Shopify Shop App Abused for Callback Phishing Attacks
Attackers are exploiting the Shopify Shop app's order tracking features to launch callback phishing attacks, tricking users into installing remote access tools.
Scattered Spider Members Plead Guilty to Transport for London Attack
Two members of Scattered Spider pleaded guilty to the August 2024 Transport for London cyberattack, highlighting the group's social engineering efficacy.
WhatsApp VBScript Campaign Installs ManageEngine RMM — Technical Guide
Attackers are targeting WhatsApp Desktop users with malicious VBScripts to install ManageEngine RMM, enabling unauthorized remote access and control.
Lumma Stealer Distributed via Fake EditPro AI Image Generator
Threat actors are leveraging a fake AI image generator website to distribute Lumma Stealer malware targeting both Windows and macOS systems.
Meta AI Support Bot Exploited for Instagram Account Takeovers
Hackers manipulated Meta's AI support assistant to bypass authentication and seize high-profile Instagram accounts, including government entities.
GreyVibe Actor Leverages AI Lures to Target Ukrainian Entities
Russian threat cluster GreyVibe uses ChatGPT and Gemini to automate highly targeted phishing lures and deploy custom malware against Ukrainian targets.
MuddyWater Exploits Microsoft Teams via Chaos Ransomware Decoy
Iranian APT MuddyWater utilizes Microsoft Teams social engineering and Chaos ransomware decoys to mask state-sponsored espionage operations.
Hugging Face and ClawHub Abused for Malware Distribution
Threat actors are exploiting the trust of AI and code-hosting platforms like Hugging Face and ClawHub to distribute malware via social engineering lures.
DPRK Social Engineering Behind $285 Million Drift Hack: Analysis
A deep dive into the six-month DPRK social engineering operation targeting Drift protocol, resulting in a $285 million Solana-based cryptocurrency theft.
7-Stage Phishing Chain Targets Outpost24 C-Suite via Redirects
Security researchers identify a sophisticated 7-stage phishing attack targeting Outpost24 executives using legitimate domains to evade email gateways.
Trojanized Gaming Tools Deliver Java-Based RAT via PowerShell
Security researchers identify a malware campaign using trojanized gaming tools to deliver a Java-based RAT using PowerShell and portable Java runtimes.