Cybersecurity articles tagged #Phishing on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/faronics-deploy-abused-by-phishing-actors-to-install-screenconnecthttps://runtimerebel.com/blog/faronics-deploy-abused-by-phishing-actors-to-install-screenconnectPhishing actors are abusing the legitimate Faronics Deploy endpoint management tool to gain remote access and install ScreenConnect via malicious installers.Wed, 02 Sep 2026 01:58:12 GMTScreenconnectPhishingRemote Access TrojanHuntressPowerShellhttps://runtimerebel.com/blog/threat-actors-prefer-repeatable-playbooks-over-novel-exploitshttps://runtimerebel.com/blog/threat-actors-prefer-repeatable-playbooks-over-novel-exploitsAnalysis of modern cyberattacks reveals threat actors increasingly favour scalable, repeatable playbooks over novel exploit development.Tue, 01 Sep 2026 12:54:04 GMTRansomwareZero-DayPhishingCredential TheftMalwarehttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawshttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawsAnalysis of a polymorphic phishing page utilizing heavy JavaScript obfuscation and variable scope bugs that cause browser loops.Tue, 01 Sep 2026 02:51:10 GMTPhishingCredential TheftObfuscationJavaScriptMalware Analysishttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysishttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysisUnderstanding JavaScript obfuscation techniques used in phishing and malware. Learn static and dynamic deobfuscation methods to uncover malicious intent.Tue, 01 Sep 2026 02:45:47 GMTJavaScriptObfuscationPhishingMalwareDeobfuscationhttps://runtimerebel.com/blog/openai-disrups-llm-powered-social-engineering-operationshttps://runtimerebel.com/blog/openai-disrups-llm-powered-social-engineering-operationsOpenAI disrupts a Cambodian threat network leveraging ChatGPT for complex multi-stage social engineering, romance scams, and fraud.Tue, 01 Sep 2026 02:45:05 GMTLLMSocial EngineeringPhishingFraudhttps://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirectshttps://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirectsThreat actors exploit npm and its mirroring platforms like UNPKG to host malicious HTML pages, impersonating Cloudflare CAPTCHAs for phishing redirects.Wed, 26 Aug 2026 08:31:38 GMTNPMPhishingSupply Chain AttackUNPKGCloudflare Impersonationhttps://runtimerebel.com/blog/shinyhunters-breaches-reliaquest-identity-dashboard-via-phishinghttps://runtimerebel.com/blog/shinyhunters-breaches-reliaquest-identity-dashboard-via-phishingReliaQuest confirms ShinyHunters gained brief, view-only access to its identity dashboard via a sophisticated social engineering attack.Tue, 25 Aug 2026 00:41:55 GMTShinyHuntersSocial EngineeringPhishingCredential TheftOktahttps://runtimerebel.com/blog/reliaquest-thwarts-shinyhunters-social-engineering-attack-on-okta-ssohttps://runtimerebel.com/blog/reliaquest-thwarts-shinyhunters-social-engineering-attack-on-okta-ssoReliaQuest confirms a social engineering attack by ShinyHunters targeting an employee's Okta SSO, blocked from accessing applications or customer data.Mon, 24 Aug 2026 16:25:26 GMTShinyHuntersSocial EngineeringPhishingVishingOktahttps://runtimerebel.com/blog/grandoreiro-banking-trojan-new-evasion-tactics-in-mexicohttps://runtimerebel.com/blog/grandoreiro-banking-trojan-new-evasion-tactics-in-mexicoGrandoreiro banking Trojan resurfaces in Mexico, employing advanced evasion tactics after a law enforcement takedown to target financial users.Mon, 24 Aug 2026 08:39:06 GMTGrandoreiroBanking TrojanMalwareMexicoPhishinghttps://runtimerebel.com/blog/ftp-banners-abused-to-deliver-e4del-and-pinhole-ratshttps://runtimerebel.com/blog/ftp-banners-abused-to-deliver-e4del-and-pinhole-ratsThreat actors are using FTP server banners to hide commands, delivering new Windows remote access trojans E4del and PINHOLE via LNK-based infection chains.Mon, 24 Aug 2026 08:38:06 GMTRATLNK FilesPhishingE4delPINHOLEhttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnhttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnToxicPanda 2.0 Android malware uses VPN permissions to block Google Play and abuses Wireless ADB to gain shell access and deploy overlays.Sun, 23 Aug 2026 16:15:53 GMTToxicPandaAndroidMalwarePhishingCredential Thefthttps://runtimerebel.com/blog/russian-threat-clusters-abuse-oauth-and-whatsapp-for-espionagehttps://runtimerebel.com/blog/russian-threat-clusters-abuse-oauth-and-whatsapp-for-espionageGoogle Threat Intelligence reports three suspected Russian groups using OAuth phishing, Google app passwords, and WhatsApp device linking to hijack accounts.Sun, 23 Aug 2026 16:14:39 GMTAPT29PhishingOAuthCredential TheftMalwarehttps://runtimerebel.com/blog/iauthflow-v2-phishing-toolkit-leverages-passkeys-for-persistencehttps://runtimerebel.com/blog/iauthflow-v2-phishing-toolkit-leverages-passkeys-for-persistenceDiscover how the iAuthFlow V2 phishing toolkit registers malicious passkeys to maintain persistent account access despite password resets.Sun, 23 Aug 2026 00:44:48 GMTPhishingCredential TheftPasskeysPhishing as a Servicehttps://runtimerebel.com/blog/synkloader-malware-steals-credentials-in-microsoft-teams-phishinghttps://runtimerebel.com/blog/synkloader-malware-steals-credentials-in-microsoft-teams-phishingNew SynkLoader malware distributed via Microsoft Teams phishing campaigns uses a fake lock screen to steal Windows credentials, enabling corporate network access.Sat, 22 Aug 2026 00:40:08 GMTMalwarePhishingMicrosoft TeamsCredential TheftRansomwarehttps://runtimerebel.com/blog/identity-abuse-and-phishing-via-enterprise-collaboration-platformshttps://runtimerebel.com/blog/identity-abuse-and-phishing-via-enterprise-collaboration-platformsThreat actors increasingly misuse enterprise collaboration platforms for identity phishing, credential theft, and malware delivery.Thu, 20 Aug 2026 16:29:19 GMTAPT29PhishingCredential TheftMalwarehttps://runtimerebel.com/blog/russian-threat-clusters-target-academia-and-government-via-auth-abusehttps://runtimerebel.com/blog/russian-threat-clusters-target-academia-and-government-via-auth-abuseGoogle Threat Intelligence Group tracks three Russian cyber espionage clusters abusing legitimate authentication flows and app passwords.Thu, 20 Aug 2026 16:26:40 GMTAPT29PhishingOauth PhishingCredential TheftZero-Dayhttps://runtimerebel.com/blog/crime-script-analysis-mapping-threat-workflows-and-ai-riskshttps://runtimerebel.com/blog/crime-script-analysis-mapping-threat-workflows-and-ai-risksDiscover how crime script analysis translates complex cyber attacks into narratives, highlighting AI threats in business email compromise.Wed, 19 Aug 2026 16:24:36 GMTThreat IntelPhishingArtificial Intelligencehttps://runtimerebel.com/blog/mitigating-large-scale-credential-attacks-and-password-sprayinghttps://runtimerebel.com/blog/mitigating-large-scale-credential-attacks-and-password-sprayingAnalysis of large-scale password spraying and credential theft campaigns targeting enterprise identity perimeters, edge devices, and cloud tenants.Wed, 19 Aug 2026 00:42:17 GMTCredential TheftRansomwarePhishingZero-Dayhttps://runtimerebel.com/blog/threat-actor-claims-3-6-million-azure-account-records-stolenhttps://runtimerebel.com/blog/threat-actor-claims-3-6-million-azure-account-records-stolenA threat actor named TheHatman is selling 3.6 million employee records allegedly stolen from major corporate Azure tenants using compromised credentials.Tue, 18 Aug 2026 00:40:50 GMTCredential TheftData BreachAzurePhishingSocial Engineeringhttps://runtimerebel.com/blog/public-wi-fi-dns-hijacking-credential-theft-riskhttps://runtimerebel.com/blog/public-wi-fi-dns-hijacking-credential-theft-riskCriminals are actively manipulating public Wi-Fi DNS settings to redirect users to fake login pages, stealing sensitive credentials. Learn how to protect yourself.Mon, 17 Aug 2026 16:19:43 GMTCredential TheftPhishingDnssecDNS HijackingPublic Wi Fihttps://runtimerebel.com/blog/safepal-data-breach-exposes-39798-customer-order-detailshttps://runtimerebel.com/blog/safepal-data-breach-exposes-39798-customer-order-detailsSafePal confirms a data breach impacting 39,798 customers, exposing names, emails, and shipping info. Stolen data is for sale, increasing phishing risks.Mon, 17 Aug 2026 00:40:25 GMTSafePalData BreachPhishingCryptocurrencySocial Engineeringhttps://runtimerebel.com/blog/new-jwr-phishing-framework-bypasses-mfa-with-live-monitoringhttps://runtimerebel.com/blog/new-jwr-phishing-framework-bypasses-mfa-with-live-monitoringJWR, a new real-time phishing framework, uses WebSockets to bypass MFA and steal sensitive data via SMS lures, posing a critical threat.Fri, 14 Aug 2026 01:09:15 GMTPhishingSmishingMFA BypassJWRThe Outsiderhttps://runtimerebel.com/blog/ukraine-dismantles-94-fraudulent-call-centers-seizing-millionshttps://runtimerebel.com/blog/ukraine-dismantles-94-fraudulent-call-centers-seizing-millionsUkraine, in collaboration with German police, dismantled 94 fraudulent call centers, seizing millions in assets. This disrupts investment and bank account phishing scams.Fri, 14 Aug 2026 01:07:01 GMTFraudPhishingInvestment ScamsLaw Enforcement OperationCall Centershttps://runtimerebel.com/blog/jwr-phishing-framework-real-time-data-theft-via-phaashttps://runtimerebel.com/blog/jwr-phishing-framework-real-time-data-theft-via-phaasThe JWR phishing framework, a variant of The Outsider PhaaS, harvests payment data, PII, and 2FA codes in real-time via operator-controlled sessions.Thu, 13 Aug 2026 16:47:48 GMTPhishingPhaaSCredential TheftPIIJWRhttps://runtimerebel.com/blog/webmail-css-injection-hidden-data-exfiltration-threatshttps://runtimerebel.com/blog/webmail-css-injection-hidden-data-exfiltration-threatsSecurity researchers warn that Cascading Style Sheets can exfiltrate sensitive data from webmail inboxes if vendors fail to sanitize styles.Mon, 10 Aug 2026 01:01:51 GMTWeb SecurityData ExfiltrationPhishingVulnerabilitieshttps://runtimerebel.com/blog/zero-click-ai-browser-hacking-threatens-claude-and-chatgpt-atlashttps://runtimerebel.com/blog/zero-click-ai-browser-hacking-threatens-claude-and-chatgpt-atlasZenity details zero-click indirect prompt injection vulnerabilities affecting OpenAI ChatGPT Atlas and Claude in Chrome via malicious web content.Mon, 10 Aug 2026 01:00:52 GMTZero-DayPhishingCredential TheftArtificial IntelligenceZenityhttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptohttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptoClickFix social engineering campaigns target macOS users with Go-based infostealers designed to drain cryptocurrency wallets and credentials.Mon, 10 Aug 2026 00:59:16 GMTmacOSMalwareCryptocurrencyPhishingCredential Thefthttps://runtimerebel.com/blog/cve-2025-66376-apt28-exploits-zimbra-zero-click-for-espionagehttps://runtimerebel.com/blog/cve-2025-66376-apt28-exploits-zimbra-zero-click-for-espionageRussian state-sponsored actors exploit a zero-click Zimbra vulnerability (CVE-2025-66376) to exfiltrate sensitive webmail data from targeted organizations.Sat, 08 Aug 2026 08:33:35 GMTCVE-2025-66376ZimbraCyber EspionageZero ClickPhishinghttps://runtimerebel.com/blog/q2-2026-ir-trends-phishing-mfa-bypass-rmm-tool-abusehttps://runtimerebel.com/blog/q2-2026-ir-trends-phishing-mfa-bypass-rmm-tool-abuseTalos Q2 2026 incident response data shows rising phishing and MFA bypass, with new actors like UAT-11764 and Sinobi ransomware leveraging RMM tools.Sat, 08 Aug 2026 00:57:13 GMTPhishingMFA BypassRansomwareMicrosoft 365UAT 11764https://runtimerebel.com/blog/unc6671-rebrands-multi-brand-vishing-and-cloud-extortionhttps://runtimerebel.com/blog/unc6671-rebrands-multi-brand-vishing-and-cloud-extortionGoogle Threat Intelligence Group tracks UNC6671 shifting through Redact, Pink, Helix, and Falcon extortion brands while targeting cloud environments.Fri, 07 Aug 2026 02:12:08 GMTUNC6671PhishingCredential TheftRansomwareCloud Securityhttps://runtimerebel.com/blog/talos-q2-2026-report-phishing-and-living-off-the-land-trendshttps://runtimerebel.com/blog/talos-q2-2026-report-phishing-and-living-off-the-land-trendsCisco Talos Q2 2026 report reveals spikes in MFA-bypassing phishing and malicious use of remote management tools.Thu, 06 Aug 2026 01:57:17 GMTPhishingRansomwareCredential TheftMulti Factor AuthenticationThreat Intelhttps://runtimerebel.com/blog/ai-enabled-fraud-how-global-crime-syndicates-scale-scamshttps://runtimerebel.com/blog/ai-enabled-fraud-how-global-crime-syndicates-scale-scamsOrganized crime syndicates use AI voice cloning, deepfake video, and LLMs to execute massive, scalable global financial fraud.Thu, 06 Aug 2026 01:56:44 GMTPhishingThreat IntelMachine LearningFinancial FraudSocial Engineeringhttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwarehttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwareOver 250 ClickFix domains utilize server-side browser fingerprinting to evade security sandboxes and distribute macOS infostealers like AMOS.Thu, 06 Aug 2026 01:56:14 GMTPhishingMalwareCredential TheftmacOSAtomic Stealerhttps://runtimerebel.com/blog/smoke-screen-rmm-takeover-campaign-targets-enterprise-networkshttps://runtimerebel.com/blog/smoke-screen-rmm-takeover-campaign-targets-enterprise-networksDiscover how the Smoke#Screen phishing campaign uses rotating payloads and ScreenConnect to achieve persistent remote network access.Wed, 05 Aug 2026 01:42:03 GMTPhishingRansomwareCredential TheftScreenconnecthttps://runtimerebel.com/blog/device-code-phishing-surges-1500-as-vishing-doubleshttps://runtimerebel.com/blog/device-code-phishing-surges-1500-as-vishing-doublesDevice code phishing attacks surged 1,500% while vishing doubled, exploiting modern authentication flows to bypass traditional security controls.Tue, 04 Aug 2026 11:23:35 GMTPhishingSocial EngineeringCredential TheftIdentity AccessMulti Factor Authenticationhttps://runtimerebel.com/blog/hotel-wi-fi-campaigns-use-cornflake-and-chocoshell-malwarehttps://runtimerebel.com/blog/hotel-wi-fi-campaigns-use-cornflake-and-chocoshell-malwareRussian threat actor Midnight Blizzard targets hotel Wi-Fi networks using captive portal manipulation, DNS hijacking, and custom malware.Tue, 04 Aug 2026 01:28:40 GMTMidnight BlizzardAPT29Credential TheftPhishingMalwarehttps://runtimerebel.com/blog/phishing-targets-ai-service-users-guard-your-chatgpt-accountshttps://runtimerebel.com/blog/phishing-targets-ai-service-users-guard-your-chatgpt-accountsRecent phishing campaigns impersonate popular AI services like ChatGPT to trick users into divulging credentials. Learn how to protect your accounts and data.Sat, 01 Aug 2026 10:02:17 GMTPhishingAI ServicesChatGPTSocial EngineeringCredential Thefthttps://runtimerebel.com/blog/interpol-s-i-grip-system-curtails-fraudulent-payments-a-threat-intel-briefhttps://runtimerebel.com/blog/interpol-s-i-grip-system-curtails-fraudulent-payments-a-threat-intel-briefExplore Interpol's I-GRIP system, a global initiative enabling rapid freezing of fraudulent payments and enhancing international cooperation against cyber-enabled…Fri, 31 Jul 2026 14:11:22 GMTINTERPOLFinancial FraudCybercrimeI GRIPPayment FraudBECPhishinghttps://runtimerebel.com/blog/oauth-2-0-device-code-phishing-escalates-to-industrial-threathttps://runtimerebel.com/blog/oauth-2-0-device-code-phishing-escalates-to-industrial-threatDevice code phishing, exploiting the OAuth 2.0 device authorization grant, is rapidly stealing access tokens. Learn how to defend against this growing threat.Fri, 31 Jul 2026 14:09:49 GMTDevice Code PhishingOAuth 2 0Access TokensPhishingIdentity Thefthttps://runtimerebel.com/blog/chrome-security-update-and-sonicwall-targeted-in-ai-driven-campaignshttps://runtimerebel.com/blog/chrome-security-update-and-sonicwall-targeted-in-ai-driven-campaignsAnalysis of 370 Chrome vulnerabilities and active SonicWall targeting, highlighting the rise of AI-powered phishing and automated DNS hijacking threats.Thu, 30 Jul 2026 17:29:33 GMTGoogle ChromeSonicWallAI Powered HackingDNS HijackingPhishinghttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnshttps://runtimerebel.com/blog/shinyhunters-targeting-healthcare-data-theft-surges-health-isac-warnsHealth-ISAC warns of increasing ShinyHunters data theft attacks on healthcare and med-tech organizations. Learn about TTPs and critical mitigations.Wed, 29 Jul 2026 20:57:58 GMTShinyHuntersHealthcareData TheftHealth ISACPhishingData Exfiltrationhttps://runtimerebel.com/blog/shinyhunters-data-leaks-fuel-2000-sextortion-phishing-campaignhttps://runtimerebel.com/blog/shinyhunters-data-leaks-fuel-2000-sextortion-phishing-campaignScammers are weaponizing personal data from ShinyHunters leaks to launch convincing sextortion campaigns demanding $2,000 in Bitcoin from victims.Sat, 25 Jul 2026 17:00:04 GMTShinyHuntersSextortionPhishingData BreachSocial Engineeringhttps://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-walletshttps://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-walletsBlueNoroff uses a custom phishing kit to profile crypto wallets before delivering malware through impersonated Zoom and Microsoft Teams platforms.Fri, 24 Jul 2026 17:39:06 GMTBlueNoroffLazarus GroupCryptocurrency TheftClickFixPhishinghttps://runtimerebel.com/blog/zimbra-zero-day-exploited-by-laundry-bear-against-us-ukrainehttps://runtimerebel.com/blog/zimbra-zero-day-exploited-by-laundry-bear-against-us-ukraineRussian state-sponsored group 'Laundry Bear' exploits a Zimbra zero-day via 'half-click' phishing, targeting US and Ukrainian entities for credential theft and backdoor…Fri, 24 Jul 2026 02:47:14 GMTLaundry BearZimbraZero-DayPhishingUSUkraineState Sponsoredhttps://runtimerebel.com/blog/bing-ads-promote-fake-claude-app-deliver-sectoprat-malwarehttps://runtimerebel.com/blog/bing-ads-promote-fake-claude-app-deliver-sectoprat-malwareA malvertising campaign on Bing Search is distributing a fake Claude AI desktop app, leading to SectopRAT malware infections. Verify software sources.Thu, 23 Jul 2026 21:06:56 GMTSectop RATMalvertisingBing AdsClaude AIInformation StealerPhishinghttps://runtimerebel.com/blog/zimbra-zero-click-exploitation-by-russian-apt-for-email-thefthttps://runtimerebel.com/blog/zimbra-zero-click-exploitation-by-russian-apt-for-email-theftCISA warns of Russian APT Laundry Bear (Void Blizzard) exploiting a patched Zimbra zero-click flaw combined with phishing to compromise email servers for data…Thu, 23 Jul 2026 17:27:19 GMTLaundry BearVoid BlizzardAPT28Zimbra CollaborationZero ClickEmail TheftPhishingRussian APThttps://runtimerebel.com/blog/brazilian-banking-trojan-expansion-into-portugal-targets-businesseshttps://runtimerebel.com/blog/brazilian-banking-trojan-expansion-into-portugal-targets-businessesPortuguese businesses face increased risk from Brazilian banking trojans leveraging shared language for phishing and credential theft.Thu, 23 Jul 2026 10:27:20 GMTBanking TrojanPortugalGrandoreiroFinancial CrimePhishinghttps://runtimerebel.com/blog/fake-bahrain-alert-apps-deploy-android-surveillance-malwarehttps://runtimerebel.com/blog/fake-bahrain-alert-apps-deploy-android-surveillance-malwareAnalyzing fake Bahrain alert apps distributing four-stage Android surveillance malware via phony app stores, exploiting geopolitical tensions for extensive data…Wed, 22 Jul 2026 21:12:30 GMTAndroidMobile SecuritySpywareSurveillance MalwareFake AppsPhishingSocial EngineeringBahrainhttps://runtimerebel.com/blog/email-account-takeover-via-2fa-compromise-mitigating-identity-theft-riskhttps://runtimerebel.com/blog/email-account-takeover-via-2fa-compromise-mitigating-identity-theft-riskAn identity theft incident highlights how easily email account takeover via compromised 2FA can lead to broader security breaches. Learn to protect your digital identity.Wed, 22 Jul 2026 17:24:17 GMTIdentity TheftAccount Takeover2FA BypassEmail SecurityPhishingSocial Engineeringhttps://runtimerebel.com/blog/securing-critical-infrastructure-closing-identity-gapshttps://runtimerebel.com/blog/securing-critical-infrastructure-closing-identity-gapsAttacks on critical infrastructure leverage identity gaps. This analysis details common vulnerabilities and how Zero Trust principles can enhance sector security.Tue, 21 Jul 2026 17:24:12 GMTCritical InfrastructureIdentity SecurityZero TrustCredential TheftMFA BypassSupply Chain AttackPhishing