This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.
CrazyHunter Ransomware’s Stealth Tactics and Attack Chain
Researchers have analyzed CrazyHunter, an evolving ransomware strain that combines stealthy evasion techniques with aggressive lateral movement. The ransomware disables security controls early in the attack chain, spreads across enterprise environments, and encrypts data using strong cryptography, making detection and recovery difficult.
Key Insights
Further Reading: Trellix
Sophisticated ClickFix Campaign Targeting the Hospitality Sector
A recent phishing campaign has been observed targeting the hospitality industry with a refined version of the ClickFix social-engineering technique. In this variant, victims are presented with what appears to be a routine human-verification prompt or CAPTCHA, but the displayed “fix” instructions lead them to execute commands on their systems. Once executed, these commands deploy remote-access malware that gives attackers control over endpoints, enabling credential theft, data exfiltration, or further malicious activity. Because the campaign leverages familiar prompts and trusted branding, users may be more likely to follow the steps without suspecting foul play.
Key Insights
Further Reading: SecurityWeek
Analyzing PhaltBlyx: Fake BSODs and Trusted Build Tools Used to Construct a Malware Infection
Researchers have dissected a malware campaign involving PhaltBlyx, a deceptive infection method that combines social engineering with abuse of trusted development tools and fake system prompts. In this technique, victims encounter what appears to be a Blue Screen of Death (BSOD) or other alarming system error. Instead of indicating a real crash, the fake BSOD is used to convince the user to run repair or diagnostic tools — including legitimate build tools — that have been co-opted to execute malicious scripts. Once launched, these components pull additional payloads and establish persistence, often evading traditional security defenses because they’re routed through trusted binaries.
Key Insights
Further Reading: Securonix
Cyber Criminal Ecosystem Analysis
Researchers have mapped the modern cyber criminal ecosystem, revealing how threat actors operate with increasing organization and specialization. Instead of lone attackers working in isolation, today’s underground economy functions more like a service industry — with distinct roles and marketplaces for phishing kits, malware, access brokers, and human-based attack services. This division of labor allows even low-skilled attackers to launch sophisticated campaigns by purchasing tools, infrastructure, or privileged access from others. Understanding this ecosystem helps defenders anticipate how capabilities and services evolve and how attacks scale.
Key Insights
Further Reading: Push Security
VoidLink: Cloud-Native Malware Framework Weaponizing Linux Infrastructure
Researchers have identified VoidLink, a cloud-native malware framework built specifically for Linux environments running in modern cloud infrastructure. Unlike traditional malware adapted for cloud use, VoidLink is designed from the ground up to operate in virtual machines, containers, and orchestration platforms. Its modular architecture allows operators to extend functionality while maintaining stealth, enabling long-term access and post-compromise activity across cloud workloads.
Key Insights
Further Reading: Check Point Research
ConsentFix Debrief: Browser-Native OAuth Phishing
The ConsentFix debrief outlines a phishing technique that abuses legitimate OAuth consent flows to compromise accounts without stealing passwords or bypassing MFA. Instead of traditional credential harvesting, attackers trick victims into approving application access through a browser-based workflow, granting access tokens tied to trusted applications. This approach allows attackers to blend malicious activity into normal authentication behavior, making detection more difficult in enterprise identity environments.
Key Insights
Further Reading: Push Security
CrashFix Browser Extension Campaign Delivers ModeloRAT
Researchers identified a campaign linked to the threat actor KongTuke that uses a malicious browser extension to compromise systems. The extension poses as a legitimate utility, such as an ad blocker, but is designed to intentionally destabilize the browser. Victims are then presented with fake error messages that guide them into executing attacker-controlled commands, ultimately leading to the installation of a remote-access Trojan.
Key Insights
Further Reading: Huntress
Microsoft Remains the Most Imitated Brand in Phishing Attacks in Q4 2025
Check Point Research reports that Microsoft continued to be the most frequently impersonated brand in phishing attacks during Q4 2025. Attackers consistently leverage trusted, widely used brands to increase the likelihood of user interaction and credential compromise, particularly for access to email, cloud services, and productivity platforms. Technology companies remain the most attractive targets due to the value of associated identities and accounts.
Key Insights
Further Reading: Check Point Research
Open-Source Python Script Drives Social Media Phishing Campaign
Threat researchers identified a phishing campaign leveraging social media direct messages to distribute malicious files that ultimately lead to remote access trojan deployment. The activity relies on weaponized archives, DLL sideloading, and a legitimate open-source Python script to execute payloads while blending in with normal software behavior. The campaign highlights how threat actors are expanding beyond email to exploit trust within professional networking platforms.
Key Insights
Further Reading: ReliaQuest
Payroll Diversion via Help Desk Social Engineering
Threat researchers analyzed an incident in which attackers used phone-based social engineering to manipulate help desk workflows and redirect employee payroll to attacker-controlled bank accounts. By impersonating employees and exploiting weak identity verification processes, the adversary reset credentials, re-registered multi-factor authentication devices, and modified payroll details without exploiting technical vulnerabilities. The activity demonstrates how human-focused tactics can enable financial fraud while evading traditional security controls.
Key Insights
Further Reading: Unit 42
AI-Powered HTMLMIX Obfuscation Tool Reshapes Phishing Tactics
Threat researchers analyzed HTMLMIX, an AI-enabled phishing obfuscation platform actively used to generate large volumes of unique phishing emails. The tool automates HTML code transformation and content variation to undermine signature-based detection, enabling attackers to scale phishing campaigns while maintaining high delivery success. This activity reflects a broader shift toward AI-assisted automation within phishing operations.
Key Insights
Further Reading: Abnormal AI
Fake CAPTCHA Pop-Ups Used to Trick Website Visitors
A campaign known as ClearFake is using compromised websites to display fake verification pop-ups that look like routine security checks. These prompts guide visitors through simple steps that appear harmless but actually trigger hidden commands on their computers. Because the scam appears on real, trusted websites, it can be difficult for everyday users to recognize what’s happening.
Key Points
Further Reading: Expel
2026 Threat Forecast: Top Cyberattacks Set to Increase Enterprise Exposure
Email remains the primary entry point for attackers, and emerging campaigns are increasingly focused on exploiting trust, identity, and routine workflows to bypass defenses. Threat actors are layering social engineering techniques with technical evasion methods to increase success rates and reduce detection, signaling a continued shift toward human-centric attack vectors.
Key Insights
Further Reading: Abnormal AI
Real-Time Malicious JavaScript Generated Through LLMs
Threat researchers identified a technique where attackers use large language models to generate malicious JavaScript code in real time inside a victim’s browser. Instead of hosting harmful code on attacker-controlled infrastructure, the webpage dynamically requests code generation during the visit, producing phishing functionality only at execution time. This approach makes the activity harder to detect because the malicious content does not exist until the moment it runs.
Key Insights
Further Reading: Unit 42
Phishing Messages Masquerade as Collaboration Platform Invites
A phishing campaign is abusing trusted collaboration platform notifications to deliver scam messages that look like legitimate invitations. By using real platform features, the messages appear routine and familiar, increasing the chances that recipients engage without questioning them. Instead of pushing malicious links, the messages often steer people toward fake support interactions.
Key Points
Further Reading: Check Point
Kimwolf Botnet Embedded in Corporate and Government Networks
Threat researchers reported widespread activity tied to the Kimwolf botnet, which has infected millions of internet-connected devices and is now appearing inside corporate and government environments. Once embedded, compromised devices can be used to relay malicious traffic, participate in large-scale denial-of-service activity, and scan internal networks for additional targets. The presence of consumer-grade devices inside enterprise environments is expanding the botnet’s reach beyond its original footprint.
Key Insights
Further Reading: KrebsOnSecurity
Infostealer Data Cache Exposes 149 Million Credentials
Threat researchers identified a large, publicly accessible database containing roughly 149 million stolen login credentials. The data was collected by infostealer malware that silently harvests usernames and passwords from infected devices and aggregates them for later use. Because the database was left exposed without protection, the credentials could be accessed and abused for large-scale account takeover, fraud, and follow-on intrusion activity.
Key Insights
Exposed credentials spanned a wide range of services, including email, financial platforms, and consumer accounts.
Some entries were associated with corporate, government, and educational domains, increasing targeting risk.
Further Reading: ExpressVPN
Multi-Stage AiTM Phishing and BEC Campaign Abusing SharePoint
Threat researchers uncovered a coordinated campaign that combines adversary-in-the-middle phishing with business email compromise techniques. The activity abuses trusted cloud collaboration services to deliver phishing lures, steal session data, and expand access once an initial account is compromised. By leveraging familiar internal workflows, the attackers were able to spread both inside and outside targeted organizations.
Key Insights
Further Reading: Microsoft Security Blog
Fake CAPTCHA Prompts Used to Trick Users Into Installing Malware
Researchers have identified a scam that uses fake “CAPTCHA” verification screens to deceive users into installing malicious software. Instead of a simple checkbox, these prompts instruct people to copy and run a command on their own device, which secretly launches malware designed to steal sensitive information. Because the steps look like a normal verification process, many users don’t realize anything is wrong until after their system is compromised.
Key Points
Further Reading: Blackpoint Cyber
Scam Emails Abuse a Real Microsoft Address
Scammers are sending fraudulent emails that appear to come from a legitimate Microsoft notification address, making the messages look trustworthy at first glance. Because these emails originate from a real Microsoft service that some organizations allow by default, they can slip past spam filters and land directly in inboxes. The messages often claim an urgent issue, such as an unexpected charge, and push recipients to take immediate action.
Key Points
Further Reading: Ars Technica
Detection and Response Are Moving Beyond the Endpoint
Security teams are reassessing the limits of traditional endpoint detection and response (EDR) tools as more attacks avoid touching the operating system altogether. Modern threat activity increasingly unfolds inside browsers and cloud applications, where users authenticate, access data, and perform daily work. This shift is driving interest in detection and response capabilities that extend beyond endpoints to cover browser-based attack paths.
Key Insights
Many modern attacks operate entirely within browsers, targeting credentials, sessions, and cloud access.
Further Reading: Push Security
TA584 Continues to Evolve Its Initial Access Playbook
Threat researchers report that the activity cluster tracked as TA584 continues to adapt how it gains initial access to victim environments. The group remains highly active, cycling through new email lures, delivery techniques, and malware families to keep campaigns effective. This ongoing evolution highlights how initial access operations are becoming more flexible and harder to disrupt through static defenses alone.
Key Insights
Email remains the primary delivery method, with lures tailored to specific regions, brands, or current events.
Further Reading: Proofpoint
IClickFix Framework Abuses Compromised WordPress Sites to Deliver Malware
Threat researchers have identified a large-scale malicious framework known as IClickFix that leverages compromised WordPress websites to distribute malware. Visitors to affected sites may be presented with deceptive verification prompts designed to trick them into manually executing commands on their own systems. This approach combines widespread infrastructure abuse with social engineering to infect victims at scale.
Key Insights
Further Reading: SEKOIA Blog
Windows Moves Toward Disabling NTLM Authentication by Default
Microsoft is advancing plans to reduce reliance on the legacy NTLM authentication protocol by disabling it by default in future Windows releases. NTLM has long been used as a fallback mechanism, but its design exposes environments to well-known attack techniques. The shift reflects a broader move toward modern, identity-centric authentication models across Windows ecosystems.
Key Insights
Further Reading: Microsoft Tech Community
NSA Releases Initial Zero Trust Implementation Guidelines
The U.S. National Security Agency has released the first set of guidance in a new series aimed at helping organizations implement zero trust principles in a structured, practical way. These initial materials focus on establishing visibility and understanding of environments before moving into enforcement, providing a foundation for more mature zero trust capabilities over time.
Key Insights
The first releases introduce a primer and a discovery-focused phase to help organizations map assets, data, services, and access patterns.
Further Reading: NSA
TA584 Continues to Evolve Initial Access Tactics
Threat researchers report that the activity cluster tracked as TA584 continues to adapt how it gains initial access to victim environments. This actor is highly active, rotating email lures, delivery techniques, and malware families to keep campaigns effective and harder to block. The ongoing evolution highlights how initial access operations are becoming more adaptable and challenging for defenses that rely on static indicators.
Key Insights
Email remains the primary delivery method, with lures tailored to specific regions, brands, or events to increase engagement.
Further Reading: Proofpoint
FBI Launches Operation Winter SHIELD to Boost Cyber Resilience
The FBI has introduced Operation Winter SHIELD, a nationwide initiative focused on strengthening cyber resilience across public and private organizations. Drawing directly from real-world investigations, the effort highlights common weaknesses attackers exploit and outlines practical defensive actions aimed at reducing exposure to both criminal and state-linked cyber activity.
Key Insights
Further Reading: FBI
Fake Dropbox Emails Used to Steal Login Details
Attackers are circulating phishing emails that impersonate Dropbox and attempt to trick recipients into handing over their account credentials. The messages often look like routine business communications and include a PDF attachment. When opened, the document directs the user to a fake Dropbox login page designed to capture usernames and passwords.
Key Points
Further Reading: CybersecurityNews
ShinyHunters-Linked Attacks Target SaaS Environments
Threat intelligence analysis highlights how activity associated with the ShinyHunters cybercrime ecosystem is increasingly focused on compromising software-as-a-service environments. Rather than exploiting technical vulnerabilities, these campaigns rely on social engineering and identity abuse to gain access to cloud platforms, allowing attackers to move laterally across connected services and exfiltrate sensitive data for extortion.
Key Insights
Further Reading: Google Cloud
SLH Campaign Blends Vishing With AiTM Phishing for Account Takeover
Threat researchers analyzed a recent campaign attributed to the group tracked as SLH that combines live phone-based social engineering with adversary-in-the-middle phishing. Attackers initiate contact by posing as internal IT support, then guide victims to a phishing site designed to capture credentials, MFA codes, and active session tokens. With this access, the actors can move quickly across connected cloud services using the victim’s identity.
Key Insights
Further Reading: Push Security
