March 2026 - ExploreSec Cybersecurity Awareness Newsletter

March 16, 2026

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Fake Dropbox Emails Used to Steal Login Details

Attackers are circulating phishing emails that impersonate Dropbox and attempt to trick recipients into handing over their account credentials. The messages often look like routine business communications and include a PDF attachment. When opened, the document directs the user to a fake Dropbox login page designed to capture usernames and passwords.

Key Points

Phishing emails are crafted to look like legitimate Dropbox notifications or file-sharing messages.

PDF attachments are used to make the email appear business-related and trustworthy.

Links inside the document lead to counterfeit login pages.

Entered credentials are captured by attackers and can be reused to access other accounts.

The technique relies on familiar brands and file formats to lower suspicion.

Further Reading: CybersecurityNews

DKIM Replay Attacks Abuse Trusted Email for Invoice and Support Scams

Threat researchers are tracking a rise in DKIM replay attacks, where adversaries reuse legitimate, cryptographically signed emails from trusted services such as Apple and PayPal. Because these messages retain valid authentication, they can bypass email security controls and appear legitimate to recipients, even when used to deliver fraudulent invoices or support scams.

Key Insights

DKIM replay attacks involve capturing a genuine, signed email and redistributing it without breaking authentication checks.

Since DKIM and DMARC validation still passes, many email defenses treat the replayed message as trusted.

Attackers commonly abuse invoice or notification workflows that allow user-controlled fields to inject scam content.

Messages often include urgent payment requests or fake support numbers designed to trigger rapid victim response.

DKIM verifies message integrity but does not restrict message reuse, making replay a persistent risk.

Further Reading: Kaseya

CrashFix: New ClickFix Variant Deploys Python Remote Access Trojan

Threat researchers have identified a new evolution of the ClickFix social engineering campaign known as CrashFix. This variant intentionally crashes a victim’s browser and presents a deceptive recovery prompt that convinces users to manually execute commands on their own systems. The interaction ultimately leads to the installation of a Python-based remote access trojan, giving attackers persistent access to compromised devices.

Key Insights

CrashFix commonly begins with users being prompted to install a malicious browser extension disguised as a legitimate utility, such as an ad blocker.

The extension later forces the browser into a crash state, creating urgency and the illusion of a technical failure.

Victims are shown fake troubleshooting instructions that direct them to run system commands, unknowingly initiating the infection chain.

The attack leverages built-in Windows tools and scripting to deploy a Python-based remote access trojan that enables surveillance and long-term access.

The campaign appears designed to prioritize enterprise environments, including systems connected to corporate domains.

Further Reading: Microsoft Security Blog

Why Even Smart People Fall for Phishing Attacks

Phishing doesn’t succeed because people are careless — it works because attackers understand how human decision-making works under pressure. Researchers found that phishing messages are deliberately designed to exploit emotions, habits, and cognitive shortcuts people rely on during busy workdays. When distracted or rushed, even experienced professionals can make quick decisions that feel reasonable in the moment but lead to compromise.

Key Insights

Phishing messages are often built around a simple pattern: grab attention, create emotional pressure, and prompt immediate action.

Common tactics rely on urgency, fear, authority, or trust to override careful thinking.

People tend to overestimate their ability to spot scams, which can make them more vulnerable.

Multitasking and information overload reduce the ability to notice subtle warning signs.

Familiar branding and realistic language can create a false sense of safety, even when the message is malicious.

Further Reading: Unit 42 – The Psychology of Phishing

SaaS Abuse at Scale: Phone-Based Scam Campaign Leveraging Trusted Platforms

Threat researchers have identified a large-scale scam campaign in which attackers abuse legitimate SaaS platform features to deliver phone-based fraud lures. Rather than relying on malicious links or spoofed domains, the campaign misuses native notification and messaging workflows from trusted services, causing emails to appear authentic and pass standard security checks. Victims are directed to call attacker-controlled phone numbers, shifting the final stage of the scam to voice-based social engineering.

Key Insights

Attackers exploit built-in notification systems within SaaS platforms to generate messages that inherit trust from legitimate services.

The campaign operated at significant scale, impacting tens of thousands of organizations worldwide.

Emails frequently avoid malicious links and instead instruct recipients to call fake support phone numbers.

Multiple abuse techniques were observed, including misuse of general SaaS messaging and business invitation workflows.

The activity reflects a broader shift toward abusing trusted platforms rather than deploying traditional phishing infrastructure.

Further Reading: Check Point Research

Discord Rolls Out “Teen-by-Default” Safety Settings Worldwide

Discord has announced a global rollout of “teen-by-default” safety settings beginning in early March 2026. Under this change, all new and existing users will initially experience a teen-appropriate version of the platform unless they verify their age as an adult. The update is part of Discord’s broader push to strengthen age-appropriate safeguards and align with evolving global safety expectations.

Key Points

All accounts will default to a teen-appropriate mode with stricter content and communication controls.

Users must complete age verification to access adult-restricted spaces and features.

Sensitive content may be blurred, and messaging from unfamiliar accounts can be limited under default settings.

Age verification methods include options such as on-device facial age estimation or ID verification.

The rollout builds on previous regional safety updates and expands protections globally.

Further Reading: Discord

Exposed OpenClaw AI Instances Raise Security Concerns

Recent research highlights growing security risks tied to exposed OpenClaw AI agent instances. OpenClaw is a self-hosted AI assistant platform that users can deploy to automate messaging, data access, and system tasks. However, many deployments are being misconfigured and left accessible on the public internet, creating opportunities for unauthorized access and potential compromise.

Key Points

Thousands of OpenClaw instances were found exposed online due to insecure configuration settings.

Some instances lacked strong authentication controls, allowing external parties to interact with the AI agent.

Because OpenClaw integrates with messaging platforms, cloud tools, and local systems, an exposed setup could provide indirect access to connected accounts and sensitive data.

Researchers observed scanning activity shortly after instances became publicly accessible, demonstrating how quickly exposed services attract attention.

The ease of deployment may contribute to widespread adoption, but also increases the likelihood of insecure configurations.

Further Reading: Bitsight

QR Codes Used as an Attack Vector in Phishing and Malware Campaigns

Threat researchers have documented an increase in malicious use of QR codes by attackers. QR codes — once primarily a convenience tool for quickly linking users to URLs — are now being embedded in phishing campaigns, physical media, and social engineering lures. Because many people instinctively trust QR codes and may not check the underlying link before scanning, attackers can use them to direct victims to sites hosting credential-harvesting pages, malware downloads, or other harmful content. This trend shows how even familiar convenience features can be abused when users aren’t aware of the risks.

Key Insights

QR codes are being inserted into phishing emails, SMS messages, posters, and social media posts to silently redirect users to malicious destinations.

Scanning a QR code can open links that lead to credential-harvesting pages that mimic legitimate services, increasing the chance of compromise.

QR codes can also deliver links to files or installers, which victims may download unknowingly.

Because QR codes obscure the actual URL, they make it harder for users to assess safety before interacting.

Awareness of this technique is critical, as attackers blend convenience with malicious intent in everyday workflows.

Further Reading: Unit 42

Infostealer Malware Targets OpenClaw AI Agent Secrets

Security researchers have identified infostealer malware expanding its focus to include OpenClaw AI assistant environments. Traditionally known for stealing browser credentials and system data, these threats are now targeting AI agent configuration files that may contain API keys, authentication tokens, and other sensitive secrets.

Key Points

Infostealer malware is harvesting configuration files associated with OpenClaw AI assistants.

Stolen data may include API keys, authentication tokens, and other credentials used to access connected services.

This marks a shift from browser-only credential theft to targeting locally stored AI agent secrets.

Because configuration files are often stored in user directories, traditional infostealers can easily locate and exfiltrate them.

AI agent credentials should be treated with the same level of protection as passwords and other sensitive secrets.

Further Reading: BleepingComputer – Infostealer Malware Found Stealing OpenClaw Secrets for First Time

Romance Scam Victims Often Feel Shame and Financial Loss

A recent survey of more than 2,000 U.S. adults found that many people who fall for romance scams struggle with embarrassment and underreporting, making it harder for others to learn from these crimes. These scams occur when someone posing as a romantic interest tricks victims into sending money or sharing sensitive details, often through fake profiles on social media or dating apps. Such experiences can cause both emotional distress and significant financial harm.

Key Points

Around half of survey respondents found it harder to admit falling for a romance scam than other types of fraud, which can discourage reporting and awareness.

Many people who use digital platforms to meet others notice fraudulent or fake profiles on dating sites and social media.

A notable portion of people reported losing money, with typical losses ranging into the low thousands of dollars.

Even after financial loss, many victims continue to feel stigma, and some choose not to report their experiences to authorities or support networks.

These scams tend to occur where people seek connection online, highlighting the need for caution and awareness on digital platforms.

Further Reading: NordProtect Romance Scam Survey

Huntress Report Reveals How Organized Cybercrime Operates at Scale

A new 2026 Cyber Threat Report from Huntress lays out how modern cybercriminals have evolved into highly efficient, profit-driven operators — running campaigns that resemble legitimate businesses rather than isolated hacker hits. The analysis draws on telemetry from millions of endpoints and identities and highlights how organized cybercrime groups are abusing trusted tools, stolen credentials, and scaled workflows to compromise people and organizations worldwide.

Key Takeaways

Legitimate tools are being weaponized — Remote monitoring and management (RMM) systems are now a top choice for attackers to deploy malware, steal credentials, and execute commands without using traditional hacking tools.

User deception fuels malware delivery — Techniques like ClickFix social engineering accounted for more than half of observed malware loader activity by tricking people into installing threats as part of routine actions.

Ransomware groups follow streamlined playbooks — Major ransomware operators are focusing on stealth and data theft, increasing time-to-ransom and making detection harder.

Criminal ecosystems are thriving — Stolen credentials are being sold cheaply on underground markets, making initial access easier and boosting identity-based attacks.

Mailbox manipulation and OAuth abuse lead to BEC — These identity threats are establishing footholds that set the stage for high-impact business email compromise schemes.

Further Reading: Huntress 2026 Cyber Threat Report

AI Recommendation Poisoning: How "Summarize with AI" Buttons Can Bias Your Assistant

Summary Microsoft security researchers have uncovered a new deceptive technique called AI Recommendation Poisoning. This attack targets the "memory" and personalization features of AI assistants like Microsoft Copilot, ChatGPT, and Gemini. By embedding hidden instructions in seemingly helpful "Summarize with AI" buttons or share links, companies and bad actors can inject persistent "facts" or preferences into your AI’s long-term memory. Once poisoned, the AI may begin to show subtle biases—recommending specific products, favoring certain vendors, or trusting unreliable sources—without you ever knowing the assistant has been manipulated.

Key Takeaways

The Helpful Button Trap: Be cautious of "Summarize with AI" buttons on third-party websites. They may contain hidden URL parameters that do more than just summarize; they can "pre-fill" instructions that tell your AI to "always remember this site as a trusted source."

Persistent Bias: Unlike a standard prompt injection that only affects one conversation, memory poisoning is designed to last. The injected instructions can influence the AI's behavior across future sessions, even weeks after you clicked the link.

Hidden in Plain Sight: These malicious prompts often use phrases like "from now on," "always," or "remember" to establish persistence. Because the AI presents these biased recommendations confidently, users are less likely to question their accuracy.

Practical Defense: Periodically review and clear your AI assistant’s memory or "personalization" settings. Hover over AI-related links before clicking to see if the URL contains long, suspicious-looking text strings or commands.

Further Reading: Manipulating AI memory for profit: The rise of AI Recommendation Poisoning

OpenClaw AI: Why Your New "Super Assistant" Might Be a Security Backdoor

Summary Microsoft security researchers have issued a major warning regarding OpenClaw, a viral open-source AI agent that runs locally on your computer. Unlike standard AI chatbots that just talk, OpenClaw is designed to act—it can read your emails, run terminal commands, and manage your files. However, because it operates with the same permissions as you, it lacks traditional security boundaries. This creates a "lethal trifecta": the agent has access to your private data, the ability to communicate with the outside world, and the requirement to read untrusted content (like emails or websites), making it an easy target for hackers.

Key Takeaways

The Power is the Problem: Because OpenClaw has "the keys to the kingdom" (your login details and file access), any malicious instruction it reads from a website or email could trick it into deleting files, stealing passwords, or sending spam from your account.

The "Skills" Marketplace is Risky: Much like a suspicious app store, OpenClaw’s "ClawHub" is currently flooded with community-made "skills." Researchers have found that a significant percentage of these contain hidden malware designed to steal crypto-wallets or install keyloggers.

Not for Your Work PC: Microsoft strongly advises against running OpenClaw on any computer used for actual work or personal banking. It should only be used in "isolated" environments (like a dedicated Virtual Machine) where it cannot access your sensitive identities.

Treat it as Untrusted Code: If you are testing OpenClaw, never give it access to your primary email or password manager. Assume that anything the agent "sees" or "remembers" could potentially be exfiltrated if the agent is manipulated by an external prompt.

Further Reading: Running OpenClaw safely: identity, isolation, and runtime risk

Hook, Line, and Vault: How the 1Phish Tool Steals Your Corporate Identity

Summary Security researchers have detailed a powerful new open-source phishing tool called 1Phish, designed specifically to target corporate employees. This tool goes beyond stealing passwords; it focuses on harvesting session cookies and tokens from high-value services like Okta, Microsoft, and Google. By tricking users into logging into a fake corporate portal, 1Phish allows attackers to "clone" an active login session. Once this happens, the attacker can bypass Multi-Factor Authentication (MFA) entirely and access the victim's work apps as if they were the legitimate employee.

Key Takeaways

The "One-Click" Danger: 1Phish is designed for speed. Once a victim clicks a link and enters their credentials, the attacker has nearly instant access to their corporate account before the victim even realizes something is wrong.

MFA is Not a Total Shield: This tool specializes in "session hijacking." Because it captures the "authorization token" generated after you successfully complete an MFA prompt, the attacker doesn't need to know your MFA code to stay logged in.

Mimicking Corporate Portals: 1Phish makes it very easy for attackers to clone your company's specific login page, including custom branding and logos, making the fake site look exactly like the "Single Sign-On" (SSO) page you use every day.

Stay Alert on Redirects: Be wary of any login page that feels "glitchy" or redirects you multiple times. If you are prompted to log in to a service you are already signed into, close the tab and navigate to the site directly through a trusted bookmark.

Further Reading: Hook, Line, and Vault: A Deep Dive into 1Phish

Service Desk Social Engineering Guide

March 4, 2026

This is a guide I put together for a service desk. Feel free to grab and use within your own security awareness program.

Overview for Personnel

As a Service Desk Analyst, you are the primary gateway to our organization’s data. Because you are trained to be helpful and efficient, you are the #1 target for social engineers. Theydon’t hack systems; they "hack" people.

Common Tactics USED BY ATTACKERS

The Pressure Tactic: Person sounds aggressive on a call or in a hurry. Caller may say they will escalate if not done quickly, instead of providing answers for validation questions. Caller is in a hurry to complete a task or a critical piece of work related to a priority or change.
The Distressed Employee: A caller who sounds frazzled or claims a personal emergency, hoping your empathy will lead you to skip security protocols.
The Tech "Colleague": Someone claiming to be from a different IT branch or a vendor "checking on a ticket" to gain remote access.

Red Flags

Induced Urgency: They insist that "the system will crash" if you don't act now.
Request for Exceptions: They ask you to "just this once" bypass the standard MFA or callback procedure.
Hostility: They become aggressive or condescending when you follow security policy.
Inconsistent or hesitant responses: Inbound calls is from one person, but during callback validation, the call lands to another person. Caller sounds vague or provides delayed responses
Suspicious Call Times: Calls landing in wee hours, lean hours, or during weekends, with the caller saying their manager is not available.

The Steps for a Tight Defense

Listen to your intuition: If something doesn’t feel right it probably isn’t. Run through the process and take detailed notes.• Slow Down: Scammers rely on speed. If a request feels "off," take a breath and consult your lead or manager.
Trust, but Verify: Never assume the Caller ID is accurate. Always use the official internal directory to verify the user.
Follow the Script: Security protocols (MFA pushes, manager callbacks, or employee ID verification) exist for a reason. Never skip them.
If a user cannot be validated follow the scripts:
- "As per the organization policies, we will not be able to provide any information without verifying your details. Please call us back with valid information."
- "I would be glad to assist you, however due to lack of information we are unable to proceed with the call and help you today."
Escalate anything suspicious to your Team Lead or Manager.

What to do if you suspect a scam

Don't engage: Keep the conversation professional but firm.
Document: Note the time, the claimed name, and the phone number.
Report: Immediately notify your cybersecurity team [INSERT EMAIL].

The Four Essential Shifts to Transition into Cybersecurity Leadership

February 24, 2026

Making the jump from a technical cybersecurity role to a leadership position is one of the most challenging transitions in a professional's career. In a recent panel on the Exploring Information Security podcast, experts Chris Anderson, Roger Brotz, and Mike Vetri shared the hard-won lessons they learned while moving up the career ladder.

Here are the four essential shifts every technical professional must make to become an effective leader.

Shift from "Doing" to "Empowering"

The biggest trap for new leaders is staying in the technical weeds. Roger Brotz, CISO at Acadia Healthcare, notes that while you must understand the technology to make the right moves, you cannot be a people leader if you are still the primary person on the keyboard.

Chris Anderson calls this the "mind shift from I do the work to I empower others." A leader’s job isn't to solve the technical puzzle themselves; it’s to remove obstacles so their team can solve it.

Master the Art of the "Why"

Security teams are often unfairly labeled the "Department of No." To combat this, the panel emphasized the need for Business Translation.

Technical professionals see a vulnerability and think, "This is bad." A leader must be able to translate that into a business reality: "If we don't fix this now, it will cost us $X in revenue or Y hours of downtime." Mike Vetri argues that security isn't a cost center; it’s a profit-promoting department because it prevents catastrophic losses.

Lead with Empathy (The 20% Advantage)

Cybersecurity is a high-tempo, high-stress field. The panel cited research showing that leaders who prioritize Emotional Intelligence often see their organizations exceed revenue goals by 20%.

Empathy is particularly crucial during incident response. Mike Vetri shared a story of failing to detect team burnout during a two-week crisis. He compared a burnt-out security analyst to a tired heart surgeon—eventually, fatigue leads to mistakes that the business cannot recover from.

Protect Your "Barometer"

To lead others, you must first lead yourself. The panelists shared their strategies for maintaining sanity in a 24/7 industry:

Set Hard Boundaries: If you say "yes" to every late-night request, you are inadvertently saying "no" to your family and your health.
Find a Non-Cyber Hobby: Whether it’s coaching a daughter’s soccer team, building Legos, or playing music, you need a space where "Zero Trust" doesn't exist.
Listen to Your Barometer: Most panelists agreed that their spouses or families were the first to notice when they were out of balance.

Final Thought

Transitioning to leadership doesn't mean losing your technical edge—it means using that edge to inspire others. As Mike Vetri quoted: "If your actions inspire others to do more, dream more, learn more, and become more, then you are a leader."

February 2026 - ExploreSec Cybersecurity Threat Intelligence Newsletter

February 16, 2026

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

CrazyHunter Ransomware’s Stealth Tactics and Attack Chain

Researchers have analyzed CrazyHunter, an evolving ransomware strain that combines stealthy evasion techniques with aggressive lateral movement. The ransomware disables security controls early in the attack chain, spreads across enterprise environments, and encrypts data using strong cryptography, making detection and recovery difficult.

Key Insights

Initial access is often gained through weak Active Directory credentials, followed by lateral movement using Group Policy abuse.

The ransomware uses bring-your-own-vulnerable-driver techniques to terminate security tools and evade detection.

Multi-stage execution disables defenses before loading the ransomware payload, including in-memory execution to avoid disk artifacts.

Hybrid encryption is used to lock victim data and protect encryption keys.

Victims are pressured through data leak threats and direct extortion tactics.

Further Reading: Trellix

Sophisticated ClickFix Campaign Targeting the Hospitality Sector

A recent phishing campaign has been observed targeting the hospitality industry with a refined version of the ClickFix social-engineering technique. In this variant, victims are presented with what appears to be a routine human-verification prompt or CAPTCHA, but the displayed “fix” instructions lead them to execute commands on their systems. Once executed, these commands deploy remote-access malware that gives attackers control over endpoints, enabling credential theft, data exfiltration, or further malicious activity. Because the campaign leverages familiar prompts and trusted branding, users may be more likely to follow the steps without suspecting foul play.

Key Insights

Attackers are tailoring ClickFix lures to the hospitality sector’s workflows and terminology.

The campaign uses fake verification prompts that instruct victims to run benign-looking commands.

Executing these commands installs remote-access malware that compromises devices.

Social engineering remains a powerful vector when paired with familiar user interactions.

Further Reading: SecurityWeek

Analyzing PhaltBlyx: Fake BSODs and Trusted Build Tools Used to Construct a Malware Infection

Researchers have dissected a malware campaign involving PhaltBlyx, a deceptive infection method that combines social engineering with abuse of trusted development tools and fake system prompts. In this technique, victims encounter what appears to be a Blue Screen of Death (BSOD) or other alarming system error. Instead of indicating a real crash, the fake BSOD is used to convince the user to run repair or diagnostic tools — including legitimate build tools — that have been co-opted to execute malicious scripts. Once launched, these components pull additional payloads and establish persistence, often evading traditional security defenses because they’re routed through trusted binaries.

Key Insights

Fake system errors like bogus BSODs are used to create urgency and lower user skepticism.

Attackers abuse trusted development/build tools to execute malicious scripts, making detection harder.

Once executed, these scripts fetch and deploy additional malware components.

Using legitimate tools helps the infection evade security controls that trust known binaries.

Further Reading: Securonix

Cyber Criminal Ecosystem Analysis

Researchers have mapped the modern cyber criminal ecosystem, revealing how threat actors operate with increasing organization and specialization. Instead of lone attackers working in isolation, today’s underground economy functions more like a service industry — with distinct roles and marketplaces for phishing kits, malware, access brokers, and human-based attack services. This division of labor allows even low-skilled attackers to launch sophisticated campaigns by purchasing tools, infrastructure, or privileged access from others. Understanding this ecosystem helps defenders anticipate how capabilities and services evolve and how attacks scale.

Key Insights

The cyber criminal ecosystem now resembles a service economy with specialized roles and offerings.

Tool-and-infrastructure marketplaces lower the barrier to entry for new attackers.

Access brokers sell privileged access and footholds, enabling rapid exploitation.

Services like phishing-as-a-service and malware distribution are commoditized.

Human-based services (e.g., social-engineering or insider collaboration) are part of the overall attack chain.

Further Reading: Push Security

VoidLink: Cloud-Native Malware Framework Weaponizing Linux Infrastructure

Researchers have identified VoidLink, a cloud-native malware framework built specifically for Linux environments running in modern cloud infrastructure. Unlike traditional malware adapted for cloud use, VoidLink is designed from the ground up to operate in virtual machines, containers, and orchestration platforms. Its modular architecture allows operators to extend functionality while maintaining stealth, enabling long-term access and post-compromise activity across cloud workloads.

Key Insights

VoidLink is purpose-built for cloud-native Linux environments, including virtualized and containerized infrastructure.

A modular plug-in architecture allows operators to tailor capabilities such as reconnaissance, persistence, and lateral movement.

The framework can identify cloud environments and adapt its behavior to blend in with legitimate activity.

Stealth and anti-analysis techniques are used to reduce detection and support long-term operations.

The design suggests a well-resourced threat focused on cloud and infrastructure-level compromise.

Further Reading: Check Point Research

ConsentFix Debrief: Browser-Native OAuth Phishing

The ConsentFix debrief outlines a phishing technique that abuses legitimate OAuth consent flows to compromise accounts without stealing passwords or bypassing MFA. Instead of traditional credential harvesting, attackers trick victims into approving application access through a browser-based workflow, granting access tokens tied to trusted applications. This approach allows attackers to blend malicious activity into normal authentication behavior, making detection more difficult in enterprise identity environments.

Key Insights

ConsentFix abuses legitimate OAuth consent flows rather than harvesting credentials.

Attacks operate entirely within the browser, avoiding many endpoint and email-based detections.

MFA is ineffective in this scenario because authentication occurs through a valid authorization process.

Targeting trusted or first-party applications helps attackers evade default access controls.

The technique reflects a shift toward identity-layer abuse rather than traditional phishing kits.

Further Reading: Push Security

CrashFix Browser Extension Campaign Delivers ModeloRAT

Researchers identified a campaign linked to the threat actor KongTuke that uses a malicious browser extension to compromise systems. The extension poses as a legitimate utility, such as an ad blocker, but is designed to intentionally destabilize the browser. Victims are then presented with fake error messages that guide them into executing attacker-controlled commands, ultimately leading to the installation of a remote-access Trojan.

Key Insights

The attack relies on a malicious browser extension disguised as a legitimate tool.

The extension deliberately crashes the browser to prompt user interaction.

Victims are socially engineered into running commands that install additional malware.

Corporate, domain-joined systems are targeted with more advanced payloads.

The technique combines social engineering with browser abuse rather than traditional phishing links.

Further Reading: Huntress

Microsoft Remains the Most Imitated Brand in Phishing Attacks in Q4 2025

Check Point Research reports that Microsoft continued to be the most frequently impersonated brand in phishing attacks during Q4 2025. Attackers consistently leverage trusted, widely used brands to increase the likelihood of user interaction and credential compromise, particularly for access to email, cloud services, and productivity platforms. Technology companies remain the most attractive targets due to the value of associated identities and accounts.

Key Insights

Microsoft accounted for the largest share of brand-based phishing attempts in Q4 2025.

Technology brands dominate phishing campaigns due to their broad user bases and access value.

Other commonly impersonated brands included Google, Amazon, Apple, and Meta.

Phishing lures often rely on realistic branding and subtle impersonation techniques to appear legitimate.

Further Reading: Check Point Research

Open-Source Python Script Drives Social Media Phishing Campaign

Threat researchers identified a phishing campaign leveraging social media direct messages to distribute malicious files that ultimately lead to remote access trojan deployment. The activity relies on weaponized archives, DLL sideloading, and a legitimate open-source Python script to execute payloads while blending in with normal software behavior. The campaign highlights how threat actors are expanding beyond email to exploit trust within professional networking platforms.

Key Insights

Social media direct messages are being used as a primary delivery mechanism, allowing attackers to bypass traditional email security controls.

The infection chain abuses DLL sideloading with legitimate applications and a portable Python environment to execute malicious activity.

Use of an open-source Python script reduces development effort while complicating detection by appearing benign.

Post-execution behavior indicates persistence and command-and-control communication consistent with remote access tooling.

Targeting suggests a focus on corporate users, where social engineering via trusted platforms increases engagement.

Further Reading: ReliaQuest

Payroll Diversion via Help Desk Social Engineering

Threat researchers analyzed an incident in which attackers used phone-based social engineering to manipulate help desk workflows and redirect employee payroll to attacker-controlled bank accounts. By impersonating employees and exploiting weak identity verification processes, the adversary reset credentials, re-registered multi-factor authentication devices, and modified payroll details without exploiting technical vulnerabilities. The activity demonstrates how human-focused tactics can enable financial fraud while evading traditional security controls.

Key Insights

The attack relied on voice-based impersonation of employees to bypass help desk authentication procedures.

Publicly available personal details were used to satisfy challenge-response questions and gain account access.

Credential resets and MFA re-enrollment enabled control over payroll, HR, and IT-related systems.

Payroll redirection remained undetected until employees reported missing paychecks.

The intrusion exposed gaps in identity change monitoring and cross-departmental alerting.

Further Reading: Unit 42

AI-Powered HTMLMIX Obfuscation Tool Reshapes Phishing Tactics

Threat researchers analyzed HTMLMIX, an AI-enabled phishing obfuscation platform actively used to generate large volumes of unique phishing emails. The tool automates HTML code transformation and content variation to undermine signature-based detection, enabling attackers to scale phishing campaigns while maintaining high delivery success. This activity reflects a broader shift toward AI-assisted automation within phishing operations.

Key Insights

HTMLMIX programmatically alters HTML structure to produce thousands of distinct email variants from a single template.

Automated obfuscation techniques include layout restructuring, CSS manipulation, and hidden character insertion to evade pattern-based detection.

AI-driven content features introduce language variation, preview text changes, and fabricated email threads to increase realism.

API-based workflows allow the tool to integrate directly into phishing delivery pipelines for rapid campaign scaling.

Short-lived redirect infrastructure is used to mask malicious destinations and improve initial deliverability.

Further Reading: Abnormal AI

Fake CAPTCHA Pop-Ups Used to Trick Website Visitors

A campaign known as ClearFake is using compromised websites to display fake verification pop-ups that look like routine security checks. These prompts guide visitors through simple steps that appear harmless but actually trigger hidden commands on their computers. Because the scam appears on real, trusted websites, it can be difficult for everyday users to recognize what’s happening.

Key Points

Legitimate websites are being altered to display fake verification messages.

The pop-ups instruct users to perform basic actions that quietly run harmful commands.

Familiar technology and services are used to make the activity seem normal.

Once the commands run, additional unwanted software can be installed without clear warning.

The use of trusted websites and common prompts increases the likelihood of user interaction.

Further Reading: Expel

2026 Threat Forecast: Top Cyberattacks Set to Increase Enterprise Exposure

Email remains the primary entry point for attackers, and emerging campaigns are increasingly focused on exploiting trust, identity, and routine workflows to bypass defenses. Threat actors are layering social engineering techniques with technical evasion methods to increase success rates and reduce detection, signaling a continued shift toward human-centric attack vectors.

Key Insights

Attackers are refining multi-stage phishing workflows (e.g., QR codes and vendor impersonation) to condition targets and evade security controls.

Social engineering remains central, with threat actors embedding themselves in legitimate communication threads to increase credibility.

Look-alike domains, branding mimicry, and personalized phishing pages are becoming more common to improve credential theft success.

Email continues to be the most reliable initial access vector due to its ubiquity and reliance on human interaction.

Further Reading: Abnormal AI

Real-Time Malicious JavaScript Generated Through LLMs

Threat researchers identified a technique where attackers use large language models to generate malicious JavaScript code in real time inside a victim’s browser. Instead of hosting harmful code on attacker-controlled infrastructure, the webpage dynamically requests code generation during the visit, producing phishing functionality only at execution time. This approach makes the activity harder to detect because the malicious content does not exist until the moment it runs.

Key Insights

Malicious JavaScript is generated dynamically during page visits rather than being stored on a server.

Each execution produces unique code, reducing the effectiveness of signature-based detection.

Requests to trusted LLM service domains can blend in with normal web traffic.

The technique enables phishing pages to be customized in real time based on victim context.

Detection becomes more difficult because the malicious logic exists only briefly in the browser.

Further Reading: Unit 42

Phishing Messages Masquerade as Collaboration Platform Invites

A phishing campaign is abusing trusted collaboration platform notifications to deliver scam messages that look like legitimate invitations. By using real platform features, the messages appear routine and familiar, increasing the chances that recipients engage without questioning them. Instead of pushing malicious links, the messages often steer people toward fake support interactions.

Key Points

Legitimate collaboration platform features are being used to send deceptive invitations.

Messages are designed to look like normal work notifications, such as billing or subscription alerts.

Some scams avoid links entirely and instead prompt users to contact fraudulent support numbers.

The volume of messages is high, affecting users across many organizations.

Familiar workplace tools are being leveraged to make scams feel routine and trustworthy.

Further Reading: Check Point

Kimwolf Botnet Embedded in Corporate and Government Networks

Threat researchers reported widespread activity tied to the Kimwolf botnet, which has infected millions of internet-connected devices and is now appearing inside corporate and government environments. Once embedded, compromised devices can be used to relay malicious traffic, participate in large-scale denial-of-service activity, and scan internal networks for additional targets. The presence of consumer-grade devices inside enterprise environments is expanding the botnet’s reach beyond its original footprint.

Key Insights

Kimwolf primarily spreads through compromised internet-connected devices, including consumer hardware.

Infected systems are used to generate large volumes of malicious traffic and denial-of-service activity.

Once inside an organization, compromised devices can scan internal networks for other reachable systems.

Residential proxy infrastructure is leveraged to mask command-and-control activity.

The botnet’s scale and persistence indicate continued risk despite partial disruption efforts.

Further Reading: KrebsOnSecurity

Infostealer Data Cache Exposes 149 Million Credentials

Threat researchers identified a large, publicly accessible database containing roughly 149 million stolen login credentials. The data was collected by infostealer malware that silently harvests usernames and passwords from infected devices and aggregates them for later use. Because the database was left exposed without protection, the credentials could be accessed and abused for large-scale account takeover, fraud, and follow-on intrusion activity.

Key Insights

The dataset contained approximately 149 million unique username and password combinations.

Infostealer malware was the likely source, collecting credentials directly from compromised endpoints.

Exposed credentials spanned a wide range of services, including email, financial platforms, and consumer accounts.

Some entries were associated with corporate, government, and educational domains, increasing targeting risk.

The unsecured database remained accessible long enough to pose a meaningful risk of reuse by other threat actors.

Further Reading: ExpressVPN

Multi-Stage AiTM Phishing and BEC Campaign Abusing SharePoint

Threat researchers uncovered a coordinated campaign that combines adversary-in-the-middle phishing with business email compromise techniques. The activity abuses trusted cloud collaboration services to deliver phishing lures, steal session data, and expand access once an initial account is compromised. By leveraging familiar internal workflows, the attackers were able to spread both inside and outside targeted organizations.

Key Insights

Phishing lures were designed to look like legitimate SharePoint document shares from trusted senders.

Stolen credentials and session tokens allowed attackers to bypass standard login protections.

Malicious inbox rules were created to hide follow-on activity and maintain access.

Compromised accounts were used to send additional phishing messages to internal and external contacts.

The campaign demonstrates how trusted collaboration platforms can be misused to scale email compromise.

Further Reading: Microsoft Security Blog

Fake CAPTCHA Prompts Used to Trick Users Into Installing Malware

Researchers have identified a scam that uses fake “CAPTCHA” verification screens to deceive users into installing malicious software. Instead of a simple checkbox, these prompts instruct people to copy and run a command on their own device, which secretly launches malware designed to steal sensitive information. Because the steps look like a normal verification process, many users don’t realize anything is wrong until after their system is compromised.

Key Points

Fake CAPTCHA pages instruct users to manually run commands as part of a supposed verification step.

Following these instructions can silently install malware on the device.

The malware is designed to collect sensitive data such as saved passwords and browser information.

Trusted system tools are abused to make the activity look legitimate.

The attack relies heavily on user interaction, making it harder to spot at first glance.

Further Reading: Blackpoint Cyber

Scam Emails Abuse a Real Microsoft Address

Scammers are sending fraudulent emails that appear to come from a legitimate Microsoft notification address, making the messages look trustworthy at first glance. Because these emails originate from a real Microsoft service that some organizations allow by default, they can slip past spam filters and land directly in inboxes. The messages often claim an urgent issue, such as an unexpected charge, and push recipients to take immediate action.

Key Points

Scam messages are being sent from a real Microsoft notification address.

The emails are designed to look authentic and bypass some email filters.

Messages often create urgency by claiming billing or account problems.

Recipients may be directed to call a phone number controlled by scammers.

Trusted services can be abused to make scams more convincing.

Further Reading: Ars Technica

Detection and Response Are Moving Beyond the Endpoint

Security teams are reassessing the limits of traditional endpoint detection and response (EDR) tools as more attacks avoid touching the operating system altogether. Modern threat activity increasingly unfolds inside browsers and cloud applications, where users authenticate, access data, and perform daily work. This shift is driving interest in detection and response capabilities that extend beyond endpoints to cover browser-based attack paths.

Key Insights

EDR remains effective for threats that execute directly on a device, such as malware and suspicious process activity.

Many modern attacks operate entirely within browsers, targeting credentials, sessions, and cloud access.

Browser-based phishing, session hijacking, and token theft may generate little or no endpoint telemetry.

Attackers are adapting to where users work, focusing on identity and access rather than device compromise.

Security strategies are increasingly combining endpoint visibility with browser-level detection.

Further Reading: Push Security

TA584 Continues to Evolve Its Initial Access Playbook

Threat researchers report that the activity cluster tracked as TA584 continues to adapt how it gains initial access to victim environments. The group remains highly active, cycling through new email lures, delivery techniques, and malware families to keep campaigns effective. This ongoing evolution highlights how initial access operations are becoming more flexible and harder to disrupt through static defenses alone.

Key Insights

TA584 operates as a high-volume initial access actor with frequent changes to campaign themes and infrastructure.

Email remains the primary delivery method, with lures tailored to specific regions, brands, or current events.

Campaigns increasingly rely on redirection chains and customized landing pages to drive user interaction.

The actor rotates malware families, including remote access tools that can enable follow-on activity such as ransomware.

Rapid campaign turnover reduces the effectiveness of signature-based and content-only detections.

Further Reading: Proofpoint

IClickFix Framework Abuses Compromised WordPress Sites to Deliver Malware

Threat researchers have identified a large-scale malicious framework known as IClickFix that leverages compromised WordPress websites to distribute malware. Visitors to affected sites may be presented with deceptive verification prompts designed to trick them into manually executing commands on their own systems. This approach combines widespread infrastructure abuse with social engineering to infect victims at scale.

Key Insights

IClickFix injects malicious scripts into compromised WordPress sites to redirect visitors to deceptive prompts.

Victims are shown fake CAPTCHA-style challenges that instruct them to copy and run commands.

Executing these commands leads to malware installation without exploiting a software vulnerability.

The framework has been active for months and has impacted thousands of websites globally.

Delivered payloads include tools that enable persistent remote access to infected systems.

Further Reading: SEKOIA Blog

Windows Moves Toward Disabling NTLM Authentication by Default

Microsoft is advancing plans to reduce reliance on the legacy NTLM authentication protocol by disabling it by default in future Windows releases. NTLM has long been used as a fallback mechanism, but its design exposes environments to well-known attack techniques. The shift reflects a broader move toward modern, identity-centric authentication models across Windows ecosystems.

Key Insights

NTLM is considered a legacy protocol with known weaknesses that attackers can exploit.

Future Windows versions will favor modern authentication methods such as Kerberos.

Microsoft is taking a phased approach to help organizations identify and reduce NTLM usage.

New authentication capabilities are being introduced to cover scenarios where NTLM was historically required.

NTLM will remain available for legacy compatibility but must be explicitly enabled.

Further Reading: Microsoft Tech Community

NSA Releases Initial Zero Trust Implementation Guidelines

The U.S. National Security Agency has released the first set of guidance in a new series aimed at helping organizations implement zero trust principles in a structured, practical way. These initial materials focus on establishing visibility and understanding of environments before moving into enforcement, providing a foundation for more mature zero trust capabilities over time.

Key Insights

The first releases introduce a primer and a discovery-focused phase to help organizations map assets, data, services, and access patterns.

Emphasis is placed on understanding the environment before applying controls or policy enforcement.

The guidance is modular, allowing organizations to adopt elements based on their maturity and priorities.

Later phases are expected to build on this foundation with more detailed implementation activities.

While developed with government use cases in mind, the guidance is applicable to broader enterprise zero trust efforts.

Further Reading: NSA

TA584 Continues to Evolve Initial Access Tactics

Threat researchers report that the activity cluster tracked as TA584 continues to adapt how it gains initial access to victim environments. This actor is highly active, rotating email lures, delivery techniques, and malware families to keep campaigns effective and harder to block. The ongoing evolution highlights how initial access operations are becoming more adaptable and challenging for defenses that rely on static indicators.

Key Insights

TA584 operates as a high-volume initial access actor with frequent changes to campaign themes and infrastructure.

Email remains the primary delivery method, with lures tailored to specific regions, brands, or events to increase engagement.

Campaigns often use redirection chains and customized landing pages to encourage interaction while bypassing security filters.

The group cycles through multiple malware types, including remote access tools that can facilitate follow-on compromise.

Rapid campaign turnover reduces the effectiveness of signature-based and content-only detection techniques.

Further Reading: Proofpoint

FBI Launches Operation Winter SHIELD to Boost Cyber Resilience

The FBI has introduced Operation Winter SHIELD, a nationwide initiative focused on strengthening cyber resilience across public and private organizations. Drawing directly from real-world investigations, the effort highlights common weaknesses attackers exploit and outlines practical defensive actions aimed at reducing exposure to both criminal and state-linked cyber activity.

Key Insights

Operation Winter SHIELD distills lessons learned from FBI cyber investigations into a concise set of high-impact actions.

The initiative focuses on reducing common attack paths used in ransomware, espionage, and disruptive campaigns.

Recommendations span identity protection, system hardening, and improved visibility across IT and operational technology environments.

The campaign emphasizes proactive preparation rather than reactive incident response.

Winter SHIELD supports broader efforts to improve national cyber resilience through public–private collaboration.

Further Reading: FBI

Fake Dropbox Emails Used to Steal Login Details

Key Points

Phishing emails are crafted to look like legitimate Dropbox notifications or file-sharing messages.

PDF attachments are used to make the email appear business-related and trustworthy.

Links inside the document lead to counterfeit login pages.

Entered credentials are captured by attackers and can be reused to access other accounts.

The technique relies on familiar brands and file formats to lower suspicion.

Further Reading: CybersecurityNews

ShinyHunters-Linked Attacks Target SaaS Environments

Threat intelligence analysis highlights how activity associated with the ShinyHunters cybercrime ecosystem is increasingly focused on compromising software-as-a-service environments. Rather than exploiting technical vulnerabilities, these campaigns rely on social engineering and identity abuse to gain access to cloud platforms, allowing attackers to move laterally across connected services and exfiltrate sensitive data for extortion.

Key Insights

ShinyHunters-linked operations rely heavily on phishing and voice-based social engineering to steal SSO credentials and MFA codes.

Once identities are compromised, attackers abuse trust relationships to access multiple SaaS applications.

These attacks are identity-centric and often leave little traditional endpoint evidence.

Stolen credentials and session access enable large-scale data theft without exploiting software flaws.

Identity visibility and rapid response are critical to limiting impact once access is gained.

Further Reading: Google Cloud

SLH Campaign Blends Vishing With AiTM Phishing for Account Takeover

Threat researchers analyzed a recent campaign attributed to the group tracked as SLH that combines live phone-based social engineering with adversary-in-the-middle phishing. Attackers initiate contact by posing as internal IT support, then guide victims to a phishing site designed to capture credentials, MFA codes, and active session tokens. With this access, the actors can move quickly across connected cloud services using the victim’s identity.

Key Insights

The campaign starts with phone calls impersonating IT staff to establish trust.

Victims are steered to a phishing site that captures credentials and MFA in real time.

Stolen session tokens enable immediate access to SSO-protected services.

The hybrid vishing-plus-phishing approach increases success and evasion.

Identity abuse allows attackers to expand access without deploying malware.

Further Reading: Push Security

February 2026 - ExploreSec Cybersecurity Awareness Newsletter

February 13, 2026

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Sophisticated ClickFix Campaign Targeting the Hospitality Sector

Key Insights

Attackers are tailoring ClickFix lures to the hospitality sector’s workflows and terminology.

The campaign uses fake verification prompts that instruct victims to run benign-looking commands.

Executing these commands installs remote-access malware that compromises devices.

Social engineering remains a powerful vector when paired with familiar user interactions.

Further Reading: SecurityWeek

Analyzing PhaltBlyx: Fake BSODs and Trusted Build Tools Used to Construct a Malware Infection

Key Insights

Fake system errors like bogus BSODs are used to create urgency and lower user skepticism.

Attackers abuse trusted development/build tools to execute malicious scripts, making detection harder.

Once executed, these scripts fetch and deploy additional malware components.

Using legitimate tools helps the infection evade security controls that trust known binaries.

Further Reading: Securonix

The Truman Show Scam: Trapped in an AI-Generated Reality

Researchers describe a mobile-focused scam dubbed The Truman Show Scam in which attackers use AI-generated audio and video to create highly convincing fake scenarios that manipulate victims. The scam leverages generative media to simulate trusted individuals or realistic situations — for example, mimicking a friend, coworker, or service agent — in order to extract sensitive information, push fraudulent transactions, or coerce victims into risky actions. The use of AI increases the believability of the bait, making traditional skepticism and simple heuristics less effective.

Key Insights

Attackers leverage AI-generated audio/video to simulate real people or situations with high fidelity.

The convincing nature of generative media reduces user suspicion and increases interaction rates.

Scams may involve spoofed identities of friends, colleagues, or service representatives.

AI media can be used to pressure victims into disclosing credentials, payment details, or other sensitive data.

Further Reading: Check Point Mobile Security Blog

Cyber Criminal Ecosystem Analysis

Key Insights

The cyber criminal ecosystem now resembles a service economy with specialized roles and offerings.

Tool-and-infrastructure marketplaces lower the barrier to entry for new attackers.

Access brokers sell privileged access and footholds, enabling rapid exploitation.

Services like phishing-as-a-service and malware distribution are commoditized.

Human-based services (e.g., social-engineering or insider collaboration) are part of the overall attack chain.

Further Reading: Push Security

CrashFix Browser Extension Campaign Delivers ModeloRAT

Key Insights

The attack relies on a malicious browser extension disguised as a legitimate tool.

The extension deliberately crashes the browser to prompt user interaction.

Victims are socially engineered into running commands that install additional malware.

Corporate, domain-joined systems are targeted with more advanced payloads.

The technique combines social engineering with browser abuse rather than traditional phishing links.

Further Reading: Huntress

Microsoft Remains the Most Imitated Brand in Phishing Attacks in Q4 2025 (Check Point Research)

Key Insights

Microsoft accounted for the largest share of brand-based phishing attempts in Q4 2025.

Technology brands dominate phishing campaigns due to their broad user bases and access value.

Other commonly impersonated brands included Google, Amazon, Apple, and Meta.

Phishing lures often rely on realistic branding and subtle impersonation techniques to appear legitimate.

Further Reading: Check Point Research

Hackers Use LinkedIn Messages to Spread Malware via Job Scams

Attackers are leveraging LinkedIn messaging to distribute malware through seemingly legitimate job opportunities and recruitment outreach. The campaign involves sending direct messages that appear to come from real LinkedIn contacts or credible recruiters, offering job details and enticing users to download attachments or click links that lead to malware. Because the messages originate from within LinkedIn — a trusted professional network — users may be more likely to engage, making this a potent vector for social engineering and malware distribution.

Key Insights

LinkedIn is being abused as a delivery channel for malware via direct messages tied to job offers or recruitment.

Messages mimic legitimate recruiters or contacts, increasing the chances that recipients will engage.

Malicious attachments or links in the message lead to malware downloads.

Trust in professional networking platforms lowers skepticism and can bypass some security filters.

Further Reading: The Hacker News

Phishing Emails Impersonating LastPass

A new phishing campaign is targeting LastPass users with emails that appear to come from the company. The messages claim that LastPass is performing maintenance and urge recipients to take urgent action, such as creating a backup of their password vault. These emails are designed to trick people into visiting fake websites where attackers attempt to steal login information.

Key Points

The emails falsely warn about upcoming account or system changes to create a sense of urgency.

Recipients are directed to click links that lead to look-alike websites pretending to be LastPass.

The fake sites are used to capture master passwords, which could expose all stored accounts.

The messages use familiar branding and language to appear legitimate.

Password manager users are being singled out because access to one account can unlock many others.

Further Reading: LastPass

Spam Emails Sent From Hijacked Support Systems

A large wave of spam emails has been sent after attackers abused customer support systems that rely on automated responses. By submitting fake support tickets, the attackers triggered confirmation messages to be sent to large numbers of people. Because these emails came from real company support systems, many appeared legitimate and were delivered successfully.

Key Points

Fake support tickets were submitted to trigger automatic email responses.

The resulting emails were sent from real company support addresses, making them look trustworthy.

Subject lines were often strange or alarming, causing confusion for recipients.

The spam affected many organizations at the same time, not just one company.

The issue highlights how automated systems can be misused at scale.

Further Reading: BleepingComputer

Fake CAPTCHA Pop-Ups Used to Trick Website Visitors

Key Points

Legitimate websites are being altered to display fake verification messages.

The pop-ups instruct users to perform basic actions that quietly run harmful commands.

Familiar technology and services are used to make the activity seem normal.

Once the commands run, additional unwanted software can be installed without clear warning.

The use of trusted websites and common prompts increases the likelihood of user interaction.

Further Reading: Expel

Disinformation Campaigns Exploit European Online Conversations

Misleading stories linked to Russian sources are spreading across websites and social media by tapping into real concerns and debates within European countries. These narratives often take familiar topics—such as politics, the economy, or public safety—and reshape them in ways that blur facts and fiction. By blending false claims with real issues people already care about, the content is more likely to be shared and believed.

Key Points

False or misleading stories are tailored to specific European audiences rather than using one-size-fits-all messaging.

Real events or concerns are often used as a starting point, then distorted to push a misleading narrative.

The origin and intent of the content can be difficult to identify, making it harder to judge credibility.

Social media and lesser-known websites play a major role in spreading these narratives.

The mix of truth and falsehood can make misleading information feel more convincing to everyday readers.

Further Reading: NewsGuard Reality Check

2026 Threat Forecast: Top Cyberattacks Set to Increase Enterprise Exposure

Key Insights

Attackers are refining multi-stage phishing workflows (e.g., QR codes and vendor impersonation) to condition targets and evade security controls.

Social engineering remains central, with threat actors embedding themselves in legitimate communication threads to increase credibility.

Look-alike domains, branding mimicry, and personalized phishing pages are becoming more common to improve credential theft success.

Email continues to be the most reliable initial access vector due to its ubiquity and reliance on human interaction.

Further Reading: Abnormal AI

Phishing Messages Masquerade as Collaboration Platform Invites

Key Points

Legitimate collaboration platform features are being used to send deceptive invitations.

Messages are designed to look like normal work notifications, such as billing or subscription alerts.

Some scams avoid links entirely and instead prompt users to contact fraudulent support numbers.

The volume of messages is high, affecting users across many organizations.

Familiar workplace tools are being leveraged to make scams feel routine and trustworthy.

Further Reading: Check Point

Phishing Kits Now Work Hand-in-Hand With Phone Scams

Attackers are using specialized phishing tools designed to support phone-based scams. During these calls, the scammer can control what the victim sees in their browser in real time, matching on-screen prompts to the caller’s script. This coordination makes fake login pages and security checks appear more believable, increasing the chances that victims unknowingly hand over account access.

Key Points

Phishing tools are being built to support live phone scams, not just fake emails or websites.

Scammers can change what appears on a victim’s screen while talking to them.

Real-time control helps attackers react immediately to login or verification steps.

The combination of phone calls and on-screen prompts makes scams feel more legitimate.

Common security checks can be misused when attackers guide victims step by step.

Further Reading: Okta

Password Manager Adds Pop-Up Warnings for Fake Websites

1Password has introduced a new safety feature designed to stop people from accidentally entering their login details on fake websites. When someone tries to paste saved credentials into a site that doesn’t match the correct web address, a warning pop-up appears. This pause is meant to help users notice suspicious sites before sensitive information is shared.

Key Points

A warning appears when login details are pasted into a site that doesn’t match the saved address.

The feature helps catch look-alike websites that imitate real brands and services.

It adds an extra pause moment before sensitive information is entered.

Existing protections that block automatic filling on suspicious sites are reinforced.

Many users will receive this protection automatically through their password manager.

Further Reading: BleepingComputer

Fake CAPTCHA Prompts Used to Trick Users Into Installing Malware

Key Points

Fake CAPTCHA pages instruct users to manually run commands as part of a supposed verification step.

Following these instructions can silently install malware on the device.

The malware is designed to collect sensitive data such as saved passwords and browser information.

Trusted system tools are abused to make the activity look legitimate.

The attack relies heavily on user interaction, making it harder to spot at first glance.

Further Reading: Blackpoint Cyber

Scam Emails Abuse a Real Microsoft Address

Key Points

Scam messages are being sent from a real Microsoft notification address.

The emails are designed to look authentic and bypass some email filters.

Messages often create urgency by claiming billing or account problems.

Recipients may be directed to call a phone number controlled by scammers.

Trusted services can be abused to make scams more convincing.

Further Reading: Ars Technica

Exposed AI Bot Gateways Leak Chats and Sensitive Data

Security researchers found that numerous publicly accessible control panels tied to an AI bot framework known as Clawdbot (also called OpenClaw or Moltbot) were left exposed online without proper protection. These misconfigured gateways made it possible for outsiders to view private chat histories and sensitive technical details, raising concerns about how easily personal or organizational data can be leaked through poorly secured tools.

Key Points

Many AI bot gateways were publicly accessible with no authentication required.

Exposed interfaces allowed access to private chat logs and conversation history.

Sensitive information such as API keys and access tokens was also visible.

The bots integrate with messaging platforms, increasing the potential impact of exposure.

The issue highlights risks tied to insecure configurations and default settings.

Further Reading: CybersecurityNews

Fake Dropbox Emails Used to Steal Login Details

Key Points

Phishing emails are crafted to look like legitimate Dropbox notifications or file-sharing messages.

PDF attachments are used to make the email appear business-related and trustworthy.

Links inside the document lead to counterfeit login pages.

Entered credentials are captured by attackers and can be reused to access other accounts.

The technique relies on familiar brands and file formats to lower suspicion.

Further Reading: CybersecurityNews

Unlock Your Online Freedom: Why 2026 is the Year You Master the Password Manager

January 27, 2026

This is a blog post I wrote for an internal security awareness program. Feel free to use for your own program.

Are you still wrestling with sticky notes full of passwords, or worse, using the same "Fido123!" for every online account? In 2026, there’s simply no excuse to juggle passwords manually. The secret isn't a better memory; it’s a Password Manager.

Think of it as your personal, Fort Knox-level vault for every single online credential. You only need to rset one super-strong "Master Password," and the manager does the rest: remembering, generating, and even autofilling complex, unique passwords for every site you visit.

Let's dive in and transform your online security!

Step 1: Choose Your Password Manager

The first step is selecting a password manager that fits your needs. Many reputable services offer a free tier to get you started and a "Premium" option for more quality-of-life functionality.

NordPass: Best for Beginners. Known for its incredibly user-friendly interface and robust encryption. If you're new to this, this is a good starting point!
Bitwarden: Best for Budget & Tech-Savvy Users. Open-source, highly secure, and offers a very generous free version.
1Password: Best for Families & Seamless Sharing. Features like "Travel Mode" and smooth sharing between family members make it a top choice.
Proton Pass: Best for Privacy Enthusiasts. Integrates perfectly into the Proton ecosystem and includes email aliasing for enhanced privacy.
LastPass: The Fortinet of Password Managers. Highly automated and features a "Security Dashboard" that makes fixing weak passwords very simple.
DashLane: Another paid options that offers a trial period. Includes a built-in VPN and real-time phishing protection.

Step 2: Fortify Your Vault – Setup Essentials

Once you've picked your password manager, follow these critical steps to secure your new vault:

Craft Your Master Passphrase: This is the only password you'll ever need to remember. Make it a passphrase or obscure quote – a string of 4-7 words. You can go the unrelated word route (e.g., Horse-Purple-Hat-Run-Bay); or the obscure movie quote “I’m-Riding-A-700LB-Furry-Tractor." Either is easy for you to remember and nearly impossible for a computer to guess.
Enable Multi-Factor Authentication (MFA): Link your vault to an authenticator app (like Google Authenticator) or a physical security key. Even if someone somehow gets your Master Passphrase, MFA acts as a second lock.
Install the Extensions & Apps: Download the browser extension (Chrome, Edge, Safari, Firefox) and the mobile app (iOS, Android). This allows your manager to automatically fill in login details wherever you go online.
Save Your Recovery Key: Most managers provide a "Secret Key" or "Recovery Code." Print this out and store it in a very secure, offline location (like a safe deposit box or a fireproof safe at home). It's your lifeline if you ever forget your Master Passphrase.

Step 3: Embrace the Automation – Daily Usage Made Easy

Using a password manager makes your online life simpler.

Effortless Saving: The first time you log into a site, your manager will pop up and ask, "Save this password?" Click "Yes," and you're done!
Instant Autofill: Visiting that site again? Just click the manager's icon in the login field, and it fills in your username and password for you. No typing, no remembering.
Unbreakable Passwords: When creating a new account, use the manager's Password Generator. It will instantly create a unique, complex string of characters (e.g., cXmnZK65rf*&DaaD). You don't need to know it; your manager remembers it for you.
Regular Security Audits: Take advantage of your manager's "Security Dashboard" or "Watchtower." It will alert you to weak, reused, or compromised passwords in your vault, helping you proactively strengthen your security.

Why This Matters: Beyond Just Convenience

Combat Phishing: If you accidentally land on a fake "phishing" website, your password manager won't recognize the URL and won't autofill your credentials, immediately alerting you to a potential scam.
Zero-Knowledge Security: Top-tier managers use "Zero-Knowledge" encryption, meaning your data is encrypted on your device before it even leaves. The company itself cannot see your passwords – only you can.
The Rise of Passkeys: As we move towards a passwordless future, many modern password managers now support Passkeys, allowing you to log in with just your fingerprint or face ID, bypassing passwords entirely!
A unique password for every site: We have hundreds of sites we log into on a regular basis. A password manager ensures we have a unique password for each one. In the event of a breach that compromises credentials we can find comfort in that our other accounts aren’t at risk.

Ready to Get Started? Here are Your Resources:

We want to empower you with the knowledge to stay safe online. Here are some of the best resources we've found to guide you:

For Absolute Beginners:

For Hands-On Setup:

Bitwarden Learning Center (Great for importing passwords)
1Password ‘Watchtower’ Guide (How to audit your security)
NordPass Setup Tutorial (Visual guides for easy setup)

For Deeper Dives & Comparisons:

Your Online Security Starts Here!

Making the switch to a password manager is one of the most impactful steps you can take for your personal cybersecurity. It’s not just about convenience; it’s about safeguarding your identity, finances, and privacy in an increasingly complex online world.

If you’re already a password manager user leave a comment below with your preferred password manager and why you switched. If you have any questions leave a comment or reach out to me directly.

The State of Space Security Heading into 2026

January 20, 2026

This blog post was created based on the transcript from episode 254 of the Exploring Information Security podcast. First draft by Gemini; edited by a human.

For decades, the concept of space security was relegated to science fiction or the classified halls of government agencies. Today, however, our entire way of life—from the synchronization of power grids to global financial transactions—is predicated on data traversing the stars.

In a live recording of the Exploring Information Security podcast, I sat down with Tim Fowler, CEO and founder of Ethos Labs LLC, to discuss why space is the ultimate culmination of all security specializations.

The "Veil of Obscurity" is Lifting

Historically, space systems relied on a "veil of obscurity" or technological supremacy for protection. Because it was so difficult and expensive to communicate with an orbiting satellite, security was often deprioritized in favor of pure operations.

Fowler notes that this obscurity is now gone. With the rapid commercialization of space, the technological barriers to entry have plummeted. The focus on security is still well behind and is likely too be a repeat of history where organizations will have to scramble to bolt on security.

Why Terrestrial Life Depends on Space Security

One of the most sobering points of the discussion was the real-world impact of a space-based security event. While many associate GPS only with navigation, it is actually the primary timing source for critical terrestrial infrastructure.

Financial Systems: Stock exchanges rely on GPS timing for transaction synchronization.
Power Grids: America’s "just-in-time" grid uses space-based timing to desynchronize or ramp production.
Pipelines: Crucial infrastructure synchronization is often tethered to orbital data.

A disruption in space doesn't just stay in orbit; it can cause rolling blackouts or freeze ATMs right here on the ground.

The Encryption Gap and Integrity Risks

A persistent challenge in the field is the lack of basic encryption. Fowler reported being surprised if even 50% of current space signals are encrypted, often due to the operational complexities of managing keys in orbit.

Furthermore, encryption only solves for confidentiality, not integrity. Even an encrypted signal can be captured and "replayed" by an attacker, leading a satellite to process potentially malicious commands because it lacks the layers to verify the signal's integrity.

Integrating Security with Development

Fowler argued that the most effective way to secure the "Final Frontier" is by moving security closer to operations.

Security Involved Early: The best model involves physically placing security testers (like penetration testers) directly within development teams.
Offensive Education: Teaching developers how to attack their own software is one of the most effective proactive measures to stop vulnerabilities before they launch.

The Future of Space Security and Ethos Labs

Despite the challenges, the industry is seeing an uptick in security engineering roles. For those looking to get involved, resources like the Aerospace Village and specialized training platforms are becoming more accessible.

Fowler also teased exciting developments for Ethos Labs in early 2026, including:

"Fun Size" Hardware: A new, smaller hardware platform that is easier to manufacture and ship.
On-Demand Classes: For the first time, hardware classes will be available in a guided, drop-shipped on-demand format.
Centralized Repository: A new brand under Ethos Labs aimed at being a one-stop-shop for space security videos, blog posts, and training.

Final Thoughts: AI and the Human in the Loop

Our discussion concluded with AI’s role in space. While AI is excellent for anomaly detection and "busy work" like high-speed sensor analysis, Fowler insists that mission-critical decisions must always have a human in the loop. In space, a misunderstood data point can rapidly escalate into a hostile international incident.

Want to dive deeper? Check out ethoslabs.space for more information on the upcoming hardware kits and space security training.

How to Scan Your Home Network for Unauthorized Devices and Botnets

January 13, 2026

This is an security awareness blog post I put together for my company with the help of Gemini. Feel free to grab and use within your own security awareness program.

The recent emergence of the Kimwolf botnet, as detailed by KrebsOnSecurity, serves as a reminder that your home router is a potential target for cybercriminals.

According to the report, Kimwolf has already infected over 2 million devices—primarily cheap Android TV boxes and "smart" photo frames. What makes this botnet particularly dangerous is its ability to "tunnel back" into your local network, using infected devices as a bridge to attack other gadgets behind your firewall.

If you’re worried about whether your network has been compromised, here is a guide on how to audit your local environment and evict any digital squatters.

1. Identify "The Usual Suspects"

The Kimwolf report highlights a specific class of vulnerable devices: unbranded or "budget" Android TV boxes and smart home gadgets. * The Risk: Many of these ship with ADB (Android Debug Bridge) enabled by default. This is a developer tool that allows full administrative access without a password.

The Action: Check any cheap streaming boxes (SuperBOX, X96Q, MX10, etc.) or smart frames you’ve bought recently. If you can’t verify their security settings or they don't receive regular firmware updates, they are high-risk.

2. Map Your Network

You cannot protect what you cannot see. You need a complete list of every device currently connected to your Wi-Fi or Ethernet.

Log into your Router: Open your browser and type in your router’s IP address (often 192.168.1.1). Look for a tab labeled "Connected Devices," "DHCP Client List," or "Attached Devices."
Identify the Unknowns: If you see a device named "Unknown" or a string of random characters, look at its MAC Address. You can plug this into a MAC Vendor Lookup tool to see who manufactured the internal chip. If it says a manufacturer you don't recognize (like a generic Chinese electronics firm), investigate further.
Use a Network Scanner: Download a tool like Fing (mobile) or Angry IP Scanner (desktop). These tools will scan your local IP range (usually 192.168.1.x) and list every active device.

3. Look for "Residential Proxy" Behavior

Kimwolf monetizes infected devices by selling your bandwidth as a "residential proxy." This means strangers are routing their internet traffic through your house to hide their identity.

Symptoms: * Unexplained spikes in data usage.
- Drastic slowdowns in internet speed.
- Getting "CAPTCHA" prompts more often than usual (because your IP is being flagged for bot-like behavior).
Check Your DNS: Kimwolf often uses DNS-over-TLS or redirects DNS traffic to bypass restrictions. Ensure your router is set to use a trusted DNS provider (like Google 8.8.8.8) and hasn't been tampered with.

5. Secure and Segregate

If you find a suspicious device or simply want to prevent a Kimwolf-style infection, take these steps:

Isolate IoT Devices: If your router supports it, create a "Guest Network" and put all your TV boxes, smart lights, and cameras on it. This prevents a compromised TV box from "tunnelling back" to your main computer or NAS where you store sensitive files.
Disable UPnP: Universal Plug and Play (UPnP) allows devices to automatically open ports on your router. This is a favorite entry point for botnets. Disable it in your router settings.
Kill the Power: If you have one of the cheap Android boxes mentioned in the Krebs report and cannot find a way to disable ADB or update the firmware, the safest move is to stop using it. As the report notes, these devices often come pre-infected at the factory level.

Summary

The Kimwolf botnet thrives on the "internal trust" of home networks. By auditing your connected devices today and moving "dumb" smart gadgets to a segregated guest network, you can ensure your home remains a private sanctuary rather than a node in a global cybercrime machine.

January 2026 - ExploreSec Cybersecurity Threat Intelligence Newsletter

January 7, 2026

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Sneaky2FA Phishing Kit Now Uses Browser-in-the-Browser to Steal Sessions

A recent update to the Sneaky2FA phishing-as-a-service toolkit adds a Browser-in-the-Browser (BITB) fake login window, allowing attackers to harvest both credentials and active session tokens. This setup mimics a legitimate Microsoft login flow, making it difficult for users to spot the deception and enabling attackers to bypass MFA protections.

Key Insights

The phishing flow starts with a bot-protection challenge before displaying a fake Microsoft sign-in page.

Clicking “Sign in” triggers a fake pop-up window that resembles a real browser login prompt.

Attackers capture both credentials and session tokens, enabling full account takeover even when MFA is enabled.

The kit uses obfuscation, domain rotation, and conditional content loading to avoid automated detection.

Further Reading: Push Security

Fake CAPTCHA Triggers 42-Day Ransomware Chain (Unit 42 / Akira ransomware)

Unit 42 analyzed an incident where an employee clicked a fake CAPTCHA checkbox that served as a social-engineering lure. The interaction executed a malicious script that installed a remote-access Trojan, giving attackers an initial foothold. Over the next 42 days, the threat actors escalated privileges, moved laterally, exfiltrated nearly 1 TB of data, deleted backups, and ultimately deployed Akira ransomware — all without being detected until the final stages of the breach.

Key Insights

Fake CAPTCHA and human-verification prompts remain highly effective for initiating malware execution.

Security tooling may log malicious behavior without generating alerts if detection logic is misconfigured.

Once inside, attackers can use common administrative protocols to pivot, compromise privileged accounts, and deploy ransomware.

Weak segmentation, poor credential hygiene, and ineffective alerting significantly expand the blast radius of an initial compromise.

Further Reading: Unit 42

Fake “Calendly” Invites Used to Spoof Major Brands and Hijack Ad Manager Accounts

A phishing campaign is impersonating well-known brands by sending fake Calendly-style meeting invites designed to harvest credentials. The invites lead users to a fraudulent scheduling page, followed by a CAPTCHA and a spoofed login prompt. Attackers target users with access to Google Workspace, Facebook Business, and other advertising platforms, aiming to steal credentials or session tokens and take over ad-manager accounts.

Key Insights

Attackers are weaponizing familiar scheduling tools and trusted brand names to increase credibility.

Fake meeting invites tied to business outreach or job opportunities are being used as lures.

CAPTCHA steps and attacker-in-the-middle techniques help bypass two-factor authentication.

Compromised ad accounts can be abused for unauthorized spending, malvertising, or resale.

Further Reading: BleepingComputer

The Cloudflare Outage May Be a Security Roadmap (Krebs on Security)

A recent Cloudflare outage briefly took major websites and services offline after an internal configuration error disrupted core proxy functions. The event underscored how heavily organizations rely on Cloudflare for bot filtering, traffic routing, and web application protections — and how quickly those defenses can disappear when a single provider experiences a failure.

Key Insights

The outage was triggered by a database permission change that produced a malformed feature file, breaking Cloudflare’s bot-management system.

Organizations lost key protections such as bot mitigation and traffic filtering during the disruption.

Many customers scrambled to reroute DNS or bypass Cloudflare entirely, revealing that fallback plans were often untested.

The incident highlights concentration risk created by dependence on large cloud and CDN providers.

Further Reading: Krebs on Security

PowerShell 5.1 Now Warns Before Executing Scripts from Web Content

Microsoft has updated Windows PowerShell 5.1 so that running Invoke-WebRequest (including the curl alias) against a webpage now triggers a security confirmation prompt. The prompt warns that embedded scripts in the retrieved content could run if processed using the legacy HTML parser. Users must choose to proceed or cancel, and declining halts the action. Using the -UseBasicParsing parameter avoids script execution entirely and prevents the prompt, making it the safer option for automation.

Key Insights

A new confirmation prompt appears when fetching web content that might contain executable scripts.

The -UseBasicParsing parameter avoids script execution and prevents the prompt from interrupting automated workflows.

Legacy HTML parsing now requires explicit user approval when running interactively.

The update reduces the chance of unintentionally executing malicious code embedded in fetched web content.

Further Reading: Microsoft Support

Critical React2Shell Vulnerability (CVE-2025-55182) Exploited in the Wild (Bitdefender)

The critical vulnerability CVE-2025-55182, known as React2Shell, affects React Server Components and frameworks like Next.js. The issue stems from unsafe deserialization in how server-side component payloads are handled, allowing unauthenticated remote attackers to execute arbitrary commands. Since disclosure, exploitation has accelerated, with botnets and automated scanners actively targeting both consumer smart-home infrastructure and cloud-hosted web applications.

Key Insights

The flaw enables unauthenticated remote code execution through crafted requests to vulnerable endpoints.

Attackers have rapidly integrated the exploit into automated campaigns and botnet activity.

React Server Components and major frameworks built on them are widely affected, increasing exposure across modern web stacks.

Observed exploitation often deploys cryptominers, backdoors, or additional post-exploitation tools.

Further Reading: Bitdefender

ConsentFix: Browser-Native OAuth Consent Hijacking

A newly identified phishing technique called ConsentFix combines ClickFix-style interaction tricks with OAuth consent abuse. Attackers direct victims to compromised, high-reputation sites where fake verification prompts are shown. Victims are manipulated into completing a legitimate OAuth authorization flow and then pasting the resulting authorization code into the attacker-controlled page. This grants persistent account access without stealing passwords or bypassing MFA, because the attacker leverages legitimate OAuth mechanisms used by trusted applications such as Azure CLI.

Key Insights

ConsentFix operates entirely within the browser, preventing endpoint security tools from detecting the takeover step.

Victims can be compromised even while already signed in, with no credential or MFA submission required.

The technique abuses inherently trusted OAuth flows from first-party applications.

Delivery via search-engine results and compromised sites bypasses email-focused phishing defenses.

Conditional loading and other evasion tactics make detection significantly harder.

Further Reading: Push Security

OWASP Releases Top 10 Risks and Mitigations for Agentic AI Security (PR Newswire)

The OWASP GenAI Security Project has released its Top 10 for Agentic Applications, a peer-reviewed framework outlining the most critical security risks associated with autonomous and agent-driven AI systems. Developed through more than a year of collaboration with over 100 experts, the list highlights how agentic AI introduces new categories of threats that don’t align with traditional software-vulnerability models, emphasizing risks that emerge when AI systems plan, decide, and act independently.

Key Insights

The Top 10 framework identifies high-impact risk categories such as goal hijacking, privilege misuse, and uncontrolled execution of tools.

Many agentic risks appear early in the workflow, particularly as agents start taking autonomous actions.

The project includes threat models and mitigation strategies to help organizations secure agent-powered systems.

Broad industry participation demonstrates growing urgency around securing agentic AI before widespread adoption.

Further Reading: PR Newswire

Microsoft Teams to Warn of Suspicious External Domain Traffic

Microsoft is introducing an External Domains Anomalies Report for Teams to help administrators detect unusual or risky interactions with external domains. The feature monitors messaging trends — including sudden spikes in traffic, new external domains, or abnormal engagement patterns — to flag potential security threats related to cross-organization communication. This gives IT teams better visibility into external collaboration and can help identify compromised accounts or risky data-sharing behaviors before they escalate.

Key Insights

The report identifies anomalies in message volume and interactions with external domains that may indicate compromised accounts or malicious activity.

Administrators can use the insights to distinguish between legitimate business communication and potential threats.

This feature complements other Teams security enhancements, such as warnings for malicious links and protections against unsafe content.

The rollout is planned globally in early 2026, allowing organizations to prepare for adoption.

Further Reading: Cybersecurity News

Adversary-in-the-Middle (AiTM) Phishing Targeting Microsoft 365 and Okta (Datadog Security Labs)

An active AiTM phishing campaign is targeting organizations that use Microsoft 365 and Okta for single sign-on. The attackers proxy legitimate authentication flows through convincing lookalike pages, preserving branding while intercepting credentials and session cookies. The campaign adapts dynamically, detecting federated environments and redirecting victims to tailored login flows to maximize session hijacking success.

Key Insights

The phishing infrastructure closely mirrors legitimate Microsoft 365 and Okta SSO workflows, increasing user trust.

Client-side scripts are injected to capture credentials and session cookies in real time.

Lookalike domains and anti-automation controls are used to add legitimacy and evade analysis.

Email lures commonly reference employee benefits or compensation themes to prompt interaction.

By acting as a live proxy, the attack can bypass many MFA methods that are not phishing-resistant.

Further Reading: Datadog Security Labs

Access Granted: Phishing Abuse of Device Code Authorization

A new phishing trend is exploiting Device Code Authorization flows — a common method many services use to let users sign in on shared or secondary devices (like TVs) by entering a code shown elsewhere. Attackers are crafting phishing lures that direct victims to fake “authorization” pages where they’re prompted to enter a device code. Once entered, the code links the attacker’s session to the victim’s account, giving the attacker instant access without the victim ever entering credentials or MFA codes.

Key Insights

Attackers misuse legitimate device-code sign-in flows to take over accounts without stealing passwords.

Victims can inadvertently grant access simply by entering a displayed code on a malicious page.

Because no credentials are entered, many defenses (including MFA) don’t block this technique.

This method highlights the importance of educating users about out-of-band authentication flows and confirming unexpected prompts before entering codes.

Further Reading: Proofpoint

Cybercriminals Exploiting .onmicrosoft.com Domains to Launch TOAD Scam Attacks

Cybercriminals are abusing legitimate Microsoft tenant domains that end in “.onmicrosoft.com” to deliver TOAD (Telephone-Oriented Attack Delivery) scams. By sending messages from these trusted-looking domains, attackers can bypass security filters and convince recipients that the communication is associated with Microsoft. Victims are then prompted to call fraudulent support numbers, where they are manipulated into disclosing credentials or other sensitive information.

Key Insights

Default “.onmicrosoft.com” tenant domains are being used to make scam messages appear legitimate.

The trusted reputation of these domains helps attackers evade email and messaging security controls.

Victims are often directed to call fake support numbers rather than click links.

The activity demonstrates how legitimate cloud infrastructure can be repurposed to support social-engineering campaigns.

Further Reading: Cybersecurity News

Insider Threats: Hackers Paying Company Insiders to Bypass Security (Hackread)

Threat actors are increasingly turning to insider recruitment to bypass organizational security controls. Instead of exploiting vulnerabilities from the outside, criminal groups are offering employees direct payments in exchange for internal access, sensitive data, or assistance disabling safeguards. These efforts are commonly advertised through underground forums and private messaging channels and span multiple industries, including finance, technology, and cloud services.

Key Insights

Criminal groups are offering cash payments for insider assistance, often for one-time access or specific data.

Recruitment tactics may include appeals to financial stress or dissatisfaction with work.

Insider access can allow attackers to sidestep defenses such as MFA, logging, and monitoring tools.

The trend shows a shift toward human-based attack paths rather than purely technical exploitation.

Further Reading: Hackread

Calendar-Invite Phishing Campaigns Use Meeting Invites as Lures

Attackers are increasingly using fake calendar invitations as a phishing vector. These malicious invites may arrive by email or through synced calendar apps, often appearing to come from familiar contacts or trusted services. When a recipient interacts with the invite — for example, by clicking a link to join a “meeting” — they can be led to spoofed login pages designed to harvest credentials or other sensitive information. This technique leverages the trust people place in calendar events and routine scheduling workflows to bypass skepticism.

Key Insights

Malicious invites look like legitimate meeting requests: Attackers spoof sender names and use familiar branding to increase credibility.

Links in calendar events can lead to credential-harvesting sites: Clicking “Join” or related links may redirect users to phishing pages.

Attackers abuse calendar sync and notification features: Because events often appear automatically on connected devices, users may interact without verifying the source.

This technique blends social engineering with platform abuse: It takes advantage of the routine nature of scheduling to reduce suspicion.

Further Reading: HoxHunt

Google Malvertising Attack Uses Search Ads to Deliver Phishing and Malware

A recently analyzed campaign showed how attackers are abusing Google Search Ads to distribute malicious redirects and phishing lures. Instead of relying on compromised websites or email alone, the adversary purchased search ad placements that appeared for high-traffic queries. When users clicked these ads, they were taken through a chain of redirects and deceptive pages that ultimately led to credential-harvesting forms or malware delivery. Because the initial entry point came from legitimate ads, many victims didn’t suspect the content was malicious — and traditional web-filtering tools often trust paid search results by default.

Key Insights

Malicious actors are buying legitimate search ad placements for popular queries to maximize reach.

Clicking the ad triggers redirects and cloaked landing pages that conceal the malicious intent until the final stage.

Credential harvesting and malware downloads are delivered through deceptive page flows that mimic real services.

Because the initial interaction comes from an ad, users may trust the link more than typical phishing emails or unknown sites.

Further Reading: Push Security

BlackForce Phishing Kit Technical Analysis (Zscaler)

A recent technical analysis of the BlackForce phishing kit reveals it’s a highly customizable and modular phishing-as-a-service (PhaaS) offering that enables attackers to rapidly deploy credential harvesting campaigns against a variety of targets. The kit supports multiple social-engineering motifs, dynamic content generation, and advanced obfuscation techniques, making it difficult for security tooling to detect at scale. BlackForce has been linked to campaigns that target enterprise single-sign-on portals, cloud services, and financial platforms by replicating legitimate login flows while capturing credentials and session tokens.

Key Insights

BlackForce is modular, allowing attackers to tailor templates to mimic specific services and bypass naive detection based on static indicators.

It uses dynamic content delivery and URL rotation to avoid pattern-based detection and evade automated scanners.

The kit captures not only user credentials but also session tokens, enabling broader account takeover when paired with weak or non-phishing-resistant MFA.

BlackForce campaigns often use additional obfuscation layers and intermediary redirects to hide phishing infrastructure and make takedown more difficult.

Because of its ease of deployment and adaptability, BlackForce has proliferated in underground markets, lowering the bar for threat actors to launch sophisticated phishing attacks.

Further Reading: Zscaler

Top Phishing Trends for 2025

Security researchers have identified several key phishing trends that defined 2025 — highlighting how attackers continue to evolve both their techniques and delivery mechanisms. These trends emphasize that phishing is no longer confined to simple email links, but increasingly combines social engineering with platform abuse, deceptive flows, and legitimate-looking vectors to bypass defenses and capture credentials, session tokens, and MFA responses.

Key Insights

Browser-in-the-Browser (BITB) attacks remain prevalent, using fake pop-ups that mimic legitimate login dialogs to harvest credentials and active sessions.

Consent-based abuse techniques are growing, where attackers trick users into granting OAuth consent or other permissions that grant access without passwords.

Search-engine and ad-based delivery shows attackers buying and manipulating legitimate channels to increase reach and bypass filters.

Fake verification flows (CAPTCHAs, device codes, and human-verification prompts) continue to be effective in tricking users into executing commands or authorizing access.

AiTM and proxy-style phishing remains a persistent threat, capturing session tokens even when MFA is present.

Further Reading: Push Security

Access-Granted Phishing Abuse of Device Code Authorization (Proofpoint)

Threat actors are increasingly exploiting device code authorization flows — a method used by many online services to let users sign in on secondary or shared devices by entering a short code. In this abuse pattern, phishing lures direct victims to fake authorization pages where they’re prompted to enter a code. When the code is submitted, the attacker’s session becomes linked to the victim’s account, giving the attacker access without the victim ever entering credentials or MFA data.

Key Insights

Attackers misuse legitimate device-code sign-in flows to take over accounts without stealing passwords.

Victims can inadvertently grant access simply by entering a displayed code on a malicious page.

Because no credentials are entered, many defenses — including MFA — don’t block this technique.

This method highlights the need to educate users about out-of-band authentication prompts and to verify unexpected requests before entering codes.

Further Reading: Proofpoint

Phishing Campaign Abuses Google Cloud Automation to Evade Detection (Check Point)

Researchers have identified a phishing campaign that misuses legitimate Google Cloud automation features to distribute phishing emails at scale. By sending messages through trusted Google infrastructure, attackers make their lures appear authentic and bypass reputation-based email defenses. The emails mimic routine enterprise notifications and route victims through trusted cloud services before redirecting them to credential-harvesting pages.

Key Insights

Legitimate cloud automation capabilities are being repurposed to send phishing emails from trusted infrastructure.

Familiar enterprise notification themes are used to lower suspicion and encourage interaction.

Initial links often pass through trusted cloud services before redirecting to phishing pages.

The technique demonstrates how workflow and automation features can be abused to increase phishing success and evade detection.

Further Reading: Check Point

Malicious npm Packages Used as Phishing Infrastructure to Steal Credentials (The Hacker News)

Researchers uncovered a targeted campaign in which attackers published 27 malicious packages to the npm registry and abused the platform’s content-delivery infrastructure to host phishing pages. Rather than distributing malware through package installation, the attackers used npm-hosted resources to serve HTML and JavaScript lures that impersonated document-sharing portals and Microsoft sign-in flows. The campaign primarily targeted sales and commercial personnel across multiple industries.

Key Insights

Malicious npm packages were used as hosting infrastructure for phishing content rather than for delivering code via installation.

Phishing pages mimicked trusted services to capture user credentials.

Anti-analysis techniques such as bot filtering and obfuscated scripts were used to hinder detection.

Some infrastructure overlapped with adversary-in-the-middle phishing tooling.

The activity demonstrates how open-source ecosystems can be abused as resilient platforms for phishing operations.

Further Reading: The Hacker News

Shai-Hulud 3.0 Supply Chain Worm Emerges

Researchers have identified a new variant of the Shai-Hulud npm supply chain worm, commonly referred to as Shai-Hulud 3.0 or “The Golden Path.” This iteration builds on earlier versions by maintaining install-time execution within compromised packages while improving stealth, reliability, and compatibility across environments. Current observations suggest the activity may represent testing or refinement rather than a large-scale outbreak.

Key Insights

Shai-Hulud 3.0 continues the use of malicious install scripts that execute automatically during dependency installation.

The updated variant emphasizes improved error handling and cross-platform execution.

Credential harvesting from developer systems and CI/CD environments remains a core objective.

Indicators suggest the activity may be exploratory or preparatory ahead of a broader campaign.

Further Reading: Snyk

2025 CVE Data Review and Trends

A review of 2025 CVE data shows the highest volume of publicly disclosed vulnerabilities on record, with more than 48,000 CVEs published during the year. While overall severity distribution remained relatively consistent with prior years, the sheer scale of disclosures continues to complicate vulnerability management and prioritization efforts. The analysis also highlights how web application flaws and third-party ecosystems are driving much of the growth.

Key Insights

2025 set a new record for CVE disclosures, continuing a multi-year upward trend.

A large share of vulnerabilities fell into medium and high severity ranges, increasing triage pressure.

Web application issues such as cross-site scripting and injection remain the most common weakness classes.

Third-party and plugin ecosystems contributed significantly to overall CVE volume.

Disclosure activity showed uneven distribution throughout the year, with spikes tied to coordinated releases.

Further Reading: Jerry Gamblin

January 2026 - ExploreSec Cybersecurity Awareness Newsletter

January 6, 2026

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Fake “Calendly” Invites Used to Spoof Major Brands and Hijack Ad Manager Accounts

Key Insights

Attackers are weaponizing familiar scheduling tools and trusted brand names to increase credibility.

Fake meeting invites tied to business outreach or job opportunities are being used as lures.

CAPTCHA steps and attacker-in-the-middle techniques help bypass two-factor authentication.

Compromised ad accounts can be abused for unauthorized spending, malvertising, or resale.

Further Reading: BleepingComputer

Cybercrime Goes SaaS: Renting Tools, Access, and Infrastructure

Cybercriminals are increasingly operating like SaaS providers, offering subscription-based access to phishing kits, info-stealer data, malware loaders, OTP bots, and even compromised network access. This model lowers the technical barrier for newcomers, enabling less skilled attackers to run large-scale campaigns using ready-made tools and infrastructure.

Key Insights

Phishing-as-a-service operations provide complete kits and delivery mechanisms for recurring fees.

Marketplaces now sell ongoing access to stolen credentials and session tokens as if they were data feeds.

Initial-access brokers rent out compromised systems or credentials, giving threat actors an immediate foothold.

Malware, RATs, and exploit kits can be purchased through short-term subscriptions for quick deployment.

Further Reading: BleepingComputer

California’s New Browser Privacy Requirement Could Have Nationwide Effects

California’s upcoming “Opt Me Out” requirement will mandate that web browsers include a built-in setting allowing users to automatically signal that their data should not be sold or shared. While designed for California residents, browser makers are expected to roll this out broadly, which could result in nationwide changes to how websites handle data privacy and tracking.

Key Insights

Browsers will be required to include a simple, user-accessible opt-out preference toggle.

Once enabled, the browser will automatically send a data-privacy opt-out signal to every site visited.

Industry experts anticipate browsers will implement this globally to avoid patchwork configurations.

Websites and advertisers will need to honor these opt-out signals, affecting tracking and targeted advertising models.

Further Reading: The Record

Storm-0900 Uses Fake Parking Tickets to Deliver Malware

A recent campaign by Storm-0900 sent fake parking-ticket notices and fabricated medical-alert messages to lure people into interacting with a malicious site. The attackers used a bogus CAPTCHA page as the trigger for delivering XWorm, a remote-access malware designed for credential theft, surveillance, and persistent access.

Key Insights

Attackers used urgent, familiar themes (parking violations, medical alerts) to increase engagement.

The malicious flow relied on a fake CAPTCHA page that initiated the malware delivery.

XWorm provides remote-access capabilities that enable data theft and long-term compromise.

The campaign shows continued use of real-world pretexts tied to everyday tasks to improve success rates.

Further Reading: Cybersecurity News

Threat Actors Exploit Foxit PDF Reader to Deliver Malware

A recent campaign is targeting job-seekers with fake recruitment documents packaged in ZIP or RAR archives. The files impersonate a legitimate Foxit PDF Reader executable, but launching them triggers a multi-stage malware chain that ultimately installs ValleyRAT, enabling remote access and data theft.

Key Insights

Attackers disguise a malicious executable as a trusted PDF reader to increase the likelihood of execution.

The infection sequence uses DLL side-loading and hidden Python components to download and run ValleyRAT.

ValleyRAT provides attackers with credential theft, surveillance, and persistent remote-access capabilities.

The campaign relies heavily on social engineering, using job-themed lures to target individuals likely to open unfamiliar files.

Further Reading: Cybersecurity News

Phishing Attack Leveraging Microsoft Teams Notifications

A recent campaign abuses Microsoft Teams by adding users to fake Teams groups with names referencing invoices, payments, or account issues. The groups generate legitimate-looking Teams notification emails that prompt users to call a fraudulent support number. Because the messages originate from trusted Teams infrastructure, they are more likely to pass filtering and appear credible.

Key Insights

Attackers exploit trust in collaboration platforms by using Teams notifications instead of traditional phishing emails.

Notification emails appear legitimate, increasing the chances they bypass security filters.

The campaign uses callback phishing, directing victims to call a phone number where attackers extract sensitive information.

The technique shows how platform misuse and social engineering can blend to create effective phishing without malicious links or files.

Further Reading: Cybersecurity News

PowerShell 5.1 Now Warns Before Executing Scripts from Web Content

Key Insights

A new confirmation prompt appears when fetching web content that might contain executable scripts.

The -UseBasicParsing parameter avoids script execution and prevents the prompt from interrupting automated workflows.

Legacy HTML parsing now requires explicit user approval when running interactively.

The update reduces the chance of unintentionally executing malicious code embedded in fetched web content.

Further Reading: Microsoft Support

ConsentFix: Browser-Native OAuth Consent Hijacking

Key Insights

ConsentFix operates entirely within the browser, preventing endpoint security tools from detecting the takeover step.

Victims can be compromised even while already signed in, with no credential or MFA submission required.

The technique abuses inherently trusted OAuth flows from first-party applications.

Delivery via search-engine results and compromised sites bypasses email-focused phishing defenses.

Conditional loading and other evasion tactics make detection significantly harder.

Further Reading: Push Security

Is Your Android TV Streaming Box Part of a Botnet?

An investigation has uncovered that many low-cost Android TV streaming boxes are being shipped with hidden malware that quietly enrolls devices into botnets. These compromised devices can be used for large-scale ad fraud, proxy abuse, credential stuffing, and other criminal activity — often without any visible signs to the owner. The issue largely affects off-brand devices sold online that run modified versions of Android and receive little to no security updates.

Key Insights

Some Android TV boxes arrive pre-infected, meaning users are compromised immediately after setup.

Infected devices are commonly abused as residential proxies or for ad fraud operations.

The malware is deeply embedded, making removal difficult or impossible without replacing the device.

Affected devices often lack proper update mechanisms or certification, increasing long-term risk.

Further Reading: Krebs on Security

Uncovering a Calendly-Themed Phishing Campaign

A recent phishing campaign uses fake Calendly-style scheduling pages to trick users into surrendering their credentials. Instead of a legitimate meeting invite, victims are shown a cloned scheduling interface that prompts them to log in with their corporate credentials. Behind the scenes, the attacker captures those credentials — and often MFA tokens or session cookies — enabling full account takeover or further abuse.

Key Insights

The phishing lure mimics familiar scheduling tools to lower users’ skepticism and increase the likelihood of interaction.

Attackers often pair fake scheduling pages with urgent or compelling text (e.g., job interviews, client meetings) to induce hasty responses.

The cloned interfaces capture credentials and may also harvest session data or MFA tokens for deeper access.

Because the page appears legitimate — complete with branding and typical UI elements — it can evade cursory inspection by users.

Further Reading: Push Security

Access Granted: Phishing Abuse of Device Code Authorization

Key Insights

Attackers misuse legitimate device-code sign-in flows to take over accounts without stealing passwords.

Victims can inadvertently grant access simply by entering a displayed code on a malicious page.

Because no credentials are entered, many defenses (including MFA) don’t block this technique.

This method highlights the importance of educating users about out-of-band authentication flows and confirming unexpected prompts before entering codes.

Further Reading: Proofpoint

SMS Phishers Pivot to Points, Taxes, and Fake Retailers

A surge in SMS phishing (smishing) campaigns is using new lures — including rewards-points alerts, tax refund notices, and “order issues” from well-known retailers — to trick recipients into clicking malicious links. These texts are crafted to look like legitimate communications from brands or government agencies, and they direct users to spoofed login pages or fake offers designed to capture credentials or financial information. The shift shows how attackers are evolving beyond traditional banking scams to exploit trends and behaviors that feel more routine or beneficial to users.

Key Insights

Smishing campaigns now leverage enticing themes such as reward-points expirations and tax refund notifications to increase engagement.

Fake retail order alerts capitalize on widespread online shopping habits.

Malicious links often lead to spoofed web pages that harvest credentials or sensitive personal data.

Users are more likely to click when the message appears tied to a known brand or potential benefit.

Further Reading: Krebs on Security

Android Expands Pilot for In-Call Scam Protection for Financial Apps

Google is expanding its Android in-call scam protection pilot specifically for interactions involving financial applications. This feature aims to intercept and block scam calls that impersonate banks, payment services, or other financial institutions before they reach users. By analyzing call metadata and patterns, the protection can warn users or automatically prevent known scam call types — reducing the likelihood that someone answers a phone-based phishing or social-engineering attempt targeting financial credentials or sensitive data.

Key Insights

The expanded pilot focuses on identifying and blocking scam calls tied to financial apps and services.

By analyzing characteristics of known scam call patterns, Android can warn users before an interaction begins.

Preventing scam calls before they connect reduces the success of phone-based social engineering and credential harvesting.

This feature builds on broader Android protections that aim to reduce unwanted and malicious communications.

Further Reading: Google Security Blog

Cybercriminals Exploiting .onmicrosoft.com Domains to Launch TOAD Scam Attacks

Key Insights

Default “.onmicrosoft.com” tenant domains are being used to make scam messages appear legitimate.

The trusted reputation of these domains helps attackers evade email and messaging security controls.

Victims are often directed to call fake support numbers rather than click links.

The activity demonstrates how legitimate cloud infrastructure can be repurposed to support social-engineering campaigns.

Further Reading: Cybersecurity News

Calendar-Invite Phishing Campaigns Use Meeting Invites as Lures

Key Insights

Malicious invites look like legitimate meeting requests: Attackers spoof sender names and use familiar branding to increase credibility.

Links in calendar events can lead to credential-harvesting sites: Clicking “Join” or related links may redirect users to phishing pages.

Attackers abuse calendar sync and notification features: Because events often appear automatically on connected devices, users may interact without verifying the source.

This technique blends social engineering with platform abuse: It takes advantage of the routine nature of scheduling to reduce suspicion.

Further Reading: HoxHunt

Google Malvertising Attack Uses Search Ads to Deliver Phishing and Malware

Key Insights

Malicious actors are buying legitimate search ad placements for popular queries to maximize reach.

Clicking the ad triggers redirects and cloaked landing pages that conceal the malicious intent until the final stage.

Credential harvesting and malware downloads are delivered through deceptive page flows that mimic real services.

Because the initial interaction comes from an ad, users may trust the link more than typical phishing emails or unknown sites.

Further Reading: Push Security

Top Phishing Trends for 2025

Key Insights

Browser-in-the-Browser (BITB) attacks remain prevalent, using fake pop-ups that mimic legitimate login dialogs to harvest credentials and active sessions.

Consent-based abuse techniques are growing, where attackers trick users into granting OAuth consent or other permissions that grant access without passwords.

Search-engine and ad-based delivery shows attackers buying and manipulating legitimate channels to increase reach and bypass filters.

Fake verification flows (CAPTCHAs, device codes, and human-verification prompts) continue to be effective in tricking users into executing commands or authorizing access.

AiTM and proxy-style phishing remains a persistent threat, capturing session tokens even when MFA is present.

Further Reading: Push Security

Most Parked Domains Now Serving Malicious Content

Security researchers report that a majority of parked domains — web addresses registered but not actively used for legitimate content — are now repurposed to serve malicious material. Cybercriminals are leveraging these unused or abandoned domains to host deceptive content that can deliver malware, phishing pages, or exploit kits. Because these domains often lack reputation and oversight, they present a growing risk to users who accidentally visit them through typos, shady links, or bundled ad networks.

Key Insights

A significant portion of parked domains are now used to host malicious content rather than benign placeholders.

These domains often serve phishing pages, malware downloads, or exploit kits designed to compromise visitors.

Users may encounter these threats through typosquatting, low-quality ads, or obscure links.

Because parked domains typically lack established reputation, traditional filtering and reputation systems can struggle to detect and block them effectively.

Further Reading: Krebs on Security

The Kimwolf Botnet Is Stalking Local Networks

The Kimwolf botnet highlights how modern botnets are expanding beyond traditional IoT targets to compromise consumer-grade devices such as Android TV boxes, set-top boxes, and other smart devices. Once infected, these systems are folded into a large distributed botnet and can be abused for activities like DDoS attacks and proxying traffic into private networks, weakening the assumption that home and small-office networks are naturally isolated.

Key Insights

Consumer devices are being mass-compromised and used as nodes in a large botnet.

Infected devices can act as residential proxies, allowing attackers to route traffic into local networks.

Weak default configurations, such as exposed debugging services, contribute to large-scale compromise.

The botnet demonstrates resilience through adaptable infrastructure and recovery after disruption.

Further Reading: Krebs on Security

What is React2Shell and how to respond

January 5, 2026

This blog post is based on Exploring Information Security episode 256. Gemini created the first draft and a human edited it for publication.

Last month saw the disclosure of CVE-2025-55182, nicknamed React2Shell. It Boasts a rare CVSS score of 10.0. The vulnerability allows unauthenticated Remote Code Execution (RCE) in the React Server Components (RSC) ecosystem.

As we enter 2026, the situation continues to escalate. What began as targeted state-sponsored activity has transformed into a high-volume, automated "exploit shotgun" campaign by global botnets.

The Technical Reality: Logic Abuse, Not Just a Bug

At its core, React2Shell is an unsafe deserialization flaw residing in the RSC "Flight" protocol. When a server processes a request for a Server Component, it parses a payload to reconstruct internal program structures. The vulnerable packages—specifically react-server-dom-webpack, parcel, and turbopack—fail to validate this incoming data.

How the vulnerability is exploited:

Promise Hijacking: Attackers craft a fake "Chunk" object with a custom .then() method.
Execution: When the Node.js server attempts to resolve this object as a Promise, it inadvertently executes the attacker's code.
Full Access: Because this occurs within the Node.js context, the attacker gains full access to the process, the filesystem, and sensitive environment variables like database credentials and API keys.

New Development: The "Exploit Shotgun" (RondoDox Botnet)

By late December 2025, the threat landscape shifted. The RondoDox botnet has operationalized React2Shell as a primary initial access vector. Using an automated "exploit shotgun" approach, RondoDox fires multiple exploits at servers to see which succeed, with researchers observing up to 150,000 daily exploit attempts.

Once a Next.js server is compromised, the botnet typically:

Deploys the /nuts/bolts loader to purge the host of competing malware.
Installs the /nuts/poop cryptocurrency miner.
Establishes persistence via Mirai-derived variants like /nuts/x86 to maintain a foothold even if the application is later restarted.

The Denial-of-Service Variant (CVE-2025-55184)

In addition to the RCE, researchers have identified CVE-2025-55184, a React Function Denial-of-Service flaw.7 By sending a crafted payload containing a cyclic promise reference, an attacker can force the Node.js runtime into infinite recursion.7 This freezes the server indefinitely and prevents it from yielding back to the event loop, effectively taking the application offline.7

A Vulnerable Ecosystem: Widespread Impact

The pervasiveness of this flaw cannot be overstated. A standard Next.js project created using create-next-app is exploitable in its default configuration.8 By the end of 2025, nearly 90,000 systems were still identified as vulnerable.

Furthermore, this crisis coincides with a volatile npm supply chain environment. The Shai-Hulud Worm, a self-replicating npm malware, recently compromised over 180 packages to steal GitHub secrets and drain millions in cryptocurrency. These events together highlight a dangerous trend of targeting developers and JavaScript-based infrastructure to bypass traditional security perimeters.

Your Action Plan: January 2026 Update

If your application was online and unpatched during December 2025, you must assume breach. Post-exploitation activity has already included reverse shells to Cobalt Strike servers and the harvesting of high-value AI credentials, such as OpenAI API keys and Kubernetes tokens.

Step 1: Identify Affected and Compromised Assets

The first priority is gaining visibility into your exposure. You cannot patch what you cannot find.

Manual Inventory: Navigate to your project's node_modules folder and check for react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack. Versions 19.0.0 through 19.2.0 are vulnerable.
Automated Scanning: Use the open-source CLI tool npx react2shell-guard or npx react2shell-scanner to detect vulnerable dependencies across local repositories, container images, and live URLs.
Audit Web Logs: Search your server access logs for signs of active probing. Look for HTTP POST requests containing the next-action or rsc-action-id headers. Filter for request bodies containing $@ patterns or the string "status":"resolved_model".
Detect Post-Exploitation: Hunt for suspicious processes spawned by Node.js, such as unexpected reconnaissance commands like whoami, id, uname, or attempts to read /etc/passwd. Watch for unusual file writes to the /tmp/ directory, such as pwned.txt or botnet-related binaries.
Scan for Supply Chain Indicators: Search for files like setup_bun.js and bun_environment.js, which are leading indicators of a Shai-Hulud 2.0 infection in your build environment.

Step 2: Patch Immediately (Updated Versions)

Patching requirements have evolved to address both RCE and DoS variants:

Step 3: Rotate All Secrets

Successful exploitation grants access to environment variables. You must rotate all API keys (especially Cloud and AI providers), database credentials, and service tokens accessible to the vulnerable process.

Step 4: Audit for Persistence

Check for unauthorized files in /tmp, newly created users, or modified authorized_keys files. Monitor for suspicious outgoing connections to known botnet infrastructure.

Conclusion

React2Shell is the "Log4Shell of the Frontend." As we continue to move critical logic to the server, we must treat every deserialization boundary as a potential gateway for total compromise.

The React2Shell vulnerability (CVE-2025-55182) has fundamentally altered the threat profile of modern JavaScript web applications. As the "Log4Shell of the Frontend," it marks a paradigm shift where vulnerabilities previously restricted to the client side have moved directly to the server, granting unauthenticated attackers a "master-key" to total infrastructure compromise .

The speed of weaponization—with sophisticated China-nexus actors and industrialized botnets like RondoDox launching over 150,000 exploit attempts daily—underscores that patching is no longer a scheduled task but an emergency survival protocol . The simultaneous rise of the Shai-Hulud worm further emphasizes that the security of the modern web is only as strong as its deepest transitive dependency .

Remediation must go beyond simple code updates; it requires a comprehensive "assume breach" response, including the rotation of cloud and AI credentials and a forensic audit of CI/CD environments .

Resources

China-nexus cyber threat groups rapidly exploit React2Shell ... - AWS, accessed December 12, 2025, https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
How react2shell-guard Gives Devs a Practical Response Plan | by am | IT Security In Plain English | Dec, 2025, accessed December 12, 2025, https://medium.com/it-security-in-plain-english/how-react2shell-guard-gives-devs-a-practical-response-plan-5f86b98c44e4
CVE-2025-55182 – React Server Components RCE via Flight ..., accessed December 12, 2025, https://www.offsec.com/blog/cve-2025-55182/
Security Advisory: Critical RCE Vulnerabilities in React Server Components & Next.js - Snyk, accessed December 12, 2025, https://snyk.io/blog/security-advisory-critical-rce-vulnerabilities-react-server-components/
React2Shell flaw (CVE-2025-55182) exploited for remote code execution, accessed December 12, 2025, https://news.sophos.com/en-us/2025/12/11/react2shell-flaw-cve-2025-55182-exploited-for-remote-code-execution/
Detecting React2Shell: The maximum-severity RCE Vulnerability affecting React Server Components and Next.js | Sysdig, accessed December 12, 2025, https://www.sysdig.com/blog/detecting-react2shell
CVE-2025-55182 - CVE Record, accessed December 12, 2025, https://www.cve.org/CVERecord?id=CVE-2025-55182
React2Shell (CVE-2025-55182): Critical React Vulnerability | Wiz Blog, accessed December 12, 2025, https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182
React2Shell Security Bulletin | Vercel Knowledge Base, accessed December 12, 2025, https://vercel.com/react2shell
React2Shell and related RSC vulnerabilities threat brief: early ..., accessed December 12, 2025, https://blog.cloudflare.com/react2shell-rsc-vulnerabilities-exploitation-threat-brief/
CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos ..., accessed December 12, 2025, https://www.trendmicro.com/en_us/research/25/l/CVE-2025-55182-analysis-poc-itw.html
React2Shell: Decoding CVE-2025-55182 – The Silent Threat in React Server Components, accessed December 12, 2025, https://blog.qualys.com/product-tech/2025/12/10/react2shell-decoding-cve-2025-55182-the-silent-threat-in-react-server-components
Serious React2Shell Vulnerabilities Require Immediate Attention, accessed December 12, 2025, https://www.sonatype.com/blog/react2shell-rce-vulnerabilities-require-immediate-attention
React2Shell and the Case for Deception in Your Vulnerability Management Program, accessed December 12, 2025, https://www.zscaler.com/blogs/product-insights/react2shell-and-case-deception-your-vulnerability-management-program

The Exploring Information Podcast Top 10 Podcast Episodes of 2025

December 31, 2025

In 2025, the cybersecurity landscape shifted from "theoretical risk" to "operational reality." This was reflected in the listening habits of the Exploring Information Security community, where the most-consumed content focused on the internal mechanics of cybercrime and the emerging threats of the AI era.

To create the list this year, I looked at the data from two distinct data sets Apple Podcasts and the views on YouTube. Then I threw those into Gemini and had it spit out the Top 10 episodes for this year.

The Top 10 Episodes:

1. How Do Ransomware Gangs Work? (Kyle Andrus)

The Global #1: This was the undisputed heavyweight champion of 2025. It resonated because it stripped away the "hooded hacker" myth and showed ransomware for what it is: a highly organized, corporate-style business.

Key Insight: Cybercriminal groups now have HR departments, performance reviews, and 24/7 customer support.

2. Hacking Space Systems: Inside Tempest (Tim Fowler)

The Visual Standout: While popular on audio, this exploded on YouTube. Tim Fowler’s "Tempest" CubeSat project gave the community a rare, hands-on look at the vulnerabilities in our satellite infrastructure.

Key Insight: Space is simply the newest extension of the internet—and it’s just as vulnerable.

3. Exploring the Rogue AI Agent Threat (Sam Chehab)

The 2025 Trend-Setter: This episode caught the "AI anxiety" wave perfectly. It identified a new attack vector: sanctioned AI agents that go "rogue" due to over-privileged API permissions.

Key Insight: Your biggest AI threat isn't a malicious outsider; it's a misconfigured internal tool with too much power.

4. Real-World Windows Forensics & IR (JC)

The Technical Masterclass: A staple for practitioner reference. JC’s breakdown of forensic artifacts remains one of the most shared episodes among SOC analysts and incident responders.

Key Insight: Digital detective work is about meticulous troubleshooting and pattern recognition.

5. NDR with Corelight (Brian Dye)

The Visibility Anchor: As perimeter defenses failed throughout 2025, the industry turned to Network Detection and Response. This episode became the standard guide for understanding the power of open-source Zeek telemetry.

Key Insight: In 2025, if you can't see your network traffic in real-time, you've already lost.

6. Monitoring the Inner Workings of a Cybercriminal Org (Matthew Maynard)

The Intelligence Deep-Dive: This served as the perfect companion to Rank #1. Matthew Maynard provided the "how-to" for researchers looking to safely infiltrate and monitor threat actor communities.

Key Insight: Effective threat intelligence requires a mix of technical OSINT and a deep understanding of criminal psychology.

7. Info Stealers and Supply Chain Attacks (Kyle Andrus)

The Credential Crisis: This episode highlighted why MFA alone isn't enough anymore. It focused on the rise of "session hijacking" and the commodity market for stolen employee tokens.

Key Insight: The supply chain is only as strong as the browser session of your most privileged administrator.

8. How to Implement a Content Security Policy (Jason Gillam)

The Developer’s Choice: A highly technical and practical episode that broke down the stats on why most CSPs fail. It’s the "how-to" guide that many listeners used to harden their own web applications.

Key Insight: Security shouldn't be a "bolt-on"—it needs to be built into the code using modern headers like CSP.

9. Gamifying Your Incident Response Playbook (Anushree Vaidya)

The Engagement Winner: This episode stood out for its unique approach to a dry topic. Anushree's method of using game mechanics to train IR teams saw a massive spike in social media sharing and community interaction.

Key Insight: People don't learn from boring slide decks; they learn from immersive, high-stakes simulations.

10. 2025 State of the API Report (Postman)

The Data-Driven Wrap-Up: Rounding out the top 10, this provided the statistical backbone for the year. It confirmed that the explosion of AI has made API security the most critical battleground for security engineers.

Key Insight: 2025 was the year the API became the "limbs" of the AI brain, creating a massive new attack surface.

What was your favorite episode from this past year. Leave a comment below.

Making Security Stick: Lessons from Cybersecurity Awareness Month

December 30, 2025

This blog post was created based on episode 253 of the Exploring Information Security podcast. Gemini created the first draft and a human edited it for publication.

Every October, the cybersecurity community rallies for Cybersecurity Awareness Month—a concentrated effort to bring security behaviors to the forefront of the corporate mind. But as any practitioner knows, getting thousands of employees to care about passwords and phishing is as much an art as it is a science.

In a recent episode of the Exploring Information Security podcast, I sat down with security awareness experts Maeve Mueller to discuss the logistics, the experiments, and the "human risk" of modern awareness programs. While Cybersecurity Awareness Month has already based it’s never too early to start thinking about next year.

Beyond the PowerPoint: Creative Engagement

The consensus is clear: "death by PowerPoint" is the fastest way to lose an audience. Instead, practitioners should turn to gamification and high-impact demonstrations to make lessons stick.

Mythbusters & Live Cracking: Mueller’s team found success with a "Cybersecurity Mythbusters" presentation, where they disproved common misconceptions and used live password-cracking demonstrations to show how quickly a weak password can be compromised in a real data breach.
"Pitch a Phish" Contests: Rather than just being the targets, employees at Mueller's organization were invited to create their own phishing emails to dupe a fictional persona named "Mimi Click". This role reversal turned the tables and encouraged participation by letting teammates "phish" the security team.
Watch and Win: De Block experimented with a marathon-style "Watch and Win" contest, offering prizes to anyone who completed over nine hours of popular security training modules. Despite the length, over 500 employees finished the entire series.

The Logistics of "Food and Swag"

While digital events are scalable, in-person events remain a priority for leadership. However, these come with significant "hidden" time costs in planning and cleanup.

Mueller utilized booths in office lobbies, handing out swag like screen cleaning cloths and info cards. To draw the crowd, they used the ultimate motivator: food. While in another country for a security awareness event, she used candy from the US with clever puns, like "Smarties" (because smart people are cyber-secure).

Food is the best way to fill a room. The challenge, however, is the registration gamble—knowing exactly how much food to buy without running out and leaving attendees without food.

The Shift to "Human Risk Management"

The industry is currently seeing a shift in terminology from "security awareness" toward Human Risk Management (HRM).

HRM seeks to use data science and telemetry to look at the "full person"—analyzing how they respond to training, phishing simulations, and real-world incidents to build a more accurate risk profile. While the term is "HR-adjacent," it reflects a deeper need to manage behaviors rather than just providing information.

Final Thoughts: Awareness is a Year-Round Mission

The ultimate goal of October isn't to be a one-off event, but a "launching pad" for year-round security habits. As Mueller pointed out, "October is just one time to bring it to the forefront of your mind, but this is important every single month".

For those with limited resources, the experts recommend starting small. You don't need a daily blog post or a full-blown event schedule to make an impact. Even reaching just one or two teammates and helping them secure their personal lives—which inevitably bleeds into their professional behavior—is a win for the security team.

The New Perimeter: Why Identity is the Last Line of Defense in a Zero Trust World

December 26, 2025

This is a blog post based on the transcript from episode 251 of the Exploring Information Security podcast. It was created with the help of Gemini and edited by a human.

In the early days of networking, security was relatively straightforward: you built a wall around your data center and managed a single directory for your users. Today, that perimeter has vanished. With the explosion of cloud environments, federated access, and a mobile workforce, identity has become the new perimeter—and the primary target for modern cybercriminals.

In a recent episode of the Exploring Information Security podcast, Matt Topper, President of UberEther, joined me to discuss the evolving landscape of Identity and Access Management (IAM) and why a true Zero Trust strategy is more critical than ever.

The Identity Crisis: Beyond GRC

For years, many organizations viewed Identity and Access Management primarily through the lens of Governance, Risk, and Compliance (GRC)—a box to be checked for auditors. However, as Topper points out, the modern threat landscape has shifted IAM firmly into the center of security operations.

Legitimate credentials are now the easiest and most effective way for attackers to gain access to an environment. Whether through social engineering, purchasing leaked credentials on Telegram, or bribing disgruntled employees, once an attacker has a legitimate identity, they can bypass most traditional security tools and move laterally through a network.

Zero Trust vs. "VPN 2.0"

While "Zero Trust" has been a buzzword for over a decade, Topper warns that many organizations are falling into the trap of implementing what he calls "VPN 2.0". They deploy a new client to connect to services but fail to address the core pillars of a true Zero Trust architecture.

A robust Zero Trust strategy requires linking multiple signals together—including the health of the device, the identity of the user, and machine-to-machine communications. It’s not just about the network; it’s about ensuring that every access request is continuously verified based on all available context.

The Rise of Non-Human Identities

One of the most significant and often overlooked risks in modern environments is the proliferation of non-human identities. These include:

API Keys and Tokens: Used by services and applications to communicate with one another.
Service Accounts: Automated accounts that perform tasks within an environment.
Devices: Mobile phones, servers, and IoT devices that require network access.

These identities often run unchecked and carry broad permissions. As we move toward a world of AI agents and Model Context Protocol (MCP) servers, mapping and governing these non-human identities will be the next major security frontier.

Shared Signals: A Path Toward Better Defense

Topper is hopeful about emerging frameworks like the Shared Signals Framework from the OpenID Foundation. This open-source approach allows different vendors—such as Google, Salesforce, and Microsoft—to exchange security information in real-time.

For example, if an identity provider detects a credential compromise, it can send a signal to a SaaS application like Salesforce to immediately revoke that user's sessions and force re-authentication. This level of cross-organizational collaboration is essential to closing the window of opportunity for attackers.

The Human Risk and Data Quality

Finally, the conversation highlighted the ongoing challenge of data quality. IAM systems are only as good as the data they receive from source systems like HR. Topper suggests that exposing this data directly to users and help desks can help organizations identify and fix inconsistencies before they lead to security gaps or operational friction.

Closing Thoughts: Identity as the Foundation

As organizations continue to embrace the cloud and AI, the old ways of securing the network are no longer sufficient. Identity is no longer just a checkbox for compliance; it is the foundation of modern security. By focusing on continuous verification, governing non-human identities, and leveraging shared signals, organizations can move toward a Zero Trust model that actually protects their data in an increasingly complex world.

To learn more about UberEther and their approach to identity, visit UberEther.com.

December 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

December 8, 2025

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Scattered LAPSUS$ Hunters: 2025’s Most Dangerous Cybercrime Supergroup (Picus Security)

Picus Security charts the rise of the threat actor collective known as Scattered LAPSUS$ Hunters (SLH), a 2025 coalition of the previously independent groups Scattered Spider, LAPSUS$, and ShinyHunters. This supergroup combines extensive access-brokerage, insider-recruitment, and public-facing extortion campaigns—rendering it one of the most volatile and visible threats on the extortion landscape.

Key Insights

Alliance formation: SLH marks a strategic merger that pools reputational value and operational resources, enabling affiliate access and rapid scaling of extortion-as-a-service (EaaS) offerings.

Social engineering pivot: The group emphasizes vishing, SMS phishing, and supply-chain compromise (especially in SaaS and identity platforms) over traditional malware-driven intrusions.

Public-facing theatrics: SLH leverages Telegram channels, data-leak sites, and public threats to amplify fear, recruit affiliates, and engage in brand-style cyber extortion.

Broad target scope: Industries targeted include enterprise SaaS providers, technology firms, retail, and manufacturing, with frequent exploitation via OAuth abuse, insider access, and credential harvesting.

Resilient and adaptive: Despite law-enforcement actions, SLH maintains activity through federated branding, multiple leak portals, and decentralized affiliate networks.

Further Reading: Picus Security

The Most Advanced ClickFix Yet (Push Security)

Push Security researchers have uncovered a new and highly refined iteration of the “ClickFix” phishing framework, featuring modular capabilities for credential harvesting and session hijacking. This version uses advanced URL obfuscation, cloud-hosted redirects, and adaptive templates that mimic corporate login portals to bypass detection and deceive users more effectively.

Key Insights

Framework evolution: ClickFix’s latest version integrates dynamic templates and tokenized redirects to evade pattern-based blocking.

Session hijacking: Stolen authentication cookies allow attackers to access corporate accounts even when multi-factor authentication is enabled.

Cloud abuse: Hosting payloads on legitimate cloud services gives attackers credibility and helps phishing links evade automated scanning.

Rapid deployment: The phishing kits are prepackaged for affiliates, enabling faster setup and broader campaign reach.

Enterprise risk: The sophistication and modularity of ClickFix underline a trend toward professionalized phishing-as-a-service ecosystems.

Further Reading: Push Security

Cyber LNK Weaponizes Windows Shortcuts for Malware (Abnormal)

Abnormal researchers describe a rising threat where attackers weaponize Windows .lnk shortcut files using a point-and-click builder (Cyber LNK). As macro-based delivery declined, threat actors moved to shortcut files that masquerade as benign documents or PDFs but execute payloads when opened—giving attackers a stealthy, scalable alternative for phishing and malware distribution.

Key Insights

Shortcut-based delivery: .lnk files are being abused to launch commands or executables while appearing as harmless documents (e.g., showing a PDF icon).

Builder democratizes attacks: The Cyber LNK builder simplifies creation of weaponized shortcuts, lowering technical barriers for less skilled actors.

Macro migration vector: Attackers shifted to .lnk following widespread blocking of macro-enabled Office files, preserving phishing efficacy.

Evasion & UX spoofing: Techniques include icon spoofing, filename masquerading, and obfuscated command lines to bypass static detection and fool users.

Delivery via email phishing: Campaigns deliver .lnk attachments or archived shortcuts via phishing, combining social engineering with the new file vector.

Further Reading: Abnormal

New Phishing Campaign Exploits Meta Business Suite to Target SMBs Across the U.S. and Beyond (Check Point Research)

Check Point Research uncovered a phishing campaign that abuses the Meta Business Suite JSON API flows to masquerade as legitimate business-management notifications. Through this abuse, attackers sent convincing lures to SMBs in the U.S. and globally, claiming billing issues or account suspension and directing victims to fake login portals. The campaign succeeded in bypassing detection by conforming to expected API patterns and dynamically generating URLs that appear unique per victim.

Key Insights

API abuse for legitimacy: Attackers used Meta’s business-management JSON callbacks to fetch business names and tailor phishing messages, increasing trust and clicks.

Global SMB targeting: While initial hits were in the U.S., the campaign expanded to over 20 countries, focusing on small and mid-sized businesses with available business-suite integrations.

Dynamic URL generation: Each phishing link was unique and time-limited, preventing bulk blocking and defeating static URL reputation databases.

Credential theft via login proxy: Victims were redirected to an Azure-hosted login page that mirrored the Meta Business Suite sign-in interface, capturing both credentials and session cookies.

Evading detection: Because the attacker-generated callback requests resembled normal Meta API traffic, email filters reliant on anomaly detection struggled to flag the messages.

Further Reading: Check Point Research – New Phishing Campaign Exploits Meta Business Suite to Target SMBs Across the U.S. and Beyond

New Phishing Attack Leverages Popular Brands to Harvest Logins (Cybersecurity News)

A recent phishing campaign delivers self-contained HTML attachments that impersonate trusted brands such as Microsoft 365, Adobe, FedEx, and DHL to harvest credentials. These attachments bypass external link filtering by embedding phishing pages directly in the email and use JavaScript to send stolen data to Telegram bots rather than traditional command-and-control servers. The campaign targets industries like agriculture, automotive, construction, and education in regions including the Czech Republic, Slovakia, Hungary, and Germany.

Key Insights

Attachment-based attack delivery: Phishing emails include HTML files with fake login portals, avoiding reliance on external links and reputation lists.

Brand impersonation at scale: Multiple major brands are mimicked to increase trust and widen the potential victim pool.

Direct data exfiltration using Telegram bots: Stolen credentials are sent directly through Telegram Bot API, reducing detection trace-paths.

Industry & regional targeting: Focused on sectors with frequent procurement flows and Central/Eastern European markets, showing deliberate target selection.

Technical evasion tactics: Use of RFC-compliant filenames (e.g., “RFQ_4460-INQUIRY.HTML”) helps disguise malicious attachments as legitimate business documents.

Further Reading: Cybersecurity News

New ClickFix Attack Tricks Users with ‘Fake OS Update’ to Execute Malicious Commands (Cybersecurity News)

A new iteration of the ClickFix social-engineering campaign deploys a browser-based fake Windows update prompt that simulates a system crash or update screen. Victims who follow on-screen instructions end up executing malicious commands, leading to remote access, infostealer installations, or ransomware loaders.

Key Insights

The deceptive overlay mimics a Windows update or Blue Screen of Death (BSOD) complete with progress bar and error codes, inducing urgency and fear.

Victims are instructed to perform “manual fixes” such as pressing Ctrl+Alt+Del, entering commands in a pseudo CLI, and downloading a “recovery tool” which is actually malware.

The campaign leverages both PCs and mobile devices, with full-screen simulations compatible across platforms.

Because the user initiates the commands themselves, many security tools fail to flag the activity as malicious.

This attack underlines the persistent importance of user awareness and a skeptical mindset toward unexpected system update prompts.

Further Reading: Cybersecurity News

Global Cyber Attacks Surge in October 2025 Amid Explosive Ransomware Growth and Rising GenAI Threats (Check Point Research)

In October 2025, organizations saw a sharp rise in cyber attacks, with weekly averages nearing 2,000 per organization. Ransomware activity expanded significantly, and GenAI-related risks continued to emerge as organizations adopted newly integrated AI tools.

Key Insights

Weekly attack volumes increased across most regions, with several sectors experiencing notable year-over-year growth.

Ransomware incidents rose substantially, reflecting broader adoption of opportunistic targeting.

GenAI usage introduced new exposure points, particularly around prompt-based data leakage.

Education, telecommunications, and government sectors experienced the highest attack frequency.

Further Reading: Check Point Research

Phishing Scam Uses “rn” to Fake Microsoft (Cybersecurity News)

A new phishing campaign is abusing a visual trick that replaces the letter “m” with the characters “r” and “n”, creating deceptive domains such as “rnicrosoft.com.” The substitution is subtle enough that many users overlook it, especially on mobile devices, where character spacing is tighter. Attackers use these lookalike domains to deliver convincing credential-harvesting emails and login pages that appear legitimate.

Key Insights

Attackers rely on a visually deceptive domain swap (“m” → “rn”) that closely mimics legitimate Microsoft branding.

The technique increases success rates because users often skim URLs, especially on smaller screens.

This method reflects a broader shift toward domain-based deception rather than attachment-driven phishing.

Further Reading: Cybersecurity News

Fake Windows-Update Screen Pushes Malware via ClickFix Campaign (BleepingComputer)

A new iteration of the ClickFix phishing campaign employs a fake Windows update or error screen — complete with progress bars and warning messages — to trick victims into executing malicious commands. Once the user follows the on-screen instructions, the system launches malware capable of remote access or data theft.

Key Insights

The fake update screen leverages urgency and system-failure anxiety to prompt user action.

Because execution is triggered manually by the user, many defenses fail to flag the activity.

Although targeting Windows, this style of UI-based deception could be adapted to other platforms.

The campaign highlights a shift toward interface-spoofing rather than traditional link-based phishing.

Further Reading:
BleepingComputer

HashJack — First-Known Indirect Prompt Injection against AI Browsers (Cato Networks)

Researchers identified a new indirect prompt-injection method called HashJack, which hides malicious instructions inside the fragment section of a URL (the part after “#”). When an AI browser assistant loads the page and interprets the fragment as part of its prompt, the attacker can silently influence the assistant’s behavior without compromising the website itself. This technique turns otherwise legitimate URLs into delivery mechanisms for prompt-based attacks.

Key Insights

Attackers can weaponize any legitimate website simply by appending a malicious fragment to the URL.

URL fragments are not transmitted to servers or monitored by most network security tools, enabling the attack to bypass common defenses.

The technique can be used for phishing, misinformation, malicious instruction delivery, or data manipulation.

Multiple AI-enhanced browsers and assistants are susceptible until mitigations are deployed.

Further Reading: Cato Networks

B2B Guest Access Creates an Unprotected Attack Vector (Ontinue)

Microsoft’s “Chat with Anyone” capability in Teams allows users to chat with nearly any email address, but accepting a guest invite places them inside an external tenant where their organization’s security controls no longer apply. Attackers can exploit this gap to send phishing links or malicious files from low-security tenants, bypassing protections such as Safe Links and malware scanning.

Key Insights

Guest access applies the host tenant’s security controls, not the user’s home organization.

Attackers can use low-cost or trial tenants to bypass URL scanning and attachment inspection.

The feature is enabled globally by default, increasing the risk of unnoticed exposure.

External chats can function like email-borne phishing but without standard enterprise safeguards.

Further Reading: Ontinue

Weaponized Google Meet Page Uses ClickFix to Deliver Malware

Attackers are using a fake Google Meet landing page to trick users into executing malicious PowerShell commands. The site imitates the real Google Meet interface and displays a bogus camera or microphone error. It then instructs the user to run a “fix” that silently installs malware — often a Remote Access Trojan or infostealer — by copying a command to the clipboard and guiding the user to execute it through the Run dialog. Because the execution occurs outside the browser, typical browser-based protections are bypassed.

Key Insights

The attack depends entirely on social engineering, prompting users to manually run attacker-supplied commands.

Browser protections are avoided because execution happens through the operating system rather than a webpage.

The campaign leverages trust in Google Meet to lend legitimacy to the fake interface.

Forensic artifacts on infected systems can trace activity back to the malicious site.

Further Reading: Cybersecurity News

December 2025 - ExploreSec Cybersecurity Awareness Newsletter

December 5, 2025

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

The Most Advanced ClickFix Yet (Push Security)

Key Insights

Framework evolution: ClickFix’s latest version integrates dynamic templates and tokenized redirects to evade pattern-based blocking.

Session hijacking: Stolen authentication cookies allow attackers to access corporate accounts even when multi-factor authentication is enabled.

Cloud abuse: Hosting payloads on legitimate cloud services gives attackers credibility and helps phishing links evade automated scanning.

Rapid deployment: The phishing kits are prepackaged for affiliates, enabling faster setup and broader campaign reach.

Enterprise risk: The sophistication and modularity of ClickFix underline a trend toward professionalized phishing-as-a-service ecosystems.

Further Reading: Push Security

Minecraft, Qwerty and India123 Among 2025’s Most Common Passwords (Comparitech)

Comparitech’s latest report reveals that easily guessable passwords like “minecraft”, “qwerty”, and “india123” remain widely used despite increased awareness of password security. The findings underscore the persistent risk of weak authentication across individuals and organisations, particularly in enterprise contexts where password reuse and default credentials continue to expose systems to credential-dumping and brute-force attacks.

Key Insights

Weak passwords persist: “minecraft” topped the list of most common passwords of 2025, followed by “qwerty” and “india123”.

Password-reuse risk: Many breached credentials show repeated reuse of these weak passwords across multiple services, amplifying breach impact.

Default and predictable credentials: A significant share of password sets were based on games, simple keyboard walks (qwerty), or culturally-common strings — all easily breached.

Enterprise & IoT exposure: Weak passwords are especially problematic in business systems and connected devices where password requirements are lax and monitoring is minimal.

Actionable x-fact: Organisations should block commonly used weak passwords, enforce passphrase complexity and implement password-less or MFA approaches to reduce risk.

Further Reading: Comparitech

New Phishing Campaign Exploits Meta Business Suite to Target SMBs Across the U.S. and Beyond (Check Point Research)

Key Insights

API abuse for legitimacy: Attackers used Meta’s business-management JSON callbacks to fetch business names and tailor phishing messages, increasing trust and clicks.

Global SMB targeting: While initial hits were in the U.S., the campaign expanded to over 20 countries, focusing on small and mid-sized businesses with available business-suite integrations.

Dynamic URL generation: Each phishing link was unique and time-limited, preventing bulk blocking and defeating static URL reputation databases.

Credential theft via login proxy: Victims were redirected to an Azure-hosted login page that mirrored the Meta Business Suite sign-in interface, capturing both credentials and session cookies.

Evading detection: Because the attacker-generated callback requests resembled normal Meta API traffic, email filters reliant on anomaly detection struggled to flag the messages.

Further Reading: Check Point Research – New Phishing Campaign Exploits Meta Business Suite to Target SMBs Across the U.S. and Beyond

New Phishing Attack Leverages Popular Brands to Harvest Logins (Cybersecurity News)

Key Insights

Attachment-based attack delivery: Phishing emails include HTML files with fake login portals, avoiding reliance on external links and reputation lists.

Brand impersonation at scale: Multiple major brands are mimicked to increase trust and widen the potential victim pool.

Direct data exfiltration using Telegram bots: Stolen credentials are sent directly through Telegram Bot API, reducing detection trace-paths.

Industry & regional targeting: Focused on sectors with frequent procurement flows and Central/Eastern European markets, showing deliberate target selection.

Technical evasion tactics: Use of RFC-compliant filenames (e.g., “RFQ_4460-INQUIRY.HTML”) helps disguise malicious attachments as legitimate business documents.

Further Reading: Cybersecurity News

Inside the Scattered Lapsus$ Hunters (Push Security)

Push Security analyzed the resurgence of the Scattered Lapsus$ Hunters, a cybercrime group known for high-profile data breaches and social-engineering-driven attacks. The group has evolved its techniques, targeting enterprise collaboration platforms and cloud accounts to gain unauthorized access and exfiltrate sensitive data.

Key Insights

Social engineering roots: The group continues to rely on credential theft and social manipulation rather than technical exploits.

Corporate infiltration: They focus on compromising employees with elevated permissions to reach critical systems.

Operational evolution: Recent campaigns show improved coordination and use of legitimate services for persistence and data transfer.

Brand targeting: The group’s activity spans technology, telecom, and SaaS sectors, emphasizing organizations with valuable data.

Further Reading: Push Security – Inside the Scattered Lapsus$ Hunters

New ClickFix Attack Tricks Users with ‘Fake OS Update’ to Execute Malicious Commands (Cybersecurity News)

Key Insights

The deceptive overlay mimics a Windows update or Blue Screen of Death (BSOD) complete with progress bar and error codes, inducing urgency and fear.

Victims are instructed to perform “manual fixes” such as pressing Ctrl+Alt+Del, entering commands in a pseudo CLI, and downloading a “recovery tool” which is actually malware.

The campaign leverages both PCs and mobile devices, with full-screen simulations compatible across platforms.

Because the user initiates the commands themselves, many security tools fail to flag the activity as malicious.

This attack underlines the persistent importance of user awareness and a skeptical mindset toward unexpected system update prompts.

Further Reading: Cybersecurity News

Global Cyber Attacks Surge in October 2025 Amid Explosive Ransomware Growth and Rising GenAI Threats (Check Point Research)

Key Insights

Weekly attack volumes increased across most regions, with several sectors experiencing notable year-over-year growth.

Ransomware incidents rose substantially, reflecting broader adoption of opportunistic targeting.

GenAI usage introduced new exposure points, particularly around prompt-based data leakage.

Education, telecommunications, and government sectors experienced the highest attack frequency.

Further Reading: Check Point Research

DoorDash Data Breach Exposes Customer Information (USA Today)

DoorDash disclosed a security incident that exposed customer data such as names, contact details, delivery addresses, birthdays, and partial payment information.

Key Insights

Exposed data includes PII and partial payment card details.

Stolen information may be misused in phishing or fraud attempts.

Large consumer platforms remain attractive targets for attackers.

DoorDash is notifying affected users and has initiated incident response actions.

Further Reading: USA Today

Fake Windows-Update Screen Pushes Malware via ClickFix Campaign (BleepingComputer)

Key Insights

The fake update screen leverages urgency and system-failure anxiety to prompt user action.

Because execution is triggered manually by the user, many defenses fail to flag the activity.

Although targeting Windows, this style of UI-based deception could be adapted to other platforms.

The campaign highlights a shift toward interface-spoofing rather than traditional link-based phishing.

Further Reading:
BleepingComputer

Phishing Scam Uses “rn” to Fake Microsoft (Cybersecurity News)

Key Insights

Attackers rely on a visually deceptive domain swap (“m” → “rn”) that closely mimics legitimate Microsoft branding.

The technique increases success rates because users often skim URLs, especially on smaller screens.

This method reflects a broader shift toward domain-based deception rather than attachment-driven phishing.

Further Reading: Cybersecurity News

B2B Guest Access Creates an Unprotected Attack Vector (Ontinue)

Key Insights

Guest access applies the host tenant’s security controls, not the user’s home organization.

Attackers can use low-cost or trial tenants to bypass URL scanning and attachment inspection.

The feature is enabled globally by default, increasing the risk of unnoticed exposure.

External chats can function like email-borne phishing but without standard enterprise safeguards.

Further Reading: Ontinue

Weaponized Google Meet Page Uses ClickFix to Deliver Malware

Key Insights

The attack depends entirely on social engineering, prompting users to manually run attacker-supplied commands.

Browser protections are avoided because execution happens through the operating system rather than a webpage.

The campaign leverages trust in Google Meet to lend legitimacy to the fake interface.

Forensic artifacts on infected systems can trace activity back to the malicious site.

Further Reading: Cybersecurity News

Filling the Cyber Gap: How Student-Powered SOCs are Building the Next Generation of Security Experts

December 4, 2025

This blog post was generated by Gemini using the transcript from the podcast episode.

The cybersecurity industry is facing a persistent skills shortage, and universities often struggle to provide students with the real-world experience needed to land a job in the Cybersecurity industry. Bruce Johnson of TekStream recently discussed a solution that is simultaneously addressing both problems: the student-powered Security Operations Center (SOC).

In a conversation with me, Bruce detailed this innovative private-public partnership, its unique funding model, and how it’s cultivating not just cyber analysts, but well-rounded professionals.

A Private-Public Partnership for Workforce Development

TekStream's student-powered SOC program is a well-established solution designed to automate proactive threat detection and remediation while also serving as a crucial workforce development initiative. This is not a simple outsourcing model; it’s a three-way collaboration that includes the state, educational institutions, and TekStream.

TekStream emphasizes that their solution is an "investment solution," where the institutions own their SIEM environment licenses and retain all built assets, fostering collaborative value building instead of an outsourced expense.

Training the Analytical Detective

Johnson noted that many new graduates struggle to find jobs due to minimum experience requirements. The student-powered SOC addresses this by providing practical, real-world experience in a working SOC environment.

The program focuses on transforming curious individuals into professional analysts. The onboarding process has been compressed to just six weeks , and students are trained on tools, runbooks, and cybersecurity fundamentals through hands-on labs.

The biggest indicator of a student’s success is a proprietary critical thinking test that assesses logical reasoning and due diligence. Students are incrementally matured by starting with low-complexity threats (like IP reputation and brute force) and gradually increasing to advanced topics like TTPs (Tactics, Techniques, and Procedures), guided by a complexity scoring system.

The Value of the "Transcript" and Placement

The program provides immense reputational value to participating schools because it boasts a 100% placement rate for students. This outcome differentiates these institutions from those offering only academic backgrounds.

For the student, the program produces a highly valuable "transcript". This document details:

The specific use cases and threats the student tackled.
The level of complexity involved.
The student's productivity and quality metrics.

This transcript instills professionalism and serves as a practical skills record, giving students a significant leg up against other job candidates who only have academic backgrounds. Furthermore, the program incorporates integrated career counseling to review metrics and guide students toward roles like red teaming, forensics, or engineering.

AI Supervision: The Expert in the Loop

In a world where AI is automating level one (SA1) security tasks, students must transition from performing basic skills to supervising AI. Bruce Johnson acknowledged the concern that students might struggle with AI hallucinations or incorrect outputs due to their lack of industry experience.

TekStream’s answer is the "expert in the loop" approach. The program trains students in three areas:

Using AI in the context of incident response.
Supervising the AI.
Understanding AI more broadly.

The training environment requires students to second-guess the AI and understand the foundational work before they can effectively supervise. This approach emphasizes that trust in the technology is built incrementally over time.

An Investment in Future Talent

Beyond the immediate goal of cybersecurity, the student-powered SOC delivers an unexpected but profound benefit: the development of non-cybersecurity skills. Students gain critical life lessons and skills that help isolated individuals become more engaged, including: collaboration, accountability, professionalism, and general "adulting".

These detective and critical thinking skills are universally transferable to any industry. Ultimately, the program prepares students to handle complex threats and risk scenarios, teaching them that working in security is about developing a nuanced understanding of risk, not expecting "black-and-white answers." The demonstrated success—with students handling 50% of incident volume within a quarter of onboarding—proves this model is effectively bridging the skills gap and shaping the next generation of security professionals.

The State of the API: 2025 – Security, AI, and the Human Element

December 3, 2025

This blog post was generated by Gemini using the transcript from the podcast episode.

The API remains the "connective tissue of the modern world", but as Postman's Sam Chehab highlighted in a recent discussion with me, the State of the API report reveals that the landscape is rapidly evolving, driven by the rise of AI and persistent security challenges.

The Collaboration Crisis and the Security Connection

The annual Postman State of the API report, now in its seventh year , synthesizes data on how APIs are produced and consumed across industries. A major insight from this year's report focuses on the persistent struggle with collaboration. A shocking 93% of teams are struggling with API collaboration, which leads directly to a lot of duplicated work. From a security perspective, this fragmented collaboration means the "attack surface is getting wider". When developers find unofficial ways to share information—like Slack threads, wikis, or Confluence docs—it bypasses established security and governance processes.

However, there is a silver lining: documentation is on the rise. Fifty-eight percent of respondents cited documenting APIs as one of the most common activities they are undertaking to improve collaboration. While this is a step toward better practices, Sam Chehab notes it may be driven by the need for better collaboration or the demand for AI-ready APIs.

Shifting Left: Integrating Security into the Developer Workflow

Postman is primarily an engineering-first tool , used by 98% of the Fortune 500. The key to better security, according to Chehab, is working with the developer workflow, not against it.

The pathway to good security is a byproduct of good collaboration. This starts with the fundamentals: achieving an inventory of enterprise and software assets —the first two CIS controls—to kickstart the security journey. Postman enables developers to run security tests directly within their normal workflow using Postman collections. This drastically improves development velocity and moves security closer to the "shift left" ideal.

Furthermore, the platform's built-in load testing and performance capabilities help address the "Availability" component of the CIA triad, which security teams often historically ignore. Developers can trivially simulate denial-of-service attacks using their existing tests and Postman's features.

Preparing for the AI Agent Invasion

As AI agents increasingly consume APIs, they require a different approach to API design and documentation.

While developers often hate documentation, AI agents thrive on it. Tools can be leveraged to help write documentation about APIs that then other AIs can read. Humans may get away with a generic "error something broke" , but AI agents require rich, contextual error messages. These should specify the problem (e.g., "invalid parameter"), what was expected, and what was received so the AI can effectively process the issue.

AI also needs centralized information, clear metadata, and good descriptions around APIs to function effectively. This makes centralized platforms like Postman essential, replacing scattered wikis, portals, and Slack threads.

Top Security Concerns: Credentials and Amplification

One of the top security risks cited by 51% of developers in the report is unauthorized agent access.

This issue is primarily driven by the industry's failure to effectively solve secrets management , with API keys floating everywhere. Postman addresses this by providing tools for API key management, including forcing expiration, managing revocation policies, and having a "revoke all" option. Furthermore, Postman actively scans public repositories like GitHub for leaked Postman keys, auto-revoking them and notifying the administrator to minimize the blast radius of a leak.

Another risk is Credential Amplification. This refers to the risk that is exponential, not linear , where one credential grants access to one service, and that service then has access to another , allowing for lateral movement. This puts a name to what that sprawl looks like now.

The Emergence of Model Context Protocol (MCP)

A new concept discussed was the Model Context Protocol (MCP) , which is an emerging standard for AI interaction.

MCP acts as an abstraction layer. It sits on top of a restful-like protocol and allows you to abstract yourself away from the endpoint that you're communicating with. It enables the use of natural language to interact with a scoped-down number of APIs , making interaction with different services more agnostic (e.g., interacting with a Jira instance without hardwiring to it).

MCP, however, introduces a new supply chain risk. Security practitioners must validate which MCP servers they are using. Chehab cited the first benign "MCP hack" in the wild, where a malicious server added a BCC to an email every time an action was performed.

The Wrap Up

Chehab's final advice echoes his security philosophy: go back to basics. Secure your APIs by focusing on the fundamentals:

Gain Leadership Buy-in: Security efforts will be fleeting without support from management.
Document and Test: Focus on how you are documenting, sharing, and testing your APIs.
Ensure Consistency: Validate that your design-time plan maps to what you build and what you deploy in runtime.

By solving collaboration and basic security problems first—and using AI to help automate those basic tasks —teams can successfully secure their systems before chasing new, complex AI threats.

Stop the Steal: Your Guide to Spotting and Dodging Holiday Scams

December 2, 2025

This is a blog post I put together for a security awareness program. Feel free to grab for your own internal program.

The holiday season is a time for giving, celebration, and searching for the perfect deal. Unfortunately, it's also Scam Season—a time when cybercriminals ramp up their attacks, using urgency, emotional pressure, and tempting offers to steal your money and your identity.

From fake gift card surveys to cloned travel sites, staying aware is the best gift you can give your financial security. Here is your essential guide to recognizing the biggest threats and protecting yourself.

The Lure of the 'Free' Gift Card (The Survey Scam)

You've probably seen the message: a bright, urgent notification claiming you've been selected to receive a massive $750 or $1,000 gift card from a major retailer like Walmart. All you have to do is answer a quick survey.

What's Really Happening? This is rarely about a prize. These are sophisticated lead-generation and data-harvesting scams disguised as promotions.

Data Harvesting: As you move through the "survey," you are asked for valuable details: your name, email, phone number, address, and even personal interests.
The Hidden Cost: The promised gift card never materializes. Instead, your personal information is sold to advertisers, data brokers, and other malicious parties. This fuels targeted spam, phishing emails, and more convincing scams down the line, as criminals can now personalize their attack using real information about you.
The Hook: These scams rely on powerful psychological triggers—the sense of luck, the promise of low effort, and the false credibility lent by using official branding.

The Urgency of Fake Deals and Cloned Websites

During high-shopping seasons, scammers leverage our desire for a bargain and a great getaway.

Fake Retail Ads

Scammers run professional-looking advertisements, promoting "limited-time sales" or offering extreme discounts.

The Trap: You are taken to a website that is a near-perfect clone of a real retailer to steal your payment information. The item you paid for will never arrive.
Red Flag: Always check the URL. Scammers often use slightly altered web addresses. If the price seems too good to be true, it is.

Phony Holiday Rentals

A great last-minute travel deal can be a front for identity theft.

The Trap: Scammers clone real rental listings and pressure you to communicate and pay outside of the trusted rental platform, often demanding sensitive documents like photos of your ID or credit card upfront.
Red Flag: Legitimate platforms want you to stay within their system for security. Never send copies of personal documents via private email or text.

The Gift Card Trap (The Emergency Text/Call)

One of the most devastating scams uses your love and concern for family to drain your bank account.

The Scenario: You receive an unexpected text or call—sometimes even using an AI-faked voice—from someone claiming to be a friend or family member who is in an "emergency" (e.g., wallet stolen, car trouble).
The Ask: They claim that because they can't use their bank or credit cards, they urgently need you to buy a specific type of gift card and send them the numbers and PIN codes.
The Reality: Gift cards are untraceable currency for criminals. Once the code is shared, the money is gone. Scammers often use emotional pressure and timing to cloud your judgment.

The Impersonated Authority Figure

This scam targets your professionalism or loyalty by having the criminal impersonate a boss, CEO, pastor, or group leader.

The Scenario: You receive a text message (often using the person's real name and sometimes even a real profile photo) saying they are busy in a meeting or traveling and need you to handle an urgent task: purchasing a large number of gift cards (like Apple or Amazon) to give to staff, clients, or group members immediately.
The Ask: They promise to reimburse you later and ask you to text the photos of the card codes to them immediately.
The Red Flag: No legitimate organization, especially during business hours, will ask an employee to use personal funds to buy untraceable gift cards for a professional or organizational expense. This is a classic scam designed to exploit your willingness to help a superior.

The "Unexpected Prize" or "Account Issue" Text

These texts are designed to get you to click on a link.

The Setup: A text says, "Congratulations! You've won a $100 [Major Retailer Name] Gift Card! Click here to claim it," or claims there's an issue with a recent gift card purchase you need to verify.
The Steal: The link takes you to a fake website that steals your personal data (name, address) or your financial details under the pretense of "claiming the prize."

Always Remember: If a text promises a prize or demands urgent action regarding a gift card you didn't purchase, it is a scam. Never click on a link in an unsolicited text message.

The Golden Rule: Gift Cards are for Presents, Not Payments

No legitimate business, government agency, or reputable person will ever demand payment or request verification information in the form of a gift card for an emergency, a debt, or a prize.

Your 5-Step Security Checklist

Recognizing these scams is the best defense. Follow this checklist to stay safe:

Verify Unexpected Requests: If a friend, family member, or especially a superior/authority figure texts with an urgent financial request, always verify it independently. Call them back using a known, trusted number, or email them via their official work email address. Do not reply to the suspicious text message.
Inspect the URL: Before entering personal or payment information on any site, check the website address (URL) in the browser bar. Look for misspellings or domains that don't match the company's official name.
Be Wary of "Free": Be highly suspicious of unsolicited messages promising huge, easy rewards for low effort. Never click on links in unexpected text messages or emails claiming you've won a prize.
Use Official Channels: Only communicate and pay through the official, verified channels of banks, retailers, and booking platforms.
Listen to Your Gut: Scammers use urgency to cloud your judgment. If an offer, deal, or emergency scenario causes anxiety or forces you to act immediately, take a deep breath and step away. When in doubt, close the tab.

Stay aware and enjoy a secure, scam-free holiday season!

Sources and Further Reading

November 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

November 19, 2025

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Impact Solutions: The Point-and-Click Toolkit Democratizing Malware Delivery

A newly observed phishing toolkit—Impact Solutions—provides a user-friendly, point-and-click interface that lets low-skill threat actors generate weaponized attachments (e.g., .lnk shortcuts, HTML smuggling files, malicious SVGs) and staged payloads. The kit emphasizes social-engineering effectiveness (icon spoofing, decoy documents, Cloudflare-style verification prompts) and includes UAC bypasses, sandbox checks, and techniques intended to evade SmartScreen and many antivirus solutions.

Key Insights

Low skill, high impact: The toolkit produces ready-to-send malicious artifacts (shortcut builders, HTML smuggling templates, SVG payloads) that remove the need for malware development expertise.

Social-engineering first: Files are crafted to look legitimate (PDF icons, real-looking invoices, faux verification pages) and often present decoy documents while executing payloads in the background.

Evasion features: Built-in UAC bypass attempts, anti-VM/sandbox checks, AppData execution, and claims to bypass SmartScreen and common AV detection.

ClickFix-style and staged attacks: Some templates instruct users to paste Win+R commands or open local file paths, enabling ClickFix-style execution flows and multi-stage downloads.

Defender opportunity: Behavioral and contextual email analysis (rather than signature matching) is more effective at detecting these campaigns, since the artifacts intentionally evade static detection.

Further Reading: Abnormal AI – Impact Solutions: The Point-and-Click Toolkit Democratizing Malware Delivery

Massive Surge in Scans Targeting Palo Alto Networks Login Portals

BleepingComputer has observed a significant spike in reconnaissance activity against Palo Alto Networks devices. Thousands of hosts globally are probing PAN-OS management or login endpoints (ports 443, 7239, 7777) in just a short timeframe. This wave of scanning appears preliminary—likely mapping vulnerable or misconfigured devices for potential follow-on attacks, such as exploitation, credential stuffing, or proxy pivoting.

Key Insights

Scans primarily target authentication portals for PAN-OS and administrative web UIs (e.g. ports 443, 7239, 7777).

Most scanning traffic originates from distributed IP pools, indicating broad reconnaissance campaigns rather than focused attacks.

Such scanning often precedes attacks like SSRF, zero-day exploits, credential brokering, or lateral pivots through exposed devices.

Organizations should monitor unusual traffic to management endpoints and verify that PAN device interfaces are properly firewalled and accessible only to trusted networks.

Further Reading: Bleeping Computer – Massive Surge in Scans Targeting Palo Alto Networks Login Portals

ShinyHunters (UNC6040) Launches Corporate Extortion Blitz

The ShinyHunters group, operating under aliases like Scattered LAPSUS$ Hunters and associated with threat cluster UNC6040, has initiated a broad extortion campaign threatening dozens of Fortune 500 companies. The group claims to have stolen sensitive Salesforce data through voice-phishing, along with terabytes of consulting/project files from Red Hat and token access data from Salesloft. They are demanding ransom under threat of public data release.

Key Insights

Theft method: voice phishing was used to trick organizations into granting access to Salesforce; stolen data includes authentication tokens and customer records.

Victim profile: major companies such as Toyota, FedEx, Disney/Hulu, UPS, Red Hat, and others are alleged victims.

Extortion tactics: the group has published a “victim shaming” blog demanding ransom, threatening to leak data otherwise; claims to have compromised large volumes of configuration, consulting, and secret infrastructure elements.

Malware and targeting: They use malicious message attachments disguised as screensavers (.scr/.news-style), distributed via phishing; payloads include backdoors (e.g. ASYNCRAT) with capabilities like file exfiltration, keylogging, screenshot capture, etc.

Legal and law-enforcement response: Some members are already indicted or convicted; companies such as Salesforce publicly refuse to negotiate with ransom demands, emphasizing forensic analysis and regulatory contact.

Further Reading: Krebs on Security – ShinyHunters Wage Broad Corporate Extortion Spree

ClickFix Generator: New Automated Toolkit Enables Mass Social Engineering Attacks

Unit 42 has discovered a first-of-its-kind ClickFix Generator toolkit that enables threat actors to automate the creation of ClickFix-style phishing campaigns at scale. The generator crafts prompt texts, social engineering flows, and malicious payloads, allowing adversaries to produce campaign modules in a matter of minutes instead of hours. Early usage traces suggest the tool is already active in the wild, deployed in multiple targeted phishing campaigns.

Key Insights

Quick campaign assembly: With ClickFix Generator, attackers can build full campaigns (lures, messaging flow, payload delivery) rapidly.

Template-based operations: The toolkit comes with prebuilt templates for lures (e.g., “Update Required,” “Verification Needed”) and payload strategies.

Operational reuse: Once built, modules can be re-used or tweaked across multiple campaigns to reduce development overhead.

Detection challenges: Automated tooling increases the volume and diversity of campaigns, making static signatures less effective; defenders must rely more on flow behavior analytics and anomaly detection.

Further Reading: Unit 42 – ClickFix Generator: First-of-Its-Kind Automated Toolkit Observed in the Wild

Employees Sharing Company Secrets with ChatGPT: Rising AI Data-Leak Risk

New research shows a worrying trend: about 77% of enterprise employees regularly paste sensitive corporate data into generative AI tools like ChatGPT. Even more concerning, around 82% of those interactions come from unmanaged personal accounts, putting oversight, compliance, and data protection at risk. The study also flagged that 40% of files uploaded to these tools contain sensitive info like payment data, and 22% of pasted content includes regulated or proprietary information.

Key Insights

Using personal accounts to access AI tools creates blind spots for corporate IT and security teams.

Routine copying and pasting of internal data into AI tools bypasses traditional data loss prevention tools.

Sensitive data exposure isn’t limited to large uploads—small text snippets can still cause regulatory or competitive harm.

Employee training and strict AI usage policies are essential to protect company data.

Further Reading: Cyber Security News – “Employees Share Company Secrets on ChatGPT”

Upcoming Changes to Internet Explorer Mode in Microsoft Edge

Microsoft is updating how Internet Explorer Mode (IE Mode) works in Edge, with implications for compatibility, policy enforcement, and legacy application support. These changes impact how organizations manage legacy web apps relying on the IE11 engine via Edge’s integrated mode.

Key Insights

IE Mode enables legacy IE11 rendering (Trident/MSHTML engine) within Edge for compatibility with older intranet sites and applications.

Only sites explicitly configured (via Enterprise Mode Site List or Group Policy) will load in IE Mode; others default to modern rendering.

Upcoming updates may restrict or alter certain IE Mode behaviors—affecting ActiveX, legacy scripting, user agent emulation, or navigation fallback logic.

Organizations should audit and catalog legacy Web apps now to ensure a smooth transition before changes take effect.

Further Reading: Microsoft – Changes to Internet Explorer Mode in Microsoft Edge

100,000+ IP Botnet Launches Coordinated RDP Attack Wave

GreyNoise observed a coordinated botnet operation (started Oct 8, 2025) involving over 100,000 unique IPs from 100+ countries targeting U.S. Remote Desktop Protocol (RDP) infrastructure using RD Web Access timing attacks and RDP web-client login enumeration.

Key Insights

Mass scale & coordination: The activity involves over 100,000 IPs that share a similar TCP fingerprint, indicating centralized control.

Primary vectors: Operators leveraged RD Web Access timing attacks and RDP Web Client login enumeration to probe and enumerate targets.

Geographic distribution: Source IPs originated from 100+ countries, but attacks were concentrated on U.S. RDP infrastructure.

High-confidence botnet assessment: GreyNoise attributes this as a single multi-country botnet campaign rather than unrelated scanners.

Further Reading: GreyNoise – 100,000+ IP Botnet Launches Coordinated RDP Attack Wave

7-Zip Vulnerabilities: Code Execution, MoTW Bypass & RAR5 Crashes

Several significant vulnerabilities in 7-Zip (versions prior to 24.07 / 24.09 / 25.00 depending on the issue) have been discovered and/or exploited. These flaws allow attackers to bypass Windows’ “Mark-of-the-Web” protections, execute arbitrary code via crafted archives, or crash systems using malicious RAR5 files.

Key Insights

A critical vulnerability (CVE-2025-0411) lets nested archives bypass MoTW protections, enabling malware delivery without triggering usual warnings.

Another high-severity bug in the Zstandard decompression module enables remote code execution in affected versions before 24.07.

RAR5 decoder vulnerability (CVE-2025-53816) allows denial-of-service conditions via malicious RAR5 archives in versions before 25.00.

Version 25.00 (and 25.01 for some symbolic link flaws) includes fixes; users must update manually since 7-Zip lacks automatic update features.

Further Reading: CyberNews – 7-Zip Vulnerabilities

Espionage Exposed: North Korean Remote Worker Network

KELA’s investigation has uncovered thousands of North Korean operatives using fabricated identities and AI-assisted tools to land remote jobs in design, engineering, IT, and architecture. Their employment is a dual-purpose strategy: generate revenue for the regime and gain access to sensitive data, proprietary designs, or system access from within organizations.

Key Insights

Operatives use AI-generated headshots, edited identification, and falsified backgrounds to pass hiring checks.

Target roles span technical and creative fields—beyond just software development.

Evidence links some accounts to infostealer logs and developer-level system access.

Detection patterns include reused passwords, temporary email domains, and unusually polished portfolios for new accounts.

Further Reading: KELA – Espionage Exposed: Inside a North Korean Remote Worker Network

Healthcare Ransomware Roundup: Q1–Q3 2025

According to Comparitech’s 2025 report, ransomware and data breaches in healthcare have continued their alarming trend. The first three quarters saw more than 350 publicly disclosed attacks, resulting in over 140 million records impacted and ransom demands totaling over $350 million. The report highlights the prevalence of vulnerabilities, misconfigurations, and operational dependencies that make healthcare systems a persistent target.

Key Insights

Healthcare organizations face especially high ransomware pressure, given the value and sensitivity of patient data.

Large-scale attacks disproportionately impact smaller entities, which lack mature cyber resilience strategies.

Ransom demand sizes continue to escalate—multiple cases exceeded $10 million.

Attack vectors remain consistent: phishing, unpatched systems, remote desktop exploits, and misconfigured cloud services.

Further Reading: Comparitech – Healthcare Ransomware Roundup Q1–Q3 2025

Tracking ClickFix Infrastructure (AITMFeed / Lab539)

Security analysts have begun mapping core infrastructure used to support ClickFix campaigns, consolidating domain, redirect, and payload delivery patterns. The reconstruction aids defenders in identifying malicious modules tied to active campaigns.

Key Insights

Infrastructure layering: Redirect chains often pass through multiple affiliate or proxy domains before landing on ClickFix lures.

Template reuse: Several ClickFix landing pages share structural and domain-naming patterns—indicating reuse by operators or shared kits.

Payload hosting nodes: Final payload domains are typically short-lived or dynamically rotated, complicating static blocklists.

Early indicators: Identified domains and redirect paths can serve as hunting indicators to uncover emerging ClickFix campaigns before payload execution.

Further Reading: AITMFeed – Tracking ClickFix Infrastructure

Record DDoS Botnet Targets U.S. ISPs (Krebs on Security)

The Aisuru botnet, powered by hundreds of thousands of infected IoT devices, launched a record-breaking DDoS attack peaking at nearly 30 Tbps—impacting major U.S. ISPs such as AT&T, Comcast, and Verizon. Most compromised devices included routers and cameras running outdated firmware or default credentials.

Key Insights

IoT exploitation: Aisuru spreads by scanning for unsecured consumer devices with weak or factory passwords.

Massive impact: Outbound attack traffic from U.S. networks degraded ISP and customer performance.

Mirai lineage: Built from the leaked Mirai code, Aisuru now dominates global IoT botnet activity.

Shared responsibility: ISPs and users must ensure devices are updated and secured to prevent botnet recruitment.

Further Reading: Krebs on Security – DDoS Botnet Aisuru Blankets US ISPs in Record DDoS

Stealthy Phishing Kit Targets Microsoft 365 Users (Barracuda)

Barracuda researchers identified a new phishing kit, dubbed Whisper 2FA, designed to steal Microsoft 365 credentials and bypass multi-factor authentication. The kit operates in real time, capturing both login and MFA tokens through background scripts that validate credentials with attacker-controlled servers.

Key Insights

Real-time MFA capture: Uses live AJAX loops to exfiltrate credentials and prompt victims until valid MFA tokens are obtained.

Anti-analysis techniques: Employs multiple layers of encoding, disables developer tools, and crashes browser inspection to avoid detection.

Rapid adoption: Nearly one million attack attempts observed in a month, placing Whisper 2FA among the top three phishing kits globally.

Kit evolution: Newer versions add stronger obfuscation and broader MFA method support, signaling active development and threat scalability.

Further Reading: Barracuda – Threat Spotlight: Stealthy Phishing Kit Targets Microsoft 365

PhantomVAI Loader Delivers Infostealers in Targeted Attacks

Researchers at Palo Alto Networks’ Unit 42 have identified a new malware loader named PhantomVAI, which is being used to deliver well-known information stealers such as LummaC2 and Rhadamanthys. The loader uses deceptive Microsoft OneDrive-themed lures and employs advanced evasion tactics to bypass traditional security tools.

Key Insights

PhantomVAI leverages phishing campaigns to distribute malicious payloads disguised as OneDrive documents.

The loader uses multilayered obfuscation and anti-analysis techniques to avoid detection.

Once executed, it deploys info-stealing malware that exfiltrates sensitive data, including credentials and browser information.

Its modular design allows threat actors to easily update and customize the loader for different payloads or delivery methods.

Further Reading: Unit42 – PhantomVAI Loader Delivers Infostealers

Non-Web Protocols: The Hidden Attack Surface (Zscaler ThreatLabz)

Zscaler’s ThreatLabz team reports that attackers are increasingly leveraging non-web protocols—such as DNS, RDP, and SMB—to evade detection and exploit enterprise environments. The findings show that a significant share of modern intrusions now occur outside traditional web traffic channels.

Key Insights

DNS abuse dominates: DNS-based tunneling, dynamic updates, and domain generation algorithms account for nearly 84% of non-web protocol attacks.

Brute-force activity surging: RDP represents over 90% of brute-force incidents, while SMB remains a key vector for lateral movement and ransomware propagation.

Retail and energy sectors hit hardest: Retail accounted for 62% of observed attacks, followed by energy and manufacturing industries where legacy systems persist.

Legacy protocols exploited: Long-trusted protocols like SMBv1 and RDP continue to be weaponized for access, persistence, and data exfiltration.

Further Reading: Zscaler – Under the Radar: How Non-Web Protocols Are Redefining the Attack Surface

Scattered LAPSUS$ Hunters Shift Tactics Toward EaaS & Insider Recruitment (Unit 42 / Palo Alto Networks)

Unit 42 reports that the cybercriminal group Scattered LAPSUS$ Hunters—known for major extortion operations—is evolving its approach. The group appears to be transitioning toward an Extortion-as-a-Service (EaaS) model while recruiting insiders and experimenting with new ransomware capabilities.

Key Insights

Extortion-as-a-Service model: The group is offering affiliates the ability to run extortion campaigns without relying on traditional ransomware encryption.

Insider recruitment drive: Members are openly seeking employees within telecom, gaming, SaaS, and hosting companies across several Western countries.

Data leak activity: Following a public deadline, the group released data allegedly tied to multiple aviation, energy, and retail organizations.

New ransomware development: References to a tool dubbed “SHINYSP1D3R” suggest potential expansion into full ransomware operations.

Broader targeting: Beyond major tech platforms, the group’s focus now spans hospitality, retail, and loyalty program data.

Further Reading: Unit 42 – Scattered LAPSUS$ Hunters Signal Shift in Tactics

Tykit: New Phishing Kit Stealing Hundreds of Microsoft Accounts in Finance (ANY.RUN)

Researchers at ANY.RUN have identified a new phishing kit framework, dubbed Tykit, that targets Microsoft 365 credentials across financial and corporate sectors. The kit demonstrates organized Phishing-as-a-Service (PhaaS) characteristics, allowing widespread deployment and efficient credential harvesting.

Key Insights

Broad targeting: Active since May 2025, Tykit campaigns have primarily targeted finance, construction, IT, and professional services organizations.

Layered delivery chain: Attacks begin with an SVG image embedding encoded JavaScript that redirects victims to fake Microsoft 365 login pages.

Credential exfiltration: After submission, stolen data is transmitted through encrypted POST requests to attacker-controlled command-and-control endpoints.

Evasion and MFA bypass: The kit detects analysis tools, restricts developer console access, and supports methods to bypass two-factor authentication.

Commercial reuse: Numerous samples share nearly identical domain patterns and code structures, indicating large-scale kit distribution.

Further Reading: ANY.RUN – Tykit Technical Analysis

Microsoft 365 Copilot — Arbitrary Data Exfiltration via Mermaid Diagrams (Adam Logue)

Adam Logue demonstrated an indirect prompt-injection technique against Microsoft 365 Copilot where a specially crafted Office document caused Copilot to fetch sensitive tenant data (e.g., recent emails), hex-encode it, and embed that encoded data into a generated Mermaid diagram. The diagram contained a clickable “login” artifact whose link pointed to an attacker server with the hex data in the URL; when activated the data was exfiltrated. Microsoft has since patched the issue by removing interactive/dynamic hyperlink behavior from Mermaid diagrams in Copilot.

Key Insights

Indirect prompt injection + rendering chain: The attack chained prompt injection (hidden instructions in document sheets) with Copilot’s ability to call enterprise search tools and then render outputs into Mermaid.

Mermaid as an exfil channel: Mermaid diagrams support CSS/hyperlink features that can be abused to place large, encoded payloads (hex strings) into clickable artifacts.

Encoded-data transport: Exfiltration relied on Copilot hex-encoding fetched data and embedding it in a URL — simple to decode from server logs once received.

Click vs zero-click nuance: Adam’s PoC required a click to transmit the data, but related research (e.g., Cursor IDE) shows remote rendering can enable zero-click variants — increasing risk where renderers auto-fetch remote content.

Patch validated: Microsoft removed interactive/dynamic hyperlink behavior in Mermaid renders for Copilot, mitigating the specific vector; defenders should still treat diagram rendering and LLM tool integrations as risky.

Further Reading: Adam Logue – Microsoft 365 Copilot: Arbitrary Data Exfiltration Via Mermaid Diagrams

Beyond Credentials: Weaponizing OAuth Applications for Persistent Cloud Access (Proofpoint)

Proofpoint researchers show how attackers are increasingly abusing OAuth applications to gain resilient, long-lived access inside compromised cloud environments. After an initial account takeover, adversaries can create or authorize internal OAuth apps with broad API scopes — allowing data access and command-and-control that survives password resets and MFA unless the malicious app is explicitly revoked.

Key Insights

Persistence beyond credentials: Malicious OAuth apps retain authorized access even after victims change passwords or enable MFA, creating durable backdoors.

Automatable attack flow: Proofpoint developed a proof-of-concept and tooling that demonstrate how attackers can fully automate app creation, permission assignment, and authorization.

Internal app abuse: Attackers leverage the ability to register or authorize internal (second-party) applications with custom scopes to read mailboxes, files, and other sensitive cloud resources.

Long-lived tokens & stealth: Tokens and app permissions can remain valid for extended periods (months to years) and are often overlooked by standard account-centric detections.

Detection gaps: Traditional defenses focused on credentials (password resets, MFA) are insufficient; defenders need app-centric telemetry and regular permission audits.

Further Reading: Proofpoint – Beyond Credentials: Weaponizing OAuth Applications for Persistent Cloud Access

Prompt Injection to RCE in AI Agents (Trail of Bits)

Trail of Bits demonstrates that argument-injection flaws in agent platforms can bypass “human approval” protections and lead to remote code execution (RCE). By exploiting pre-approved system commands whose arguments aren’t properly sanitized or separated, researchers achieved RCE across multiple popular agent implementations and propose design changes—like sandboxing and strict argument handling—to reduce the risk.

Key Insights

Approved-command attack surface: Allowlisting commands (e.g., find, git, rg) while failing to validate or safely separate arguments creates a powerful injection vector.

Argument injection practicalities: Attackers can craft arguments that append or alter behavior of pre-approved commands (e.g., via special characters, facet patterns or malformed flags) to escalate to arbitrary execution.

Human-approval bypass: Workflows that auto-execute “safe” commands without robust argument checks let adversaries bypass intended human-in-the-loop controls.

Cross-platform prevalence: Trail of Bits reproduced the class of vulnerability across three different agent platforms, suggesting the issue is a common design antipattern.

Evasion & usability tradeoffs: Naïve blocking of arguments breaks legitimate functionality; secure designs require careful argument modeling or safer alternatives (e.g., dedicated APIs).

Mitigations recommended: Use sandboxed execution, strong argument separation/parsing, avoid facade patterns that accept raw argument strings, and log/monitor command invocations for anomalous parameters.

Further Reading: Trail of Bits – Prompt injection to RCE in AI agents

Global Smishing Campaign Targets Mobile Users (Unit 42 / Palo Alto Networks)

A large-scale smishing (SMS phishing) campaign has been identified by Unit 42, targeting mobile users across multiple regions. Attackers are exploiting promotional hooks and limited oversight on mobile endpoints to deliver malicious links and credential-harvesting portals.

Key Insights

Many messages impersonate banks, logistics firms, or retail brands and include URLs leading to credential-stealing sites or malicious apps.

The campaign spans numerous countries and uses localized language and brand cues to increase trust and response rates.

Because mobile devices often lack the endpoint protections found on desktops, the campaign leverages the low visibility of mobile threats to evade detection.

Tactics include use of short-link services, dynamic domains, and rapid rotation of landing pages to defeat static blocklists.

Further Reading: Unit 42

Devman’s RaaS Launch: The Affiliate Who Aims to Become the Boss (Analyst1)

Research by Analyst1 reveals how a ransomware affiliate known as Devman evolved from working under major cybercrime groups to launching his own Ransomware-as-a-Service (RaaS) platform in late 2025. The report highlights his shift from affiliate to operator, his use of the leaked DragonForce code, infrastructure consolidation, and efforts to recruit new affiliates.

Key Insights

Affiliate turned service operator: Devman transitioned from a high-performing affiliate to creating his own RaaS offering.

Capital investment signals seriousness: He actively purchased initial access in Western countries and built a dedicated leak site with high ransom demands.

Leveraging leaked code & bugs: His ransomware variant reused DragonForce/Conti code, showing both operational maturity and technical flaws.

Recruitment & platform launch: The RaaS platform went live in late September 2025, featuring affiliate recruitment messaging and new infrastructure.

Branding and self-promotion: Devman’s public persona projects a “gangster-entrepreneur” image, reflecting how ransomware operators blend crime with marketing.

Further Reading: Analyst1

Insider Threats Loom While Ransom Payment Rates Plummet (Coveware)

Coveware’s latest report reveals that despite a sharp decline in ransom payments in Q3 2025, insider-caused incidents are growing in significance. Although organizations are less frequently paying ransoms, internal misuse, negligence, and compromised credentials by insiders are becoming key contributors to successful breaches.

Key Insights

Ransom payment decline: Payment rates have fallen substantially, suggesting organizations are shifting to alternative recovery approaches.

Insider risk rise: The proportion of incidents involving insiders—whether malicious, negligent, or compromised—has increased notably.

Less money, more tactics: While the ransom amounts may drop, attackers are still achieving impact through stolen credentials, insider access, or supply-chain leverage.

Mitigation gap: Many organisations focused on external threat vectors but lack rigorous controls for internal access monitoring, exit protocols, and third-party liaison.

Further Reading: Coveware – Insider Threats Loom While Ransom Payment Rates Plummet

Catching Credential Guard Off-Guard (SpecterOps)

SpecterOps researchers have detailed new techniques that undermine Windows Credential Guard, a key defensive feature meant to isolate and protect user credentials. The findings demonstrate how attackers with elevated privileges can bypass Credential Guard to extract sensitive authentication data, even in systems considered fully protected.

Key Insights

Bypass through privilege misuse: Attackers can exploit accounts with specific service permissions to sidestep Credential Guard’s memory isolation.

In-memory data extraction: New tools enable credential dumping directly from protected memory regions, exposing NTLM hashes and LSA secrets.

Detection blind spots: Many defenders rely on Credential Guard as a standalone safeguard; this research highlights the need for behavioral detection and anomaly monitoring.

Lateral movement risk: Compromised credentials obtained through these methods allow stealthier privilege escalation and movement within the network.

Further Reading: SpecterOps

LockBit Returns — and It Already Has Victims (Check Point Research)

The ransomware group LockBit, previously disrupted in early 2024, has re-emerged under a new variant known as LockBit 5.0 (ChuongDong). Check Point Research confirmed new attacks spanning Windows, Linux, and ESXi systems across multiple regions, signaling a full return of one of the most prolific Ransomware-as-a-Service (RaaS) operations.

Key Insights

Affiliate recruitment resumes: LockBit is again advertising in underground forums, rebuilding its affiliate ecosystem.

Expanded platform targeting: The updated variant includes support for Windows, Linux, and ESXi environments.

Enhanced capabilities: Faster encryption and new evasion methods improve operational efficiency for attackers.

Global victim impact: Confirmed incidents across multiple continents indicate the group’s infrastructure is fully operational again.

RaaS resilience: Despite past takedowns, the LockBit model demonstrates the durability of ransomware service ecosystems.

Further Reading: Check Point Research

The YouTube Ghost Network (Unmasked – Check Point Research)

Researchers at Check Point Research uncovered a large-scale malware-distribution operation on YouTube — dubbed the YouTube Ghost Network — which used compromised and fake channels to post over 3,000 videos offering game cheats and cracked software, but in fact delivering infostealers like Rhadamanthys and Lumma Stealer. Those videos amassed hundreds of thousands of views and were deliberately boosted with fake likes and comments to create trust. The network mapped multiple account-roles (video-uploads, community posts, interaction bots) and showed how malware actors are abusing platform trust and engagement tools to run self-infection traps at scale.

Key Insights

Role-based account structure: The network divided labor across accounts: content uploaders, engagement bots, and link/post sharers — enabling resilience even when channels were banned.

High-engagement deception: Some videos had hundreds of thousands of views and positive comment streams, increasing perceived legitimacy.

Infostealer distribution via “free” software lure: The campaigns baited users with cracked software or game hacks, directing them to archives hiding infostealers.

Massive scale and rapid growth: Over 3,000 malicious videos were identified, with 2025 upload volume tripling from prior years.

Platform-trust exploitation: Attackers leveraged YouTube’s social features to amplify reach and bypass traditional detection systems.

Further Reading: Check Point Research

Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited (Unit 42 / Palo Alto Networks)

A critical vulnerability in the Windows Server Update Services (WSUS) role—tracked as CVE-2025-59287—allows unauthenticated remote code execution (RCE) on Windows servers where WSUS is enabled. Researchers observed active exploitation following Microsoft’s emergency patch, making this a high-priority threat for enterprises.

Key Insights

Unauthenticated system-level access: Attackers exploiting the vulnerability can execute arbitrary code as SYSTEM on affected WSUS servers.

Wide exposure: Thousands of publicly exposed WSUS instances were detected, broadening the potential attack surface.

Rapid post-patch exploitation: Exploitation began shortly after an out-of-band update and the vulnerability was added to the U.S. known-exploited vulnerabilities catalog.

Reconnaissance & exfiltration patterns: Observed attack chains include WSUS service processes spawning shells that gather domain data and exfiltrate via webhooks.

Preventable risk exposure: WSUS should never be Internet-facing; failing to block default WSUS ports or disable unused roles significantly increases risk.

Further Reading: Unit 42

New Phishing Attack Uses Invisible Characters to Evade Filters (Cybersecurity News)

Security researchers have observed a campaign that embeds invisible Unicode characters (zero-width and similar) into email subjects and URLs to evade keyword-based filters and URL reputation checks. The technique breaks up recognisable words and link patterns so automated scanners miss them while email clients render the content normally for users — increasing click-through risk and lowering detection rates.

Key Insights

Invisible-character obfuscation: Attackers insert zero-width spaces, soft hyphens, and other invisible Unicode characters into subject lines and URLs to defeat pattern-matching and reputation checks.

MIME/encoding abuse: Malicious emails use MIME tricks and encoded attachments (SVGs, HTML) to hide payloads and redirect chains from straightforward inspection.

SafeLinks & gateway bypasses: The obfuscation can break or bypass URL-rewriting and safe-link protections, causing scanners to misclassify or truncate suspicious links.

User-facing normalcy: Message lists may display garbled or incomplete subjects while the opened email shows a readable, convincing lure — increasing the chance a recipient will engage.

Hunting signals: Look for unusually high counts of zero-width/unicode characters in subjects/URLs, mismatched subject rendering between list view and message view, and abnormal redirect chains from SVG/HTML attachments.

Further Reading: Cybersecurity News

Exploiting Trust in Collaboration: Microsoft Teams Vulnerabilities Uncovered (Check Point Research)

Check Point Research found multiple vulnerabilities in Microsoft Teams that let attackers manipulate conversations and notifications to impersonate colleagues, alter message content silently, and forge caller identities. The flaws exploit trust built into collaboration features—such as message identifiers, conversation topics, and call initiation fields—allowing attackers to mislead recipients without obvious signs of tampering.

Key Insights

Invisible message edits: Attackers can rewrite previously sent messages without triggering the “Edited” label, undermining the integrity of chat history.

Spoofed notifications: Notification fields can be manipulated so alerts appear to originate from trusted executives or colleagues.

Display-name manipulation: Conversation topics in private chats can be changed to alter displayed participant names, misleading recipients about who they’re speaking with.

Forged caller identity: Call initiation fields can be abused to present arbitrary names during audio/video calls, enabling convincing impersonation.

Platform-trust attack surface: Collaboration apps’ built-in trust signals (notifications, display names, edit markers) can be weaponized to bypass user assumptions and social-engineering defenses.

Further Reading: Check Point Research

Phishing Campaign Abuses Cloudflare Services (Cyber Security News)

A new large-scale phishing campaign has been discovered exploiting the infrastructure of Cloudflare Pages and ZenDesk to host malicious login portals, leveraging trusted cloud platforms to evade detection and harvest credentials. Over 600 malicious *.pages.dev domains were involved, using typosquatting of support portals and live chat operators to further trick victims. Cyber Security News

Key Insights

Trusted-platform exploitation: Attackers register domains under *.pages.dev (Cloudflare Pages) and use Zendesk hubs to make pages appear legitimate, thereby defeating reputation-based defenses.

Mass-scale credential harvest: More than 600 malicious domains were identified in the campaign, showing rapid registration and deployment of phishing infrastructure.

Live-chat assault vector: In some cases, human operators engaged victims via embedded chat interfaces, requesting phone numbers and convincing them to install remote tools under the guise of “support.”

Technical advance in delivery: The attackers used Google Site Verification and Microsoft Bing Webmaster tokens to validate fake pages and improve its search legitimacy and SSO poisoning potential.

Multi-vector exit stratagem: Beyond credential theft, the campaign steered victims to install legitimate remote-monitoring tools repurposed for malicious access, increasing post-compromise risk.

Further Reading: Cyber Security News