2026-08-17 09:00 UTC
Other
Other
How QR-code phishing can slip past corporate security measures
Quishing has become a popular alternative to traditional phishing. Here’s how businesses can close the gap.
P0
LATEST
Aggregated cybersecurity reporting, advisories and research. 233 matching records.
AUTO-POLL // 2026-10-04 09:05 UTC
CYBER INTEL TEMPERATURE
TODAY'S AGGREGATED INTELLIGENCE
COOL
COOL
WARM
ELEVATED
HOT
CRITICAL
P9 / P100
7-DAY C.I.T. REPORT
CYBER CONDITIONS // DAILY C.I.T. READINGS
TODAY → 6 DAYS AGO
TODAY
Oct 4
RANSOMWARE
P9
COOL // 5 ARTICLES
SAT
Oct 3
RANSOMWARE
P4
COOL // 14 ARTICLES
FRI
Oct 2
RANSOMWARE
P7
COOL // 46 ARTICLES
THU
Oct 1
RANSOMWARE
P8
COOL // 63 ARTICLES
WED
Sep 30
RANSOMWARE
P10
WARM // 59 ARTICLES
TUE
Sep 29
RANSOMWARE
P4
COOL // 68 ARTICLES
MON
Sep 28
RANSOMWARE
P7
COOL // 52 ARTICLES
2026-08-14 14:00 UTC
Security Journalism
Security Journalism
The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI
Google Workspace attacks do not always begin with phishing. Stolen OAuth tokens can provide another path into Gmail, Drive, and connected systems. Material Security explains why organizations need defenses that cover the entire Workspace attack chain. [...]
P0
2026-08-14 10:57 UTC
Security Journalism
Security Journalism
CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps
Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-the-Browser (BitB) windows to steal Google and Facebook credentials and, in more advanced cases, relay multi-factor authentication (MFA) prompts in real time. CTM360, which detailed the activity in a new report titled RecruitTrap, said it
P0
2026-08-13 10:00 UTC
Vendor Research
Vendor Research
Dissecting the JWR phishing framework
Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms.
P0
2026-08-10 13:19 UTC
Security Journalism
Security Journalism
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development
North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence (AI) offline on its own servers, connecting document-search tools to files in its possession, and collecting the software parts needed to build AI into its malware. South Korean security firm Genians says it uncovered the
P0
2026-08-10 12:25 UTC
Security Journalism
Security Journalism
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the victim's machine, and used a
P0
2026-08-07 18:16 UTC
Security Journalism
Security Journalism
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. Significantly, the threat actor often contacts employees via
P0
2026-08-07 10:38 UTC
Security Journalism
Security Journalism
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails
Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email. "The campaign uses residential proxies to disguise malicious sign-ins as ordinary consumer traffic,
P0
2026-08-06 14:00 UTC
Vendor Research
Vendor Research
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
Written by: Tyler McLellan, Austin Larsen Introduction Google Threat Intelligence Group (GTIG) continues to track UNC6671 actively conducting compromises leading to data theft extortion, despite the alleged announced retirement of the BlackFile extortion brand in May 2026. Telemetry and infrastructure analysis reveal that rather than disbanding, UNC6671 has diversified its operations across multiple extortion fronts including Redact, Pink, Helix, and Falcon. UNC6671 continues to rely on voice p…
P0
2026-08-04 13:00 UTC
Security Journalism
Security Journalism
Bank of America Phishing Email Delivers ScreenConnect Malware
A fake Bank of America phishing email kicks off a multi-stage malware infection chain. See how one convincing bank scam unravels.
P0
2026-08-04 07:00 UTC
Security Journalism
Security Journalism
Device Code Phishing Up 1,500% in 2026; Vishing Doubles
Newer social engineering techniques help attackers ignore entrenched security controls and limit the evidence they leave behind.
P0
2026-07-31 21:01 UTC
Vendor Research
Vendor Research
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch. The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft appeared first on Microsoft Security Blog.
P0
2026-07-31 13:00 UTC
Security Journalism
Security Journalism
Device Code Phishing Keeps Evolving. Here’s What to Watch For
Huntress is tracking an evolving wave of device code phishing that abuses trusted Microsoft 365 sign-in flows. Learn the signals defenders should watch for and how to respond.
P0
2026-07-28 10:00 UTC
Vendor Research
Vendor Research
IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
Talos IR's Q2 report highlights a significant surge in phishing-based initial access and the weaponization of legitimate remote management tools. Learn how to sharpen your defenses.
P0
2026-07-27 09:32 UTC
Other
Other
No Room For Compromise: How Business Email Protection Predicts BEC Before It Starts
Most business email compromise (BEC) attacks start with stolen credentials, not a malicious email. Group-IB uses threat intelligence to detect compromised accounts before attackers log in — predicting BEC before it starts.
P0
2026-07-16 14:00 UTC
Security Journalism
Security Journalism
Custom HTML for Custom Phishing: Make the Fake Feel Real
Build personalized, realistic phishing scenarios with Huntress Custom HTML for Custom Phishing, tailored to your organization's unique risks and vendors.
P0
2026-07-09 20:00 UTC
Security Journalism
Security Journalism
Reduce Human Risk | Build a Strong Security Awareness Training Program | Huntress
Build a security awareness training program that actually changes user behavior. Huntress Managed SAT delivers engaging content, phishing sims, and results.
P0
2026-07-07 12:00 UTC
Security Journalism
Security Journalism
Meta Phishers Abuse Business Account Manager Service | Huntress
Huntress is tracking a threat actor group as they evolve a phishing attack that uses a Facebook feature to send the initial spam lure.
P0
2026-07-02 12:00 UTC
Security Journalism
Security Journalism
Celebrating Canada Day with Localized Managed Phishing
Huntress Managed SAT now offers localized phishing simulations for Canada, using familiar, country-specific brands and scenarios to provide more effective security awareness training for your learners.
P0
2026-07-01 08:35 UTC
Other
Other
Phishing in the Balkans: Fake Traffic Fines, Real Losses
This blog documents Group-IB’s research into an SMS phishing campaign targeting Serbian road users through the impersonation of Serbia's state road authority, and how it can be linked to both Darcula and Phoenix PhaaS platforms with victims across the globe.
P0
2026-06-22 13:00 UTC
Security Journalism
Security Journalism
We Need to Talk About Device Code Phishing
During the June Tradecraft Tuesday, Huntress researchers looked at device code phishing variations and why threat actors love this attack so much.
P0
2026-06-18 04:45 UTC
Other
Other
GitBait: Phishing dirigido al sector financiero mexicano
Se ha descubierto una infraestructura de phishing modular dirigida a múltiples bancos mexicanos, que abusa de GitHub Pages, emplea scripts ofuscados y centraliza la exfiltración de credenciales mediante la API de SheetBest, lo que indica una operación de phishing escalable y persistente de múltiples marcas.
P0
2026-06-17 06:57 UTC
Other
Other
GitBait: Phishing the Mexican Financial Sector
A modular phishing infrastructure targeting multiple Mexican banks has been uncovered, abusing GitHub-hosted Pages, employing obfuscated scripts, and featuring a centralized credential exfiltration via SheetBest API, indicating a scalable and persistent multi-brand phishing operation.
P0
2026-06-15 14:00 UTC
Security Journalism
Security Journalism
The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
A compromised terminal server became a phishing stager. A fake Boots survey aimed at 8.9 million inboxes, with the payload on a hacked Bolivian government site.
P0
2026-06-15 14:00 UTC
Vendor Research
Vendor Research
Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research
Written by: Patrick Whitsell, John McGuiness, Muhammad Umair Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abuse…
P0
2026-06-15 08:55 UTC
Other
Other
EvilTokens: A phishing attack that doesn’t steal your password
A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages
P0
2026-06-11 18:00 UTC
Security Journalism
Security Journalism
Inside Kali365, a Device Code Phishing Ecosystem | Huntress
Huntress traced device code phishing from Tencent Cloud to Kali365, a Microsoft 365 kit that steals tokens and keeps access even after MFA or password resets.
P0
2026-06-11 07:51 UTC
Other
Other
Sniper’s Nest: From Brand Impersonation to Browser Hijacking and CPA Fraud
This blog provides a deep-dive into SniperDz, a centralised PhaaS platform with more than 80 ready-made phishing templates impersonating over 30 global brands, and uncovers the hidden infrastructure behind this sophisticated and highly-organized fraud ecosystem.
P0
2026-06-10 07:33 UTC
Other
Other
SilabRAT, What’s Your Power?
SilabRAT (aka SnappyClient) is an advanced Remote Access Trojan (RAT) sold as a Malware-as-a-Service (MaaS) on Darkweb forums. Developed by the threat actor "o1oo1," SilabRAT is heavily focused on financial gain through credential theft. It offers stability and is capable of bypassing existing security measures.
P0
2026-06-05 14:00 UTC
Vendor Research
Vendor Research
Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms
Written by: Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer, Tyler McLellan Introduction From January through May 2026, Mandiant identified a financially motivated data theft extortion campaign executed by the threat cluster UNC3753 (also tracked as "Luna Moth," “Chatty Spider,” and "Silent Ransom Group") targeting dozens of organizations across professional, legal, and financial services in the United States. UNC3753 leverages voice phishing (vishing) and social engineering deception tech…
P0