China-linked actor UTA0565 sent phishing emails that pushed recipients to click spoofed links to fake media/NGO websites. Visiting the sites triggered a Chrome-to-Windows zero-day exploit chain that escaped the browser sandbox and installed CLEANGULP malware for remote control.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Support Chow Hang-tung, sign the joint NGO letter.” Looks legit, even name-drops Center for American Progress. But the link goes to americanprgoress.top, a fake CAP site. Just visiting it can quietly trigger a Chrome-to-Windows zero-day chain and drop malware named chrome_cleanup.exe. Same trick with chinadigitaltimes.top. These cloned media and NGO sites load hidden iframes, then CLEANGULP malware phones home to a lookalike news domain over plain HTTP. If an advocacy or media email wants you to click, pause and hover: if the link isn’t the exact domain you expect, like americanprogress.org or chinadigitaltimes.net, do not open it.
Researchers say a China-aligned group (UTA0565) sent phishing emails to government targets and used multiple fake websites to lure victims into visiting pages that triggered a Chrome-and-Windows zero-day exploit chain. The messages used political advocacy themes and spoofed well-known organizations…
China-linked attackers targeted NGOs with spear-phishing emails that urged recipients to click a link to a legitimate U.S. university website. The link path abused a website flaw to silently redirect victims to attacker infrastructure, which then exploited Chrome and Windows to install malware…
Researchers reported four separate espionage groups using the same “BlueMoon” exploit kit within days, targeting organizations in the US and Southeast Asia. The attacks began with phishing emails that lured recipients to attacker-controlled websites, where Chrome and Windows vulnerabilities were…
Multiple suspected China-linked espionage groups used a new exploit kit (“BlueMoon”) that starts with phishing emails and a malicious link to break into organizations in the US and Southeast Asia. Clicking the link can trigger browser and Windows vulnerabilities to install surveillance tools,…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
