Threat Watcher

Researchers found a real campaign offering fake “desktop apps” for major U.S. payroll/HR platforms that don’t actually provide desktop software. Victims who install the download unknowingly install ScreenConnect remote access configured for silent, unattended control, giving attackers a direct path…

A researcher demonstrated that attackers can take over a company’s branded QR-code subdomain (e.g., qr.company.com) if the company stops using a QR vendor but forgets to remove the DNS record. Anyone scanning a legitimate printed QR code can then be redirected to an attacker-controlled website,…

Researchers found flaws in Salesforce Agentforce that let attackers plant “poisoned” lead data which the AI agent later processed and used to silently leak CRM data, without any employee click. A related Slack integration flaw could also let attackers send phishing messages that appear to come from…

A security professional was approached by an unknown, likely fake social-media profile offering $300 for a short “digital transformation” phone consultation. The pitch was a confidence trick designed to screen for useful access and then escalate into requests for non-public information that could…

This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…

A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a…

A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…

A CTM360 report describes real-world “ClickFix” campaigns where attackers compromise legitimate websites and show fake error/verification messages that trick users into copying a command and pasting it into trusted system tools (Run box, PowerShell, Terminal). This approach avoids traditional…

Researchers say the RemControl Android banking trojan tricks people into installing a fake “TVTap” IPTV app from look‑alike Google Play pages promoted via ads. Once installed, it abuses Android permissions to take over the phone, show fake banking login screens, and steal PINs and other banking…

This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…

Astrana Health disclosed that attackers stole private and confidential data after using social engineering to trick employees. The attackers impersonated Astrana personnel and spoofed the company’s main phone number to contact staff, leading to unauthorized access to servers and data exfiltration.

Kaspersky reports a real-world MacSync infostealer campaign seen in September 2026 that tricks users into installing fake or cracked macOS apps. The attack uses staged downloads (including iCloud Calendar content) and then prompts the user for an administrator password using realistic-looking…

Researchers reported a real developer-targeting campaign linked to DPRK actors where attackers pose as legitimate recruiters or Web3 companies and trick targets into running code or pulling poisoned dependencies. The operation has now expanded to include malicious Terraform providers hosted in the…

Scammers are using realistic LinkedIn recruiter profiles and even verified company pages to post fake jobs that push people to off-platform sites or email addresses. The scams aim to take money (e.g., paid “resume help”) or collect sensitive personal data like driver’s licenses or Social Security…

Researchers reported a real phishing campaign delivering the DarkMe remote-access trojan by emailing victims a link that appears to download a PNG image. Instead, the click downloads a disguised Windows executable (.pif) that runs when double-clicked and then pulls additional stages to install an…

Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…

Microsoft disrupted “EvilTokens,” a subscription cybercrime service that stole Microsoft account access using device-code phishing and then used AI-style automation to rapidly mine victims’ inboxes for payment and org-chart details. The goal was to quickly craft believable payment-fraud messages…

Microsoft says it disrupted the “EvilTokens” phishing-as-a-service platform, which it links to compromises of over 12,000 inboxes across more than 10,000 organizations. The service used AI to tailor phishing emails to a victim’s role and to analyze compromised inboxes to identify trusted…

Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…

Microsoft says it disrupted “EvilTokens,” an AI-assisted phishing service used to trick employees into authorizing attacker access via the device-code login flow (often used for TVs/printers). Victims who entered an attacker-provided code in their browser unknowingly granted access tokens that…