Threat Watcher

Cisco Talos observed an APT spear-phishing campaign targeting people affiliated with Taiwan research organizations using credible-looking public event invitations. Attackers impersonated well-known academic/policy institutions, used mismatched “safe-looking” registration links, and in some cases…

Researchers at ANY.RUN report a real-world phishing operation (“Wazza”) targeting banking, government, and manufacturing in the U.S., Europe, and Australia. The campaign uses a multi-step redirect and validation chain to filter out bots and only then shows an Adobe-branded “Device Code” sign-in…

Researchers found 16 malicious Firefox browser extensions pretending to be Rabby or OKX crypto wallets. When a user imports a wallet, the fake add-ons capture the recovery phrase/private key and send it to attacker-controlled Cloudflare Workers, enabling wallet takeover and theft.

ESET reports that the Russia-aligned group UAC-0099 used spear‑phishing emails to trick victims in Ukraine into clicking a link that downloads a malicious archive. The infection chain runs a script that installs MATCHBOIL, which then downloads a spying backdoor (MATCHWOK) and sets persistence so it…

Sonatype reports Q3 2026 saw 149,329 malicious open-source packages, with many designed to steal secrets or download additional malware after installation. The article highlights real supply-chain incidents where attackers abused developer trust and automated workflows, including a case where a…

The article describes a real phishing investigation where attackers used an adversary-in-the-middle (AiTM) proxy to relay a genuine Microsoft sign-in and steal both credentials and the victim’s live session token. The lure came from a legitimately compromised corporate mailbox, making common email…

A construction/landscaping firm’s executive email account was compromised and used to send convincing “request for proposal” (RFP) emails to another company, tricking recipients into entering Microsoft 365 credentials and an MFA code on a fake login page. The attackers used a man-in-the-middle…

ASOS confirmed an unauthorized push notification was sent to customers through its official mobile app, claiming the retailer was “hacked” and threatening to leak data unless ASOS engaged with the attackers. The message attempted to pressure ASOS’ security and privacy teams and directed the company…

Microsoft reports a real Midnight Blizzard-linked campaign where attackers tamper with hotel Wi‑Fi captive portals to redirect travelers to phishing and fake update pages. The goal is to steal credentials or trick users into installing malware, which can follow employees back into corporate…

Researchers found a real phishing operation that pretends to offer AI marketing tools (e.g., “Muse Ads”) and prompts users to click “Connect” to log in. The login pop-up looks like Google or Okta, but it’s a fake browser window embedded inside the webpage, designed to steal passwords and MFA codes,…

Attackers briefly took over Microsoft’s official Twitter/X account and rebranded it with a Clippy avatar to push a Clippy-themed cryptocurrency scam. Posts suggested the token was tied to Microsoft’s stock price, potentially tricking followers into thinking it was legitimate. A fake “corporate”…

Okta analyzed thousands of real social-engineering incidents and found most account takeovers still rely on stealing passwords and then bypassing MFA through push prompts or one-time codes. Okta described multiple campaigns where attackers phished credentials and then talked victims into using…

Surfside Beach, South Carolina lost $545,598.30 after staff wired money to a fraudulent account based on emails from a lookalike domain. The forensic review found no compromise of the town’s internal systems or Microsoft 365, attackers simply registered a near-identical domain and used it to…

Cofense tracked real email campaigns targeting hotels with fake guest complaints, reviews, and inquiries. The emails push staff to click a link and open what looks like a photo or video, but it leads to a disguised Windows shortcut (LNK) that installs remote-access malware. The malware hides its…

Barracuda analyzed a real phishing campaign where one email was designed to trick both a person and the AI assistant summarizing their inbox. The messages used normal phishing lures (like password-protected attachments) while also hiding “prompt injection” instructions to make AI summaries label…

ASOS customers received an unauthorized push notification sent through ASOS’s real mobile app. The message claimed ASOS’s Snowflake environment was compromised and urged recipients to contact the sender via Telegram, leveraging the trust people place in official app notifications. ASOS said it was…

Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…

Microsoft observed a ClickFix campaign where compromised websites show a fake CAPTCHA that tricks people into opening Windows Run and executing a pasted command. The attack hides a VBScript payload in the browser cache (disguised as an image) so the device already has the file locally when the…

ASOS customers received an unexpected push notification inside the official ASOS app claiming the retailer had been hacked and demanding engagement to prevent data leaks. ASOS confirmed it was an “unauthorised customer notification” tied to third‑party messaging platforms and said it restricted…

Attackers compromised over 100 legitimate websites and showed visitors in Ukraine a fake Cloudflare verification page. The page instructed users to copy and run a PowerShell command, which instead installed Lunex Stealer to steal passwords, tokens, and crypto wallet data and enable remote access.…