Threat Watcher

Researchers reported multiple cases where AWS autonomous agents could be manipulated with prompt injection to reveal or extract cloud credentials. In demonstrations, the agent returned live temporary AWS credentials, enabling access to code, other agents, and sensitive data, showing how a single…

Scammers are targeting YouTube creators with personalized “sponsorship” emails that lead to a convincing fake collaboration website. The site pulls public channel data, then asks the creator to “Sign in with Google” to “verify” the channel, stealing the password and one-time code to take over Gmail…

Researchers say the Russia-aligned group UAC-0099 has been phishing Ukrainian organizations with malicious links that install a data-harvesting malware called MatchBoil. The emails have included lures like fake Ukrainian court summonses, and clicking the link leads to downloading an archive that…

A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…

Cisco Talos observed an APT spear-phishing campaign targeting people affiliated with Taiwan research organizations using credible-looking public event invitations. Attackers impersonated well-known academic/policy institutions, used mismatched “safe-looking” registration links, and in some cases…

Researchers at ANY.RUN report a real-world phishing operation (“Wazza”) targeting banking, government, and manufacturing in the U.S., Europe, and Australia. The campaign uses a multi-step redirect and validation chain to filter out bots and only then shows an Adobe-branded “Device Code” sign-in…

Researchers found 16 malicious Firefox browser extensions pretending to be Rabby or OKX crypto wallets. When a user imports a wallet, the fake add-ons capture the recovery phrase/private key and send it to attacker-controlled Cloudflare Workers, enabling wallet takeover and theft.

ESET reports that the Russia-aligned group UAC-0099 used spear‑phishing emails to trick victims in Ukraine into clicking a link that downloads a malicious archive. The infection chain runs a script that installs MATCHBOIL, which then downloads a spying backdoor (MATCHWOK) and sets persistence so it…

Sonatype reports Q3 2026 saw 149,329 malicious open-source packages, with many designed to steal secrets or download additional malware after installation. The article highlights real supply-chain incidents where attackers abused developer trust and automated workflows, including a case where a…

The article describes a real phishing investigation where attackers used an adversary-in-the-middle (AiTM) proxy to relay a genuine Microsoft sign-in and steal both credentials and the victim’s live session token. The lure came from a legitimately compromised corporate mailbox, making common email…

A construction/landscaping firm’s executive email account was compromised and used to send convincing “request for proposal” (RFP) emails to another company, tricking recipients into entering Microsoft 365 credentials and an MFA code on a fake login page. The attackers used a man-in-the-middle…

ASOS confirmed an unauthorized push notification was sent to customers through its official mobile app, claiming the retailer was “hacked” and threatening to leak data unless ASOS engaged with the attackers. The message attempted to pressure ASOS’ security and privacy teams and directed the company…

Microsoft reports a real Midnight Blizzard-linked campaign where attackers tamper with hotel Wi‑Fi captive portals to redirect travelers to phishing and fake update pages. The goal is to steal credentials or trick users into installing malware, which can follow employees back into corporate…

Researchers found a real phishing operation that pretends to offer AI marketing tools (e.g., “Muse Ads”) and prompts users to click “Connect” to log in. The login pop-up looks like Google or Okta, but it’s a fake browser window embedded inside the webpage, designed to steal passwords and MFA codes,…

Attackers briefly took over Microsoft’s official Twitter/X account and rebranded it with a Clippy avatar to push a Clippy-themed cryptocurrency scam. Posts suggested the token was tied to Microsoft’s stock price, potentially tricking followers into thinking it was legitimate. A fake “corporate”…

Okta analyzed thousands of real social-engineering incidents and found most account takeovers still rely on stealing passwords and then bypassing MFA through push prompts or one-time codes. Okta described multiple campaigns where attackers phished credentials and then talked victims into using…

Surfside Beach, South Carolina lost $545,598.30 after staff wired money to a fraudulent account based on emails from a lookalike domain. The forensic review found no compromise of the town’s internal systems or Microsoft 365, attackers simply registered a near-identical domain and used it to…

Cofense tracked real email campaigns targeting hotels with fake guest complaints, reviews, and inquiries. The emails push staff to click a link and open what looks like a photo or video, but it leads to a disguised Windows shortcut (LNK) that installs remote-access malware. The malware hides its…

Barracuda analyzed a real phishing campaign where one email was designed to trick both a person and the AI assistant summarizing their inbox. The messages used normal phishing lures (like password-protected attachments) while also hiding “prompt injection” instructions to make AI summaries label…

ASOS customers received an unauthorized push notification sent through ASOS’s real mobile app. The message claimed ASOS’s Snowflake environment was compromised and urged recipients to contact the sender via Telegram, leveraging the trust people place in official app notifications. ASOS said it was…