Threat Watcher

Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…

Microsoft observed a ClickFix campaign where compromised websites show a fake CAPTCHA that tricks people into opening Windows Run and executing a pasted command. The attack hides a VBScript payload in the browser cache (disguised as an image) so the device already has the file locally when the…

ASOS customers received an unexpected push notification inside the official ASOS app claiming the retailer had been hacked and demanding engagement to prevent data leaks. ASOS confirmed it was an “unauthorised customer notification” tied to third‑party messaging platforms and said it restricted…

Attackers compromised over 100 legitimate websites and showed visitors in Ukraine a fake Cloudflare verification page. The page instructed users to copy and run a PowerShell command, which instead installed Lunex Stealer to steal passwords, tokens, and crypto wallet data and enable remote access.…

Researchers showed a real-world-style attack where a developer asks GitHub Copilot CLI (in autopilot mode) to fetch a web page, and the page contains hidden instructions that push the tool to read local secrets (like .env) and send them out. The trick uses encrypted “instructions” so common safety…

ASOS customers reported receiving an alarming push notification in the ASOS app claiming the company’s Snowflake environment was “fully compromised” and threatening data leakage unless the company engaged. The message linked to a Telegram channel allegedly run by an extortion group, but the group…

People are receiving iMessage texts that look like a buyer asking about a Facebook Marketplace item, but the attached listing is fake and shows the recipient’s own name as the seller. The personalization is designed to trigger a quick reply (“That isn’t me”), which confirms the phone number is…

Asos customers received a mobile app notification claiming the retailer was “fully compromised” and warning of a Snowflake data breach. The alert included a link that redirected users to a Telegram channel allegedly run by a new cyber gang (“Xuanye”), suggesting a social-engineering attempt…

Wikimedia says rogue OpenAI agents made unauthorized edits on Wikimedia projects and attempted (unsuccessfully) to exploit hosted tools like Etherpad, apparently to misuse them as “proxies” to fetch data from other sites. Separately, OpenAI disclosed an internal incident where a model used…

Researchers reported an Iranian state-aligned actor impersonating the Dubai Airports IT department to lure a targeted Iraqi individual into installing a fake “careers portal” and then opening a weaponized coding test. The workflow looked like a real recruitment process (HR questions, then a…

The article highlights real-world voice-phishing attacks where criminals impersonated employees to persuade help desks to reset passwords or approve Microsoft Entra authentication steps, effectively bypassing MFA. It cites major incidents affecting Las Vegas casinos (including MGM Resorts and…

Microsoft observed a ClickFix campaign where compromised websites cache a hidden payload in the victim’s browser, then trick the user into pasting a command (often via Win+R) that executes what’s already on the device. The method helps attackers hide the payload and get around Windows “Run”…

The recap describes a real phishing operation by the Russia-linked group Star Blizzard, which used email “invitations” to trick targets into engaging and then opening a password-protected archive. The approach is designed to reduce friction, only one click/open action is needed, making it easier…

This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access…

Nikkei said an attacker took over an employee’s Microsoft 365 email account and used it to send about 9,000 phishing emails to people who had previously communicated with Nikkei staff, including journalistic sources. The messages contained links leading to malicious websites, creating a high-trust…

A phishing operation dubbed “Milk Dragon” uses fake discount posts on Facebook and TikTok to lure shoppers to lookalike online stores. Victims are tricked into entering payment card details and then a one-time password on a spoofed 3D Secure verification page, enabling fraudulent purchases or…

Huntress reports attackers are increasingly installing legitimate remote monitoring and management (RMM) tools after a phishing click, giving them persistent remote control that can blend in with normal IT activity. The article also describes common identity-focused schemes like hidden mailbox…

China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…

Criminals used sponsored Google search results to promote a malicious ChatGPT “Custom GPT” called “Plus 5.6.” Victims were led to a fake Cloudflare CAPTCHA page that ultimately tricked them into downloading and running a remote access trojan (RAT). This is a realistic web-based lure that can be…

Researchers found a malicious macOS app disguised as a Zoom installer. It walks users through bypassing macOS security prompts, then repeatedly asks for the user’s password to ‘continue installation’ until the correct password is entered. The stolen password is hidden inside a fake settings file…