Threat Watcher

A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…

Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…

A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…

Proofpoint linked China-nexus actor TA419 to credential-phishing campaigns aimed at U.S. AI policy experts, including people at think tanks. The attacker impersonated well-known AI policymakers and an Anthropic executive, using believable “advisory committee” and “research questions” emails to draw…

A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…

Researchers found macOS users being tricked into installing a fake Zoom app that actually installs a persistent backdoor called CloudSyncD. The installer guides the victim through a normal-looking setup and prompts for the user’s password so it can run with elevated privileges and stay on the Mac…

After a Free Mobile customer data breach, scammers sent convincing emails that mimic Free Mobile’s real branding and templates. The emails claim a €9.99 unpaid invoice and threaten service suspension, pushing victims to a fake payment page that collects credit card details via redirect links.

A China-aligned group (TA419) targeted US AI policy experts by impersonating well-known AI and policy figures and sending friendly “collaboration” emails. If the target engaged, the attackers redirected them through multiple URLs to a fake Microsoft login pop-up designed to steal Microsoft 365…

A China-aligned espionage group (TA419) targeted U.S. AI policy experts by impersonating well-known public figures and sending credible policy-related invitations. After victims replied, the attackers sent shortened links that led to a fake OneDrive login designed to capture passwords, MFA codes,…

Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another…

Researchers found dozens of lookalike websites impersonating real crypto projects and promising a small, believable reward boost if users “vote” on a rewards distribution date. The vote is fake; clicking “Vote now” triggers a wallet connection prompt and can lead to malicious approval/signature…

Researchers say a China-aligned group (TA419) impersonated well-known AI policy figures and an Anthropic executive to lure US AI policy experts into replying to emails about a fake advisory committee or Senate report. Once a target engaged, the attackers sent shortened links that led through a fake…

A future security executive describes how, as a young teenager, he used deception to get a phone company to install a second phone line at his home. He posed as his father using a forged letter and a believable technical-sounding request (“dedicated low-noise line for a modem”), successfully…

Proofpoint reports a China-aligned espionage group (TA419) targeted U.S. AI policy experts at think tanks, universities, and law firms using phishing emails that impersonated well-known officials and AI industry figures. The attackers tried to start a conversation first, then sent a shortened link…

A China-aligned group (tracked as TA419) impersonated real AI policy figures and sent benign-sounding outreach to people working on AI policy at US and Japanese organizations. Once targets replied, the attackers sent a shortened link that ultimately led to a fake OneDrive/Microsoft 365 login page…

Researchers found a fake Zoom installer for macOS that tricks users into bypassing built-in security checks and entering their Mac login password. The password is used locally to run a second-stage backdoor with elevated privileges, enabling remote commands and additional payload delivery. Jamf did…

Microsoft reports that the Russia-linked group Star Blizzard (COLDRIVER) has expanded from small, highly targeted spear-phishing to larger phishing “blasts” hitting NGOs, think tanks, and government organizations. The campaigns use believable email themes like event invitations, tax audits, and…

Researchers report a sharp rise in scam victims at hundreds of financial institutions, with many scams starting on mobile devices. The article walks through a real scam session where a victim, guided by a phone call and remote access software, nearly sent a high-risk transfer to a new payee. It…

Research into Microsoft’s Copilot inside SQL Server Management Studio (SSMS) shows how “read-only” safeguards could be bypassed to run dangerous SQL commands using the victim’s existing database connection. The post demonstrates indirect prompt injection (malicious instructions hidden in files or…

OpenAI says it stopped a coordinated campaign that tried to copy (“distill”) its model’s reasoning by exploiting how the chat system handled encrypted reasoning data. Instead of hacking databases, the operators used carefully structured prompts at scale to get the model to reproduce protected…