Country

Moldova

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 28, 2026 · last 14d ago

Timeline2 articles

Fake GTA 6 leaked copy drains your crypto wallet

A fake GTA 6 leaked-copy website loads a multi-chain crypto wallet drainer that sweeps Solana balances and can steal assets across seven blockchain networks.

A fake Grand Theft Auto VI countdown site offers a supposed leaked copy for $50 or 1 SOL and loads a wallet drainer on page visit. An embedded Solana script transfers nearly the entire wallet balance, while a separate 2.4 MB script built on a legitimate wallet-connector tool targets wallets on Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom, including stablecoins and NFT collections. The drainer geo-blocks CIS countries via a CIS_Protection setting, profiles visitor holdings, and evades automated scanners, suggesting a rented drainer-as-a-service.

Malwarebytes LabsSep 1, 16:07 UTC · 14d agoPhishing & fraud

Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations

Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.

Recorded Future's Insikt Group documented a BlueDelta (APT28/Fancy Bear/Forest Blizzard) espionage campaign from late September 2025 through early April 2026 targeting government and diplomatic organizations in Romania, Spain and Türkiye. The group delivered HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic lures, including one impersonating Spain's Ministry of the Presidency after a Spanish-Moldovan meeting. HOOKEDGE uses webhook.site as C2, a scheduled task every 30 minutes that downloads commands through Microsoft Edge, and canary pixels like docopened.jpg to track phishing funnel progress. A second tier with 5-minute check-ins served high-value victims, and beaconing intervals were stretched to 61 minutes to evade sandboxes; code overlap ties HOOKEDGE to BlueDelta's earlier HEADLACE backdoor.

Security AffairsAug 28, 11:26 UTC · 18d agoThreat actor in the wild

Appears with

threat actor APT28 1 threat actor BlueDelta 1 threat actor Fancy Bear 1 threat actor Forest Blizzard 1 malware HEADLACE 1 malware HOOKEDGE 1 malware wallet drainer 1 organization GRU 1 organization Insikt Group 1 organization Malwarebytes 1 organization Recorded Future 1 organization Rockstar Games 1 product Microsoft Edge 1 product Microsoft Word 1 product webhook.site 1 victim GTA 6 fans 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.