TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.
50
Product
AutoFocus
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
7 articles · newest firstxHunt Campaign: New Watering Hole Identified for Credential Harvesting
Unit 42 tied the xHunt campaign to a watering hole on a Kuwait government website used to passively harvest visitors' NTLM credential hashes.
52
Campaign Evolution: pseudo
Unit 42 traces the pseudo-Darkleech campaign's 2016 shift from Angler to Neutrino to Rig exploit kits and rotating ransomware payloads.
22
Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
24
"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.
26
Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.
27
Locky Ransomware Installed Through Nuclear EK
Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.
24
Appears with
- Palo Alto Networksvendor · 7
- Palo Alto Networksorganization · 6
- Cerbermalware · 3
- Lockymalware · 2
- CryptoMixmalware · 2
- Wiresharkproduct · 2
- WildFireproduct · 2
- Nuclear EKmalware · 1
- Trapsproduct · 1
- Ursnifmalware · 1
- Empire Packmalware · 1
- Miurefmalware · 1
- Proofpointorganization · 1
- KINSmalware · 1
- Gootkitmalware · 1
- xHuntthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.