Anthropic-themed phishing emails bypass secure email gateways
Since September, an unnamed actor has used fake Anthropic previews to steal Google and Microsoft credentials.
52
- Mentions · 7d1
- Mentions · 30d7
- All mentions15
- First seenAug 12, 2026
- Last mentioned1d ago
Timeline
15 articles · newest firstEight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Eight malicious npm packages, downloaded 40,767 times, installed Overlord RAT and a Node.js stealer.
73
Fake Zoom installer hides macOS backdoor CloudSyncD
Jamf analyzes CloudSyncD, a fake macOS Zoom installer that steals passwords and deploys a backdoor.
56
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
Jamf says a fake Zoom macOS installer now deploys the CloudSyncD backdoor for persistent access.
62
Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor
A fake Zoom installer tricks Mac users into launching CloudSyncD, a new privileged backdoor.
63
CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer
Jamf found CloudSyncD, a macOS backdoor in a fake Zoom installer that captures a password to launch its payload.
56
CloudSyncD Uses Invisible Unicode to Hide Phished Mac Passwords in Plain Sight
CloudSyncD, a fake Zoom macOS backdoor, hides phished passwords with invisible Unicode and calls live C2.
62
Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs
Hackers phish employees with fake Zoom and PDF installers that deploy signed MSP360 and ScreenConnect access.
72
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
76
Google Beam expands with new regions, partners, and customers
Google expands Beam telepresence hardware to six countries and an Industrious coworking network.
30
Google Beam expands with new regions, partners, and customers
Google Beam rolls out in six countries with HP hardware and Industrious access.
30
CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
CSuite targets US and EU organizations with device-code phishing and remote access. 60% of identified victims are US-based; 351 related sandbox analyses detected; 23 modules in the phishing panel.
90
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.
58
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.
72
Researchers found a way to hijack devices through Zoom screen sharing
Researchers used a public AI tool to find a Zoom flaw enabling device hijacking via screen sharing in under 20 prompts.
65
Related CVEs
by mentions- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
Appears with
- macOSproduct · 5
- CloudSyncDmalware · 5
- Zoomvendor · 4
- Applevendor · 4
- Jamforganization · 4
- Microsoftvendor · 4
- Googlevendor · 3
- Google Meetproduct · 3
- HP Dimensionproduct · 2
- Telegramproduct · 2
- Google Beamproduct · 2
- OneDriveproduct · 2
- Industriousorganization · 2
- Windowsproduct · 2
- HPvendor · 2
- Capital Grouporganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.