ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “html”

14 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 122Vulnerability 76Malware 28Threat actor 16Phishing & fraud 14Ransomware 13Data breach 7Advisory 5
SeverityAllcritical 204high 57medium 19low 1info 0

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers · 23h agoPhishing & fraud in the wild2

New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

Fortra researchers track an active phishing campaign targeting Spanish speakers that abuses mshta.exe to run HTA payloads for reconnaissance and credential theft.

Fortra's FIRE team says a phishing campaign active since June 2026 targets Spanish-speaking users with invoice ('Facturación') and judicial ('Aviso Judicial') lures, many sent via libero.it/italiaonline.it infrastructure with SCL:-1 markings to bypass anti-spam. Clicking embedded links delivers an HTA launcher executed via mshta.exe, which hides its window off-screen, builds dynamic C2 URLs, and performs reconnaissance using WMI, PowerShell, and environment-variable inspection. A second-stage JavaScript dropper uses HTML smuggling to reconstruct a Base64-encoded ZIP in the browser, delivering a 7-Zip self-extracting executable disguised as a Firefox installer; staged design allows later delivery of credential stealers or ransomware. Defenders are urged to block archivogratuito[.]online and shortener domains goo[.]su, abrir[.]link, and abre[.]ai, and to restrict mshta.exe execution via AppLocker or ASR rules.

GBHackers · 5d agoPhishing & fraud in the wild1

GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds

eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.

eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.

Cyber Security News · 22h agoPhishing & fraud in the wild 9 sources5

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

OX Security researchers found 24 npm packages abusing unpkg mirrors to host fake Cloudflare CAPTCHA pages that redirect victims to attacker-controlled phishing infrastructure.

OX Security researchers documented 24 npm packages whose single HTML pages, once mirrored on services like unpkg.com, render as fake Cloudflare CAPTCHA pages on trusted domains and redirect victims to attacker-controlled phishing infrastructure for ClickFix attacks or credential harvesting. An earlier version contacted a typosquat Microsoft login domain (login.microsofte.live); after Chrome Safe Browsing blocklisting, the actor switched to the KeyVal key-value store as a dead drop resolver, currently redirecting to the legitimate ChatGPT site. The approach mirrors Socket's October 2025 report on 175 npm packages abusing unpkg.com in the Beamglea campaign.

The Hacker News · 22d agoPhishing & fraud in the wild

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.

Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.

Cisco Talos · 9d agoPhishing & fraud in the wild

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security News · 23h agoPhishing & fraud in the wild 2 sources

Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters

VBSpam Q3 2026 test shows phishers abusing DKIM-aligned domains, Amazon SES, and multi-stage URL cloaking to defeat email filters.

Virus Bulletin's Q3 2026 VBSpam test (AMTSO-LS1-TP207) found phishing campaigns moving payloads past the email itself via browser-fingerprinting gates, redirect chains, and hidden POST requests. Examples include a Dutch McAfee/TotalAV scareware renewal scam, a German overdue-payment Web3 fraud delivered via Amazon SES from DKIM-aligned moolaah.com, and Romanian BCR PSD2 credential phishing embedding IPv6-mapped URLs resolving to 103.193.179.223. Net at Work NoSpamProxy ranked first with a 99.995 score while open-source Rspamd caught only 62.55% of phishing mail.

GBHackers · 2d agoPhishing & fraud in the wild 2 sources

Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments.

Microsoft tracked a million-message AI-assisted BEC campaign impersonating executives with fake ServiceNow invoices to steal ~$50,000 ACH payments.

Microsoft detected over one million messages in a BEC campaign running August 3-5, using AI-assisted phishing templates, executive impersonation, and fabricated ServiceNow subscription invoices to trick finance teams into authorizing fraudulent ACH payments of roughly $50,000. The US received 87.7% of volume. Attackers used lookalike domains like service-nowinc[.]com registered just days before delivery, with no compromise of ServiceNow itself. Telltale signs included verbose HTML comments, uniform formatting, and inconsistent forwarded-message headers.

GBHackersupdated · 5d agofirst · 6d agoPhishing & fraud in the wild 2 sources

Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.

Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.

GBHackers · 8d agoPhishing & fraud in the wild

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.

Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.

Microsoft Security Blog · 13d agoPhishing & fraud in the wild1

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

Huntress · 15d agoPhishing & fraud in the wild1

ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign

Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.

Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild

Scam Attacks Taking Advantage of the Popularity of the Generative AI Wave

Unit 42 finds about 225 generative AI-themed domains registered daily since ChatGPT's launch, with nearly 29 percent suspicious, fueling scams and PUP delivery.

Palo Alto Networks analyzed new domain registrations containing generative AI keywords such as chatgpt, prompt, and sora since ChatGPT's November 2022 launch, observing around 225 GenAI-related registrations per day. About 28.75 percent of these domains are suspicious, a rate 22 times higher than for general new domains, with registration spikes aligning with milestones like Bing ChatGPT integration, the GPT-4 release, new GPTs, and OpenAI's Sora announcement. Over 72 percent of the domains use gpt or chatgpt keywords, and gpt domains show a 76 percent suspicious rate. Case studies cover PUP delivery, spam distribution, and monetized domain parking, with 35 percent of traffic to these domains directed at suspicious ones.

Palo Alto Unit 42 · Aug 17, 2026Phishing & fraud in the wild1