30
30
30
FBI raises alarm over deceptive phishing campaign targeting prominent people
The FBI warns of an ongoing OAuth consent phishing campaign granting attackers persistent access to high-profile victims' cloud accounts without passwords.
The FBI says attackers impersonate government officials, journalists and event coordinators on commercial messaging apps to trick prominent individuals, their families and acquaintances into authorizing malicious OAuth applications on Microsoft or Google cloud services. Once approved, attackers gain persistent access to emails, files and other sensitive data; the access survives password changes and bypasses MFA, and can only be revoked by invalidating the OAuth token in security settings. The campaign has been tracked since late 2025, and the FBI advises independently verifying senders and granting access only to trusted applications.
62
Kimwolf botnet rebuilt to survive takedowns, researchers say
Palo Alto Unit 42 reports the Kimwolf/Aisuru botnet now uses HTTP/2 Chrome-impersonation floods and Ethereum blockchain-based command resolution to survive takedowns.
Palo Alto Networks' Unit 42 says a new Kimwolf/Aisuru botnet version active since February conducts DDoS floods over HTTP/2 with full Chrome browser fingerprints, making attack traffic hard to distinguish from real users. The malware resolves command servers via the Ethereum Name Service using five shuffled Ethereum endpoints, with a Tor hidden service fallback, so authorities cannot seize a domain or serve a takedown order. The botnet, powered mostly by hijacked Android TV boxes and IoT devices, previously had servers seized and an alleged operator arrested; new C2 infrastructure traces to a single network in Saint Petersburg, Russia. It is unclear whether the same developers built the new version.
57
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
45
30
30
30
45
30
30
30
45
45
30
30
30
30
30
30
30
30
30
45