60
60
60
60
60
60
60
60
60
60
60
60
60
60
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.
Google's Threat Intelligence Group documented three suspected Russia-linked clusters, UNC6293, UNC7005, and UNC5976, abusing legitimate authentication flows. UNC6293, a likely APT29/ICE RELIC sub-cluster, impersonates US State Department officials in app password and OAuth phishing targeting fewer than five victims at a time. UNC7005, tracked by Microsoft as STORM-2945, spoofs the GLOBSEC conference, runs device code phishing against Microsoft and WhatsApp accounts, and deploys VIDAR and AtomicStealer infostealers. Targets include researchers, academics, diplomats, think-tank analysts, and defense personnel in Europe and the United States.
82
60
60
60
60
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants
Head Mare APT exploits unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants.
Kaspersky discovered malicious TrueConf software installers used by the Head Mare APT group to deploy the PhantomCore and PhantomGraph backdoors. The group exploits vulnerabilities in an unpatched TrueConf server to reach targets. Video conference participants are infected via the trojanized installers.
67
Week in review: Critical SAP NetWeaver flaw exploited, RSAC 2025 Conference
60
60
60
60
60
45
60
60
Delta investigates in-flight Wi-Fi spoofing on post
A passenger on Delta flight 591 allegedly spoofed the airline's in-flight Wi-Fi with a rogue access point, prompting an FBI and FAA investigation.
Delta Airlines is investigating an incident on flight 591 from Las Vegas to Atlanta in which a passenger reportedly created a rogue Wi-Fi network named 'Delta WiFi Fast' to steal sensitive passenger data. The cabin crew deactivated the aircraft's Wi-Fi for roughly 30 minutes, and Delta says flight safety and aircraft operating systems were never affected. The FBI's Atlanta office and the FAA acknowledged awareness of the incident, which bears hallmarks of an evil twin attack involving spoofed login portals and credential harvesting. DEF CON organizers said this year's conference in Las Vegas also suffered multiple similar deauthentication Wi-Fi attacks.
50
60
60
60
60
60
60
60
60
60
60
60