Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
Microsoft disrupted three Chinese phishing platforms that enabled more than 750 million impersonation messages.
Stories per day · 30 days
4 RSS
Relatedmicrosoft2china1cogui1credential-theft1domain-seizure1japan1phishing1phishing-as-a-service1phishing-kit1storm-29901storm-31191yam-store1
11 stories, newest first · one card per story
Stories tagged #initial-access-broker
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft details a Chinese-language phishing-kit market that enabled over one billion messages to 75,000 organizations.
7
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
Russian-speaking initial access broker CyberXero ran 51 Claude Code AI agents to steal 628,000 Ukrainian records, per SOCRadar.
6
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure
Hunt.io says BraZetsu access-broker infrastructure kept stable TLS and hosting patterns months before public IOCs.
2
FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns
FBI warns FortiBleed compromised over 86,000 Fortinet firewalls and VPNs in 194 countries.
2
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale
SOCRadar flagged alleged French leaks, an SMTP dump, a US access auction, and a Struts exploit sale.
Exploit.in Database Reveals the Roots of Today’s Ransomware Ecosystem
A 2005–2008 Exploit.in dump links early forum practices to today's ransomware ecosystem.
4
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
Group-IB details BraZetsu, a modular Python Windows malware that monetizes compromised-host access through the Infected Marketplace for initial access brokers.
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
2
More than 200 victims of Medusa ransomware identified over the last year, CISA says
CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.
3