Formbook uses localized order lures against European firms
ANY.RUN says JavaScript and PowerShell stages inject Formbook/XLoader to steal browser-stored credentials.
Stories per day · 30 days
6 RSS
Relatedapt3espionage3identity-theft3lazarus3sentencing3silent-lynx3south-korea3tax-fraud3ukraine3winrar3central-asia2crossweb-ex2cve-2025-80882gorbag2infostealer2uat-62752wire-fraud2apt281
39 stories, newest first · one card per story
Stories tagged #spearphishing
Bitter deploys PapRAT backdoor against South Asian organizations
Fortinet describes C++ and Rust PapRAT builds delivered through LNK, VHDX, and WebDAV chains, with one chain also dropping WmRAT.
Gorbag APT exploits WinRAR CVE-2025-8088 to deploy BeautyStealer
Russia-aligned Gorbag APT deploys BeautyStealer infostealer via WinRAR flaw in spearphishing emails against Ukrainian law enforcement and government targets.
Gorbag APT group targets Ukrainian organizations with self-deleting malware
Gorbag APT uses BeautyStealer that erases itself after collecting credentials from Ukrainian law enforcement, city councils and defense entities.
Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
1
Lazarus hid FlashHole malware traffic with post-quantum keys
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
2
Lazarus Operation FlashHole targets South Korean organizations
Kaspersky links at least three firms in three sectors, with earliest evidence in July 2025.
6
Nigerian man sentenced to 8 years for tax-prep hacking and fraud
Amachukwu must pay nearly $3.65 million in restitution and forfeit almost $10.85 million after a 2019–2023 scheme.
1
Nigerian national sentenced to 8 years for tax-business hacks
Chukwuemeka Amachukwu must also pay more than $3.6 million after spearphishing U.S. tax preparers and filing fraudulent returns.
1
Nigerian national gets 8 years for US tax-prep spearphishing
The court also imposed one year of supervised release, $3.6 million in restitution, and forfeiture of nearly $11 million.
2
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
SideCopy is spear-phishing Indian organizations with malicious shortcuts to deploy in-memory ReverseRAT for data theft.
3
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.
8
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.
4
TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
4
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
UAT-11985 used likely AI-written event invites and an AiTM kit to steal Google sessions from Taiwan researchers.
5
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos says UAT-11985 phished Taiwan researchers with AI-assisted event lures and real-time Google AitM.
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
Russia-aligned UAC-0099 uses MATCHBOIL to install the MATCHWOK spy backdoor on Ukrainian transport, manufacturing, and energy firms.
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
8
Iranian hacker accused of draining 31TB from university inboxes extradited to the US
Montenegro approved extraditing Amir Barati over an alleged IRGC-linked theft of 31TB from universities.
3
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Cisco Talos says China-nexus UAT-11587 deployed the Antino backdoor against Asian government and policy organizations.
Iranian accused of hacking American universities extradited from Montenegro
Montenegro extradited Iranian hacker Amir Barati, charged over the Mabna Institute university data-theft campaign.
4
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor
Cisco Talos attributes UAT-11587 (China-nexus) to compromising ~350 endpoints in eight Asian countries using the Antino backdoor with Microsoft Graph-based C2.
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks
Microsoft says Russian APT Star Blizzard now delivers backdoors through its RedFlick phishing chain.
4