Malware Analysis

Attackers took over the official HBO Max Reddit account and turned it into a distribution channel for malicious ads that triggered ClickFix attacks against both Windows and macOS users. The compromised account was used to run promoted posts, lending the campaign the credibility of a verified brand account while directing victims toward information-stealing malware. ClickFix-style attacks typically rely on social engineering rather than software exploits: victims are shown fake error messages, "verification" prompts, or update dialogs that instruct them to paste a command into a terminal or run dialog, which then downloads and executes the payload. Because the user performs the final step themselves, this technique can slip past many automated defenses and browser-based protections. Key points from the incident: The HBO Max Reddit account was compromised and abused to push malicious advertisements. The ads led to ClickFix attacks targeting Windows and macOS devices. The final payload was information-stealing malware designed to harvest data from infected systems. This case highlights how much trust users place in official or verified social media accounts, and how quickly that trust can be weaponized when an account is hijacked. Promoted posts from a recognizable brand tend to receive far less scrutiny than unsolicited messages, which makes them an effective lure for delivering infostealers. If your organization monitors social media for brand abuse, this is a reminder that account takeovers on advertising platforms can function as a malware delivery vector, not just a reputational problem. Reviewing who holds access to corporate social accounts and enabling strong authentication on those accounts remains a practical first step. Source: BleepingComputer Has your team reviewed access controls and MFA coverage on your organization's social media accounts recently?

Malware tied to intrusions on F5 BIG-IP Access Policy Manager appliances conceals a PHP web shell in memory rather than in a file on disk, according to an analysis from Sophos published on September 7. The technique works by hooking into the appliance's own PHP scripts. When Apache loads any of the three affected scripts, the malware appends the web shell to the in-memory copy of that script. Because the file on disk is never modified, a routine file inspection can return a clean result even while the web shell is active in memory. The three scripts abused in this manner are: The appliance's own PHP scripts loaded by Apache (three in total, per Sophos) This memory-resident approach means defenders relying solely on disk-based scanning may miss the compromise entirely. Because the injected code lives only in the running process, detection typically requires memory inspection or monitoring for anomalous behavior rather than file integrity checks. Note: The source article does not provide specific CVE identifiers or file paths for this activity. Source: The Hacker News Has anyone here dealt with memory-only web shells on BIG-IP APM, and what detection approach worked for you?

The Gigabud banking trojan has evolved a new evasion technique that leverages a core Android feature to slip past the security checks built into banking apps, according to research from Group-IB published on September 9. Rather than relying solely on overlay attacks or accessibility abuse, the malware now installs a second Android application whose job is to set up a work profile on the infected device. Work profiles are the isolated containers Android normally reserves for employer-managed apps, keeping their data and activity walled off from everything in the personal space. Gigabud abuses this separation by dropping a tampered banking app inside the work profile, where it can operate outside the visibility of protections running in the user's personal environment. That architectural gap is the heart of the trick: banking apps tend to check their own container for signs of tampering, hooks, or suspicious siblings, but the work profile presents a boundary they are not designed to inspect across. A modified app planted on the other side of that boundary can appear legitimate to checks running in the personal space. Key points so far: The second app's sole purpose is creating the work profile and placing the rogue banking app within it. The approach exploits the isolation between work and personal profiles that Android provides for enterprise use. Group-IB attributes the activity to Gigabud, a known Android banking trojan. No specific CVE identifiers or affected app versions were disclosed in the report, and the publication does not name the targeted banking applications or geographic regions involved. Readers should watch for follow-up technical analysis from Group-IB, which typically publishes indicators of compromise and detection guidance alongside its campaign reports. Source: The Hacker News Does your organization allow work profiles on BYOD devices, and would that policy help or hinder detection of this kind of abuse?

Anthropic has disclosed that it disrupted a campaign by a Russian state-sponsored threat actor that abused Claude to build an AI-assisted workflow aimed at staying ahead of detection efforts. The operation is attributed to a cyber espionage cluster Anthropic tracks as GTG-20006, where "GTG" stands for Generative Threat Group. According to the company, this cluster aligns with broader reporting that links it to Midnight — the article does not provide further details on that attribution. The key takeaway from the disclosure is the tradecraft: rather than a one-off use of AI to generate code, the actor reportedly used Claude within a repeatable workflow to rebuild malware after it was detected. That pattern points to AI being folded into the post-detection phase of an intrusion, shortening the cycle between compromise, discovery, and retooling. Anthropic said it disrupted the activity, though the source material does not detail the specific technical measures taken or the full scope of the targeting. For defenders, the case reinforces that AI-assisted development is now part of the threat model for state-linked espionage, not just criminal opportunism. Detection and response timelines that assume slow adversary retooling may no longer hold. Source: The Hacker News Does your organization factor AI-assisted adversary retooling into its detection and response planning?

Threat actors are increasingly abusing trusted AI platforms as an attack surface, leveraging the reputation of services like Claude to distribute malware and trick users, according to an analysis by Huntress. The campaigns observed by Huntress target AI users through several distinct vectors: Weaponized Claude Artifacts — malicious content hosted within the platform's artifact feature Shared AI conversations — poisoned or crafted chat threads used as lures Sponsored search results — paid ads directing victims toward malicious destinations ClickFix-style lures — fake error or verification prompts that trick users into running malicious commands themselves The common thread across these techniques is abuse of user trust: because the content appears to originate from or relate to legitimate AI services, victims are more likely to interact with it without suspicion. Search results are also being poisoned to push malicious content toward users searching for AI-related tools and information. Anyone using AI platforms in their workflow should treat shared artifacts, conversation links, and AI-themed search results with the same caution they would apply to any unsolicited file or link. Source: Unknown Has your organization implemented any controls around how employees interact with AI platforms and shared AI-generated content?

A Ukrainian national has been sentenced to four years in prison for his involvement in Conti ransomware operations conducted between 2021 and 2022. The sentence closes out a case tied to one of the more prolific ransomware groups of that period, which targeted organizations across multiple sectors and regions before its infrastructure was disrupted and its members scattered. Conti operated as a ransomware-as-a-service operation, with affiliates carrying out intrusions while core members maintained the malware, negotiation portals, and leak site. The group was known for double extortion tactics, stealing data before encrypting systems and threatening to publish it if victims did not pay. Details on the specific charges, the defendant's role within the group, and the jurisdiction where the sentence was handed down were not elaborated in the source report beyond the prison term and the timeframe of the attacks. Key points: Sentence: four years in prison Group involved: Conti ransomware Attack period: 2021 to 2022 Defendant: Ukrainian national Source: BleepingComputer Does your organization treat Conti-era indicators as still relevant in current threat hunting, or have you retired them?

A new Android malware family called Mantax Otax is making the rounds, and it stands out because it blends ransomware and spyware functionality into a single payload. According to reporting, the malware is capable of encrypting files on the infected device, exfiltrating sensitive data, and then spamming and harassing victims, adding a psychological pressure layer on top of the usual data-loss impact. This dual-purpose approach is notable for the Android threat landscape, where ransomware and spyware have typically been separate categories. Combining file encryption with data theft gives attackers two leverage points, and the added harassment component suggests the operators are prioritizing intimidation to push victims toward paying or complying. Key facts to keep in mind: The malware is tracked as Mantax Otax Capabilities include file encryption, data theft, and victim harassment via spam It targets the Android platform If you manage Android devices in your environment, it is worth reviewing your mobile threat defense posture, restricting sideloaded app installs where possible, and keeping an eye out for unusual file-access or encryption activity on endpoints. Source: Unknown Has anyone seen samples or indicators tied to Mantax Otax in the wild, and how is your team handling mobile ransomware exposure?

Researchers have documented a curious wave of worm-like behavior tied to ConnectWise ScreenConnect, where rogue client instances are being used to push a malicious VBScript payload onto systems as they join a session. The activity, detailed by Huntress, hinges on a four-stage infection chain that ultimately delivers a payload to newly connected hosts—essentially turning the remote access tool into a distribution vector. The three separate incidents observed so far share a common end goal but rely on widely different entry points, which suggests a level of adaptability in the operators' approach. Those initial vectors break down as follows: A tech-support scam abusing Microsoft Quick Assist to gain a foothold A phishing campaign delivering an MSI installer as the initial dropper A third, unidentified method that also led to the same ScreenConnect abuse All three cases converge on the same post-exploitation routine: the attacker leverages the ScreenConnect client to drop a VBScript, which then progresses through additional stages before executing on the target. The scripting chain is notable for its modularity—each stage appears designed to fetch and execute the next piece, reducing the footprint left on disk at any single moment. Huntress notes that the payload is specifically triggered when a new host connects to the rogue ScreenConnect server, implying the attackers have automated the delivery mechanism. This is not a case of a compromised legitimate server; rather, it points to threat actors hosting their own instance or modifying client behavior to achieve the desired spread. For defenders, the key takeaway is to scrutinize any ScreenConnect client that initiates outbound connections to unapproved or unknown hosts. Organizations should also review their allowlists for remote access tools, particularly Quick Assist and ScreenConnect, since these are being repurposed rather than exploited through a vulnerability. Mitigation steps to consider: Audit all ScreenConnect servers and clients in your environment for unauthorized instances. Restrict outbound connections from remote access tools to approved IP ranges or domains. Deploy behavioral detection rules for VBScript execution chains originating from remote support sessions. Monitor for Quick Assist or ScreenConnect process launches that do not correlate with active support tickets. Review MSI installer logs for unattended installation flags that could indicate phishing-driven deployment. Source: The Hacker News Are your remote support tools locked down to only sanctioned hosts, or could an unapproved ScreenConnect client connect out to an attacker-controlled server right now?

Researchers have detailed a new strain of compiled V8 JavaScript malware dubbed JSCeal, which is capable of bypassing Google authentication through the theft of session cookies. The malicious payloads are heavily obfuscated using javascript-obfuscator, employing a layered approach to evade analysis. Key protection mechanisms observed by Check Point Research include: RC4-protected strings to conceal data Control-flow flattening to disrupt code analysis Proxy functions to obscure function calls Operation wrappers to further complicate reverse engineering JSCeal's capabilities extend beyond simple credential theft, encompassing broader surveillance and traffic-interception functions. The malware is compiled for the V8 JavaScript engine, a departure from typical script-based threats, which allows it to operate with greater stealth and complexity. Source: The Hacker News Given the malware's reliance on stolen session cookies rather than traditional credential phishing, how is your organization monitoring for suspicious session anomalies in Google Workspace?

Researchers have detailed a new offensive technique called GuardBreaker, observed in attacks carried out by the Russia-aligned threat group UAC-0099 against a target in Ukraine. The method is designed specifically to disrupt artificial intelligence-assisted analysis pipelines. According to findings shared by ESET, the attacker’s strategy involves deliberately injecting content intended to trip an LLM’s safety mechanisms. The goal is to cause the AI tool to halt processing or refuse further interaction, effectively blinding the analyst to the malware’s true purpose. The technique relies on embedding prompts related to nuclear weapons or other catastrophic scenarios within the malware’s code or command output. When an AI-assisted analysis tool processes the file, the embedded prompt triggers a refusal or shutdown response, preventing full examination of the threat. This tactic highlights a growing shift in adversarial behavior: instead of evading AI detection, some groups are now attempting to weaponize the constraints of those same systems. By forcing the AI to err on the side of caution, UAC-0099 can stall incident response efforts and buy time for their operations to proceed undetected. It is worth noting that this is not a vulnerability in the AI model itself, but rather an abuse of its built-in safety protocols. The attack does not require exploit code; it simply relies on the predictable behavior of a well-trained model when confronted with highly sensitive or dangerous topics. The campaign appears narrowly focused for now, but the technique could easily be repurposed by other groups looking to blind automated defense tools. Source: The Hacker News Has your team encountered any cases where malicious files deliberately caused your AI-powered security tools to stop mid-analysis, and how did you work around it?

A newly attributed campaign from the Iranian threat actor tracked as Nimbus Manticore reveals a notable expansion in its operational scope, moving beyond its traditional Windows-focused arsenal to target Linux and Apple macOS environments. The group is now leveraging two previously undocumented malware families, both built on Node.js and JavaScript, to deliver cross-platform remote access trojans (RATs) that mark a significant evolution in their technical capabilities. Kaspersky researchers, who are tracking the activity, observed the group employing a social engineering lure centered on fake job recruitment. The attackers pose as potential employers and send coding test challenges to targets, a tactic designed to trick victims into executing malicious payloads under the guise of a legitimate technical assessment. This approach suggests a shift toward more targeted, strategic intrusions rather than broad, indiscriminate attacks. The technical details surrounding the two new RAT families indicate a deliberate investment in cross-platform compatibility, likely to broaden the group's targeting footprint. While the full scope of the campaign's victims is not yet public, the use of Node.js and JavaScript allows the malware to run seamlessly across operating systems, complicating detection efforts for security teams that may not have visibility into malicious scripts on non-Windows endpoints. Key takeaways from the analysis include: The threat actor, Nimbus Manticore, is now attributed to campaigns using cross-platform RATs written in Node.js and JavaScript. Infection chains begin with phishing or social engineering lures, specifically themed around recruitment and coding tests. The new malware families extend the group's reach to Linux and macOS systems, in addition to their previous Windows-focused operations. The activity was documented by Kaspersky, though no specific CVE identifiers or patch numbers were mentioned in the initial reporting. Affected organizations should prioritize monitoring for suspicious Node.js processes and review any unsolicited recruitment messages that request the download or execution of coding challenge files, as these may be initial infection vectors. Source: The Hacker News Does your security operations center actively monitor for malicious Node.js or JavaScript execution on Linux and macOS endpoints, or is that visibility still a blind spot in your environment?

Authorities from the U.S., Bulgaria, Hungary, and Romania, alongside private-sector partners CrowdStrike and the Shadowserver Foundation, have dismantled the peer-to-peer (P2P) infrastructure behind the long-running Sality botnet. The coordinated law enforcement action, carried out on August 31, 2026, did not simply seize servers; instead, officials turned the botnet's own P2P protocol against it, effectively neutralizing its ability to distribute new malware payloads. By hijacking the communication channels that Sality relied upon, the operation has severed the link between the botnet's operators and the infected machines under their control. This technique prevents the threat actors from pushing updated malware or instructions to the compromised hosts, containing the spread of the infection. The U.S. Department of Justice (DoJ) announced the successful takedown on Tuesday, highlighting the collaborative nature of the effort. The operation was a joint effort between law enforcement agencies from Bulgaria, Hungary, and Romania, with support from the DoJ. Private industry partners included CrowdStrike and the Shadowserver Foundation. The action targeted Sality's P2P network, a critical component of its resilience. This sinkholing technique marks a significant shift in disrupting botnets that were previously considered highly resilient due to their decentralized architecture. The full impact on the remaining Sality infections is still being assessed, but the operation effectively cripples the network's command-and-control capabilities. Source: The Hacker News Given Sality's long operational history, how is your organization verifying that its endpoint protection flagged and contained any potential Sality-related activity prior to this takedown?

The U.S. Department of Justice (DoJ) has unsealed charges against a Russian national who was extradited from Cyprus on August 28, linking him to a widespread malware distribution campaign that targeted users of a freelance platform. The accused, Searzhudin Tamirlanovich Aktulaev, 40, allegedly weaponized roughly 255 fake accounts on the platform to send booby-trapped Excel attachments to approximately 80,000 users during 2016 and 2017. According to the U.S. Attorney's Office for the Northern District of California, Aktulaev was arrested in Cyprus in May 2025. The indictment alleges that the malicious Excel files were designed to infect victim machines, potentially leading to unauthorized access and data theft. The scale of the operation—spanning tens of thousands of targeted users—highlights the persistent threat of social engineering via seemingly benign office documents. Suspect: Searzhudin Tamirlanovich Aktulaev, 40, Russian national Arrest Location: Cyprus (May 2025) Extradition Date: August 28 Campaign Period: 2016–2017 Attack Vector: Malware-laced Excel attachments Scale: ~80,000 targeted users via ~255 fake accounts The case underscores the legal reach for cybercriminals who believe they can operate from abroad, as well as the ongoing risk posed by phishing campaigns that leverage legitimate business platforms for initial access. Source: The Hacker News Given that this campaign relied on fake accounts on a freelance marketplace, does your organization have controls in place to scrutinize external file deliveries from third-party platforms, or is email filtering still the primary defense?

Researchers have uncovered a new Android banking trojan dubbed StreamRat, which was distributed to Spanish-speaking users through malicious advertisements on Meta. The campaign, which used a fake television-streaming app as a lure, was primarily aimed at audiences in Spain and reportedly reached an estimated 570,950 Meta accounts across the European Union. According to ThreatFabric, the ad campaign was designed to appear legitimate, enticing users to download a streaming service that actually carried the malicious payload. Once installed, StreamRat grants its operators extensive control over the infected device, functioning as a full-featured remote access tool (RAT). This includes the ability to steal credentials, intercept two-factor authentication codes, read and send SMS messages, and even capture screen content in near real-time. The trojan's capabilities go beyond typical banking malware, as it can also manipulate device settings, install additional payloads, and potentially lock users out of their own devices. The campaign underscores a growing trend where malware distributors abuse legitimate advertising networks to target specific linguistic and geographic groups, bypassing traditional email-based phishing vectors. For Android users, especially those in Spanish-speaking regions, this serves as a reminder to only download applications from the official Google Play Store and to scrutinize app permissions carefully. Target vector: Malicious Meta ads promoting a fake TV streaming app. Primary region: Spain / European Union. Impact: Full device takeover, credential theft, SMS interception, and screen capture. Distribution: Third-party APK downloads (not via official store). Source: The Hacker News Has your organization taken steps to block sideloaded APK installations on managed devices, or are you still relying on user awareness alone to prevent such infections?

In early August, GitGuardian researchers identified that a recent variant of the Shai-Hulud infostealer worm has significantly expanded its credential-harvesting capabilities. The malware now scans for sensitive data across 469 distinct locations, a substantial increase from the 189 paths monitored by earlier iterations of the worm. This expanded reach targets a broad spectrum of developer environments, Continuous Integration/Continuous Deployment (CI/CD) tooling, cloud service configurations, and even configuration files associated with AI development tools. The jump in scanned locations indicates that the threat actors behind Shai-Hulud are actively broadening their scope to capture credentials stored in more diverse and specialized software ecosystems. The evolution of this worm underscores a growing trend where attackers prioritize the harvesting of secrets and access tokens embedded within automated workflows and developer utilities. For security teams, this highlights the critical need to audit not just traditional code repositories, but also the configuration files of the ancillary tools that support the software development lifecycle. The malware monitors a wide array of file types and application-specific paths. Focus areas include credentials for cloud providers, CI/CD pipelines, and container orchestration platforms. AI tool configs are now a target, reflecting the increased adoption of these technologies in development pipelines. The shift from 189 to 469 paths suggests a deliberate effort to ensure broader coverage of modern development stacks, potentially increasing the likelihood of capturing high-privilege access keys. Source: The Hacker News Is your organization auditing the configuration paths of your CI/CD and AI tooling, or is your secret scanning still limited to source code repositories?

Attackers are increasingly abusing the trusted Node.js runtime environment to smuggle malicious payloads past security defenses. According to a new report from the Symantec Threat Hunter Team, this technique has been observed in active campaigns since February 2026, specifically targeting government departments, technology companies, and hotels. The core of the attack relies on the inherent legitimacy of node.exe, the standard executable for the Node.js JavaScript runtime. Because this binary is a trusted, signed component present in many enterprise environments, security tools often fail to flag its execution as suspicious. The attackers exploit this trust by using node.exe to run malicious JavaScript code directly, effectively turning a benign development tool into a malware loader. Primary targets: Government agencies, technology firms, and the hospitality sector. Active timeframe: Observed in the wild since February 2026. Execution method: Leverages the legitimate node.exe binary to interpret and execute attacker-controlled JavaScript. This approach is particularly dangerous because it blurs the line between legitimate administrative activity and malicious behavior. The malicious JavaScript can be delivered via various means, such as a downloadable file or a script fetched remotely, and then executed locally using the already-present Node.js runtime. This reduces the need for complex exploit chains or the dropping of custom, easily-detected binaries on the disk. While the report does not provide specific indicators of compromise, organizations should review their security policies regarding the execution of scripting runtimes, especially where they are not strictly required for business operations. Source: The Hacker News Are you reviewing your environment for unsanctioned use of Node.js, or is this a runtime your security team currently treats as fully trusted?

Researchers have shed light on a Python-based Windows malware framework known as BraZetsu, which is being used to power an underground marketplace that sells access to compromised machines. Rather than following the typical infostealer playbook, BraZetsu functions as a modular master toolkit designed for Initial Access Brokers (IABs). It effectively transforms hacked endpoints into trackable, commercial inventory, allowing cybercriminals to monetize network footholds on a scale previously reserved for legitimate enterprise asset management. Key aspects of the framework include: A modular architecture that allows operators to deploy specific plugins or functionalities on demand. Capabilities that go beyond simple credential theft, focusing on persistent access and long-term control. Integration with a centralized marketplace backend, which likely functions as a command-and-control hub as well as a storefront. The discovery highlights a growing trend where commodity malware is evolving into comprehensive business platforms, complete with the logistical support needed to manage and sell thousands of compromised hosts simultaneously. Source: The Hacker News Given that this toolkit appears to prioritize long-term access over quick credential grabs, how is your security team adjusting detection rules to spot modular Python frameworks rather than just traditional infostealer signatures?

An active malware campaign is being distributed through bogus software-download websites that impersonate trusted vendors, luring victims with malicious installers. According to Microsoft, the campaign has resulted in compromises across multiple organizations and industries, with a primary focus on China-based operations of multinational companies and Chinese-speaking users. The attackers are using trojanized installers that go beyond simple payload delivery. Once executed, the malware actively disables Windows Update and tampers with Microsoft Defender, weakening the host’s defenses to avoid detection and maintain persistence. This dual-action approach allows the threat to operate with fewer safeguards in place, increasing the risk of lateral movement and data exfiltration. Key technical observations from the campaign include: Malicious installers are hosted on fake download portals that mimic legitimate vendor sites. The malware modifies system settings to stop Windows Update from running, preventing critical patches from being applied. Microsoft Defender is altered or disabled, reducing endpoint visibility and allowing the payload to execute more freely. The campaign appears to be geographically targeted, with a concentration on Chinese-speaking users and multinational organizations operating in China. Organizations should review their endpoint detection and response logs for signs of disabled security services or failed update attempts. Users are advised to avoid downloading software from unofficial or unverified mirrors, and to verify the authenticity of any installer before execution. Source: The Hacker News Are any of your endpoints showing signs of disabled update services or modified Defender policies, and how are you tracking this campaign across your environment?

Ransomware resilience is no longer just about having backups or a solid endpoint detection tool in place — managed service providers need a layered strategy that they actively test across every client environment. Acronis highlights six core capabilities that should be part of any MSP’s recovery playbook, focusing on reducing exposure, detecting threats early, and preserving clean recovery points. While the full details of the checklist go deeper, the key takeaway is that protection must be verified under real-world conditions. For MSPs, this means routinely simulating attacks to confirm that detection triggers correctly, that backup chains remain intact, and that restoration workflows actually meet recovery time objectives. Simply deploying tools is not enough — you have to prove they work together when it matters most. Reduce attack surface by hardening client endpoints and patching known vulnerabilities. Detect active threats quickly using behavioral analysis and continuous monitoring. Preserve recovery points by using immutable or write-once storage to stop ransomware from encrypting backups. Test restoration processes regularly to ensure critical systems can be brought back online fast. Verify that backup integrity checks are automated and run consistently across all client environments. Align recovery speed with business expectations, factoring in both recovery time objectives and recovery point objectives. The emphasis on testing is what separates a documented plan from a practical one. If you haven’t already, run a tabletop exercise or a live restore drill with your largest client to identify gaps before an actual incident forces the issue. Source: BleepingComputer Is your team actively running restore drills across all client environments, or is testing limited to only a few key accounts?

A California federal grand jury has indicted a Russian national for orchestrating a large-scale phishing campaign that compromised approximately 80,000 freelancers. The operation deployed TVRAT and DarkVNC malware to hijack accounts and steal funds, with the indictment detailing a multi-year scheme that preyed on remote workers. The attack chain reportedly began with legitimate-looking phishing emails designed to lure victims into downloading a malicious attachment or visiting a fake login page. Once delivered, the dual-malware payload functioned as a remote access toolkit: TVRAT acted as the primary backdoor for command-and-control, while DarkVNC provided live screen capture and keystroke logging capabilities. Together, the tools allowed the attacker to wait for freelancers to log into financial or work-related portals, then perform unauthorized wire transfers directly from the victim’s session. The indictment covers the suspect’s alleged use of money mules and cryptocurrency exchanges to launder the proceeds. It also highlights how the freelancer community, often dependent on platforms without corporate endpoint protection, became a prime target for these thefts. Authorities have urged gig-economy workers to enable hardware-based two-factor authentication and to treat unsolicited job-related messages with suspicion. Source: BleepingComputer For those of you operating as independent contractors or managing remote teams, how are you enforcing phishing resistance outside a traditional corporate perimeter?