Threat Intelligence

A phishing campaign exploiting remote monitoring and management (RMM) software has expanded far beyond its initial targeting, with the United States now accounting for approximately 45% of all observed activity. The operation, which researchers at ANY.RUN initially linked to Canadian victims due to its use of Canada Revenue Agency (CRA) tax documents as lures, has been identified as part of a much larger effort spanning 46 countries. The United States is the primary target, representing nearly half of the campaign's activity. The campaign leverages tax-related documents to trick users into initiating malicious installations. The threat actors abuse legitimate RMM tools to gain remote access to compromised systems. According to ANY.RUN's analysis, researchers connected 601 distinct cases to this broader global operation. The technique relies on social engineering to convince victims that they are installing necessary software, when in reality they are granting the attackers remote control capabilities. This method allows the threat actors to bypass traditional security measures by using trusted administrative tools for malicious purposes. The shift in geographic focus highlights the adaptability of the threat actors, who adjusted their lures to match the target audience. While tax season remains a common vector, the success of this campaign depends on the inherent trust users place in branded documents and familiar software names. Source: The Hacker News Given that the U.S. is now the primary target, has your organization restricted or audited the use of RMM tools to prevent this type of abuse?

Microsoft is tracking a high-volume phishing campaign that abuses invisible Unicode tag characters to slip past email security filters. The attackers are not using these characters to conceal instructions from human readers while revealing them to AI models — they are using them to fragment financial trigger words like “funding” mid-string, so that automated filters fail to parse the malicious intent of the message. According to the Microsoft Security Research team, the campaign has already sent out millions of emails, relying on this Unicode-based obfuscation to keep payloads and lure text under the radar of legacy detection systems. The technique involves inserting invisible Unicode tag characters into key financial terms, breaking the literal string. This prevents signature-based and keyword-matching filters from flagging the email as malicious. The campaign volume is described by Microsoft as “high-volume,” indicating broad targeting. For defenders, the key takeaway is that email security layers relying solely on keyword or regex-based detection are now insufficient. Organizations should prioritize behavior-based analysis, link reputation scoring, and sender authentication checks to catch these obfuscated lures before they reach inboxes. Source: The Hacker News Is your email gateway equipped to flag messages with unexpected Unicode characters, or would this kind of obfuscation bypass your current defenses?

Brazilian financial services, retail, and e-commerce organizations have been under attack since 2024 by a financially motivated threat actor known as Breeze Comet (formerly UNC5669). Researchers from Google Threat Intelligence Group (GTIG) and Mandiant characterize the group as specialized in tampering with payment systems and banking software within Brazil to enable unauthorized transfers. The campaign focuses on manipulating transaction flows at the point of sale or within backend banking integrations. While the exact initial access vector is not detailed in public reporting, the attackers demonstrate deep familiarity with Brazilian payment infrastructure and compliance frameworks. Key operational details disclosed so far include: Activity concentrated exclusively on Brazilian entities across financial services, retail, and e-commerce verticals. The ability to execute hundreds of fraudulent transactions per campaign, indicating automated or semi-automated exploitation of payment logic. Targeting of banking software and payment gateways rather than traditional endpoint malware. A clear financial motive, with no evidence of espionage or data theft beyond what is necessary for payment fraud. Breeze Comet’s tradecraft suggests a deliberate focus on the unique characteristics of Brazilian banking, including Pix instant payments and local card processing rules. The group appears to have evaded widespread detection by operating within legitimate transaction volumes, making anomaly-based monitoring particularly challenging. Affected organizations are advised to review payment gateway logs for irregular sequence patterns and to validate any changes to bank routing configurations. Source: The Hacker News Given the heavy reliance on Pix and local payment rails, how is your organization detecting anomalies in high-frequency transaction streams without drowning in false positives?

The most common way into a company last year wasn't a sophisticated zero-day exploit—it was simply asking the user to run a command. A web page instructs a visitor to prove they are not a robot. While the instructions are being read, a malicious command is silently copied to the clipboard. The page then walks the victim through opening a terminal (Windows Run dialog, macOS Terminal, or Linux terminal) and pasting the contents. This technique, known as ClickFix, was the most prevalent initial access method observed by Microsoft's threat intelligence team last year. ClickFix is a prime example of the shift in attacker behavior. Threat actors aren't necessarily pursuing more complex or "better" attacks; they are optimizing for repeatable, reliable social engineering. The attack chain relies on psychological coercion and user trust, bypassing traditional email security gateways entirely. Key characteristics of this trend include: Social engineering is the primary vector, targeting the human element rather than technical vulnerabilities. The attack is platform-agnostic, working across Windows, macOS, and Linux as long as the user follows the prompts. Malicious payloads often include info-stealers or remote access trojans (RATs) delivered via the pasted command. Microsoft’s data indicates this method has outpaced traditional phishing links and malicious attachments in observed volume. Because the command is pasted directly by the user, it often bypasses endpoint detection rules that monitor for file downloads or browser-based exploits. Security teams are encouraged to focus on user education regarding console commands and to monitor for unusual powershell, cmd, or bash execution patterns. Source: The Hacker News Has your organization updated its user training to specifically address "paste-and-run" social engineering tactics like ClickFix, or are you relying on endpoint detection to catch the payload after it lands?

North Korean state-linked threat actors are expanding their long-running remote worker infiltration scheme beyond the information technology sector. Recent investigations have identified suspected operatives employed in sales, marketing, and even the medical profession, signaling a broadening of the insider threat strategy. The scheme, widely tracked as the IT worker scheme, typically involves operatives using false identities and U.S.-based proxies to secure remote employment with Western companies. Once hired, they leverage their access to steal proprietary data, exfiltrate corporate intelligence, or generate illicit revenue for the regime. The new findings indicate these actors are now targeting industries with less technical oversight but equally sensitive data—namely healthcare, where patient records and research data present high-value targets. Affected sectors now include: technology, sales, marketing, and healthcare. Methods remain consistent: fake resumes, proxy interviews, and staged employment infrastructure. Intent persists: espionage, data theft, and financial gain for the DPRK regime. Organizations vetting remote candidates should scrutinize identity verification processes, especially for roles with access to sensitive systems or personal data. The expansion into non-IT roles suggests that standard HR screening may no longer be sufficient to mitigate this threat. Source: The Hacker News Has your organization revised its remote hiring vetting protocols to account for non-IT roles in light of this expanded threat?

A new social engineering campaign, tracked as TerminalFix, is abusing fake Cloudflare CAPTCHA prompts on compromised websites to deliver malicious PowerShell commands through Windows Terminal. Microsoft has issued a warning after observing the activity, which uses a modified version of the ClickFix technique to deploy reverse tunnels for remote access. The attack chain begins when a user visits a legitimate site that has been injected with malicious code. The site displays a fraudulent CAPTCHA verification page, often styled to look like a Cloudflare challenge. When the user clicks the verification button, a command is copied to the clipboard, and a prompt in Windows Terminal instructs them to paste and run it. This action executes a PowerShell script that downloads and runs a payload from a remote server. The payload establishes a reverse tunnel to attacker-controlled infrastructure. This tunnel allows the operators to interact with the compromised machine as if they were on the local network. Microsoft notes that the campaign leverages the trust users place in CAPTCHA checks, which are normally harmless. Once the reverse tunnel is active, attackers can perform follow-up actions, including credential harvesting, lateral movement, or deploying additional malware such as remote access trojans (RATs) or stealers. The use of legitimate Windows Terminal and PowerShell reduces the chance of triggering traditional security alerts, as these tools are commonly used by administrators. To mitigate this threat, Microsoft recommends the following: Block or restrict the use of Windows Terminal and PowerShell for non-administrative users where possible. Enable tamper protection and real-time scanning in Microsoft Defender. Review and monitor for outbound connections to unknown IPs or domains, especially on ports commonly used for tunneling. Train users to recognize that legitimate CAPTCHA checks never require copying and running commands in a terminal. This campaign highlights how attackers continue to repurpose known techniques like ClickFix, which was previously linked to the ClearFake cluster, to bypass user awareness. In this case, the addition of a fake Cloudflare skin adds legitimacy, and the use of reverse tunnels makes the intrusion harder to detect post-exploitation. Source: BleepingComputer Are your users trained to spot CAPTCHA prompts that ask them to paste commands into a terminal, or have you deployed additional policy restrictions to block this behavior?

The China-nexus threat actor tracked as Fire Ant has moved beyond its established focus on VMware hypervisors, now targeting Cisco IOS XR routers, TACACS+ servers, and Linux management hosts. According to incident response firm Sygnia, the campaign is aimed at networks where these devices serve as the backbone for routing, authentication, and administrative control. The intrusion chain demonstrates a clear strategic shift: instead of merely compromising virtual infrastructure, Fire Ant is now hijacking the very systems that manage network access and security logging. By compromising TACACS+ servers, the actor can intercept and manipulate authentication credentials for network devices. Simultaneously, targeting management hosts allows for the suppression or alteration of security logs, effectively blinding defenders to ongoing malicious activity. Affected infrastructure includes Cisco IOS XR routers and associated TACACS+ servers. Linux-based management hosts used for network administration are also in scope. The actor’s tactics involve credential theft and log tampering to maintain persistence. Sygnia’s investigation underscores the sophistication of the operation, though specific indicators of compromise or detailed exploitation methods were not disclosed in the public summary. Organizations relying on these platforms should treat this as an active threat and audit their authentication and logging pipelines for anomalies. Source: The Hacker News Given that Fire Ant is now targeting network infrastructure rather than just virtualized environments, how is your organization auditing TACACS+ and management plane access for signs of similar compromise?

Cybersecurity researchers have uncovered a cluster of 18 Google Chrome extensions and one Microsoft Edge extension that were published over the past six months, all carrying hidden wallet secret-stealing and cryptocurrency-draining capabilities. According to security researcher Karlo Zanki at Socket, the extensions share notable similarities in code structure and operational tradecraft, strongly suggesting a coordinated campaign. The extensions were designed to harvest wallet secrets and drain cryptocurrency funds from unsuspecting users. While the exact distribution numbers remain unclear, the fact that these were available through official browser stores underlines the growing sophistication of supply-chain attacks targeting browser extensions. Affected platforms: Google Chrome (18 extensions) and Microsoft Edge (1 extension) Publication window: Last six months Key capability: Wallet secret extraction and crypto-asset draining Evidence indicates the campaign may have been active for an extended period, with the code showing deliberate efforts to evade detection through commonalities in obfuscation and behavior. Users who have installed any browser extensions recently, especially those related to crypto wallets or trading, are advised to audit their installed add-ons and review permissions carefully. Source: The Hacker News With the increasing prevalence of malicious browser extensions, has your organization implemented any specific controls to vet or monitor extension permissions across employee devices?

Security researchers have uncovered a new adversary-in-the-middle (AitM) phishing toolkit dubbed NovaCookies, which is being leveraged in active campaigns that abuse legitimate Docusign notifications to intercept Microsoft 365 authentication sessions. According to a report from Island, shared ahead of publication, NovaCookies operates as a subscription-based phishing platform priced at $320/month. The service functions as a proxy, sitting between the victim and genuine Microsoft 365 sign-in pages to capture authenticated session cookies in real time. The attacks begin with a legitimate-looking Docusign notification, often forwarded or spoofed, to lure targets into clicking a link. Victims are then redirected through a malicious proxy that relays their login request to the real Microsoft 365 service. Once the victim authenticates, NovaCookies captures the session token, allowing the attacker to maintain access even after the victim logs out. The phishing kit is rented as a service, lowering the technical barrier for aspiring attackers. Campaigns appear focused on organizations relying on Microsoft 365 for email and collaboration. The abuse of genuine Docusign notifications adds a layer of trust, making the phishing attempt harder to detect. To reduce exposure, organizations should enforce phishing-resistant multi-factor authentication (MFA), such as FIDO2 security keys, and monitor for unusual session activity or impossible travel patterns. Source: The Hacker News Has your organization taken steps to harden Microsoft 365 sessions against AitM phishing toolkits like NovaCookies?

The U.S. Department of Justice (DoJ) announced on Wednesday that law enforcement has successfully disrupted two hacking platforms—QScan and QTRouter—used by Chinese state-sponsored threat actors to infiltrate critical infrastructure and sensitive networks across the United States. The operation, attributed to the group QTFY, is linked to the Chinese company Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司). The FBI-led action targeted the infrastructure supporting these tools, which were reportedly employed for data theft and network intrusion campaigns against U.S. organizations. Key details from the announcement include: QScan was used for reconnaissance and vulnerability scanning, while QTRouter served as a routing and proxy tool to obscure malicious traffic. The takedown is part of an ongoing effort to dismantle state-sponsored cyber operations aimed at U.S. critical sectors. No specific CVE identifiers or system-level indicators were disclosed in the initial public statement. This disruption follows a pattern of recent U.S. government actions against Chinese cyber espionage infrastructure. The DoJ has not yet released specific indicators of compromise or a full technical breakdown of the platforms, but organizations are advised to review their network logs for communications with known or suspected malicious IP ranges associated with these tools. Given the sensitive nature of the investigation, further technical details may be released in the coming weeks as federal agencies continue their analysis. Source: The Hacker News How is your organization handling threat intelligence related to state-sponsored groups like QTFY, and have you observed any traffic patterns that might align with the described QScan or QTRouter activity?

Threat actors are now abusing the npm ecosystem and its mirror registries to host malicious HTML pages designed to impersonate Cloudflare CAPTCHA challenges. These pages serve as redirects, funneling unsuspecting visitors to attacker-controlled websites. The attack leverages the trust associated with legitimate package registries. By publishing packages that contain these deceptive HTML files, the actors ensure the malicious content is hosted on reputable infrastructure, which can help bypass security filters and increase the likelihood of user engagement. Once a user lands on the page, they are presented with a fake Cloudflare verification prompt. Instead of a legitimate security check, interacting with the page triggers a redirect to a phishing site or other malicious destination. The abuse involves npm and its public mirrors. The payload is an HTML page mimicking a Cloudflare CAPTCHA. The primary function of the page is to redirect visitors to external, attacker-controlled URLs. This technique highlights an ongoing trend of attackers abusing trusted, high-reputation services for phishing infrastructure. Organizations should monitor for unexpected npm packages and review any content hosted on mirror domains that attempts to impersonate common security prompts. Source: BleepingComputer Has your team implemented monitoring for malicious or suspicious packages published to internal or public npm mirrors?

Three distinct suspected Russian cyber espionage clusters are actively abusing legitimate Google OAuth flows and the WhatsApp linking feature to compromise accounts belonging to academics, defense professionals, and government staff across Europe, with similar targeting observed against academia and think tanks in the U.S. The threat actors involved are tracked as UNC6293, UNC7005, and UNC5976. These groups are relying on persistent, adaptive techniques that exploit user trust in standard authentication procedures rather than deploying novel malware. By mimicking legitimate login prompts and abusing account-linking processes, the actors can hijack accounts without triggering typical security alerts. The focus on high-value individuals in geopolitically sensitive sectors suggests a concerted espionage campaign aimed at intelligence collection. Key characteristics of the campaigns include: Abuse of Google OAuth to request excessive permissions or device-bound tokens, allowing persistent access even if passwords are changed. Manipulation of the WhatsApp web-linking feature to silently bind an attacker-controlled device to the victim's account, enabling real-time message interception. Heavy use of social engineering to initiate the authentication flow, often through convincing phishing lures tailored to the target's research or policy focus. Active monitoring of victim inboxes to intercept multi-factor authentication (MFA) prompts or recovery codes. The threat actors are noted for their ability to adapt quickly, shifting infrastructure and changing tactics when initial access attempts fail. The operational tempo suggests a highly organized effort requiring significant operational security discipline. Source: The Hacker News Is your organization currently requiring additional verification for any unexpected OAuth or device-linking requests, or have you observed similar phishing lures targeting your user base?