Research reports
1,224 reports from 387 publishers45 added in the past week
34 reports, newest added first
Added Tue 5 May
A “??????t??????a????????????e ??????o????????????” Smishing Campaign that changes behaviour based on User-Agent, and abuses…
A “𝙨t𝙧a𝗇𝗀e 𝙛o𝙣𝗍” Smishing Campaign that changes behaviour based on User-Agent, and abuses… By Lena 8 min read Jan 23, 2023 Recently in Japan, there has been an increase in Smishing attacks that uses a strange font. This got me wondering what was behind…
Phishing
Added Fri 1 May
Blog
This is your information security hub, providing you with regular updates from the world of cloud security: Recommendations, reports, podcasts, eBooks, surveys, news, and more. Home » Blog Email Security 30 April 2026 How the Booking Phishing Campaign Works…
Phishing
PerSwaysion Campaign
In the first quarter of 2020, Group-IB Threat Intelligence team received a lead concerning corporate email account compromise of an Asia-based company. A joint investigation of Group-IB DFIR and Threat Intelligence teams reveals an uptrending phishing…
Phishing
Added Wed 29 Apr
Evilginx 2.2 - Jolly Winter Update
Tis the season to be phishing! I've finally found some free time and managed to take a break to work on preparing a treat for all of you phishing enthusiasts out there. Just in time for the upcoming holiday season, I present you the chilly Evilginx update.…
Phishing
Evilginx 2.4 - Gone Phishing
Welcome back everyone! I can expect everyone being quite hungry for Evilginx updates! I am happy to announce that the tool is still kicking. It's been a while since I've released the last update. This blog tells me that version 2.3 was released on January…
Phishing
Added Sat 25 Apr
Phishing-as-a-Service Profile: LabHost Threat Actor Group
Canadian Phishing-as-a-Service Background In 2022 and 2023, Fortra monitored threat actors targeting Canadian banks as they adopt the use of Phishing-as-a-Service platforms. Initially, t
Phishing
Added Thu 23 Apr
When Trust Becomes a Weapon: Google Cloud Storage Phishing Deploying Remcos RAT
Modern phishing campaigns increasingly abuse legitimate services. Cloud platforms, file-sharing tools, trusted domains, and widely used SaaS applications are now part of the attacker’s toolkit. Instead of breaking trust, attackers borrow it. This shift…
MalwarePhishing
Added Mon 20 Apr
Rancor: The Year of The Phish
Earlier this year, Check Point researchers identified a targeted and extensive attack against Southeast Asian government entities over the span of 7 months. The attackers, which we believe are members of the Rancor threat group, used classic spear-phishing to…
Phishing
Added Fri 17 Apr
Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation
Check Point Research identifies phishing domain patterns, offering actionable insights to proactively counter threats from the notorious cyber group behind recent airline attacks Scattered Spider, a sophisticated cyber threat group known for aggressive social…
Phishing
Added Wed 15 Apr
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsoredMalwarePhishing
Added Mon 13 Apr
Unmasking APT29: The Sophisticated Phishing Campaign Targeting European Diplomacy
Check Point Research has been observing a sophisticated phishing campaign conducted by Advanced Persistent Threat (APT) 29, a Russian-linked threat group. The operation targeted diplomatic organizations throughout Europe. The campaign appears to continue a…
State-sponsoredPhishing
Added Fri 10 Apr
Arcane Werewolf revamps its arsenal with Loki 2.1 implant
In October and November 2025, BI.ZONE Threat Intelligence observed malicious activity by Arcane Werewolf (Mythic Likho) targeting Russian manufacturing enterprises. Retrospective analysis suggests that the threat actor most likely used phishing emails as the…
MalwarePhishing
Added Mon 6 Apr
New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)
This blog series expands upon a presentation given at DEF CON 29 on August 7, 2021. Phishing attacks are starting to evolve from the old-school faking of login pages that harvest passwords to attacks that abuse widely-used identity systems such as Microsoft…
VulnerabilitiesPhishing
Added Wed 26 Nov 2025
DAMASCENED PEACOCK
Windows, delivered via spear-phishing. DAMASCENED PEACOCK A lightweight, staged downloader targeting Windows, delivered via spear-phishing. Executive summary • DAMASCENED PEACOCK is a lightweight downloader targeting Windows. • The analysed sample was for…
MalwarePhishing
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.