Research reports

Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles

In July 2026, a China-aligned threat actor Proofpoint tracks as TA419 conducted multiple credential phishing campaigns impersonating prominent economists and artificial intelligence (AI) policymakers to target AI experts working for US think tanks,…

Carry-On Compromise: TA4922 Packs PackClient

August 27, 2026 Kyle Cucci, Rob Kinner, Tony Robinson and the Proofpoint Threat Research Team Key Findings Proofpoint identified a command and control (C2) framework called PackClient sold on Telegram. It is being used by at least one threat actor,…

Malware

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

By By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 29, 2026 By Greg Lesnewich, Stuart Del Caliz, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and…

Vulnerabilities

ta458 roundpress exploits

By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team This…

Vulnerabilities

TA488 Targets Zimbra Mailservers with Half-Click Exploits

By Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team July 23, 2026 Greg Lesnewich, Nick Attfield, Konstantin Klinger, Saher Naumaan, Mark Kelly, and the Proofpoint Threat Research Team…

State-sponsoredVulnerabilities

One Email Closer to the Edge: UNK_MassTraction & the Physics of Exploitation

July 07, 2026 Greg Lesnewich, Mark Kelly, and the Proofpoint Threat Research Team Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA…

Vulnerabilities

TA4922: The Suspected Chinese Crime Group is Going Global

TA4922 is a highly sophisticated threat actor demonstrating a rapid operational tempo and continually evolving malware arsenal. The group has been observed using multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT…

Malware

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team Key Findings Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor…

Phishing