Research reports
1,224 reports from 387 publishers45 added in the past week
Added Sun 25 Oct
MoqHao Part 1: Identifying Phishing Infrastructure
In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and…
Phishing
Added Sun 18 Oct
LARVA-208
(EncryptHub) is a threat actor that has come to the forefront with highly sophisticated spear-phishing attacks since 26 June 2024. In the attacks it has carried out, it exhibits a different operational strategy by carrying out all the processes necessary to…
Phishing
Added Fri 16 Oct
Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety
UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…
RansomwareState-sponsoredPhishing
Added Wed 14 Oct
App-Specific Password phishing and how to prevent it
App-Specific Passwords (ASPs) are a way for users to access applications that do not support MFA or are otherwise incompatible with a platform’s standard login workflows. They are intended to enable a user to login to “legacy” (typically desktop) applications…
Phishing
Same Sea, New Phish: Russian Government-Linked Social Engineering Targets App-Specific Passwords
Keir Giles, a prominent expert on Russian information operations, was targeted with a sophisticated and personalized novel social engineering attack. The attacker took extensive measures to avoid raising Mr. Giles’ suspicions, and deceived him into creating…
State-sponsoredPhishing
Added Sat 10 Oct
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
State-sponsoredMalwarePhishing
Added Fri 2 Oct
Unmasking EvilTokens: Getting to the root of device code phishing
By Microsoft Threat Intelligence, Microsoft Defender Experts, Microsoft Security Research Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI…
Phishing
Added Tue 15 Sep
Introducing LX RAT: ITR Phishing Targets Finance and Tech
ZeroBEC researchers uncovered a prolonged phishing and malware campaign that uses Indian Income Tax Return (ITR) refund lures to deliver a multi-stage AutoIt infection chain. The campaign targeted financial and technology organizations and successfully evaded…
MalwarePhishing
Added Tue 8 Sep
Credential harvesting that survives takedowns: REVSTEALER
Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. This family has gained momentum in recent months, with higher distribution volume, and has emerged as a formidable threat, featuring a comprehensive credential harvester, an…
Phishing
Added Fri 7 Aug
Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor
The Larva-24009 threat actor has been active since at least 2023, carrying out phishing email attacks targeting users both in Korea and globally to install malware. ASEC (AhnLab SEcurity intelligence Center (ASEC) has previously disclosed attack cases by this…
MalwarePhishing
Added Thu 6 Aug
Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit – From Telegram Hype to FBI Takedown Theater
The operators of Kali365 maintain an active marketing Telegram channel which has actively posted about the kit and advertised its features, including in this post first seen on 12 March 2026: Notably, Kali365 advertised two phishing methods that are…
PhishingTakedowns and arrests
Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft
Mandiant has identified an expansion in threat activity that uses tactics, techniques, and procedures (TTPs) consistent with prior ShinyHunters-branded extortion operations. These operations primarily leverage sophisticated voice phishing (vishing) and…
Phishing
Token Bingo: Don’t Let Your Code be the Winner
In early April 2026, Arctic Wolf began tracking a large-scale device code phishing campaign impacting organizations across multiple regions and sectors. Similar to the widespread “Riding the Rails” campaign first observed in late March by Huntress, the threat…
Phishing
ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications
EclecticIQ analysts assess with high confidence that ShinyHunters is expanding its operations by combining AI-enabled voice phishing, supply chain compromises, and leveraging malicious insiders, such as employees or contractors, who can provide direct access…
RansomwarePhishing
Added Tue 4 Aug
Added Sat 25 Jul
NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phish
NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign PHOTO INFORMATION FORT MEADE, Md. (July 23, 2026) — Today, the National Security Agency (NSA) in collaboration with partners, is releasing a Cybersecurity…
Phishing
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
In mid-April 2026, an exposed directory on an operator-owned Alibaba Cloud server gave us a complete view into an active China-nexus operation. The server with bash history, toolkits, webshell paths against victims, and staged phishing packages were all…
Phishing
Added Tue 21 Jul
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed,…
MalwarePhishing
Added Wed 10 Jun
Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency
By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team By Saher Naumaan, Carlos Rubio, and the Proofpoint Threat Research Team Key Findings Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor…
Phishing
Added Wed 6 May
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities
Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…
MalwarePhishingSupply chain
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.