39 results for “Phishing”

Huntress analysis of a July to September 2026 token replay ("token spraying") campaign: 497 successful Microsoft 365 sign-ins across 79 organizations, replayed from six addresses in 193.26.115.0/24 (1337 Services GmbH). Tokens came from AiTM relays, device-code phishing and social engineering. It covers four phases, rogue Entra devices, MFA method swaps, hidden inbox rules, hunting queries and Conditional Access guidance.

huntress.comwriteupPublished and added 22 Oct 2026🛡️ Security

Wiz CIRT investigation of LLMjacking campaigns against Google Cloud billing accounts. Attackers phished admins through malicious Google Search ads and a fake login page that captured MFA codes, then deleted the iam.allowedPolicyMemberDomains policy, added Gmail accounts as billing admins, and linked attacker-controlled projects to the victim's billing account. Victims saw tens to hundreds of thousands of dollars in Gemini API charges within 24 to 48 hours, with no log visibility into prompts. Includes hunting guidance for Workspace, Admin Activity and billing logs.

wiz.iowriteupPublished and added 20 Oct 2026🛡️ Security

OpenSourceMalware analyzes a targeted phishing email from my-github[.]com (same server 193.32.204[.]199 as GhostAction's CI/CD exfiltration) that impersonated a GitHub new-sign-in alert. Recovered HTML and a HAR show a GitHub reverse proxy that captures passwords and TOTP codes, rewrites GitHub subdomains, and injects JavaScript that silently completes an OAuth device flow with repo, workflow and read:org scopes, then exfiltrates the token to TCP/8443. It includes a per-session redirect controller, mutable redirect behavior seen in URLScan, a victim's audit-log outcome (MFA stopped escalation), IOCs, and response guidance.

opensourcemalware.comwriteupPublished and added 11 Oct 2026🛡️ Security

OpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.

opensourcemalware.comwriteupAdded 10 Oct 2026, published 9 Oct 2026🛡️ Security

Cisco Talos details UAT-11985, a spear-phishing campaign against Taiwan-based research organizations (impersonating institutions like the Taiwan European Union Centre and NCCU Institute of International Relations) that used AI-assisted, templated lure emails and poster-based QR code phishing (quishing) to drive victims to a real-time adversary-in-the-middle phishing kit. The kit impersonates Google sign-in across zh-CN/zh-TW/en locales, uses a split HTTP-POST/WebSocket architecture to mirror Google's live authentication flow and dynamically push MFA challenge screens, enabling full session-token theft and MFA bypass. Talos attributes the kit's localization architecture and lexical choices to a Simplified Chinese-speaking developer and publishes ClamAV/Snort coverage plus IOCs on GitHub.

blog.talosintelligence.comwriteupPublished and added 8 Oct 2026🛡️ Security

Huntress details a phishing campaign that abuses legitimate Microsoft Power BI dashboards (app.powerbi.com) to host a fake "Download Reference" lure that bypasses mail filters trusting the Microsoft domain. Clicking the lure triggers browser/environment fingerprinting and Telegram-bot-based victim telemetry exfiltration via attacker domains (dailylifeproject.site, burnsworth.site, etc.), then silently downloads rogue ScreenConnect installers; a chained CMD/PowerShell script (SCAutoFix.ps1) deploys a second ScreenConnect instance, uninstalls the first for evasion, drops the defense-evasion tool HideUL_x64.exe, and sets a recurring scheduled task before Huntress's SOC intervened.

huntress.comwriteupPublished and added 7 Oct 2026🛡️ Security

Cisco Talos details UAT-11587, a China-nexus threat cluster targeting government, defense, and policy organizations across Taiwan, India, the Philippines, Cambodia, and other Asian countries with spear-phishing and a five-stage infection chain (HTA/WSF stagers, JScript decryptors, .NET BinaryFormatter/ActivitySurrogateSelector deserialization gadgets, and DLL sideloading via the signed GatherOsState.exe) to deploy a new Rust-compiled backdoor called Antino. Antino uses Microsoft Graph/Outlook/OneDrive as a dead-drop C2 channel instead of a traditional C2 server, supports shell/PowerShell execution, file transfer, shellcode loading with a sleep-mask evasion technique, and abuses the Windows Scripted Diagnostics framework for persistence; Talos also notes possible infrastructure overlap with Symantec's "Jewelbug" cluster and Arctic Wolf's UNC6384 reporting. Includes ClamAV/Snort coverage and IOCs.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Microsoft's DART team details an investigation into Storm-3068, a threat actor that escalated from a self-service password reset account takeover into full control of an organization's Azure DevOps environment, then weaponized a malicious pipeline to harvest kubeconfig files and gain access to Kubernetes clusters. The actor also deployed the Atera remote management agent and the Chisel tunneling tool to establish reverse tunnels and alternate remote access, and exfiltrated seven stolen kubeconfig files into a repository. The report lays out the attack chain, DART's response, and hardening recommendations around SSPR monitoring, phishing-resistant MFA, branch protection, and pipeline permission controls.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Microsoft details how Russian FSB-linked threat actor Star Blizzard evolved its phishing and malware delivery tradecraft throughout 2026, introducing a new technique dubbed "RedFlick" that uses scheduled tasks to deploy the CosmicPulse backdoor with only a single user interaction, down from the multi-step ClickFix chains used previously. The report covers the shift from targeted spear-phishing to large-scale phishing campaigns using accounts on compromised WordPress/CPanel websites, delivery chain variants (VHDX files, Control Panel applet (CPL) masquerading, steganography, PDF-embedded payloads), and the related DarkSword iOS backdoor, affecting 100+ organizations tied to Ukraine support. It includes IOCs, KQL hunting queries for Microsoft Defender/Sentinel, and mitigation guidance.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Huntress details a 2026 DarkMe RAT campaign that ditches the zero-days (CVE-2023-38831, CVE-2024-21412) previously used by the Water Hydra/EvilNum-linked group in favor of a plain phishing email delivering a disguised .pif file. The writeup reverse-engineers the full chain — msiexec pulling a wrapped MSI, a WSF stager, three obfuscated VB6 loader DLLs (Coconout.dll, Use.dll, Finalized.dll), a novel 329-app "inverted sandbox" gate, process hollowing into a signed clspack.exe, and Locked:// protocol-handler persistence — and corrects prior public reporting by showing the payload's "single-byte XOR" is actually a broken RC4 implementation. It closes with fresh C2 infrastructure (thatawful[.]boutique, port 7712), OSINT on delivery domains (including a related ClickFix/Efimer campaign), and concrete Sigma-style hunting rules and remediation steps.

huntress.comwriteupAdded 23 Sep 2026, published 22 Sep 2026🛡️ Security

Datadog Security Labs walks through hunting for GitHub organization compromise using GitHub audit logs, covering the full attack chain from stolen PATs/OAuth tokens and device-code phishing (initial access) through secrets-listing enumeration, private-repo/tree discovery, and bulk collection via git.clone or repo.download_zip. It provides copy-pasteable queries (with fields like hashed_token, programmatic_access_type, external_identity_nameid) mapped to MITRE ATT&CK techniques and calls out GitHub audit-log quirks (missing IP on failed auth, inconsistent visibility fields, misleading token permission scopes) that shape accurate detections.

securitylabs.datadoghq.comwriteupAdded 25 Sep 2026, published 16 Sep 2026🛡️ Security

Microsoft Security Research details an active campaign (since May 2026) where attackers use voice-phishing and SMS lures impersonating IT helpdesk passkey/SSO enrollment requests to drive victims into AiTM or device-code phishing flows, compromising Microsoft 365 identities. Post-compromise, actors register attacker-controlled MFA methods (e.g., software OTP tokens) for persistence, conduct systematic Microsoft Graph reconnaissance across users, groups, roles, and SharePoint/OneDrive/Exchange, then exfiltrate data at a measured pace using automated Node.js/python-httpx tooling while evading detection through IP rotation and anonymous proxies. The post includes real audit-log JSON examples, multiple KQL hunting queries for GraphAPIAuditEvents/CloudAppEvents, full MITRE ATT&CK mapping, and attributes the initial-access tradecraft to Storm-3121 and Storm-3032, which feed into ShinyHunters/Falcon and Helix extortion operations.

microsoft.comwriteupAdded 3 Oct 2026, published 9 Sep 2026🛡️ Security

Huntress SOC details two August incidents where phishing emails led victims through a fake CAPTCHA/Adobe PDF Reader lure into a browser-in-the-browser (BiTB) page spoofing get.adobe.com, tricking them into installing a ScreenConnect client disguised as an Adobe Reader update. The installer chained to a second rogue ScreenConnect client via curl/cmd.exe, both registered as Windows services for persistence, then executed defense-evasion binaries (HideCursor.exe, HideUL.exe) to hide cursor/screen activity before Huntress disrupted the intrusions. Full IOCs (domains, ScreenConnect client IDs/relays, file hashes/paths) are included for defenders.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Huntress researchers uncovered the operator console for "Knight Office," a Flask-based adversary-in-the-middle (AiTM) phishing kit used to steal Microsoft 365 session tokens via a DocuSign-themed, self-spoofed lure that routes victims through Monday.com redirects and a compromised Joomla site to a fake Microsoft device-code authentication page. After capturing tokens, the attacker registered a rogue device in Microsoft Entra ID and bound a Windows Hello for Business key credential to the compromised account to maintain persistent, MFA-bypassing access even after token revocation. The writeup details IOCs (IPs, .vu domains, User-Agent strings), links the campaign to hundreds of reported phishing emails since April, and gives defenders concrete hunting/response steps around callback-proxy sign-ins and newly registered WHfB credentials.

huntress.comwriteupAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Huntress dissects a trojanized Exodus crypto wallet installer (v24.33.4, unsigned MSI built with WiX) that installs a genuine wallet but patches Electron's show()/focus()/center() methods so no window ever appears, then loads a modular RAT via a hand-written reflective PE loader implemented in JavaScript using the Node.js koffi FFI library. The RAT (VNC, SOCKS proxy, browser-credential stealer, recon module) beacons over WebSockets and uses Azure Table Storage as a dead-drop C2 channel to blend into legitimate cloud traffic, while delivery abuses double-extension .pdf.js phishing, ZIP-staged JS files, and an unused search-ms/WebDAV technique; the writeup also covers multi-layer string-array/arithmetic deobfuscation and includes full IOCs and mitigation guidance.

huntress.comwriteupAdded 3 Sep 2026, published 1 Sep 2026🛡️ Security

Huntress details a phishing campaign that tricks victims into installing a legitimately signed Faronics Deploy agent disguised as Adobe/Zoom documents, enrolling endpoints into an attacker-controlled deployment console. The threat actors then abuse Faronics' remote script execution to pull PowerShell payloads (via curl, mshta, msiexec) from GitHub-hosted staging and install ScreenConnect for persistent remote access. The post identifies key forensic artifacts (C:\ProgramData\Faronics\Logs\ScriptRunner.log and the deployment's unique "ck" identifier) that defenders can use to trace attacker infrastructure and cluster malicious enrollments, and notes Faronics' response to disrupt abuse after Huntress's disclosure.

huntress.comwriteupAdded 5 Sep 2026, published 31 Aug 2026🛡️ Security

Huntress security team shares their internal strategy for running monthly phishing simulations, including how they rotate lures (payment offers, spoofed conferencing tools), track click rates and report-before-click as success metrics, and use repeat-clicker data to target individualized training. Includes real click-rate trends from their own employees across January-February campaigns showing how difficulty escalation and exposure therapy reduce susceptibility over time.

huntress.comwriteupAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

Arctic Wolf Labs documents GoCaracal, a previously undocumented modular Go-based malware framework attributed with medium confidence to Dark Caracal (linked to Lebanon's GDGS), deployed alongside an updated Bandook variant in a June 2026 intrusion against a Venezuelan communications organization. The extended GoCaracal build features a novel Ethereum smart-contract (BulletproofC2) fallback that lets operators update C2 addresses via on-chain transactions without redeploying malware, and analysis of 249 samples traces the framework's four-phase development from January to July 2026. The report includes delivery-chain details (SVG phishing, URL shorteners, Delphi loader), infrastructure analysis (AEZA Group, AlexHost hosting), a YARA rule, and IOCs for detection.

arcticwolf.comwriteupAdded 26 Sep 2026, published 26 Aug 2026🛡️ Security

Socket's Threat Research team tracked 77 linked Firefox extension identities in a campaign dubbed "Offside Wallet Theft Factory": 40 are confirmed malicious (impersonating OKX, Rabby Wallet, TronLink and others) and 37 are deceptive sports-score shell extensions later repurposed into wallet stealers. Techniques include Supabase-controlled remote phishing switches, Cloudflare Worker exfiltration of recovery phrases, modified Rabby Wallet code that exfiltrates serialized keyrings via persistAllKeyrings() before local encryption, and hardcoded C2 servers stealing credentials and clipboard data. The post includes full SHA-256/IOC listings and shows how extension identities are repurposed over version history from benign utilities into wallet-draining malware.

socket.devwriteupPublished and added 19 Aug 2026🛡️ Security

Huntress researchers document a phishing campaign targeting Black Hat/DEF CON attendees via X DMs impersonating a CoinDesk exec, luring victims into opening a weaponized Google Doc with a custom Google Apps Script sidebar that runs a fake "decryption" flow before delivering ClickFix-style commands or a manual "update" that drops malware. On macOS this delivers AMOS infostealer plus a LaunchDaemon-based polling backdoor with SOCKS5 proxy capability; a follow-up fake DocSend/Dropbox installer delivers a ClickOnce/NSIS loader chain on Windows that installs NetSupport RAT, a process-hollowed rogue Certificate Authority that MITMs VirusTotal traffic, and an incomplete Ledger wallet-targeting implant. The piece includes deep technical detail on the loader's C2 protocol, stolen/fraudulent code-signing certificates, and infrastructure patterns (multi-branded loader domains), plus mitigation guidance and a link to published IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Wiz details how attackers abuse Entra ID's Device Registration Service to register rogue devices — often via device code phishing — to satisfy Conditional Access policies requiring joined devices, commonly using the open-source ROADrecon framework and predictable names like DESKTOP-XXXXXXXX. As attackers shift to AI-generated, benign-looking device names (e.g., "Work PC") and plausible User-Agent strings, static IOC matching breaks down, so Wiz shifted to behavioral detections: naming-convention anomaly detection against tenant baselines and correlating device-code-phishing alerts with subsequent device registrations, including a shared KQL query for identifying anomalous naming baselines.

wiz.iowriteupAdded 3 Sep 2026, published 18 Aug 2026🛡️ Security

Huntress dissects a Bank of America-themed phishing email that lures victims into downloading AccountGuardSetup.vbs, which unpacks through several layers of base64-encoded PowerShell to silently install ScreenConnect RMM with Administrator privileges. The chain uses AES-128-CBC encrypted blobs to deliver a C# UAC-bypass exploit via the ICMLuaUtil COM interface (MITRE ATT&CK T1548.002), then hides the resulting ScreenConnect service (renamed "Windows Security") from users and admins using SDDL/ACL manipulation so it can't be seen, logged, or removed.

huntress.comwriteupAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

Huntress details a second 2026 wave of device code phishing against Microsoft 365, this time abusing VPS reseller BL Networks (BitLaunch/BLNWX, AS399629) after an earlier wave tied to Railway and the EvilTokens phishing-as-a-service kit. Huntress observed 533 malicious events and 113 successful logins from a single BL Networks IP in April, spreading across multiple IPs and subnets by May, with 26 critical incidents across 23 identities logged in July, and argues defenders must stop trusting infrastructure reputation and instead hunt for anomalous device-code sign-in clusters and revoke tokens quickly. It ties the activity to the broader legitimate-cloud-plus-legitimate-Microsoft-auth-page attack pattern also seen with Railway, EvilTokens, and Kali365.

huntress.comwriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Huntress reverse-engineers MacSync, a macOS stealer-and-RAT chain delivered via a weaponised claude.ai share link promoted through Google Ads malvertising, where a victim searching for how to install Claude on a Mac pastes a curl piped to zsh one-liner. The writeup traces all six stages: a polymorphic zsh loader, a server-side AppleScript that social-engineers Full Disk Access and validates the account password via dscl authonly, keychain and browser Safe Storage theft, a statically-linked C++ Mach-O RAT with WebSocket and AES-CBC C2 plus LaunchAgent persistence disguised as legitimate updaters, a signed Screen Recording-badged helper that phishes the TCC screen-capture permission, and trojanised Electron wallet apps (Ledger Live and Ledger Wallet) that inject a fake recovery-phrase phishing flow. It ties the kit to the AMOS and Atomic Stealer lineage via Russian-language code comments and shared infrastructure, and documents concrete IOCs including domains, C2 IP, mutex naming, and plist patterns for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 29 Jul 2026🛡️ Security

Huntress researchers analyzed a phishing campaign that abused Meta's legitimate "Business Partner Manager" email feature (from security@facebookmail.com) to send convincing phishing lures that bypass typical email validation checks. The threat actor injected a URL into the field meant for a partner's business name, redirecting victims through Google Sites, a fake "Meta Agency Partner Program" page (aussiecleaningservices[.]com), and later a Facebook Messenger chatbot ("AI Strategic Partner") leading to a fake Meta Verified/Content Monetization phishing page (sw[.]run, framed via Netlify) that harvested credentials, MFA codes, and ID documents, exfiltrating them to a Telegram bot with Vietnamese-language text, before Meta shut down the abuse vector.

huntress.comwriteupAdded 3 Sep 2026, published 7 Jul 2026🛡️ Security

Huntress details its investigation into the Klue supply-chain breach, in which a threat actor calling itself Icarus compromised the market-intelligence platform Klue via a long-dormant integration credential, then stole OAuth tokens to pivot into downstream customers' Salesforce and Gong instances, exfiltrating CRM data (contacts, price quotes, opportunity notes) from Huntress and dozens of other companies. The writeup includes IOCs, extortion-email analysis, attribution to Icarus via matching Session Messenger IDs, identification of bulletproof-hosted (AS200593/PROSPERO OOO) leak infrastructure, and IR guidance (log review, session revocation, phishing awareness) for other affected Klue customers.

huntress.comwriteupAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

Huntress SOC incident report on an internet-facing RD Gateway/RDWeb terminal server compromised via credential reuse with no MFA, where the actor staged Gammadyne Mailer (a legitimate commercial bulk-mail tool) to send 8.9 million Boots-impersonation phishing emails direct-to-MX from the victim's clean IP, evading AV entirely. The phishing kit itself was hosted on a compromised Bolivian government domain (ipelc.gob.bo) to inherit its trust and dodge reputation blocklists, and the writeup details the log-forensics (Windows Security log gaps, Terminal Services operational logs, Chainsaw parsing, WFP Event 5157) used to reconstruct the timeline and attribute a separate opportunistic brute-force bot.

huntress.comwriteupAdded 3 Sep 2026, published 15 Jun 2026🛡️ Security

Huntress SOC investigation into Kali365 (also seen as Octopi365/Freedom365), an AI-enabled Phishing-as-a-Service kit that abuses the Microsoft device-code authentication flow to steal M365 tokens and maintain persistent mailbox access even after password resets. The writeup dissects three panel editions (base AiTM/device-code capture, a post-compromise BEC/fraud module using Claude for drafting wire-transfer scam replies, and a self-service reseller tier with crypto billing via OxaPay), and reverse-engineers the companion Electron desktop apps OctoLink Live and OctoLink Sender, which exchange stolen refresh tokens for real ESTSAUTH session cookies to drive undetected Graph mail-sending and admin-portal access — tactics overlapping with Microsoft's Storm-2372 reporting. Includes IoCs and a KQL hunting rule for detecting device-code abuse.

huntress.comwriteupAdded 3 Sep 2026, published 11 Jun 2026🛡️ Security

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

huntress.comwriteupAdded 3 Sep 2026, published 3 Jun 2026🛡️ Security

Huntress details a device-code phishing campaign hitting 340+ Microsoft 365 tenants across the US, Canada, Australia, New Zealand, and Germany since February 2026, in which attackers abuse Railway.com's clean-IP PaaS infrastructure to run OAuth device-code token replay at scale, bypassing MFA entirely. The campaign chains vendor URL-rewriter abuse (Cisco, Trend Micro, Mimecast), compromised sites, Cloudflare workers.dev phishing pages, and AI-assisted lure generation, and Huntress has attributed it to the EvilTokens Phishing-as-a-Service platform advertised via Telegram. The post includes IOCs (Railway CIDR ranges), Sentinel KQL hunting queries, and mitigation guidance (block Railway IPs, revoke refresh tokens, restrict device code flow, enable CAE).

huntress.comwriteupAdded 3 Sep 2026, published 23 Mar 2026🛡️ Security

Huntress SOC documents a recurring attack pattern from late 2025 where threat actors gain initial access via phishing-delivered RMM installers such as GoTo Resolve, PDQ, and ITarian, then use that foothold to deploy a secondary rogue RMM such as ScreenConnect or SimpleHelp for redundant persistence, sometimes chaining three RMMs in one intrusion. It walks through specific incidents at a real estate firm, investment firm, and car dealer, including file paths, C2 domains, and phishing lures like fake invitations and a fake Microsoft Teams bid transcript, and closes with detection guidance such as asset inventory, the LOLRMM list, and log auditing.

huntress.comwriteupAdded 3 Sep 2026, published 18 Dec 2025🛡️ Security

Huntress details a December 2025 incident where attackers used SEO poisoning to surface fake, attacker-created ChatGPT and Grok shared conversations as top Google results for benign queries like "clear disk space on macOS." Victims who followed the AI-formatted "troubleshooting" instructions and pasted a Terminal command triggered a multi-stage AMOS (Atomic macOS Stealer) infection: a bash loader silently validated the user's password via `dscl -authonly`, escalated to root via `sudo -S`, deployed a hidden `.helper` Mach-O payload, trojanized Ledger Wallet and Trezor Suite apps to steal seed phrases, and persisted via a LaunchDaemon-driven AppleScript watchdog that relaunches under the active GUI user's session every second. The piece is notable as the first documented case of AMOS using AI-platform-hosted content (rather than phishing or fake installers) as the initial lure, and includes defender detection guidance (monitoring osascript credential prompts, dscl -authonly usage, sudo -u with piped passwords, hidden dotfiles).

huntress.comwriteupAdded 3 Sep 2026, published 9 Dec 2025🛡️ Security

Huntress CEO Kyle Hanslovan demonstrates a full modern account-takeover chain against Microsoft 365: buying stolen credentials on a dark web marketplace, using a ChatGPT-crafted phishing email with a fake SharePoint link to trigger a ClickFix-style CAPTCHA that tricks the victim into pasting a PowerShell command, stealing active session cookies with an infostealer, and importing them via the Cookie Editor browser extension to bypass MFA entirely. It then covers post-compromise tradecraft — malicious inbox rules to forward/hide sensitive emails, Teams-based social engineering of IT support to register new MFA devices, and abusing email-based password resets on non-SSO apps (payroll, CRM) — plus defensive recommendations (conditional access, inbox rule auditing, DMARC/DKIM/BIMI, session revocation processes, security awareness training).

huntress.comwriteupAdded 3 Sep 2026, published 26 Nov 2025🛡️ Security

CVE-2025-59419 is an SMTP command injection in Netty's SMTP codec, found by depthfirst's autonomous security agent. The codec accepted \r\n in user input such as the RCPT TO recipient, letting an attacker inject extra SMTP commands and forge senders. The forged mail passes SPF, DKIM and DMARC, enabling BEC and phishing. Maintainers merged the agent-generated patch, citing Netty's existing HTTP codec validation.

depthfirst.comwriteupAdded 29 Oct 2026, published 20 Oct 2025🛡️ Security

A Huntress researcher walks through Device Code Phishing, an OAuth 2.0 device authorization grant abuse technique, and shows why it is far more dangerous against Azure/Microsoft 365 than against Google Cloud. In Azure, the attacker controls the requested resource and can use Microsoft's undocumented "Family of Client IDs" (e.g. the Microsoft Authentication Broker client ID) to phish a Primary Refresh Token capable of joining rogue devices, enrolling MFA, and full account takeover; Google's device code implementation restricts the flow to a handful of narrow scopes (GDrive file access, YouTube read-only) and requires a registered/verified OAuth app, neutering the same attack. The piece includes working curl/Python requests for both providers and references prior research by Dirk-jan Mollema, Nestori Syynimaa, and Lina Lau.

huntress.comwriteupAdded 3 Sep 2026, published 6 Feb 2025🛡️ Security

A DFIR analysis by dfir.ch dissecting a real-world phishing campaign that abuses the Windows "search-ms" URI protocol handler embedded in an HTML attachment ("Booking_Confirmation.html") to trigger a WebDAV connection via rundll32/davclnt.dll, present a spoofed Explorer search result, and lure the victim into executing an LNK file. The LNK launches a headless conhost.exe pulling an obfuscated batch script (new.bat) over a trycloudflare.com tunnel, which drops a decoy PDF, downloads a full Python interpreter (FTSP.zip) and additional scripts, and ultimately performs shellcode injection. The post also documents Sysmon process-create telemetry and the HKCU WordWheelQuery registry key as forensic artifacts of the search-ms query.

dfir.chwriteupAdded 3 Sep 2026, published 4 Aug 2024🛡️ Security

A practical walkthrough showing how a dangling DNS CNAME (subdomain takeover) combined with the default 'relaxed' DMARC alignment mode (aspf=r/adkim=r) lets an attacker send phishing emails that pass SPF and DMARC for the victim's organizational domain, using a self-owned mail server behind Microsoft 365. The author also demonstrates a partial DKIM trick — signing with a domain other than the spoofed sender to make emails look more legitimate — and shows the resulting mail landing in an Outlook inbox with dmarc=pass. It recommends setting aspf=s/adkim=s (strict alignment) and cleaning up unused DNS records as mitigations.

bencteux.frwriteupAdded 3 Sep 2026, published 25 Jan 2023🛡️ Security

A hands-on research post that walks through using Windows `assoc`/`ftype` to enumerate file-extension-to-program associations and identify which extensions (.com, .pif, .scr, .bat/.cmd, .vbs/.js, .jar, .chm via hh.exe) execute directly or indirectly on double-click, useful for crafting phishing payloads that evade mail defenses. It includes working PoCs (a .NET binary renamed to .com/.pif/.scr, a VBS script, a Java JAR, and a malicious CHM built with hh.exe per LOLBas), plus credential-theft-relevant extensions like .scf and browser-opening extensions (.html/.svg/.mhtml) for phishing pages, ending with allow-list-based mitigation advice.

bencteux.frwriteupAdded 3 Sep 2026, published 26 Oct 2022🛡️ Security