#credentialharvesting — Public Fediverse posts

AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.

Pulse ID: 6ab22dd5026bef69ef5a17fd
Pulse Link: https://otx.alienvault.com/pulse/6ab22dd5026bef69ef5a17fd
Pulse Author: AlienVault
Created: 2026-09-22 07:27:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Malware #CredentialHarvesting #SocialEngineering #SupplyChain #OTX #AlienVault

AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.

Pulse ID: 6ab22dd5026bef69ef5a17fd
Pulse Link: https://otx.alienvault.com/pulse/6ab22dd5026bef69ef5a17fd
Pulse Author: AlienVault
Created: 2026-09-22 07:27:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Malware #CredentialHarvesting #SocialEngineering #SupplyChain #OTX #AlienVault

AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.

Pulse ID: 6ab22dd5026bef69ef5a17fd
Pulse Link: https://otx.alienvault.com/pulse/6ab22dd5026bef69ef5a17fd
Pulse Author: AlienVault
Created: 2026-09-22 07:27:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Malware #CredentialHarvesting #SocialEngineering #SupplyChain #OTX #AlienVault

AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.

Pulse ID: 6ab22dd5026bef69ef5a17fd
Pulse Link: https://otx.alienvault.com/pulse/6ab22dd5026bef69ef5a17fd
Pulse Author: AlienVault
Created: 2026-09-22 07:27:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Malware #CredentialHarvesting #SocialEngineering #SupplyChain #OTX #AlienVault

AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution

This document analyzes multiple cybersecurity incidents involving various threat actors and malicious campaigns. The analysis covers sophisticated attack methodologies including exploitation of vulnerabilities, deployment of specialized malware tools, and targeting of critical infrastructure across multiple sectors. The campaigns demonstrate advanced persistent threat capabilities with focus on data exfiltration, system compromise, and lateral movement within targeted networks. Key observations include the use of social engineering tactics, exploitation of remote access vulnerabilities, and deployment of custom malware frameworks. The threat landscape encompasses government, technology, financial, and defense sectors with significant emphasis on supply chain attacks and credential harvesting operations.

Pulse ID: 6ab22dd5026bef69ef5a17fd
Pulse Link: https://otx.alienvault.com/pulse/6ab22dd5026bef69ef5a17fd
Pulse Author: AlienVault
Created: 2026-09-22 07:27:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Malware #CredentialHarvesting #SocialEngineering #SupplyChain #OTX #AlienVault

North Korea Exploits Job Seekers to Infect 30,000 Devices

North Korean hackers have compromised over 30,000 devices by posing as recruiters, targeting unsuspecting job seekers with a clever ruse that steals sensitive information and cryptocurrency. By exploiting stolen IDs, these cybercriminals can impersonate victims and generate foreign currency, ultimately funding the regime.

https://osintsights.com/north-korea-exploits-job-seekers-to-infect-30000-devices?utm_source=mastodon&utm_medium=social

#NorthKorea #Waterplum #JobScams #CredentialHarvesting #CryptocurrencyTheft

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

Pulse ID: 6aaaca963a639dd0475e8462
Pulse Link: https://otx.alienvault.com/pulse/6aaaca963a639dd0475e8462
Pulse Author: AlienVault
Created: 2026-09-16 16:57:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #BackDoor #CredentialHarvesting #GitHub #OTX #AlienVault

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

Pulse ID: 6aaaca963a639dd0475e8462
Pulse Link: https://otx.alienvault.com/pulse/6aaaca963a639dd0475e8462
Pulse Author: AlienVault
Created: 2026-09-16 16:57:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #BackDoor #CredentialHarvesting #GitHub #OTX #AlienVault

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

Pulse ID: 6aaaca963a639dd0475e8462
Pulse Link: https://otx.alienvault.com/pulse/6aaaca963a639dd0475e8462
Pulse Author: AlienVault
Created: 2026-09-16 16:57:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #BackDoor #CredentialHarvesting #GitHub #OTX #AlienVault

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

Pulse ID: 6aaaca963a639dd0475e8462
Pulse Link: https://otx.alienvault.com/pulse/6aaaca963a639dd0475e8462
Pulse Author: AlienVault
Created: 2026-09-16 16:57:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #BackDoor #CredentialHarvesting #GitHub #OTX #AlienVault

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

Pulse ID: 6aaaca963a639dd0475e8462
Pulse Link: https://otx.alienvault.com/pulse/6aaaca963a639dd0475e8462
Pulse Author: AlienVault
Created: 2026-09-16 16:57:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Afghanistan #BackDoor #CredentialHarvesting #GitHub #OTX #AlienVault

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

Pulse ID: 6aa84f430eb4651668636168
Pulse Link: https://otx.alienvault.com/pulse/6aa84f430eb4651668636168
Pulse Author: AlienVault
Created: 2026-09-14 19:47:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#SSL #VPN #CVE202421762 #CredentialHarvesting #OTX #AlienVault

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

Pulse ID: 6aa84f430eb4651668636168
Pulse Link: https://otx.alienvault.com/pulse/6aa84f430eb4651668636168
Pulse Author: AlienVault
Created: 2026-09-14 19:47:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#SSL #VPN #CVE202421762 #CredentialHarvesting #OTX #AlienVault

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

Pulse ID: 6aa84f430eb4651668636168
Pulse Link: https://otx.alienvault.com/pulse/6aa84f430eb4651668636168
Pulse Author: AlienVault
Created: 2026-09-14 19:47:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#SSL #VPN #CVE202421762 #CredentialHarvesting #OTX #AlienVault

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

Pulse ID: 6aa84f430eb4651668636168
Pulse Link: https://otx.alienvault.com/pulse/6aa84f430eb4651668636168
Pulse Author: AlienVault
Created: 2026-09-14 19:47:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#SSL #VPN #CVE202421762 #CredentialHarvesting #OTX #AlienVault

Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence

An exposed directory on a Thai server revealed an active intrusion campaign targeting 3BB (Triple T Broadband), one of Thailand's largest broadband providers. The attacker exploited CVE-2024-21762 in a FortiGate 60F SSL-VPN appliance to gain initial access, then deployed MeshCentral remote management software for persistent command-and-control. The operation involved extensive reconnaissance, credential harvesting targeting RADIUS authentication databases, privilege escalation using PwnKit and Dirty COW exploits, lateral movement via SSH brute-forcing across 55+ internal hosts, and anti-forensic cleanup procedures. Multiple devices were already enrolled under attacker control at discovery, with additional targeting of Jasmine International infrastructure. The attacker's toolkit included web application exploitation scripts, database credential extraction tools, and persistence mechanisms designed to maintain long-term access to subscriber authentication systems.

Pulse ID: 6aa84f430eb4651668636168
Pulse Link: https://otx.alienvault.com/pulse/6aa84f430eb4651668636168
Pulse Author: AlienVault
Created: 2026-09-14 19:47:14

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#SSL #VPN #CVE202421762 #CredentialHarvesting #OTX #AlienVault

The Death of Trust: Why Adversary-in-the-Middle and QR Attacks Are Gutting Corporate Defenses

1,408 words, 7 minutes read time.

We have built our enterprise security perimeters on a foundation of sand, and the storm has finally arrived. For years, security leadership assured stakeholders that multi-factor authentication was the ultimate shield against unauthorized entry. That comfort was a lie, born of complacency and soft thinking. Threat actors have evolved past simple credential harvesting; they are actively deploying Adversary-in-the-Middle (AiTM) phishing frameworks and zero-visibility QR code vectors that bypass legacy defenses without breaking a single line of code. We watched the systems fail because we relied on passive compliance rather than uncompromising operational discipline.

The modern attack landscape does not care about our corporate policy manuals or annual security awareness videos. According to data tracked by Microsoft Threat Intelligence and the Cybersecurity and Infrastructure Security Agency (CISA), targeted organizations face an unprecedented surge in AiTM token hijacking and image-embedded QR phishing campaigns designed specifically to bypass secure email gateways. Threat actors set up reverse-proxy infrastructure that sits directly between our users and legitimate authentication endpoints. When our workforce logs in, the attacker proxies the request, steals the authenticated session cookie in real time, and walks straight through the front door.

We must strip away the illusion that traditional defensive controls are keeping us safe. The rise of hybrid voice-and-email callback attacks and CAPTCHA-gated phishing infrastructure proves that attackers are exploiting the exact gaps we left open through institutional laziness. This deep-dive analysis confronts the mechanical realities of modern social engineering, dissects the failure of static multi-factor authentication, and lays out the hard architecture required to survive.

The Mechanics of Session Hijacking: How Reverse Proxies Bypass Legacy MFA

We need to understand the structural failure occurring at the authentication layer. Legacy multi-factor authentication relies on push notifications, SMS codes, or time-based one-time passwords (TOTP) to verify identity. Threat actors bypass these controls entirely by utilizing advanced AiTM phishing proxies like EvilGinx. The attack vector does not attempt to break encryption algorithms or crack complex passwords; it simply manipulates the human operating the endpoint into handing over full access.

The process is surgically precise and brutally efficient. An employee receives a high-urgency communication, often mimicking internal human resources or critical SaaS infrastructure. The link inside routes the target to an attacker-controlled proxy server that dynamically mirrors the organization’s real login portal in real time. As the employee inputs their primary credentials and completes the secondary MFA challenge, the proxy server relays those packets directly to the legitimate service provider.

Once the service provider authenticates the session, it issues a session token or authentication cookie back to the user. Because that traffic flows directly through the adversary’s proxy, the attacker captures the live session token instantaneously. The attacker then injects that session token into their own browser, instantly hijacking the active, fully authenticated corporate session without ever needing to know the user’s password or possess their physical MFA token. We must realize that the authentication process completed successfully in the eyes of the server, yet the enterprise was compromised entirely.

Blind Spots in the Perimeter: The Rise of Image-Based Quishing and TOAD Attacks

We have allowed our perimeter defenses to become completely blind to non-traditional attack vectors. Standard secure email gateways spend massive compute resources scanning incoming plain-text URLs and parsing standard attachments for known malicious signatures. Cybercriminals recognize this dependency and have adapted by shifting their payloads into optical and multi-channel vectors that bypass automated text-scanning engines entirely.

QR code phishing, known colloquially as quishing, represents a massive operational vulnerability across corporate environments. Attackers embed malicious authentication URLs inside image-based QR codes wrapped within benign PDF documents or inline email bodies. Traditional email filters read the image as harmless static graphic data, allowing the message to land directly in the victim’s inbox. The target is instructed to scan the code using a personal mobile device to complete an mandatory system update or open a secure document.

This action immediately forces the target off our managed corporate network and onto an unmonitored mobile device that lacks endpoint detection and response (EDR) agents. From there, the mobile browser connects to the AiTM proxy framework, and the session is compromised out of sight of internal security operations. Simultaneously, Telephone-Oriented Attack Delivery (TOAD) campaigns combine fake subscription invoices with live callback centers. When employees call the listed support number, live operators leverage high-urgency social engineering to guide targets through manual credential entry or remote control software installation. The system fails because we trained our people to look for suspicious links while leaving them exposed to visual and verbal exploitation.

Engineering Absolute Resistance: Deploying FIDO2 and Zero-Trust Architecture

We cannot solve an architectural flaw with soft solutions like additional compliance training or stern warning banners. Human error under psychological manipulation is an inevitable reality; therefore, our technical controls must enforce absolute resistance at the protocol level. We must eliminate push-based and TOTP-based authentication schemes in favor of hardware-bound, phishing-resistant credentials based on FIDO2 and WebAuthn standards.

FIDO2 architecture neutralizes AiTM reverse-proxy attacks through cryptographic origin binding. When an employee authenticates using a FIDO2 security key or platform authenticator, the web browser cryptographically binds the authentication request to the specific domain origin shown in the browser address bar. If an attacker routes the employee to a spoofed proxy domain, the browser detects the domain mismatch and refuses to sign the authentication challenge. The proxy captured nothing because no valid token was ever generated.

Beyond hardware-bound authentication, we must enforce strict Zero-Trust network access and continuous conditional access policies. Authentication must never be treated as a single, static event that grants permanent access for the duration of a session token. System infrastructure must continuously evaluate device health, geographic velocity, IP reputation, and behavioral anomalies throughout the entire life of the connection. If a session token suddenly presents from an unrecognized IP address or an unmanaged device, that session must be revoked immediately, and step-up authentication must be enforced.

Summary of Core Defenses

• Hardware-bound FIDO2 and WebAuthn protocols eliminate AiTM session hijacking by cryptographically binding authentication challenges to verified domain origins.
• Optical payload inspection and mobile device management controls counter image-based quishing vectors that bypass traditional secure email gateways.
• Continuous conditional access policies validate device compliance, network context, and session integrity in real time to neutralize stolen session tokens.

The era of trusting simple passwords paired with basic multi-factor push notifications is dead. Attackers have weaponized automated proxies and optical vectors to turn our own authentication mechanisms against us. Survival requires dropping the comfortable illusion of legacy security, taking absolute accountability for our technical debt, and building an unyielding architecture that stops threat actors cold before the system burns.

D. Bryan King

Sources

• CISA: Defending Against Software Supply Chain Attacks & Phishing Proxies
• Microsoft Security: From Cookie Theft to BEC: Adversary-in-the-Middle Phishing
• MITRE ATT&CK: Steal Web Session Cookie (Technique T1539)
• NIST National Vulnerability Database: Session Hijacking & Token Exploits
• FIDO Alliance: FIDO2 Authentication Standards & Specifications
• W3C: Web Authentication (WebAuthn) Specification
• FBI Internet Crime Complaint Center (IC3): Public Service Announcement on Quishing Trends
• SANS Institute: Combatting Adversary-in-the-Middle (AiTM) Phishing Attacks
• NIST Special Publication 800-63-3: Digital Identity Guidelines
• Mandiant: Dissecting Adversary-in-the-Middle Infrastructure
• BleepingComputer: Microsoft Warns of Massive AiTM Phishing Campaigns
• Krebs on Security: Microsoft on AiTM Phishing Attacks That Bypass MFA
• Dark Reading: Quishing on the Rise: How QR Code Attacks Bypass Defenses
• SecurityWeek: QR Code Phishing Trends Targeting Corporate Enterprise Networks
• Infosecurity Magazine: MFA Bypass and Session Token Hijacking Surge
• CrowdStrike: What is an Adversary-in-the-Middle (AiTM) Attack?
• Palo Alto Networks: Understanding AiTM Phishing Frameworks and Reverse Proxies
• Trend Micro: Adversary-in-the-Middle Phishing Attacks Explained
• Fortinet: What is Quishing? Understanding QR Code Phishing Threats
• Proofpoint: Telephone-Oriented Attack Delivery (TOAD) Threat Insight
• Rapid7: Understanding Session Hijacking and Pass-the-Cookie Attacks
• Check Point Software: Comprehensive Guide to Quishing and EvilGinx Exploits
• Sophos: Technical Report on Modern MFA Bypass Techniques
• SentinelOne: Session Cookie Theft: How Attackers Bypass MFA
• ThreatDown: QR Code Phishing (Quishing) Mechanics Explained
• Schneier on Security: Analysis of MFA Bypasses via Reverse Proxies
• ZDNET: QR Code Phishing as a Growing Enterprise Security Threat
• The Hacker News: Analysis of EvilGinx3 Phishing Framework Capabilities
• CNET: Quishing: How Scammers Use QR Codes to Steal Credentials
• Aruba Networks: Fundamentals of Zero Trust Network Access (ZTNA) Architecture

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

Rate this:

The Vite development server vulnerability CVE-2026-39364 is exploited in mass scanning for credential harvesting. F5 Labs logged 32,000 events. Patch now.

#Vite #CVE202639364 #CloudSecurity #CredentialHarvesting #F5Labs #DevSecOps #FileDisclosure #InfoSec #AWS #MassScanning

https://securityonline.info/vite-cve-2026-39364-exploited/?utm_source=mastodon&utm_medium=jetpack_social

The Vite development server vulnerability CVE-2026-39364 is exploited in mass scanning for credential harvesting. F5 Labs logged 32,000 events. Patch now.

#Vite #CVE202639364 #CloudSecurity #CredentialHarvesting #F5Labs #DevSecOps #FileDisclosure #InfoSec #AWS #MassScanning

https://securityonline.info/vite-cve-2026-39364-exploited/?utm_source=mastodon&utm_medium=jetpack_social

The Vite development server vulnerability CVE-2026-39364 is exploited in mass scanning for credential harvesting. F5 Labs logged 32,000 events. Patch now.

#Vite #CVE202639364 #CloudSecurity #CredentialHarvesting #F5Labs #DevSecOps #FileDisclosure #InfoSec #AWS #MassScanning

https://securityonline.info/vite-cve-2026-39364-exploited/?utm_source=mastodon&utm_medium=jetpack_social

The Vite development server vulnerability CVE-2026-39364 is exploited in mass scanning for credential harvesting. F5 Labs logged 32,000 events. Patch now.

#Vite #CVE202639364 #CloudSecurity #CredentialHarvesting #F5Labs #DevSecOps #FileDisclosure #InfoSec #AWS #MassScanning

https://securityonline.info/vite-cve-2026-39364-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Discover how adversarial AI threats fuel massive AI credential harvesting operations. Attackers use automated agents for fast cyber crime campaigns.

#AISecurity #CyberThreats #CredentialHarvesting #Cybersecurity

https://securityonline.info/adversarial-ai-threats/?utm_source=mastodon&utm_medium=jetpack_social

Discover how adversarial AI threats fuel massive AI credential harvesting operations. Attackers use automated agents for fast cyber crime campaigns.

#AISecurity #CyberThreats #CredentialHarvesting #Cybersecurity

https://securityonline.info/adversarial-ai-threats/?utm_source=mastodon&utm_medium=jetpack_social

Discover how adversarial AI threats fuel massive AI credential harvesting operations. Attackers use automated agents for fast cyber crime campaigns.

#AISecurity #CyberThreats #CredentialHarvesting #Cybersecurity

https://securityonline.info/adversarial-ai-threats/?utm_source=mastodon&utm_medium=jetpack_social

Discover how adversarial AI threats fuel massive AI credential harvesting operations. Attackers use automated agents for fast cyber crime campaigns.

#AISecurity #CyberThreats #CredentialHarvesting #Cybersecurity

https://securityonline.info/adversarial-ai-threats/?utm_source=mastodon&utm_medium=jetpack_social

Anthropic Exposes AI Abuse by Hackers Linked to Russia, China

Anthropic uncovered a massive AI-powered operation by hackers linked to Russia and China, who used a sophisticated pipeline to download and scan 1.8 million Android apps for sensitive secrets. This alarming breach highlights the growing threat of AI abuse in cyber attacks.

https://osintsights.com/anthropic-exposes-ai-abuse-by-hackers-linked-to-russia-china?utm_source=mastodon&utm_medium=social

#AiAbuseDetection #Russia #China #Shinyhunters #CredentialHarvesting

A sophisticated phishing campaign uses redirect chains to abuse Google infrastructure. Learn how attackers abuse Google infrastructure to steal credentials.

#GoogleInfrastructure #Phishing #CredentialHarvesting #Cybersecurity #InfoSec

https://securityonline.info/abuse-google-infrastructure-phishing/?utm_source=mastodon&utm_medium=jetpack_social

A sophisticated phishing campaign uses redirect chains to abuse Google infrastructure. Learn how attackers abuse Google infrastructure to steal credentials.

#GoogleInfrastructure #Phishing #CredentialHarvesting #Cybersecurity #InfoSec

https://securityonline.info/abuse-google-infrastructure-phishing/?utm_source=mastodon&utm_medium=jetpack_social

A sophisticated phishing campaign uses redirect chains to abuse Google infrastructure. Learn how attackers abuse Google infrastructure to steal credentials.

#GoogleInfrastructure #Phishing #CredentialHarvesting #Cybersecurity #InfoSec

https://securityonline.info/abuse-google-infrastructure-phishing/?utm_source=mastodon&utm_medium=jetpack_social

A sophisticated phishing campaign uses redirect chains to abuse Google infrastructure. Learn how attackers abuse Google infrastructure to steal credentials.

#GoogleInfrastructure #Phishing #CredentialHarvesting #Cybersecurity #InfoSec

https://securityonline.info/abuse-google-infrastructure-phishing/?utm_source=mastodon&utm_medium=jetpack_social

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center (FMC) Software. CVE-2026-20079 is a critical authentication bypass vulnerability allowing remote attackers to execute scripts and obtain root access. CVE-2026-20316 enables remote login using low-privileged accounts and can be chained with other vulnerabilities for privilege escalation. Three distinct threat actor clusters have been identified conducting post-compromise activities: UAT-12197 deployed web shells and credential theft tools; UAT-11823, overlapping with Russian APT Sandworm, deployed Cyclops Blink malware and established reverse shells; UAT-11988, a Qilin ransomware operator, conducted extensive reconnaissance, credential harvesting, and deployed ransomware after establishing persistent network access through tunneling tools. Customers are strongly advised to apply available hotfixes immediately.

Pulse ID: 6aa1c2281252d98a241ae632
Pulse Link: https://otx.alienvault.com/pulse/6aa1c2281252d98a241ae632
Pulse Author: AlienVault
Created: 2026-09-09 20:31:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #CredentialHarvesting #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Russia #Sandworm #Talos #Vulnerability #Worm #bot #AlienVault

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center (FMC) Software. CVE-2026-20079 is a critical authentication bypass vulnerability allowing remote attackers to execute scripts and obtain root access. CVE-2026-20316 enables remote login using low-privileged accounts and can be chained with other vulnerabilities for privilege escalation. Three distinct threat actor clusters have been identified conducting post-compromise activities: UAT-12197 deployed web shells and credential theft tools; UAT-11823, overlapping with Russian APT Sandworm, deployed Cyclops Blink malware and established reverse shells; UAT-11988, a Qilin ransomware operator, conducted extensive reconnaissance, credential harvesting, and deployed ransomware after establishing persistent network access through tunneling tools. Customers are strongly advised to apply available hotfixes immediately.

Pulse ID: 6aa1c2281252d98a241ae632
Pulse Link: https://otx.alienvault.com/pulse/6aa1c2281252d98a241ae632
Pulse Author: AlienVault
Created: 2026-09-09 20:31:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #CredentialHarvesting #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Russia #Sandworm #Talos #Vulnerability #Worm #bot #AlienVault

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center (FMC) Software. CVE-2026-20079 is a critical authentication bypass vulnerability allowing remote attackers to execute scripts and obtain root access. CVE-2026-20316 enables remote login using low-privileged accounts and can be chained with other vulnerabilities for privilege escalation. Three distinct threat actor clusters have been identified conducting post-compromise activities: UAT-12197 deployed web shells and credential theft tools; UAT-11823, overlapping with Russian APT Sandworm, deployed Cyclops Blink malware and established reverse shells; UAT-11988, a Qilin ransomware operator, conducted extensive reconnaissance, credential harvesting, and deployed ransomware after establishing persistent network access through tunneling tools. Customers are strongly advised to apply available hotfixes immediately.

Pulse ID: 6aa1c2281252d98a241ae632
Pulse Link: https://otx.alienvault.com/pulse/6aa1c2281252d98a241ae632
Pulse Author: AlienVault
Created: 2026-09-09 20:31:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #CredentialHarvesting #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Russia #Sandworm #Talos #Vulnerability #Worm #bot #AlienVault

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center (FMC) Software. CVE-2026-20079 is a critical authentication bypass vulnerability allowing remote attackers to execute scripts and obtain root access. CVE-2026-20316 enables remote login using low-privileged accounts and can be chained with other vulnerabilities for privilege escalation. Three distinct threat actor clusters have been identified conducting post-compromise activities: UAT-12197 deployed web shells and credential theft tools; UAT-11823, overlapping with Russian APT Sandworm, deployed Cyclops Blink malware and established reverse shells; UAT-11988, a Qilin ransomware operator, conducted extensive reconnaissance, credential harvesting, and deployed ransomware after establishing persistent network access through tunneling tools. Customers are strongly advised to apply available hotfixes immediately.

Pulse ID: 6aa1c2281252d98a241ae632
Pulse Link: https://otx.alienvault.com/pulse/6aa1c2281252d98a241ae632
Pulse Author: AlienVault
Created: 2026-09-09 20:31:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #CredentialHarvesting #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Russia #Sandworm #Talos #Vulnerability #Worm #bot #AlienVault

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Cisco Talos is tracking active exploitation of two vulnerabilities in Secure Firewall Management Center (FMC) Software. CVE-2026-20079 is a critical authentication bypass vulnerability allowing remote attackers to execute scripts and obtain root access. CVE-2026-20316 enables remote login using low-privileged accounts and can be chained with other vulnerabilities for privilege escalation. Three distinct threat actor clusters have been identified conducting post-compromise activities: UAT-12197 deployed web shells and credential theft tools; UAT-11823, overlapping with Russian APT Sandworm, deployed Cyclops Blink malware and established reverse shells; UAT-11988, a Qilin ransomware operator, conducted extensive reconnaissance, credential harvesting, and deployed ransomware after establishing persistent network access through tunneling tools. Customers are strongly advised to apply available hotfixes immediately.

Pulse ID: 6aa1c2281252d98a241ae632
Pulse Link: https://otx.alienvault.com/pulse/6aa1c2281252d98a241ae632
Pulse Author: AlienVault
Created: 2026-09-09 20:31:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #CredentialHarvesting #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RansomWare #Russia #Sandworm #Talos #Vulnerability #Worm #bot #AlienVault

Threat Actors Exploit AI for Large-Scale Credential Harvesting

Threat actors are supercharging their attacks with AI, using it to scale up credential harvesting and launch more sophisticated campaigns. Google Threat Intelligence Group reports that financially motivated and espionage-focused attackers are increasingly turning to AI to target high-value sectors like healthcare,…

https://osintsights.com/threat-actors-exploit-ai-for-large-scale-credential-harvesting?utm_source=mastodon&utm_medium=social

#Ai #CredentialHarvesting #GoogleThreatIntelligenceGroup #Healthcare #ArtificialIntelligence

Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy

Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, Search, DoubleClick, Custom Search, Tag Manager and Analytics to proxy malicious traffic through trusted domains. Victims' email addresses are encoded in URL fragments and stripped before server-side logging. Landing pages dynamically impersonate target organizations by pulling live logos from Clearbit, capturing real-time website screenshots, and validating domains via Google's DNS API. The operation includes multilingual support for 16 languages and dual execution tracks: credential harvesting with immediate Telegram exfiltration, or silent ScreenConnect remote access tool installation. Lures span document reviews, credential expiry notices, package delivery, payment notifications, government benefits and voicemail themes targeting manufacturing, government, finance and...

Pulse ID: 6a9ef40735b49c55dc7166c9
Pulse Link: https://otx.alienvault.com/pulse/6a9ef40735b49c55dc7166c9
Pulse Author: AlienVault
Created: 2026-09-07 17:27:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CredentialHarvesting #CyberSecurity #DNS #DoubleClick #Email #Google #Government #ICS #InfoSec #Manufacturing #OTX #OpenThreatExchange #Phishing #Proxy #RAT #Rust #ScreenConnect #Telegram #bot #AlienVault

Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy

Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, Search, DoubleClick, Custom Search, Tag Manager and Analytics to proxy malicious traffic through trusted domains. Victims' email addresses are encoded in URL fragments and stripped before server-side logging. Landing pages dynamically impersonate target organizations by pulling live logos from Clearbit, capturing real-time website screenshots, and validating domains via Google's DNS API. The operation includes multilingual support for 16 languages and dual execution tracks: credential harvesting with immediate Telegram exfiltration, or silent ScreenConnect remote access tool installation. Lures span document reviews, credential expiry notices, package delivery, payment notifications, government benefits and voicemail themes targeting manufacturing, government, finance and...

Pulse ID: 6a9ef40735b49c55dc7166c9
Pulse Link: https://otx.alienvault.com/pulse/6a9ef40735b49c55dc7166c9
Pulse Author: AlienVault
Created: 2026-09-07 17:27:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CredentialHarvesting #CyberSecurity #DNS #DoubleClick #Email #Google #Government #ICS #InfoSec #Manufacturing #OTX #OpenThreatExchange #Phishing #Proxy #RAT #Rust #ScreenConnect #Telegram #bot #AlienVault

Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy

Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, Search, DoubleClick, Custom Search, Tag Manager and Analytics to proxy malicious traffic through trusted domains. Victims' email addresses are encoded in URL fragments and stripped before server-side logging. Landing pages dynamically impersonate target organizations by pulling live logos from Clearbit, capturing real-time website screenshots, and validating domains via Google's DNS API. The operation includes multilingual support for 16 languages and dual execution tracks: credential harvesting with immediate Telegram exfiltration, or silent ScreenConnect remote access tool installation. Lures span document reviews, credential expiry notices, package delivery, payment notifications, government benefits and voicemail themes targeting manufacturing, government, finance and...

Pulse ID: 6a9ef40735b49c55dc7166c9
Pulse Link: https://otx.alienvault.com/pulse/6a9ef40735b49c55dc7166c9
Pulse Author: AlienVault
Created: 2026-09-07 17:27:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CredentialHarvesting #CyberSecurity #DNS #DoubleClick #Email #Google #Government #ICS #InfoSec #Manufacturing #OTX #OpenThreatExchange #Phishing #Proxy #RAT #Rust #ScreenConnect #Telegram #bot #AlienVault

Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy

Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, Search, DoubleClick, Custom Search, Tag Manager and Analytics to proxy malicious traffic through trusted domains. Victims' email addresses are encoded in URL fragments and stripped before server-side logging. Landing pages dynamically impersonate target organizations by pulling live logos from Clearbit, capturing real-time website screenshots, and validating domains via Google's DNS API. The operation includes multilingual support for 16 languages and dual execution tracks: credential harvesting with immediate Telegram exfiltration, or silent ScreenConnect remote access tool installation. Lures span document reviews, credential expiry notices, package delivery, payment notifications, government benefits and voicemail themes targeting manufacturing, government, finance and...

Pulse ID: 6a9ef40735b49c55dc7166c9
Pulse Link: https://otx.alienvault.com/pulse/6a9ef40735b49c55dc7166c9
Pulse Author: AlienVault
Created: 2026-09-07 17:27:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CredentialHarvesting #CyberSecurity #DNS #DoubleClick #Email #Google #Government #ICS #InfoSec #Manufacturing #OTX #OpenThreatExchange #Phishing #Proxy #RAT #Rust #ScreenConnect #Telegram #bot #AlienVault

Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy

Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, Search, DoubleClick, Custom Search, Tag Manager and Analytics to proxy malicious traffic through trusted domains. Victims' email addresses are encoded in URL fragments and stripped before server-side logging. Landing pages dynamically impersonate target organizations by pulling live logos from Clearbit, capturing real-time website screenshots, and validating domains via Google's DNS API. The operation includes multilingual support for 16 languages and dual execution tracks: credential harvesting with immediate Telegram exfiltration, or silent ScreenConnect remote access tool installation. Lures span document reviews, credential expiry notices, package delivery, payment notifications, government benefits and voicemail themes targeting manufacturing, government, finance and...

Pulse ID: 6a9ef40735b49c55dc7166c9
Pulse Link: https://otx.alienvault.com/pulse/6a9ef40735b49c55dc7166c9
Pulse Author: AlienVault
Created: 2026-09-07 17:27:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CredentialHarvesting #CyberSecurity #DNS #DoubleClick #Email #Google #Government #ICS #InfoSec #Manufacturing #OTX #OpenThreatExchange #Phishing #Proxy #RAT #Rust #ScreenConnect #Telegram #bot #AlienVault

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

A previously undocumented Linux toolkit has been targeting South Korean automotive and media organizations with minimal detection since early 2025. The campaign employs a HAProxy instance called ted backdoor, compiled within the victim's existing HAProxy version 2.8.12, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This sophisticated framework enables remote command execution, malicious script injection into web traffic, credential harvesting, and long-term surveillance. The ted backdoor uses HAProxy's native filter API and internal structures to intercept SSL-decrypted HTTP traffic while maintaining legitimate load balancing operations. Operating alongside are an SSH keylogger, a curl-based RAT with HAProxy health monitoring capabilities, and a deployment stager. The toolkit is attributed with medium confidence to DPRK APTs based on targeting patterns, simple XOR-based encryption schemes, custom substitution ciphers, and C2 infrastructure associated with APT37.

Pulse ID: 6a9af7a5158ae188847551b5
Pulse Link: https://otx.alienvault.com/pulse/6a9af7a5158ae188847551b5
Pulse Author: AlienVault
Created: 2026-09-04 16:53:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT37 #BackDoor #CredentialHarvesting #CyberSecurity #DPRK #Encryption #HTTP #InfoSec #KeyLogger #Korea #Linux #Nim #OTX #OpenThreatExchange #Proxy #RAT #RCE #RemoteCommandExecution #SSH #SSL #SouthKorea #Trojan #bot #AlienVault

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

A previously undocumented Linux toolkit has been targeting South Korean automotive and media organizations with minimal detection since early 2025. The campaign employs a HAProxy instance called ted backdoor, compiled within the victim's existing HAProxy version 2.8.12, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This sophisticated framework enables remote command execution, malicious script injection into web traffic, credential harvesting, and long-term surveillance. The ted backdoor uses HAProxy's native filter API and internal structures to intercept SSL-decrypted HTTP traffic while maintaining legitimate load balancing operations. Operating alongside are an SSH keylogger, a curl-based RAT with HAProxy health monitoring capabilities, and a deployment stager. The toolkit is attributed with medium confidence to DPRK APTs based on targeting patterns, simple XOR-based encryption schemes, custom substitution ciphers, and C2 infrastructure associated with APT37.

Pulse ID: 6a9af7a5158ae188847551b5
Pulse Link: https://otx.alienvault.com/pulse/6a9af7a5158ae188847551b5
Pulse Author: AlienVault
Created: 2026-09-04 16:53:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT37 #BackDoor #CredentialHarvesting #CyberSecurity #DPRK #Encryption #HTTP #InfoSec #KeyLogger #Korea #Linux #Nim #OTX #OpenThreatExchange #Proxy #RAT #RCE #RemoteCommandExecution #SSH #SSL #SouthKorea #Trojan #bot #AlienVault

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

A previously undocumented Linux toolkit has been targeting South Korean automotive and media organizations with minimal detection since early 2025. The campaign employs a HAProxy instance called ted backdoor, compiled within the victim's existing HAProxy version 2.8.12, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This sophisticated framework enables remote command execution, malicious script injection into web traffic, credential harvesting, and long-term surveillance. The ted backdoor uses HAProxy's native filter API and internal structures to intercept SSL-decrypted HTTP traffic while maintaining legitimate load balancing operations. Operating alongside are an SSH keylogger, a curl-based RAT with HAProxy health monitoring capabilities, and a deployment stager. The toolkit is attributed with medium confidence to DPRK APTs based on targeting patterns, simple XOR-based encryption schemes, custom substitution ciphers, and C2 infrastructure associated with APT37.

Pulse ID: 6a9af7a5158ae188847551b5
Pulse Link: https://otx.alienvault.com/pulse/6a9af7a5158ae188847551b5
Pulse Author: AlienVault
Created: 2026-09-04 16:53:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT37 #BackDoor #CredentialHarvesting #CyberSecurity #DPRK #Encryption #HTTP #InfoSec #KeyLogger #Korea #Linux #Nim #OTX #OpenThreatExchange #Proxy #RAT #RCE #RemoteCommandExecution #SSH #SSL #SouthKorea #Trojan #bot #AlienVault

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

A previously undocumented Linux toolkit has been targeting South Korean automotive and media organizations with minimal detection since early 2025. The campaign employs a HAProxy instance called ted backdoor, compiled within the victim's existing HAProxy version 2.8.12, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This sophisticated framework enables remote command execution, malicious script injection into web traffic, credential harvesting, and long-term surveillance. The ted backdoor uses HAProxy's native filter API and internal structures to intercept SSL-decrypted HTTP traffic while maintaining legitimate load balancing operations. Operating alongside are an SSH keylogger, a curl-based RAT with HAProxy health monitoring capabilities, and a deployment stager. The toolkit is attributed with medium confidence to DPRK APTs based on targeting patterns, simple XOR-based encryption schemes, custom substitution ciphers, and C2 infrastructure associated with APT37.

Pulse ID: 6a9af7a5158ae188847551b5
Pulse Link: https://otx.alienvault.com/pulse/6a9af7a5158ae188847551b5
Pulse Author: AlienVault
Created: 2026-09-04 16:53:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT37 #BackDoor #CredentialHarvesting #CyberSecurity #DPRK #Encryption #HTTP #InfoSec #KeyLogger #Korea #Linux #Nim #OTX #OpenThreatExchange #Proxy #RAT #RCE #RemoteCommandExecution #SSH #SSL #SouthKorea #Trojan #bot #AlienVault

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

A previously undocumented Linux toolkit has been targeting South Korean automotive and media organizations with minimal detection since early 2025. The campaign employs a HAProxy instance called ted backdoor, compiled within the victim's existing HAProxy version 2.8.12, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This sophisticated framework enables remote command execution, malicious script injection into web traffic, credential harvesting, and long-term surveillance. The ted backdoor uses HAProxy's native filter API and internal structures to intercept SSL-decrypted HTTP traffic while maintaining legitimate load balancing operations. Operating alongside are an SSH keylogger, a curl-based RAT with HAProxy health monitoring capabilities, and a deployment stager. The toolkit is attributed with medium confidence to DPRK APTs based on targeting patterns, simple XOR-based encryption schemes, custom substitution ciphers, and C2 infrastructure associated with APT37.

Pulse ID: 6a9af7a5158ae188847551b5
Pulse Link: https://otx.alienvault.com/pulse/6a9af7a5158ae188847551b5
Pulse Author: AlienVault
Created: 2026-09-04 16:53:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APT37 #BackDoor #CredentialHarvesting #CyberSecurity #DPRK #Encryption #HTTP #InfoSec #KeyLogger #Korea #Linux #Nim #OTX #OpenThreatExchange #Proxy #RAT #RCE #RemoteCommandExecution #SSH #SSL #SouthKorea #Trojan #bot #AlienVault

REVSTEALER ramps up: analysis of up-and-coming infostealer

An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...

Pulse ID: 6a9d57d410d16313f7424f67
Pulse Link: https://otx.alienvault.com/pulse/6a9d57d410d16313f7424f67
Pulse Author: AlienVault
Created: 2026-09-06 12:08:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #Clipboard #CredentialHarvesting #CyberSecurity #Encryption #InfoSec #InfoStealer #Malware #OTX #OpenThreatExchange #Password #Proxy #RAT #ReverseProxy #SMS #SocialEngineering #VPN #Word #YouTube #bot #cryptocurrency #AlienVault

REVSTEALER ramps up: analysis of up-and-coming infostealer

An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...

Pulse ID: 6a9d57d410d16313f7424f67
Pulse Link: https://otx.alienvault.com/pulse/6a9d57d410d16313f7424f67
Pulse Author: AlienVault
Created: 2026-09-06 12:08:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #Clipboard #CredentialHarvesting #CyberSecurity #Encryption #InfoSec #InfoStealer #Malware #OTX #OpenThreatExchange #Password #Proxy #RAT #ReverseProxy #SMS #SocialEngineering #VPN #Word #YouTube #bot #cryptocurrency #AlienVault

REVSTEALER ramps up: analysis of up-and-coming infostealer

An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...

Pulse ID: 6a9d57d410d16313f7424f67
Pulse Link: https://otx.alienvault.com/pulse/6a9d57d410d16313f7424f67
Pulse Author: AlienVault
Created: 2026-09-06 12:08:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #Clipboard #CredentialHarvesting #CyberSecurity #Encryption #InfoSec #InfoStealer #Malware #OTX #OpenThreatExchange #Password #Proxy #RAT #ReverseProxy #SMS #SocialEngineering #VPN #Word #YouTube #bot #cryptocurrency #AlienVault

REVSTEALER ramps up: analysis of up-and-coming infostealer

An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...

Pulse ID: 6a9d57d410d16313f7424f67
Pulse Link: https://otx.alienvault.com/pulse/6a9d57d410d16313f7424f67
Pulse Author: AlienVault
Created: 2026-09-06 12:08:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #Clipboard #CredentialHarvesting #CyberSecurity #Encryption #InfoSec #InfoStealer #Malware #OTX #OpenThreatExchange #Password #Proxy #RAT #ReverseProxy #SMS #SocialEngineering #VPN #Word #YouTube #bot #cryptocurrency #AlienVault

REVSTEALER ramps up: analysis of up-and-coming infostealer

An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting browsers, VPN applications, password managers, cryptocurrency wallets, and gaming platforms. It incorporates sophisticated anti-analysis mechanisms including a weighted sandbox scoring system and uses Polygon blockchain-based dead drops for resilient infrastructure management. Distribution occurs primarily through social engineering campaigns targeting gamers via compromised YouTube channels advertising fake game cheats, though samples also impersonate legitimate software like Slack and qBittorrent. The malware delivers four additional modules extending capabilities to include wallet theft, clipboard manipulation, reverse proxy functionality, and cryptocurrency mining deployment. Most samples employ VMProtect packing and feature an App-Bound Encryption bypass using debugger-...

Pulse ID: 6a9d57d410d16313f7424f67
Pulse Link: https://otx.alienvault.com/pulse/6a9d57d410d16313f7424f67
Pulse Author: AlienVault
Created: 2026-09-06 12:08:52

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BlockChain #Browser #Clipboard #CredentialHarvesting #CyberSecurity #Encryption #InfoSec #InfoStealer #Malware #OTX #OpenThreatExchange #Password #Proxy #RAT #ReverseProxy #SMS #SocialEngineering #VPN #Word #YouTube #bot #cryptocurrency #AlienVault

Attackers Exploit PaperCut Flaws to Harvest Education Sector Credentials

Stolen logins from the education sector could give attackers a master key to unlock other critical systems, sparking serious concerns about widespread security breaches. Threat actors are exploiting PaperCut flaws to harvest credentials, creating a privileged pathway for further malicious activity.

https://osintsights.com/attackers-exploit-papercut-flaws-to-harvest-education-sector-credentials?utm_source=mastodon&utm_medium=social

#Papercut #Cve202681578 #Cve202682078 #EducationSector #CredentialHarvesting

Attackers Exploit PaperCut Flaws to Harvest Education Sector Credentials

Stolen logins from the education sector could give attackers a master key to unlock other critical systems, sparking serious concerns about widespread security breaches. Threat actors are exploiting PaperCut flaws to harvest credentials, creating a privileged pathway for further malicious activity.

https://osintsights.com/attackers-exploit-papercut-flaws-to-harvest-education-sector-credentials?utm_source=mastodon&utm_medium=social

#Papercut #Cve202681578 #Cve202682078 #EducationSector #CredentialHarvesting

Shai-Hulud Infostealer Worm Targets 469 Credential Locations, Threatens Software Supply Chains

A recent Shai-Hulud infostealer worm variant has significantly upped the ante, now scanning 469 credential locations - a massive jump from 189 in earlier variants - to harvest sensitive access credentials and threaten software supply chains. This strategic shift allows attackers to exploit…

https://osintsights.com/shai-hulud-infostealer-worm-targets-469-credential-locations-threatens-software?utm_source=mastodon&utm_medium=social

#InfostealerWorm #Shaihulud #SupplyChain #CredentialHarvesting #MalwareOperations

Shai-Hulud Infostealer Worm Targets 469 Credential Locations, Threatens Software Supply Chains

A recent Shai-Hulud infostealer worm variant has significantly upped the ante, now scanning 469 credential locations - a massive jump from 189 in earlier variants - to harvest sensitive access credentials and threaten software supply chains. This strategic shift allows attackers to exploit…

https://osintsights.com/shai-hulud-infostealer-worm-targets-469-credential-locations-threatens-software?utm_source=mastodon&utm_medium=social

#InfostealerWorm #Shaihulud #SupplyChain #CredentialHarvesting #MalwareOperations

Shai-Hulud Infostealer Worm Targets 469 Credential Locations, Threatens Software Supply Chains

A recent Shai-Hulud infostealer worm variant has significantly upped the ante, now scanning 469 credential locations - a massive jump from 189 in earlier variants - to harvest sensitive access credentials and threaten software supply chains. This strategic shift allows attackers to exploit…

https://osintsights.com/shai-hulud-infostealer-worm-targets-469-credential-locations-threatens-software?utm_source=mastodon&utm_medium=social

#InfostealerWorm #Shaihulud #SupplyChain #CredentialHarvesting #MalwareOperations

Shai-Hulud Infostealer Worm Targets 469 Credential Locations, Threatens Software Supply Chains

A recent Shai-Hulud infostealer worm variant has significantly upped the ante, now scanning 469 credential locations - a massive jump from 189 in earlier variants - to harvest sensitive access credentials and threaten software supply chains. This strategic shift allows attackers to exploit…

https://osintsights.com/shai-hulud-infostealer-worm-targets-469-credential-locations-threatens-software?utm_source=mastodon&utm_medium=social

#InfostealerWorm #Shaihulud #SupplyChain #CredentialHarvesting #MalwareOperations

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads

Socket Threat Research team identified 19 malicious browser extensions (18 Chrome, 1 Edge) published in the last six months, delivering an extendable malware framework. These extensions establish WebSocket communication with command and control servers, strip Content Security Policy headers, and use XSS injection to execute malicious payloads. The primary focus is cryptocurrency wallet secret stealing and crypto draining. The threat actor employs two publishing approaches: creating malicious extensions from scratch or acquiring legitimate extensions with established user bases and weaponizing them. The most impactful case involves the 'Enable Right Click & Copy' extension, which had approximately 70,000 Chrome users and 10,000 Edge users when compromised. The campaign, tracked as 'Superior', has been active since February 2024, demonstrating sophisticated operational capabilities and persistent evolution of malicious modules targeting multiple cryptocurrency platforms, exchanges, and credential harvesting.

Pulse ID: 6a90b73a174ed7192aa841e4
Pulse Link: https://otx.alienvault.com/pulse/6a90b73a174ed7192aa841e4
Pulse Author: AlienVault
Created: 2026-08-27 22:16:26

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Chrome #CredentialHarvesting #CyberSecurity #Edge #InfoSec #Malware #OTX #OpenThreatExchange #RAT #XSS #bot #cryptocurrency #AlienVault

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads

Socket Threat Research team identified 19 malicious browser extensions (18 Chrome, 1 Edge) published in the last six months, delivering an extendable malware framework. These extensions establish WebSocket communication with command and control servers, strip Content Security Policy headers, and use XSS injection to execute malicious payloads. The primary focus is cryptocurrency wallet secret stealing and crypto draining. The threat actor employs two publishing approaches: creating malicious extensions from scratch or acquiring legitimate extensions with established user bases and weaponizing them. The most impactful case involves the 'Enable Right Click & Copy' extension, which had approximately 70,000 Chrome users and 10,000 Edge users when compromised. The campaign, tracked as 'Superior', has been active since February 2024, demonstrating sophisticated operational capabilities and persistent evolution of malicious modules targeting multiple cryptocurrency platforms, exchanges, and credential harvesting.

Pulse ID: 6a90b73a174ed7192aa841e4
Pulse Link: https://otx.alienvault.com/pulse/6a90b73a174ed7192aa841e4
Pulse Author: AlienVault
Created: 2026-08-27 22:16:26

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Chrome #CredentialHarvesting #CyberSecurity #Edge #InfoSec #Malware #OTX #OpenThreatExchange #RAT #XSS #bot #cryptocurrency #AlienVault

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads

Socket Threat Research team identified 19 malicious browser extensions (18 Chrome, 1 Edge) published in the last six months, delivering an extendable malware framework. These extensions establish WebSocket communication with command and control servers, strip Content Security Policy headers, and use XSS injection to execute malicious payloads. The primary focus is cryptocurrency wallet secret stealing and crypto draining. The threat actor employs two publishing approaches: creating malicious extensions from scratch or acquiring legitimate extensions with established user bases and weaponizing them. The most impactful case involves the 'Enable Right Click & Copy' extension, which had approximately 70,000 Chrome users and 10,000 Edge users when compromised. The campaign, tracked as 'Superior', has been active since February 2024, demonstrating sophisticated operational capabilities and persistent evolution of malicious modules targeting multiple cryptocurrency platforms, exchanges, and credential harvesting.

Pulse ID: 6a90b73a174ed7192aa841e4
Pulse Link: https://otx.alienvault.com/pulse/6a90b73a174ed7192aa841e4
Pulse Author: AlienVault
Created: 2026-08-27 22:16:26

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Chrome #CredentialHarvesting #CyberSecurity #Edge #InfoSec #Malware #OTX #OpenThreatExchange #RAT #XSS #bot #cryptocurrency #AlienVault