home.social

#malspam — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #malspam, aggregated by home.social.

fetched live
  1. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  2. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  3. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  4. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #grandoreiro #malspam
  5. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  6. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  7. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  8. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  9. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #zoom #screenconnect #malspam
  10. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  11. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  12. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  13. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  14. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  15. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  16. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  17. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  18. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  19. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  20. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  21. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  22. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  23. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  24. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  25. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  26. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  27. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  28. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  29. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  30. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  31. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  32. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  33. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #remcos #malspam
  34. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  35. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  36. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  37. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  38. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #japan #fingerprinting #email #malspam #amazon #phishing
  39. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  40. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  41. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  42. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  43. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  44. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  45. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  46. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  47. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  48. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  49. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #threatintel #phishing #emailsecurity #aithreats #soc #blueteam
  50. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #threatintel #phishing #emailsecurity #aithreats #soc #blueteam
  51. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #digitalrisk #malspam #cyberdefense #securityresearch #brandabuse #frauddetection
  52. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #threatintel #phishing #emailsecurity #aithreats #soc #blueteam
  53. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  54. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  55. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  56. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  57. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  58. James_inthe_box @[email protected] ·

    If you've been experiencing these new #malspam with @Action1corp #action1 RMM, there's a tasty lil file called C:\Windows\Action1\what_is_this.txt that's everything you need to know:
    app.any.run/tasks/a38ca435-f03

    #malspam #action1
  59. James_inthe_box @[email protected] ·

    If you've been experiencing these new #malspam with @Action1corp #action1 RMM, there's a tasty lil file called C:\Windows\Action1\what_is_this.txt that's everything you need to know:
    app.any.run/tasks/a38ca435-f03

    #malspam #action1
  60. James_inthe_box @[email protected] ·

    If you've been experiencing these new #malspam with @Action1corp #action1 RMM, there's a tasty lil file called C:\Windows\Action1\what_is_this.txt that's everything you need to know:
    app.any.run/tasks/a38ca435-f03

    #malspam #action1