3+ day, 3+ hour ago   (444+ words) Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The campaign begins with a phone call or SMS sent to an employee’s personal device. Posing as IT support, the caller claims the target must urgently update a…...

3+ day, 1+ hour ago   (557+ words) A phishing campaign that moves the credential-harvesting page out of attacker-controlled web infrastructure and into the victim’s browser. Unlike ordinary phishing kits, which host cloned login portals on domains that can eventually be detected and disrupted, this campaign delivers malicious…...

4+ day, 23+ hour ago   (634+ words) A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The result is a hands-on-keyboard…...

6+ day, 33+ min ago   (632+ words) The campaign’s central advantage is that it presents trusted Google-owned domains at nearly every point a gateway, proxy, or analyst is likely to inspect. Rather than relying on a malicious URL evading detection, the actors use legitimate redirect and tracking…...

6+ day, 5+ hour ago   (605+ words) A previously undocumented Linux espionage toolkit linked with medium confidence to DPRK-aligned threat actors has been used to compromise South Korean organizations in the automotive and media sectors. The campaign is notable because it does not exploit a flaw in…...

1+ week, 1+ day ago   (461+ words) The activity, documented by PolySwarm, targeted entities in Romania, Spain, and Turkey between late September 2025 and early April 2026. New variants identified during June and July 2026 show that the group continues refining its phishing lures, malware execution chain, and command-and-control (C2) methods....

1+ week, 4+ day ago   (548+ words) A financially motivated threat actor tracked as BREEZE COMET has breached Brazilian financial, retail, and eCommerce organizations, using privileged access to payment platforms to execute hundreds of fraudulent transactions in tightly timed waves. The activity overlaps with clusters publicly identified…...

1+ week, 4+ day ago   (414+ words) Continue on our backup domain.” Rather than using an HTTP redirect or JavaScript-based browser redirection, the page presents a clickable link that requires the victim to manually navigate to openai-backup.one. The purported backup site is unrelated to OpenAI and…...