2FA phishing
-
Amazon says APT29 attempted watering-hole attack to harvest Microsoft credentials; AWS says no systems affected
Amazon said it disrupted an APT29 watering-hole campaign aimed at harvesting Microsoft credentials, stressing that no AWS systems were compromised. The operation used spoofed Cloudflare pages and randomized redirects to trick users, with Google Threat Intelligence and AWS detailing evasion techniques and previous similar activity.
-
Abandoned Sogou Zhuyin Update Server Hijacked to Deliver Espionage Malware, TAOTH Campaign Reveals
A June 2025 reveal shows attackers hijacking an abandoned Sogou Zhuyin update server to deploy multiple spyware and backdoors (TOSHIS, DESFY, GTELAM, C6DOOR) in a campaign targeting East Asia and overseas Chinese communities, with phishing and OAuth abuse used to gain access to high-value targets.
-
Healthcare Services Group breach affects more than 624,000 individuals
Healthcare Services Group said a data breach exposed the personal information of more than 624,000 individuals, with unauthorized access occurring between Sept. 27 and Oct. 3, 2024 and notifications sent on Aug. 25, 2025. Data types varied but included identifiers and financial details; credit monitoring is being offered, and there is no current evidence of…
-
ZipLine phishing campaign uses public contact forms to drop in-memory MixShell malware, researchers say
Cybersecurity researchers warn of ZipLine, a social-engineering campaign that uses public-facing Contact Us forms to seed weeks-long conversations before delivering in-memory MixShell malware via a weaponized ZIP file, with DNS tunneling as the primary command-and-control channel.
-
HOOK Android banking trojan adds ransomware overlay, expands remote command set
Security researchers have identified a new HOOK Android banking trojan variant that adds ransomware-style overlays, remote command capabilities, and expanded data-theft features, signaling a growing blend of banking fraud with spyware and ransomware tactics.
-
Auchan data breach exposes loyalty data of hundreds of thousands of customers
French retailer Auchan disclosed a cyberattack that exposed the personal data of hundreds of thousands of loyalty-account holders, including names, addresses, emails, phone numbers, and loyalty card numbers, while bank data and PINs were not affected. The company has notified CNIL and urged vigilance against phishing.
-
Cheap VPS Hijacking Drives New Wave of SaaS-Based Business Email Compromises, Darktrace Finds
A Darktrace security report details a new wave of attacks where criminals rent cheap VPS services to hijack business email accounts, bypass traditional defenses, and establish covert, long-term access through subtle inbox rules.
-
Transparent Tribe targets Indian government with dual-platform Linux and Windows malware, researchers say
Researchers say the Transparent Tribe (APT36) has expanded its assault on Indian government networks with a cross‑platform campaign targeting Windows and Linux‑BOSS systems through spear‑phishing, weaponized desktop shortcuts, and a Go‑based backdoor, complemented by anti‑analysis techniques and 2FA‑focused phishing.
