ThreatVectr

Threat Intelligence — Page 19

Hotel lobby with business travelers at the front desk and in seating areas, Wi-Fi network selection screen on a laptop showing spoofed networks, fake Microsoft
Threat Intelligence

Hotel Wi-Fi hijack campaign quietly harvests Microsoft 365 logins from business travellers

A cluster with overlapping infrastructure tied to Russia-linked APT28 activity is tampering with DNS on hotel and conference Wi-Fi gateways to funnel guests into fake Microsoft login pages, ReliaQuest reports.

4 min read
Cyber-attack command center aesthetic with multiple monitors displaying fake Zoom and Microsoft Teams landing pages, cryptocurrency wallet monitoring tools, and
Threat Intelligence

North Korean Hackers Run Fake Zoom and Teams Sites to Rob Crypto Wallets

BlueNoroff's phishing kit screens visitors' crypto wallets before deciding who gets the malware, researchers say.

4 min read
A smartphone screen displaying a fake Snapchat support message asking for login verification codes, with the victim's confused face partially visible in the pho
Threat Intelligence

Illinois man gets 76 months for phishing 750 women's Snapchat accounts

Kyle Svara, 26, tricked victims into handing over login codes by posing as Snap staff, then stole nude photos and traded them online.

4 min read
A dark web marketplace interface displayed on multiple monitors, with malware builder tools and freshly packaged software packages arranged in an organized list
Threat Intelligence

Golden Chickens Malware Crew Returns With Four New Tools

The criminal group behind a long-running malware-as-a-service operation has rolled out fresh code, including a stripped-down loader and a browser password stealer.

4 min read
A Microsoft Teams chat window with hundreds of unread phishing messages flooding across the screen simultaneously, while a timeline graph beside it shows a shar
Threat Intelligence

After Tycoon2FA Was Shut Down, Phishing Criminals Went Looking for New Tricks

Microsoft's Q2 2026 email threat report shows that busting a major phishing-for-hire service slashed attack volume by 92%, but criminals quickly pivoted to Microsoft Teams chats and automated campaigns that hit tens of thousands of organisations in hours.

4 min read
A cybercrime forum listing page for Dolphin X malware, displaying a scoring algorithm interface that ranks infected machines by financial value and net worth es
Threat Intelligence

Dolphin X: The New Malware That Uses AI to Pick Which Victims to Rob First

A remote access trojan sold on a cybercrime forum claims to score infected machines by their value, so criminals can go after the richest targets first.

4 min read
A Bing search results page showing a sponsored ad for 'Claude Desktop' at the top, clicking through to a phishing page styled to look identical to Anthropic's o
Threat Intelligence

Fake Claude installer promoted by Bing ads hits 29 organisations with SectopRAT

Attackers hid a phishing page on Anthropic's own domain, then bought Bing ads to send people to a booby-trapped 'Claude Desktop' download.

4 min read
A computer desktop showing three simultaneous malware infection vectors: a browser extension icon, a downloaded package file, and an image file in a folder, all
Threat Intelligence

The Week Malware Wore a Friendly Face: Fake Extensions, Poisoned Packages and an Image That Talked to an AI

The payload wasn't the story this week. The disguise was.

4 min read
A Notepad++ plugin repository page displaying a fake plugin installer file, with code snippets visible in the background showing the LunchPoke loader obfuscated
Threat Intelligence

Ukraine warns of hackers hiding malware inside a fake Notepad++ plugin

CERT-UA links the campaign to UAC-0099, a group previously tied to Russia's Sandworm, which is using a genuine copy of Notepad++ to smuggle in a loader called LunchPoke.

4 min read
A server room with rows of cloud infrastructure equipment, one unit's indicator lights glowing with exposed data streaming outward, maps of Asia and Latin Ameri
Threat Intelligence

Leaky Alibaba Cloud Server Exposes China-Linked Spying Kit Aimed at Hospitals and Governments

Researchers at Group-IB stumbled on a misconfigured server in Singapore that revealed a new Windows loader, TriBack, used against targets across Asia and Latin America.

4 min read
A code repository interface showing PHP packages in GitHub, with hidden scanning and reconnaissance scripts automatically executing in the background, cPanel co
Threat Intelligence

Hijacked GitHub Repos Turned Into Attack Machines Hunting cPanel Servers

Researchers found booby-trapped PHP packages using GitHub's own automation to scan the internet for web hosting control panels.

4 min read
Portuguese bank statements and account records showing gradual unauthorized transfers, a computer screen displaying the same banking malware code that has remai
Threat Intelligence

A Six-Year-Old Brazilian Bank Fraud Tool Is Still Emptying Portuguese Accounts

Lampion has barely changed since 2019. It doesn't need to. Portugal keeps falling for it.

4 min read
An office scene showing a person at a desk receiving a phone call while looking at a suspicious email, with thought bubbles and visual cues indicating manipulat
Threat Intelligence

What is social engineering? A plain-English guide

Social engineering is the art of manipulating people, not machines, to hand over access, money, or data. Here is how it works and how to stop it.

4 min read
An email inbox displayed on a screen with one suspicious message standing out among legitimate emails—its sender address slightly off, urgency language emphasiz
Threat Intelligence

What is phishing and how do you spot a phishing email?

Phishing is the most common way attackers steal credentials and money. Here is what the attack looks like and how to catch it before you click.

5 min read
Illustration: a jungle compound surrounded by razor wire fencing, corrugated metal structures, and armed personnel
Threat Intelligence

Inside Myanmar's Jungle Scam Factories: How a Global Crime Industry Evades Every Crackdown

Armed fighters discovered roughly 3,000 captive workers inside a scam compound hidden behind razor wire in Myanmar's jungle. Investigators say the industry isn't shrinking. It's moving deeper into the forest.

3 min read
© 2026 Threat Vectr