Phish Tank

Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social engineering and obsfucation, including blockchain abuse. June 30, 2026, By Elizabeth Montalbano Source: Henk Vrieselaar via Alamy Stock Photo Attackers have been targeting hotels and other hospitality organizations with a phishing campaign that uses malicious zip files purporting to include guest photos, with the aim of installing malware to achieve long-term access to compromised systems.Both researchers at Microsoft and Trend Micro have observed the malicious activity, though they did not confirm if it was connected, according to separate reports published recently. Neither company immediately responded to a request for comment by Dark Reading about a potential link between the activities they described. Attackers in both campaigns use similar social engineering tactics to target the hospitality sector by impersonating guests who have complaints or requests, and

The Hacker News Jun 30, 2026  Phishing / ImpersonationThe FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages.Check Point Exposure Management published the FIFA World Cup 2026 Cyber Threat Report this month, covering financial services, transportation, hospitality, and gambling. Here are three findings worth reading carefully.1 in 3 FIFA Partners Can't Block Email ImpersonationPre-tournament research by Proofpoint found that more than one-third of official FIFA World Cup 2026 partners lack sufficient DMARC enforcement to prevent domain spoofing. That means attackers can send an email that appears to come from a sponsor, a vendor, or a logistics partner, with no technical barrier stopping it.The World Cup supply chain is enormous. Airlines, hotels, broadcast par

June 25, 2026, By Bill Toulas Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software.The Shop digital shopping assistant serves as a centralized platform where users can track orders from multiple online retailers, access receipts and shipping updates, and discover and purchase products from merchants that use Shopify.The app is very popular in North America, where support and purchasing options are more substantial. It has 50 million downloads on Google Play and 7 million ratings in Apple's App Store.According to cybersecurity company Gen Digital, scammers are inserting fake orders that appear alongside legitimate purchases, impersonating brands such as Norton, McAfee, Apple, and PayPal.Fake Norton purchase receipt in the Shop appSource: Gen DigitalThe threat actor also listed a phone number in the digital receipts that

Check Point Research tracked 6,843 new Amazon-themed domains registered between December 2025 and May 2026, with phishing operations targeting shoppers in at least 22 countries June 22, 2026, By Ana Maria Constantin TL;DRCheck Point found 6,843 fake Amazon domains ahead of Prime Day, with phishing emails and fake storefronts targeting shoppers across 22 countries.Cybersecurity researchers have identified nearly 7,000 fraudulent Amazon-themed domains registered in the six months leading up to Prime Day 2026, which begins on 23 June. Check Point Research tracked 6,843 new domains created between December 2025 and May 2026, with registrations peaking at 1,446 in April and remaining elevated at 1,267 in May.Of the total, 9.2 percent were classified as malicious or suspicious. The rate accelerated sharply in early June: during the first week of the month, one in every 13 newly registered Amazon-themed domains was flagged, according to Check Point’s analysis.Prime Day 2026 runs from 23 to 26

June 10, 2026 Hackers are using fake tax notification emails to trick Windows users into downloading dangerous multi-stage malware that runs entirely in memory, leaving almost no trace behind.The campaign, tracked as Operation TaxShadow, has been active since at least May 20, 2026, targeting individuals by impersonating official Indian government tax authorities.The emails are crafted to create panic, warning recipients of financial penalties and demanding action before a deadline.The attack begins with a convincingly designed email carrying the logos and language of a legitimate Indian tax enforcement body. Victims who click the link land on a fake government website nearly identical to the real one, complete with bilingual English and Hindi text.From there, users are prompted to download a ZIP file described as an official tax document, which is actually a fully armed malware package ready to compromise their system.Researchers at Cyfirma identified the campaign and found it extends

June 9, 2026 A new and sophisticated Browser-in-the-Browser phishing campaign has been discovered targeting Microsoft 365 users, using a fake login popup that is nearly impossible to tell apart from the real thing.The attack is so convincing that even tech-savvy users can fall for it without realizing their credentials have been stolen.The campaign works by embedding a fake browser popup window directly inside a malicious webpage. The popup mimics the standard Microsoft OAuth login screen, complete with a fake address bar showing a legitimate-looking URL, a padlock icon, and familiar branding.Users who click “Sign in with Microsoft” on a compromised site are shown this fake window and, believing it to be real, willingly type in their login details.Researchers at Unit 42, the threat intelligence and incident response team, identified the campaign and shared details in a report with Cyber Security News (CSN).They noted that this phishing popup is not just a simple overlay. It is draggabl

Ravie Lakshmanan Jun 04, 2026  Malware / CybercrimeA new China-linked cybercrime group known as TA4922 has expanded its targeting focus to target European organizations in the U.K., Germany, Italy, and South Africa.These efforts have been complemented by a "rapid operational tempo" and a continually evolving malware arsenal comprising known families like ValleyRAT (aka Winos 4.0) and Atlas RAT (aka AtlasCross RAT), as well as previously undocumented tools called RomulusLoader and SilentRunLoader, according to Proofpoint.The enterprise security company is keeping tabs on the activity under the moniker TA4922, describing it as a Chinese-speaking threat actor largely targeting East Asia. TA4922 is assessed to share some level of overlap with Silver Fox, with the threat actor's tradecraft more focused on cybercriminal objectives than espionage."The actor is likely financially motivated and focused on obtaining remote access to victim environments for financial gain, such as data theft, fra

June 2, 2026, By Stefan Dasic A new scam is targeting people who publish Chrome extensions.The scam arrives as an official-looking “copyright removal request” claiming your extension is about to be removed from the Chrome Web Store and that you have 48 hours to appeal.It even looks personalized. After you enter your extension’s ID to “verify” it, the page pulls in your extension’s real name and icon. But it’s all part of a phishing attack designed to steal your Google username and password.If attackers gain access to a developer account, they may be able to take over the extension, access developer resources, or potentially push malicious updates to users.What’s actually going onIf you’ve published a Chrome extension, you might encounter a page that looks like an official Google notice warning that your extension is being removed for copyright infringement.The page asks you to enter your extension ID, then displays your real extension details alongside a complaint number and countdown

Legitimate-looking emails coming from Robinhood systems lured recipients to phishing websites. May 28, 2026, By Eduard Kovacs Investing and trading platform Robinhood has confirmed that cybercriminals exploited a vulnerability in its account creation process to send out legitimate-looking phishing emails.Many Robinhood users reported receiving suspicious emails over the weekend and an analysis revealed that they were sent out as part of a phishing campaign. According to the company, the emails came from ‘noreply@robinhood.com’ and had the subject line ‘Your recent login to Robinhood’.“This phishing attempt was made possible by an abuse of the account creation flow,” Robinhood explained. “It was not a breach of our systems or customer accounts, and personal information and funds were not impacted.” >>Full Article<<

May 27, 2026, By Pieter Arntz Cybercriminals are abusing Adobe infrastructure in a LinkedIn phishing campaign that steals passwords and redirects victims to the legitimate LinkedIn site afterward.The phishing email masquerades as a business inquiry designed to look like it’s come via LinkedIn and includes a fake “contract” attachment. But it contains a number of red flags:The sender name, email address, and email signature don’t match The sender company exists, but not in the US The sender name exists, but not at that company The attachment has a double file extension: pdf.html“I would like to do business with you via LinkedIn. I’m a buyer.Please find attached the signed contract No. #33110:12000pcs.I look forward to hearing from you. “ Double file extensions are often used to mislead recipients into thinking a file is something other than what it really is. The attached HTML file is highly obfuscated. Basically, it’s a one-line JavaScript.The script uses two common obfuscation methods

A new phishing campaign uses obfuscated JavaScript, PowerShell, and process hollowing to deploy PureLogs malware and steal sensitive data By Xiaopeng Zhang | May 26, 2026Affected Platforms: Microsoft WindowsImpacted Users: Windows UsersImpact: Collect sensitive data from the victim’s computerSeverity Level: High BackgroundFortiGuard Labs recently identified a phishing campaign distributing a PureLogs variant designed to collect sensitive data from the victim’s device. The analysis provides an in-depth examination of the campaign, including the phishing emails and the mechanisms by which the JavaScript file operates on the victim's device.This campaign uses deceptive emails disguised as purchase orders, a tactic commonly used to trick recipients into opening malicious attachments.The following sections detail the infection chain, the phishing email’s characteristics, the obfuscated JavaScript file, and the subsequent stages of the attack, including PowerShell execution, process hollowin

 May 22, 2026, By Jonathan Greig Cybercriminals are using a new, easy-to-use service to trick people into giving them access to their Microsoft 365 accounts, according to the FBI.The law enforcement agency published an advisory on Thursday about Kali365 — a Telegram-based service for cybercriminals that allows them to capture legitimate "OAuth" tokens enabling widespread access to Microsoft 365 environments. Multiple cybersecurity companies warned last month that they were seeing hundreds of attacks enabled by Kali365. The tool, which the FBI referred to as a Phishing-as-a-Service platform, “lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.”“First seen in April 2026. Kali365 has primarily been distributed via Telegram, enabling cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor a

How attackers are hiding .NET infostealers inside seemingly harmless images to evade detection and streamline multi-stage payload delivery By Winnie Lin and Yurren Wan | May 15, 2026Affected Platforms: Microsoft WindowsImpacted Users: Any organizationImpact: Attackers Stolen data may be leveraged for follow-on attacksSeverity Level: HighThe use of steganography in the threat landscape continues to accelerate. Threat actors are increasingly shifting from direct encrypted transfers to a 'legitimate-file-plus-hidden-data' model, effectively masking their next-stage payloads within everyday media.FortiGuard Labs recently uncovered a phishing campaign that abuses environment variables to hide malicious commands and uses PawsRunner as a Steganography Loader to deploy the .NET infostealer PureLogs.Figure 1: Attack flowThis blog outlines the malware's delivery vector and provides a technical analysis of PawsRunner and the subsequent deployment of an evolved PureLogs payload. Initial AccessThe

May 5, 2026, By Pierluigi Paganini Microsoft revealed a phishing campaign hitting 35,000 users in 26 countries, stealing login tokens via fake code-of-conduct emails and legit services.Microsoft disclosed a major phishing campaign that targeted over 35,000 users across 26 countries in mid-April 2026.Attackers used fake “code of conduct” emails sent through legitimate platforms to trick recipients into visiting bogus sites that stole authentication tokens.“The campaign targeted tens of thousands of users, primarily in the United States, and directed them through several stages of CAPTCHA and intermediate staging pages designed to reinforce legitimacy while filtering out automated defenses.” reads the report published by Microsoft. “The lures in this campaign used polished, enterprise-style HTML templates with structured layouts and preemptive authenticity statements, making them appear more credible than typical phishing emails and increasing their plausibility as legitimate internal co

Attackers are abusing two remote monitoring and management (RMM) tools to evade detection in a campaign that has impacted over 80 organizations so far. May 4, 2026, By Jai Vijayan A stealthy phishing campaign targeting organizations across multiple industries highlights a growing trend by attackers to weaponize legitimate IT management tools to bypass security controls and maintain persistence on compromised systems.Security researchers at Securonix say the campaign, which they are tracking as VENOMOUS#HELPER, has been active since at least April 2025 and has hit more than 80 organizations, primarily in the US but also in Western Europe and Latin America. Not One, But Two RMM ToolsWhat makes the campaign noteworthy, according to Securonix, is its deliberate avoidance of traditional malware in favor of two, legitimately signed, commercially available remote monitoring and management (RMM) tools — SimpleHelp and ScreenConnect — for enabling persistent control over victim machines.The cho

Ravie Lakshmanan May 04, 2026 Malware / Network SecurityThe China-based cybercrime group known as Silver Fox has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor.The activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities."Both waves followed a nearly identical structure: phishing emails were styled as official notices regarding tax audits or prompted users to download an archive containing a 'list of tax violations,'" Kaspersky said. "Inside the archive was a modified Rust-based loader pulled from a public repository. This loader would download and execute the well-known ValleyRAT backdoor."The campaign is estimated to have impacted organizations across the industrial, consulting, retail, and transportation sectors. More than 1,600 phishing emails were flagged between early January and early February.Ful

Legitimate-looking emails coming from Robinhood systems lured recipients to phishing websites. April 28, 2026, By Eduard Kovacs Investing and trading platform Robinhood has confirmed that cybercriminals exploited a vulnerability in its account creation process to send out legitimate-looking phishing emails.Many Robinhood users reported receiving suspicious emails over the weekend and an analysis revealed that they were sent out as part of a phishing campaign. According to the company, the emails came from ‘noreply@robinhood.com’ and had the subject line ‘Your recent login to Robinhood’.“This phishing attempt was made possible by an abuse of the account creation flow,” Robinhood explained. “It was not a breach of our systems or customer accounts, and personal information and funds were not impacted.” >>Full Article<<

April 16, 2026, By Lara Pearce Cybersecurity experts are sounding the alarm on a new wave of increasingly convincing phishing scams targeting Australian travellers using their personal travel details.Large-scale data breaches of travel companies — such as Booking.com earlier this week and last year by Qantas — are providing valuable detailed personal information to potential scammers.NordVPN cybersecurity expert Adrianus Warmenhoven warned the latest attack on Booking.com would likely result in a spike in phishing emails, fake payment requests and "verification" messages targeting affected users. Artificial intelligence is making phishing scams more convincing than ever, with scam websites that are "almost foolproof" copies of authentic sites. (Getty)"This type of breach is particularly dangerous not because of financial data, but because of context," he said."When attackers gain access to booking details such as names, travel dates, and accommodation information, they can craft highl

April 13, 2026, By Lawrence Abrams The FBI Atlanta Field Office and Indonesian authorities have dismantled the "W3LL" global phishing platform, seizing infrastructure and arresting the alleged developer in what is described as the first coordinated enforcement action between the United States and Indonesia targeting a phishing kit developer.The W3ll Store was a phishing kit and online marketplace that enabled cybercriminals to steal thousands of credentials and attempt more than $20 million in fraud. "This Website Has Been Seized as part of a coordinated law enforcement action taken against W3LL STORE," reads a seizure message on w3ll[.]store website."The domain for w3ll.store has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981 and 982 by the United States District Court for the Northern District of Georgia as part of a joint law enforcement action by the Federal Bureau of Investigation."Seizure banner shown on

April 9, 2026, By Bill Toulas A new Lua-based malware, called LucidRook, is being used in spear-phishing campaigns targeting non-governmental organizations and universities in Taiwan.Cisco Talos researchers attribute the malware to a threat group tracked internally as UAT-10362, who they describe as a capable adversary "with mature operational tradecraft."LucidRook was observed in attacks in October 2025 that relied on phishing emails carrying password-protected archives.The researchers identified two infection chains, one using an LNK shortcut file that ultimately delivered a malware dropper called LucidPawn, and an EXE-based chain that leveraged a fake antivirus executable impersonating Trend Micro Worry-Free Business Security Services. LNK-based attack chainSource: Cisco Talos >>Full Article<<

April 9, 2026, By Bill Toulas Threat actors using a previously undocumented phishing-as-a-service (PhaaS) platform called “VENOM” are targeting credentials of C-suite executives across multiple industries.The operation has been active since at least last November and appears to target specific individuals who serve as CEOs, CFOs, or VPs at their companies.VENOM also seems to be closed access, as it has not been promoted on public channels and underground forums, thus reducing its exposure to researchers.The VENOM attack chainThe phishing emails, observed by researchers at cybersecurity company Abnormal, impersonated Microsoft SharePoint document-sharing notifications as part of internal communication.The messages are highly personalized and include random HTML noise such as fake CSS classes and comments. The attacker also injects fake email threads tailored to the target, increasing credibility.A QR code rendered in Unicode is provided for the victim to scan for access. The trick is de

April 6, 2026, By Pierluigi Paganini DPRK-linked hackers use GitHub C2s, starting attacks via phishing LNK files that drop a PDF and PowerShell script in South Korea.North Korea-linked threat actors target South Korean organizations using GitHub as C2 servers. The attack chain starts with phishing emails carrying obfuscated LNK files that drop a decoy PDF and a PowerShell script to advance the intrusion.“FortiGuard Labs recently detected a series of LNK files targeting users in South Korea. These attacks use a multi-stage scripting process and leverage GitHub as Command and Control (C2) infrastructure to evade detection.” reads the report published by FortiGuard Labs. “Although these LNK files can be traced back to 2024, earlier versions had less obfuscation and contained significant metadata, allowing us to track similar attacks spreading the XenoRAT malware.” >>Full Article<<