Full List

Search

Search Results (Phishing)

• Russian Organizations Across Various Industries February 5, 2025 • [ malware, phishing, data leak ] Nova Infostealer malware campaign targeting Russian organizations across multiple industries collected credentials and files via phishing and malicious installers.
• Ukrainian government and critical infrastructure organizations September 25, 2024 • [ phishing, malware, espionage ] Russian nation-state operators exploited a zero-day vulnerability in 7-Zip (CVE-2025-0411) beginning in September 2024 to deliver SmokeLoader malware through spearphishing campaigns targeting Ukrainian government and critical infrastructure entities. The campaign bypassed Windows Mark-of-the-Web protections to execute payloads and conduct espionage activities. No specific victims or data volumes have been disclosed.
• Multiple South Korean government and business entities February 12, 2025 • [ phishing, espionage ] Spear-phishing campaign leveraging LNK and PowerShell scripts deployed by North Koreas RGB 3rd Technical Surveillance Bureau (Kimsuky) targeting South Korean government, defense, and cryptocurrency sectors.
• AultCare Corporation September 25, 2024 • [ phishing, data leak ] An unauthorized party accessed an employee email account and a SharePoint instance on 2024-09-25. AultCare reviewed affected content and began notifying brokers and affected individuals by 2025-01-21.
• Coinbase users December 1, 2024 • [ phishing, social engineering ] Between December 2024 and January 2025, criminal phishing campaigns impersonating Coinbase support stole approximately $65 million in cryptocurrency from hundreds of users worldwide. Attackers used fake login pages, wallet-draining scripts, and social-engineering messages to capture credentials and bypass two-factor authentication. Coinbase confirmed that its own systems were not breached.
• Users of Indian banking mobile apps February 11, 2025 • [ malware, phishing, data leak ] Android malware campaign disguised as Indian bank apps, distributed via phishing links and fake APKs to install FinStealer; exfiltration of banking credentials and personal information confirmed by CYFIRMA and other researchers.
• Chemical, Food, and Pharmaceutical Enterprises in Russia February 5, 2025 • [ infostealer, phishing, data leak ] Nova Infostealer campaign led by Rezet, also known as Rare Wolf, targeted Russian chemical, food, and pharmaceutical firms, harvesting credentials and internal documents through phishing and malicious installers.
• Fillmore County Hospital October 27, 2024 • [ phishing, data leak ] An unauthorized party accessed an employee email account on 2024-10-27. Investigation completed 2024-12-18. Affected data includes personal, medical, payment, and insurance information. Individuals were notified 2025-02-13.
• PrivatBank February 6, 2025 • [ phishing, malware, data leak ] A criminal group identified as UAC-0006 used phishing emails with password-protected attachments to deliver SmokeLoader malware targeting PrivatBank customers. The campaign aimed to steal credentials and financial data, active since November 2024.
• Users of fake DeepSeek sites February 6, 2025 • [ phishing, data leak ] Phishing campaign using dozens of fake DeepSeek-branded websites to steal user credentials and cryptocurrency through fraudulent login and wallet interfaces.
• University end-users via cloned site February 5, 2025 • [ malvertising, phishing, malware ] Malvertising campaign cloning a German university website to distribute a fake Cisco AnyConnect installer which installed NetSupport RAT on victim machines.
• 163.com Users February 4, 2025 • [ phishing, espionage ] The Taiwanese-linked espionage group GreenSpot APT (aka PoisonVine / APT-Q-20) created spoofed 163.com domains and fake download pages to harvest email credentials from users in mainland China, Hong Kong, and Taiwan. Hunt.io attributed the campaigns infrastructure to Taiwan but no government department link has been identified.
• MyVidster (2025) October 24, 2025 • [ leak, phishing, technology ] In October 2025, the data of almost 4M MyVidster users was posted to a public hacking forum. Separate to the 2015 breach, this incident exposed usernames, email addresses and in a small number of cases, profile photos.
• Multiple devices at undisclosed telecommunications firm(s) May 1, 2025 • [ hack, social, malware ] UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in United States of America using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
• Multiple devices at undisclosed telecommunications firm(s) May 1, 2025 • [ social, hack, malware ] UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in United Kingdom using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
• Multiple devices at undisclosed telecommunications firm(s) May 1, 2025 • [ social, hack, malware ] UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in United Arab Emirates using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
• Multiple devices at undisclosed telecommunications firm(s) May 1, 2025 • [ social, espionage, phishing ] UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in France using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
• Multiple devices at undisclosed telecommunications firm(s) May 1, 2025 • [ social, hack, phishing ] UNC1549 (Subtle Snail) compromised multiple devices at an undisclosed telecommunications firm in Canada using LinkedIn job-lures and the MINIBIKE backdoor; Azure-hosted C2 infrastructure was observed. No confirmed data exfiltration volumes or operational disruption reported.
• OutcomesOne July 1, 2025 • [ social, phishing, healthcare ] A phishing attack compromised a single employees email account for about one hour at OutcomesOne, a Florida-based professional services firm providing health IT and medication management support to insurers and pharmacies. Attackers accessed PHI stored in the organizations email application server, exposing data of roughly 149,000 individuals including names, demographics, provider, insurance, and medication information. No Social Security numbers or financial data were involved.
• Templeton Properties (Halifax, Nova Scotia) September 20, 2025 • [ social, phishing ] An employee at Templeton Properties clicked a phishing email link impersonating an invoice, triggering suspicious activity on company computers. The IT administrator confirmed it was a fraudulent email and contained malicious content. No confirmed data theft was reported.