DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images...
Lures
Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance...
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between...
That “job brief” on Google Forms could infect your device
We’ve identified a campaign using business-related lures, such as job interviews, project briefs, and financial document, to distribute malware,...
From Windows to macOS: ClickFix attacks shift tactics with ChatGPT-based lures
From Windows to macOS: ClickFix attacks shift tactics with ChatGPT-based lures Pierluigi Paganini March 17, 2026 ClickFix campaigns are evolving,...
Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins
Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins Pierluigi Paganini March 14, 2026 Attackers linked to Storm-2561...
