Executive Summary
Security Risk Advisors (SRA) has identified several evolving threat campaigns, including 'ClickFix' delivery mechanisms and 'Payroll Pirate' session hijacking. The ClickFix campaign utilizes social engineering to trick users into executing commands, often via `finger.exe` or `tar.exe`, to stage Python-based payloads. The 'Payroll Pirate' campaign targets finance and HR personnel through AiTM session hijacking and Microsoft Graph API reconnaissance to facilitate unauthorized access.
Technical analysis also highlights 'ClearFake' campaigns using blockchain RPC services for malicious redirection and the 'SNEAKY2FA' phishing kit, which leverages Google Sites for staging. Additionally, Iranian-linked actors MuddyWater and Handala Hack are observed using specific discovery and reassembly techniques. These threats collectively represent a high risk for credential theft, session abuse, and initial access across various sectors including healthcare and finance.