Ethan Andrews

ClickFix campaigns utilize fake Google and Cloudflare verification pages to trick users into executing PowerShell commands that deliver loaders like ResiLoader and various stealers.

Threat actors are weaponizing the Microsoft Device Authorization Grant flow to bypass MFA and maintain persistent access to corporate Microsoft 365 environments.

The Iranian threat actor Cavern Manticore is targeting Israeli IT providers and government sectors using the modular Cavern C2 framework and supply chain exploitation.

Cavern Manticore, an Iran-nexus threat actor, targets Israeli government and IT sectors using a modular .NET C2 framework employing complex compilation formats as anti-analysis layers.

A malicious Chromium extension impersonates Perplexity AI to intercept search queries and capture real-time keystrokes using browser-native APIs and typosquatted infrastructure.

The REF6045 activity cluster uses ClickFix social engineering to deploy SCMBANKER, a PowerShell toolkit designed for banking fraud targeting Mexican financial institutions.

Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.

Void Dokkaebi targets software developers by injecting obfuscated JavaScript malware into configuration files like tailwind.config.js to establish command-and-control via blockchain APIs.

An attacker used display-name impersonation and same-day registered domains to bypass standard email authentication and deliver a curiosity-based photo lure.

State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.