Research Center

CloudSEK’s threat research team uncovered¹ BigBear 2.0, an Evilginx2-based phishing-as-a-service platform aimed exclusively at Microsoft 365. Victims who click a phishing link land on a reverse proxy that passes their traffic to the real Microsoft sign-in page while quietly keeping the password and the session cookie issued after MFA. Replaying that cookie hands an attacker a logged-in account without needing a password or a second factor again. The researchers gained admin access to the panel, which held 5,137 credential records from 461 organizations across more than 40 countries and is leased by its operator to at least five affiliate crews.

Microsoft’s Security Research team investigated¹ a high-volume phishing campaign that borrowed a trick from AI prompt injection research. The attacker inserted invisible Unicode tag characters — a technique known as “ASCII smuggling” — inside financial lure words like “funding.” The words still read normally to recipients, but filters matching the literal keyword no longer saw them. The messages pushed business loan and line-of-credit offers from hundreds of disposable finance-themed sender domains.

Microsoft Defender Experts¹ is tracking an active campaign that uses counterfeit software download sites to impersonate trusted vendors. Users looking for popular programs download installer archives that deliver malware instead. The malware sets up persistence, weakens security protections, and calls back to attacker-controlled infrastructure. Microsoft says the activity resembles the reported Silver Fox campaign but has not attributed it to a nation-state actor.

On 22 September 2026, President Trump told the UN General Assembly that the United States would call AI “super intelligence.” Domain registrations containing the term had drawn between 1 and 33 new names a day earlier in the month. On 22 September alone, 739 were registered, with 752 more following from 23 to 27 September.

Using current domain registrations containing superintelligence and variants such as superintelligent, super-intelligence, superinteligencia, superintelligenz, and misspellings like superintellegence, we built a 1,677-domain dataset and analyzed it across creation dates, registrars, registrant emails, name servers, hosting networks, and naming intent.

Symantec’s Threat Hunter Team reported on Security.com¹ about Jewelbug, a China-based hackers-for-hire group. It runs two operations side by side: espionage against governments and militaries across the Middle East and Asia, and a for-profit cryptocurrency fraud business. Both are administered from a single control panel. In under three months of active operations, the group’s victim database logged more than a million implant check-ins and over 580,000 stolen browser cookies.

Google Threat Intelligence Group (GTIG) detailed¹ three suspected Russian cyber espionage clusters — UNC6293, UNC7005, and UNC5976 — targeting individuals in academia, government, diplomacy, and defense across Europe and the U.S. Instead of malicious attachments, the clusters abuse legitimate authentication flows: app passwords, OAuth consent, Microsoft device codes, and WhatsApp device linking. One approval hands the attacker access to the target’s personal email, cloud, or messaging account.

Confiant documented¹ SourTrade, a malvertising operation active since late 2024 that impersonates TradingView, Solana, and Luno to reach crypto investors and retail traders. Its landing pages never serve a finished malware file. They send the victim’s browser build instructions and let it assemble the final Windows executable in memory, so every victim gets a differently hashed file.

The Swiss Cyber Institute named¹ the most notorious ransomware as of April 2026. We zoomed into five of them—LockBit, Cl0p, Akira, Medusa, and Qilin—in a bid to know more about their network IoCs and identify new artifacts.