Phishing

Attacks involved the use of Rich Communication Services messages indicating false payments that included links redirecting to websites spoofing government agencies, postal services, and banking entities, including the U.S. Postal Service, Linkt, and Lloyds.

The “Phish ‘n’ Ships” threat operation has infected more than 1,000 websites and has possibly stolen tens of millions of dollars.

The threat of a copyright infringement claim has become the latest way for malware operators to trick their targets.

Attackers leveraged pernicious ads to lure targets into downloading ZIP packages with the malicious Electron app in the guise of legitimate software, which downloads the SYS01 infostealer that primarily compromises Facebook credentials while displaying the advertised software to conceal compromise.

Malicious sites have been leveraged to redirect to a CAPTCHA, with clicking the "I'm not a robot" button followed by the copying and execution of malicious code prompting the distribution of the Lumma infostealer.

The Russian nation-state actor continues its espionage activities, using RDP to access sensitive information or drop malicious code.

Malicious emails delivered by attackers — who sometimes spoofed Microsoft employees or leveraged Microsoft- and Amazon Web Services-related social engineering lures — included Remote Desktop Protocol configuration files as attachments, which when executed established a connection between the targeted devices and the attacker-controlled server.