Phishing

The OAuth URLs intentionally include an invalid scope, forcing redirection to malicious sites.

The attack uses social engineering and PWA features, making users believe they are interacting with a legitimate Google security page.

Attackers are using IPv6 address ranges to gain control over .arpa subdomains, pointing them to servers hosting phishing pages.

Windows systems have been covertly compromised with the Teramind endpoint monitoring software for unauthorized surveillance as part of advanced phishing campaigns spoofing Zoom and Google Meet, GBHackers News reports.

The malicious version 5.8 of QuickLens was pushed to approximately 7,000 users on February 17, 2026, after the extension changed ownership.

The report details how generative AI and AI agents are becoming central to new threats, with risks of over-delegation and privilege misuse growing.

The scam employs a "today only" tactic, presenting victims with a notification of a €499.99 charge for a subscription, with the date dynamically set to the current day.