Phishing

Attacks with the updated Inferno Drainer involved the exploitation of Discord to facilitate redirection to phishing sites.

Malicious emails purporting to be from the SSA that informed about the availability of Social Security Statements included attachments and links that led to the installation of the ScreenConnect remote access tool.

Multiple threat actors have been using the Panda Shop smishing kit, which exploits Google RCS and Apple iMessage, as well as SMS gateways, to primarily compromise Google Wallet and Apple Pay and pilfer credit card and personal information.

Criminals used social engineering tactics, such as posing as locked-out employees or IT staff, to manipulate password resets and breach systems.

Attackers pretending to be part of the New York Post's editorial team sent invites for a podcast episode that included a Telegram contact.

More than 600 scam operators leveraging the Darcula phishing-as-a-service kit were reported to have been able to exfiltrate 884,000 credit cards from malicious text messages.

At least 37 domains have been registered by Luna Moth via GoDaddy in March.