Credential Theft

80 posts

$Sandbox process tree for the Underground loader, showing an injected dllhost.exe launching chrome.exe and msedge.exe and staging stolen cookies under C:\ProgramData\Underground, before a second dllhost.exe deletes that folder.$

Malware Credential Theft

$100k in Crypto Drained by the Underground Operation

October 1, 20268 min read

Python NodeStealer: AI-Assisted to Full Spyware

Python NodeStealer: AI-Assisted to Full Spyware

August 26, 20266 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

Malware Social Engineering

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Malware Credential Theft

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

August 3, 20268 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

Malware Credential Theft

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

Malware Supply Chain

Shai-Hulud-Style npm Worm Hits @tanstack

May 12, 20262 min read

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

Malware Credential Theft

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

May 7, 202615 min read

Malware Supply Chain

Shai-Hulud Resurfaces: Intercom-client@7.0.4 Harvesting Github Credentials

April 30, 20261 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

Malware Credential Theft

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

OpenClaw Trap: AI-Assisted Lure Factory Targets Developers & Gamers

Malware Supply Chain

OpenClaw Trap: AI-Assisted Lure Factory Targets Developers & Gamers

March 23, 202613 min read

Malware Supply Chain

Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading

November 26, 202526 min read

RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts

Malware Credential Theft

RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts

October 23, 202510 min read

Glitch-hosted Phishing Uses Telegram & Fake CAPTCHAs to Target Navy Federal Credit Union Customers

Phishing Credential Theft

Glitch-hosted Phishing Uses Telegram & Fake CAPTCHAs to Target Navy Federal Credit Union Customers

June 2, 20254 min read

Ransomware Phishing

Netskope Threat Coverage: Scattered Spider

May 29, 20252 min read

New DOGE Big Balls Ransomware Tools in the Wild

Ransomware Crypto

New DOGE Big Balls Ransomware Tools in the Wild

May 7, 20259 min read

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

Malware Credential Theft

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

April 4, 20258 min read

New Phishing Campaign Abuses Webflow, SEO, and Fake CAPTCHAs

Phishing Credential Theft

New Phishing Campaign Abuses Webflow, SEO, and Fake CAPTCHAs

February 12, 20253 min read

Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection

Malware Credential Theft

Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection

January 23, 20255 min read

Netskope Threat Labs Predictions for 2025

November 27, 20242 min read

Python NodeStealer Targets Facebook Ads Manager with New Techniques

Malware Credential Theft

Python NodeStealer Targets Facebook Ads Manager with New Techniques

November 20, 20245 min read

Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages

Phishing Crypto

Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages

October 23, 20244 min read

DCRat Targets Users with HTML Smuggling

Malware Credential Theft

DCRat Targets Users with HTML Smuggling

September 26, 20245 min read

Cloud Threats Memo: Iranian Threat Actors Continue to Exploit Azure

September 11, 20243 min read

Phishing in Style: Microsoft Sway Abused to Deliver Quishing Attacks

Phishing Credential Theft

Phishing in Style: Microsoft Sway Abused to Deliver Quishing Attacks

August 27, 20245 min read

Two Recent Campaigns from Brazil and Korea Exploiting Legitimate Cloud Services

June 13, 20243 min read

Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling

Phishing Credential Theft

Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling

May 23, 20246 min read

From Delivery To Execution: An Evasive Azorult Campaign Smuggled Through Google Sites

Malware Credential Theft

From Delivery To Execution: An Evasive Azorult Campaign Smuggled Through Google Sites

March 15, 20249 min read

Malware Credential Theft

Cloud Threats Memo: A Parasite Exploiting Legitimate Cloud Services

December 1, 20233 min read

Cloud Credential Theft

Cloud Threats Memo: Mitigating the Risk of Third-party Apps

September 15, 20232 min read

New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials

Malware Credential Theft

New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials

September 14, 20236 min read

Evasive Phishing Campaign Steals Cloud Credentials Using Cloudflare R2 and Turnstile

Phishing Credential Theft

Evasive Phishing Campaign Steals Cloud Credentials Using Cloudflare R2 and Turnstile

August 14, 20235 min read

AWS Amplify Hosted Phishing Campaigns Abusing Telegram, Static Forms

Phishing Credential Theft

AWS Amplify Hosted Phishing Campaigns Abusing Telegram, Static Forms

July 14, 20235 min read

Phishing Campaigns Abusing Telegram to Bypass MFA

Phishing Credential Theft

Phishing Campaigns Abusing Telegram to Bypass MFA

June 21, 20234 min read

InterPlanetary File System: A Decentralized Place to Host Phishing Content

Phishing Credential Theft

InterPlanetary File System: A Decentralized Place to Host Phishing Content

May 16, 20236 min read

Vulnerability Credential Theft

CVE-2023-23397: Microsoft Outlook Zero-Day Exploited by APT28

March 21, 20231 min read

Attackers Increasingly Abusing DigitalOcean to Host Scams and Phishing

Phishing Social Engineering

Attackers Increasingly Abusing DigitalOcean to Host Scams and Phishing

March 9, 20238 min read

Credential Theft Ransomware

Netskope Cloud Threats Memo: Learnings From the Hi-Tech Crime Trends 2022/2023

February 16, 20232 min read

Cloud Abuse: New Technique Using Adobe Acrobat to Host Phishing

Cloud Abuse: New Technique Using Adobe Acrobat to Host Phishing

November 16, 20223 min read

New Phishing Technique Targeting Over 20 Crypto Wallets

Phishing Credential Theft

New Phishing Technique Targeting Over 20 Crypto Wallets

November 10, 20223 min read

BlackCat Ransomware: Tactics and Techniques From a Targeted Attack

Ransomware Malware

BlackCat Ransomware: Tactics and Techniques From a Targeted Attack

November 9, 202213 min read

RedLine Stealer Campaign Abusing Discord via PDF Links

Malware Phishing

RedLine Stealer Campaign Abusing Discord via PDF Links

October 3, 20225 min read

Attackers Continue to Abuse Google Sites and Microsoft Azure to Host Cryptocurrency Phishing

Phishing Credential Theft

Attackers Continue to Abuse Google Sites and Microsoft Azure to Host Cryptocurrency Phishing

September 15, 20226 min read

Abusing Google Sites and Microsoft Azure for Crypto Phishing

Phishing Credential Theft

Abusing Google Sites and Microsoft Azure for Crypto Phishing

August 9, 20224 min read

Ousaban: LATAM Banking Malware Abusing Cloud Services

Ousaban: LATAM Banking Malware Abusing Cloud Services

August 4, 20227 min read

Phishing Credential Theft

Netskope Threat Coverage: Microsoft Discloses New Adversary-in-the-Middle (AiTM) Phishing Attack

July 18, 20223 min read

Cloud Credential Theft

Breaking Down the 2022 Verizon Data Breach Investigations Report (DBIR)

June 28, 20224 min read

Credential Theft Cloud

Cloud Threats Memo: Analyzing the Top 10 Initial Access Vectors

May 19, 20223 min read

RedLine Stealer Campaign Using Binance Mystery Box Videos to Spread GitHub-Hosted Payload

Malware Credential Theft

RedLine Stealer Campaign Using Binance Mystery Box Videos to Spread GitHub-Hosted Payload

May 12, 20226 min read

Multi-Factor Authentication (MFA) Bypass Through Man-in-the-Middle Phishing Attacks

Phishing Credential Theft

Multi-Factor Authentication (MFA) Bypass Through Man-in-the-Middle Phishing Attacks

April 14, 20224 min read

Cloud Threats Memo: Protecting Yourself from Static Web App Phishing Campaigns

Phishing Credential Theft

Cloud Threats Memo: Protecting Yourself from Static Web App Phishing Campaigns

April 5, 20222 min read

New Formbook Campaign Delivered Through Phishing Emails

Malware Phishing

New Formbook Campaign Delivered Through Phishing Emails

March 11, 20229 min read

Cloud Threats Memo: Keeping Collaboration Apps Secure

February 22, 20222 min read

Credential Theft Cloud

Cloud Threats Memo: Why Multi-Factor Authentication is a Must-Have

February 10, 20222 min read

Infected PowerPoint Files Using Cloud Services to Deliver Multiple Malware

Phishing Malware

Infected PowerPoint Files Using Cloud Services to Deliver Multiple Malware

January 24, 20227 min read

Over-Privileged Service Accounts Create Escalation of Privileges and Lateral Movement in Google Cloud

Cloud Credential Theft

Over-Privileged Service Accounts Create Escalation of Privileges and Lateral Movement in Google Cloud

December 2, 202113 min read

Phishing Ransomware

Cloud Threats Memo: Scary Examples of Weaponizing Google Drive

November 18, 20213 min read

DBatLoader: Abusing Discord to Deliver Warzone RAT

Malware Credential Theft

DBatLoader: Abusing Discord to Deliver Warzone RAT

October 21, 20214 min read

Cloud Threats Memo: Adding to the List of Exploited Cloud Services

September 28, 20212 min read

Who Do You Trust? Challenges with OAuth Application Identity

Auth Credential Theft

Who Do You Trust? Challenges with OAuth Application Identity

September 14, 202112 min read

New Phishing Attacks Exploiting OAuth Authorization Flows (Part 3)

New Phishing Attacks Exploiting OAuth Authorization Flows (Part 3)

August 12, 20218 min read

New Phishing Attacks Exploiting OAuth Authorization Flows (Part 2)

New Phishing Attacks Exploiting OAuth Authorization Flows (Part 2)

August 10, 20217 min read

New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)

New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)

August 10, 20215 min read

Cloud Threats Memo: Watch Out for Google Forms Cloud Phishing

Cloud Threats Memo: Watch Out for Google Forms Cloud Phishing

July 23, 20212 min read

Vulnerability Remote Access

Cloud Threats Memo: Illustrating Big Risks in the Shift to Remote Working

June 17, 20212 min read

Remote Access Credential Theft

Cloud Threats Memo: RDP Misconfigurations and Initial Access Brokers

June 8, 20212 min read

Cloud Credential Theft

A Real-World Look at AWS Best Practices: Password Policies

June 3, 20215 min read

Cloud and Threat Report: Gone Phishing

Phishing Credential Theft

Cloud and Threat Report: Gone Phishing

May 26, 20213 min read

Cloud Credential Theft

A Real-World Look at AWS Best Practices: IAM User Accounts

May 6, 20219 min read

Credential Theft Ransomware

Cloud Threats Memo: Beware Outsourced Cyber Attacks and Compromised Credentials

April 28, 20211 min read

The Root of Your AWS Insecurities

Cloud Credential Theft

The Root of Your AWS Insecurities

February 16, 20219 min read

Here Comes TroubleGrabber: Stealing Credentials Through Discord

Credential Theft Malware

Here Comes TroubleGrabber: Stealing Credentials Through Discord

November 13, 20209 min read

GCP OAuth Token Hijacking in Google Cloud—Part 2

Cloud Credential Theft

GCP OAuth Token Hijacking in Google Cloud—Part 2

August 25, 20208 min read

A Big Catch: Cloud Phishing from Google App Engine and Azure App Service

Phishing Credential Theft

A Big Catch: Cloud Phishing from Google App Engine and Azure App Service

August 12, 20204 min read

GCP OAuth Token Hijacking in Google Cloud - Part 1

Cloud Credential Theft

GCP OAuth Token Hijacking in Google Cloud - Part 1

August 7, 20207 min read

MITRE Att&ck View: Securing AWS Temporary Tokens

Cloud Credential Theft

MITRE Att&ck View: Securing AWS Temporary Tokens

January 31, 20206 min read

Securing AWS Temporary Tokens

Cloud Credential Theft

Securing AWS Temporary Tokens

August 10, 201910 min read

Git Your RATs Here!

Git Your RATs Here!

January 17, 20188 min read

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

Malware Vulnerability

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

December 14, 20175 min read

Phishing Attacks on Retail Industry Ramp Up as the Holiday Shopping Season Approaches

Phishing Malware

Phishing Attacks on Retail Industry Ramp Up as the Holiday Shopping Season Approaches

December 13, 20175 min read

Phishing as a Service - Phishing revamped

Phishing Credential Theft

Phishing as a Service - Phishing revamped

July 12, 20177 min read