#phishing · Cortex

Post-phishing C2 beaconing

Scenario: An employee clicked a link in a phishing email which resulted in compromising their workstation. This workstation sends a DNS query for a known malicious domain, then immediately triggers an IDS alert. Step 1: Find phishing attacks by examining email_security_alerts for violations. Step 2: Use Access logs to correlate the user’s email (To) to their IP Address. Step 3: Find internal IPs querying a specific malicious domain in gateway_dns logs.

30 juil.

phishing

Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals

China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing

Phishing Abuses RMM Tools for Persistent Access

Star Blizzard refines phishing and malware delivery with the RedFlick technique

'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

Passkey-themed social engineering leads to identity and cloud compromise

Companies may be measuring phishing resilience the wrong way

Trezor: 347,000 users targeted in phishing attacks after Brevo breach

GPT-6 Astra: A new generation of intelligence

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update

New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM

Military device manufacturer discloses cyber incident to SEC

Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

Post-phishing C2 beaconing

Post-phishing C2 beaconing

Explorer d'autres thèmes