VulnHub

A phishing campaign that lasted six months used seasonal eCards to trick victims into downloading legitimate Remote Monitoring and Management (RMM) tools. Attackers crafted emails that appeared to be friendly holiday greetings, leading individuals to believe they were receiving festive messages. Instead, these emails contained links that, when clicked, installed RMM software on the victims' devices without their knowledge. This tactic poses a significant risk as it allows attackers to gain remote access to the systems of unsuspecting users, potentially leading to data breaches and further exploitation. Companies and individuals need to be vigilant about unexpected emails, especially those that seem too good to be true, to avoid falling victim to similar attacks.

Recent research by Sophos reveals that compromised logins are now the leading method for ransomware delivery, surpassing traditional software vulnerabilities. This shift means that attackers are increasingly using phishing, brute force attacks, and other identity-based threats to gain access to networks. As a result, organizations may be at greater risk if they do not enhance their security measures around user credentials. Companies should prioritize employee training on recognizing phishing attempts and implement multi-factor authentication to bolster defenses. This change in attack vectors highlights the need for a more proactive approach to cybersecurity, particularly in safeguarding login credentials.

A misconfigured server has exposed the operations of three phishing groups using Evilginx forks, which are tools designed to bypass multi-factor authentication (MFA). This incident shows how attackers can exploit configuration errors to facilitate phishing attacks that are more sophisticated and harder to detect. The exposed data could potentially allow these operators to target unsuspecting users, putting sensitive information at risk. As more organizations adopt MFA as a security measure, attackers are finding ways to circumvent these protections, making it essential for companies to ensure their server configurations are secure. This incident serves as a reminder of the importance of proper server management and security practices.

A misconfigured Python web server used in a phishing operation targeting Microsoft 365 was discovered by Lexfo, a French cybersecurity firm. The server was left publicly accessible with directory listing enabled, allowing researchers to access a log file that contained the command used to run the server. This oversight led them to uncover not only the phishing toolkit but also two additional related operations. The exposed setup raises concerns about the security practices of attackers, as it can lead to further exploitation of users unaware of these phishing attempts. Organizations using Microsoft 365 should be vigilant and ensure their security measures are robust against such phishing schemes.

A recent report by Secret Double Octopus reveals that only 28% of the financial workforce is using phishing-resistant multi-factor authentication (MFA). Many banks and financial organizations still rely on traditional passwords, which leaves them vulnerable to phishing attacks and credential theft. The combination of phishing-resistant technologies with less secure methods, like passwords plus one-time passwords (OTPs), is common but insufficient to protect against identity security risks. This situation raises concerns about the overall security posture of financial institutions, as attackers can exploit weaknesses in authentication processes. As phishing attacks continue to rise, the need for stronger authentication measures becomes more critical for protecting sensitive financial data.

A new group called Helix has emerged, employing tactics like voice phishing (vishing) to target SharePoint environments for data theft. They are using identity-focused strategies to gain access to sensitive information by tricking users into providing their credentials. This method includes device code phishing and exploiting multi-factor authentication (MFA) weaknesses. The emergence of Helix poses a significant risk to organizations that rely on SharePoint for data management, as attackers can bypass traditional security measures. Companies must remain vigilant and educate their employees about these tactics to prevent falling victim to such scams.

A serious vulnerability has been found in OpenPLC v3, which could allow authenticated attackers to write arbitrary files to the filesystem and execute malicious code. This flaw, identified as CVE-2026-14480, stems from how the legacy web user interface handles file uploads, enabling attackers to specify file names without proper validation. If exploited, it could lead to code execution under the OpenPLC runtime user, posing significant risks to critical infrastructure sectors such as manufacturing, energy, and transportation. OpenPLC v3 is now end-of-life and no longer receives security updates, making it essential for users to upgrade to OpenPLC v4 to mitigate this risk.

Schneider Electric's PowerChute Serial Shutdown software has several vulnerabilities that could allow attackers to manipulate system files, inject malicious data, or gain unauthorized access to accounts. Versions 1.4 and earlier are affected by these security flaws, which include issues like improper path restrictions and output handling. If exploited, these vulnerabilities could disrupt services or expose sensitive information across critical sectors such as energy, healthcare, and transportation. Users of affected versions are urged to upgrade to version 1.5, which includes fixes for these issues. The vulnerabilities were disclosed recently, and it is crucial for organizations to address them promptly to mitigate potential risks.

Kaspersky has reported that the Armored Likho group, a previously identified advanced persistent threat (APT), is actively targeting government and energy sectors using a combination of techniques. They employ BusySnake Stealer, a type of malware designed to extract sensitive information, alongside AI-generated loaders and phishing methods to infiltrate systems. This campaign poses significant risks to organizations in these critical sectors, as the stolen data could lead to further exploitation or security breaches. The use of sophisticated tools and tactics highlights the evolving nature of cyber threats and the need for enhanced security measures within these industries. Organizations should remain vigilant and strengthen their defenses against such targeted attacks.