Find what you’re looking for
Browse everything
6,872 results in Threat Reports
Microsoft 365 Under Siege: OAuth Device Code Phishing Attacks Surge in 2025
In late 2025, Microsoft 365 accounts across multiple sectors were targeted in a sophisticated phishing campaign leveraging OAuth device code authorization. Threat actors, including financially motivated group TA2723 and a Russia-aligned group tracked as UNK_AcademicFlare, deceived victims into entering attacker-provided device codes on legitimate Microsoft login portals. This granted attacker-controlled applications elevated access to organizational email and data, bypassing credentials and even multi-factor authentication protections. Attackers utilized phishing kits such as SquarePhish and Graphish, and orchestrated lures mimicking document sharing or salary bonus notifications to maximize engagement and scale. Notably, state-aligned campaigns exploited compromised government accounts to build rapport, targeting U.S. and European government, academic, and transportation sectors. These OAuth-based phishing attacks mark a significant escalation in adversary techniques focusing on authorization abuse rather than credential theft. The surge in such activity since September 2025 demonstrates the growing adaptation of sophisticated phishing kits and highlights a strategic shift toward targeting identity and cloud permissions, reflecting evolving attack surfaces and regulatory scrutiny in cloud security.
UEFI Firmware Vulnerability Leaves Major Motherboards Open to Early-Boot DMA Attacks
In December 2025, researchers disclosed a critical hardware/firmware vulnerability impacting various ASRock, ASUS, GIGABYTE, and MSI motherboards. The flaw allows threat actors to launch direct memory access (DMA) attacks during the early boot process, bypassing typical Unified Extensible Firmware Interface (UEFI) and Input–Output Memory Management Unit (IOMMU) protections. Attackers can exploit this window to inject code or access sensitive memory before system defenses activate. The incident exposes endpoints to risk of credential theft, persistent malware implants, and lateral movement, with potential compromise of high-value IT and OT assets. This incident is highly relevant as firmware attacks and supply chain risks escalate, especially with the push towards Zero Trust security architectures. Hardware-level exposures pose challenges that traditional endpoint or network controls may not immediately mitigate, requiring urgent attention to firmware security and early-boot exploit detection.
Nigerian Authorities Arrest Raccoon0365 Phishing Platform Developer Linked to Microsoft 365 Attacks
In December 2025, Nigerian authorities arrested three individuals linked to the Raccoon0365 phishing platform, which was responsible for widespread credential theft targeting Microsoft 365 users. The service enabled cybercriminals to create convincing fake Microsoft login pages, facilitating business email compromise, data breaches, and significant financial losses across 94 countries. The investigation and arrests were made possible through intelligence provided by Microsoft via the FBI, leading to the apprehension of the platform's alleged developer and the recovery of digital evidence. Raccoon0365 operated via a Telegram channel with over 800 members, selling access to the phishing kits for cryptocurrency and leveraging Cloudflare infrastructure with compromised credentials. This incident is highly relevant as phishing-as-a-service (PhaaS) platforms continue to industrialize credential theft and make sophisticated attacks broadly accessible. The disruption of Raccoon0365 illustrates the importance of global collaboration, threat intelligence sharing, and proactive law enforcement action in curbing cybercrime.
New DCOM Object Abuse Enables Lateral Movement via Control Panel (2024)
In early 2024, new research revealed an undisclosed vulnerability in Microsoft Windows, where adversaries can abuse the Distributed Component Object Model (DCOM) to achieve lateral movement and persistence by exploiting Control Panel item registration. Attackers can remotely trigger the loading of malicious DLLs via the COpenControlPanel DCOM object, circumventing common defenses and security controls in enterprise environments. By registering rogue DLLs within specific Windows registry keys and leveraging remote registry manipulation, threat actors obtain both initial code execution and ongoing persistence, with minimal user interaction and limited detection from traditional endpoint defenses. This exposure highlights a shift toward advanced lateral movement techniques exploiting legitimate system components. With the rapid evolution of attacker TTPs, especially those bypassing modern endpoint protections and leveraging system internals, organizations face increased risk of undetected breaches and regulatory scrutiny. Proactive monitoring and refined segmentation are now essential to close these newly exposed attack paths.
Cloud Atlas 2025: APT Espionage Hits Russian and Belarusian Organizations via Cloud-Based Implants
In the first half of 2025, the persistent threat group Cloud Atlas launched a series of sophisticated cyber-espionage campaigns targeting organizations in Russia and Belarus. Attackers employed spear-phishing emails with weaponized Microsoft Office documents exploiting CVE-2018-0802, initiating a complex multi-stage infection chain. Custom implants such as VBShower, VBCloud, CloudAtlas, and PowerShower enabled attackers to establish persistent access, exfiltrate sensitive data, steal credentials, and abuse cloud-based C2 channels. Multiple sectors were affected, including telecommunications, construction, government, and manufacturing, with operations characterized by stealthy lateral movement, DLL hijacking, and multi-layered payload delivery. This incident is significant due to Cloud Atlas's use of novel, previously undocumented toolsets and cloud service abuse, reflecting a trend among APT actors toward cloud-based, modular attacks. It highlights the urgent need for heightened east-west security, advanced threat visibility, and multi-layered cloud controls, amid continued evolution of state-sponsored threat tactics.
Nigeria Arrests Developer Behind RaccoonO365 Phishing Attacks on Microsoft 365
In December 2025, Nigerian authorities arrested three high-profile cybercriminals, including the developer behind the notorious RaccoonO365 Phishing-as-a-Service (PhaaS) operation. RaccoonO365 enabled widespread Microsoft 365 phishing campaigns targeting large global corporations, facilitating credential theft and unauthorized access through sophisticated phishing kits and email lures. The Nigeria Police Force National Cybercrime Centre (NPF–NCCC) led the investigation, collaborating with international law enforcement agencies to dismantle core elements of the PhaaS infrastructure. The disruption has limited the proliferation of phishing tools contributing to corporate account compromises and subsequent business email compromise (BEC) incidents. This case underscores the persistent evolution and professionalization of phishing-as-a-service marketplaces, often operated across borders. It highlights an increased law enforcement focus on targeting not only the end-users but also the developers and operators of cybercriminal toolkits enabling downstream attacks.
Critical WatchGuard Fireware VPN Vulnerability Exploited Globally in 2025
In December 2025, WatchGuard disclosed a critical vulnerability (CVE-2025-14733, CVSS 9.3) impacting Fireware OS devices used for remote and branch office VPN connections via IKEv2. Remote unauthenticated attackers exploited an out-of-bounds write flaw in the iked process, allowing arbitrary code execution and potential compromise of security appliances. WatchGuard confirmed in-the-wild attacks linked to multiple malicious IPs, with over 117,000 internet-exposed devices at risk worldwide—over 35,000 in the U.S. alone. The vulnerability persisted in devices with previous IKEv2 configurations, even if settings were deleted. This incident exemplifies a broader threat trend as adversaries increasingly target edge networking infrastructure and VPN appliances through sophisticated exploits. The rapid addition of CVE-2025-14733 to CISA’s Known Exploited Vulnerabilities catalog underscores regulatory urgency and the need for vigilant patch management.
CISA Flags WatchGuard Firebox CVE-2025-14733 for Active Exploitation: Edge Device Security in Focus
In December 2025, CISA added CVE-2025-14733 affecting WatchGuard Firebox appliances to its Known Exploited Vulnerabilities Catalog after evidence of intensified in-the-wild exploitation. This out-of-bounds write vulnerability enables remote attackers to execute arbitrary code or disrupt device operations, threatening the integrity of network edge security. Organizations running unpatched Firebox devices are susceptible to threat actors leveraging this flaw for initial access, lateral movement, or persistent presence, with potential impact ranging from data compromise to operational downtime. Federal agencies were given a limited timeframe to remediate as mandated by Binding Operational Directive 22-01. The exploitation of CVE-2025-14733 underscores a trend where threat groups rapidly adopt edge infrastructure vulnerabilities into their toolkits. This incident reflects rising urgency for rigorous, proactive vulnerability management, as the window from disclosure to active exploitation continues to narrow.
Cracked Software & YouTube Used to Deliver CountLoader and GachiLoader Malware in 2025
In December 2025, researchers revealed a sophisticated dual-campaign where cracked software download sites and compromised YouTube videos were exploited to distribute the CountLoader and GachiLoader malware families. Users seeking pirated software were redirected to malicious downloads delivering CountLoader, a modular loader which enabled persistent access, evasion of antivirus tools, lateral movement, and ultimately delivered infostealer payloads such as ACR Stealer. In parallel, the YouTube Ghost Network used compromised accounts to distribute GachiLoader via fake installer videos, leveraging new techniques for stealth and privilege escalation, and dropping secondary threats such as Rhadamanthys stealer. These campaigns showcase rising innovation in malware loader design, particularly the use of signed-binary abuse, fileless execution, and exploitation of popular platforms to target unwary users. Such approach not only increases malware payload delivery rates but poses detection challenges for enterprises and individuals alike.
Russia-Linked Hackers Exploit Microsoft 365 Device Code Phishing in 2025
In September 2025, a Russia-linked threat group identified as UNK_AcademicFlare launched a sophisticated phishing campaign targeting Microsoft 365 users via the device code authentication workflow. By leveraging compromised email accounts from government and academic sectors, attackers sent plausible phishing messages that tricked recipients into authorizing malicious device codes, leading to credential theft and account takeovers. The campaign enabled widespread unauthorized access to cloud platforms, risking data exposure and significant operational impact—particularly for targeted organizations with weak multi-factor authentication (MFA) policies.<br><br>Such attacks reflect an increasing trend in adversaries using native authentication flows to bypass defenses and highlight growing risks around cloud account compromises. Regulatory scrutiny is intensifying, and organizations must urgently strengthen identity controls and security monitoring to address these evolving social engineering tactics.
China-backed APT 'LongNosedGoblin' Penetrates Asian Governments via Group Policy Abuse
In late 2025, cybersecurity researchers uncovered a sophisticated cyber-espionage campaign targeting multiple Southeast Asian and Japanese government entities, attributed to a new China-backed advanced persistent threat (APT) group known as LongNosedGoblin. Active since at least 2023, the group leveraged privileged access to Windows environments—specifically abusing legitimate Group Policy mechanisms to deploy malicious payloads, conduct lateral movement, and gain deep persistence within victim networks. Once entrenched, the attackers deployed a range of custom C#/.NET tools, including keyloggers, data exfiltration malware, and backdoor implants (NosyDoor), often using cloud services for command and control communications. The campaign highlights the risk of domain administrator credential compromise, allowing broad control across entire agency infrastructures. Fewer than a dozen victims were confirmed, but the attacks signify a moderate level of operator sophistication. This incident signals a shift in APT tactics toward leveraging built-in administrative utilities for stealthy malware distribution and lateral escalation, reducing detection risk. Use of cloud-based C2 and tailored tooling further complicate response and attribution, illustrating the urgency for proactive identity management and defense-in-depth protections across government and enterprise networks.
How Identity Fraud Among Home-Care Workers Put Patients at Risk in 2025
In late 2025, a series of identity fraud cases within the home healthcare sector exposed substantial patient safety risks, as unqualified individuals impersonated registered caregivers to provide in-home care services. Attackers exploited weak identity and access management processes—primarily by sharing credentials and mobile devices, enabling false geolocation verification—to bypass patient safety protocols. Law enforcement and government reports highlighted multiple cases in the US and UK involving impersonation, altered electronic monitoring, and direct falsification of visit records. These incidents led to financial fraud against Medicaid, diminished quality of patient care, and, in some tragic cases, severe patient neglect or harm. This trend reflects a growing abuse of digital identity controls in healthcare, where rapid sector expansion and understaffed workforces create security gaps. The surge in similar impersonation tactics and the inadequacy of traditional geolocation or password-based controls underline the urgent need for advanced identity verification—such as biometrics—combined with device and contextual authentication, especially as regulatory scrutiny increases.