✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Civic/Social Organization
Breach intelligence, attack campaigns, and threat reports targeting the Civic/Social Organization sector.
Explore Other Sectors
Civic/Social Organization Threat Reports
CISA Warns: Surge in Spyware Targeting Messaging Apps (2024)
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued a critical alert about threat actors leveraging commercial spyware to infiltrate messaging applications. Attackers have used sophisticated social engineering and mimicry of trusted messaging apps to deploy Android spyware—sometimes via malicious image files shared through platforms like WhatsApp—or by exploiting vulnerabilities in applications such as Signal, especially targeting Samsung devices. The primary victims are high-value individuals, including government, military, and political officials, as well as civil society members, with attacks observed across the United States, the Middle East, and Europe. These threats enable threat actors to gain unauthorized device access and deploy further malicious payloads, jeopardizing personal and organizational data. CISA’s latest alert underscores a sharp escalation in opportunistic spyware attacks, using new delivery vectors such as malicious QR codes and zero-click exploits. The advisory highlights the urgent need for preventative security hygiene, particularly as attackers increasingly aim at mobile messaging platforms used by sensitive sectors.
6 months ago
Kill Chain
Spyware Surge: Targeted Attacks on Messaging Apps Expose High-Profile Users (2025)
In November 2025, multiple cyber threat actors leveraged sophisticated commercial spyware to infiltrate popular messaging applications, including Signal and WhatsApp, targeting high-value individuals such as government and military officials, civil society groups, and others across the US, Middle East, and Europe. The attackers used advanced tactics like phishing, malicious device-linking QR codes, zero-click exploits, and app impersonation to compromise accounts and deliver spyware, leading to unauthorized access, lateral movement, and further malicious payloads compromising victims’ mobile devices. This incident underscores an ongoing escalation in targeted mobile surveillance operations, with advanced spyware tools proliferating and threat actors increasingly focusing on messaging platforms. Rapid evolution in attack techniques and regulatory scrutiny make the threat highly relevant for organizations and individuals handling sensitive communications.
6 months ago
Kill Chain
PhantomCaptcha Spearphishing Attack Targets Ukraine War Relief Orgs
On June 22, 2024, a coordinated spearphishing campaign dubbed 'PhantomCaptcha ClickFix' targeted Ukrainian regional government entities and major international humanitarian organizations, such as the International Committee of the Red Cross and UNICEF. The attackers used convincing phishing emails distributing malicious links intended to compromise users through browser exploits and credential harvesting, aiming to disrupt relief efforts amid ongoing conflict. Although the operation was short-lived, lasting just one day, it exposed staff to significant risk of account takeover and disruption of war relief operations. This incident spotlights the expanding use of highly targeted, short-duration spearphishing campaigns against NGOs and governmental organizations, reflecting the broader trend of cyber-enabled disruption in geopolitical conflict zones. Attacks exploiting human trust and exploiting organizational urgency are on the rise, demanding renewed vigilance.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports