✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Gambling/Casinos
Breach intelligence, attack campaigns, and threat reports targeting the Gambling/Casinos sector.
Explore Other Sectors
Gambling/Casinos Threat Reports
GoldenEyeDog Subgroup's Infiltration of DigiCert: A Wake-Up Call for Digital Trust
In April 2026, DigiCert, a leading Certificate Authority, experienced a security breach attributed to the CylindricalCanine subgroup of the GoldenEyeDog cybercrime group. The attackers infiltrated DigiCert's internal support portal by compromising two support analyst workstations through a malicious screensaver file delivered via a customer chat channel. This access enabled them to issue 27 fraudulent Extended Validation (EV) Code Signing certificates, which were subsequently used to sign malware, notably the Zhong Stealer, facilitating its distribution and evasion of security measures. The incident underscores the critical vulnerabilities within trusted digital infrastructure and the potential for widespread impact when such systems are compromised. ([thehackernews.com](https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html?utm_source=openai)) This breach highlights a concerning trend of cybercriminals targeting Certificate Authorities to obtain legitimate certificates for malicious purposes. The use of social engineering tactics to exploit support channels emphasizes the need for enhanced security protocols and employee training to prevent similar incidents in the future.
1 day ago
Kill Chain
Malicious SDKs on npm and PyPI Compromise Paysafe and Skrill Integrations
In July 2026, a coordinated supply-chain attack targeted developers integrating payment services by distributing at least 17 malicious packages on the npm and PyPI repositories. These packages masqueraded as legitimate SDKs for Paysafe, Skrill, and Neteller, aiming to steal sensitive credentials such as API keys, AWS keys, and GitHub tokens. The attackers employed typosquatting techniques, publishing packages with names closely resembling authentic ones, leading to unauthorized access and potential data breaches. This incident underscores the escalating threat of supply-chain attacks within open-source ecosystems. The attackers' ability to infiltrate multiple package managers simultaneously highlights the need for enhanced vigilance and security measures among developers and organizations to safeguard against such sophisticated threats.
1 week ago
Kill Chain
Massive Crypto Scam Operation Exploits DCloud Uni-App Framework
In June 2026, cybersecurity firm Infoblox uncovered that over 236,000 websites were utilizing investment scam templates built with the DCloud Uni-App framework. These sites facilitated a range of fraudulent activities, including fake cryptocurrency exchanges, phishing schemes, and crypto wallet drainers. The malicious domains spanned multiple continents and languages, indicating a coordinated effort by various threat actors. Notably, the RainbowEx platform, implicated in a Ponzi scheme affecting thousands in Argentina in late 2024, was among the identified domains. ([thehackernews.com](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html?utm_source=openai)) The exploitation of legitimate development frameworks like DCloud Uni-App underscores the evolving tactics of cybercriminals. This incident highlights the critical need for organizations to implement robust security measures, including thorough vetting of third-party tools and continuous monitoring for suspicious activities. ([thehackernews.com](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html?utm_source=openai))
2 weeks ago
Kill Chain
DraftKings 2022 Credential Stuffing Attack: A Case Study
In November 2022, DraftKings, a prominent fantasy sports and betting platform, experienced a credential stuffing attack that compromised approximately 60,000 user accounts. The attackers, led by Nathan Austad, known online as "Snoopy," exploited reused login credentials to gain unauthorized access. In about 1,600 cases, they added new payment methods to the compromised accounts and withdrew funds, resulting in approximately $600,000 in losses. The remaining compromised accounts were sold on cybercriminal marketplaces. Austad was sentenced to 18 months in federal prison, ordered to serve three years of supervised release, pay over $1.3 million in restitution, and forfeit an additional $463,000. This incident underscores the persistent threat of credential stuffing attacks, particularly in the online betting industry, where user accounts often contain sensitive financial information. It highlights the critical need for robust password policies, multi-factor authentication, and user education to prevent unauthorized access and financial losses.
3 weeks ago
Kill Chain
DraftKings 2022 Credential Stuffing Attack: A Case Study
In November 2022, DraftKings, a prominent sports betting platform, experienced a credential stuffing attack that compromised approximately 68,000 user accounts. Attackers exploited reused or weak passwords to gain unauthorized access, leading to the theft of nearly $300,000 from customer accounts. The company promptly reimbursed affected users and emphasized the importance of unique passwords and two-factor authentication to enhance account security. This incident underscores the growing threat of credential stuffing attacks, where cybercriminals leverage stolen credentials from previous breaches to infiltrate accounts on other platforms. The DraftKings case highlights the critical need for robust password practices and multi-factor authentication to mitigate such risks.
3 weeks ago
Kill Chain
Google Engineer Arrested for Insider Trading on Polymarket
In May 2026, Michele Spagnuolo, a 36-year-old Google security engineer, was arrested in New York for allegedly using confidential internal data to profit on the Polymarket prediction platform. Spagnuolo accessed nonpublic 'Year in Search' data to place bets on the most searched individuals of 2025, resulting in over $1.2 million in gains. He faces charges including commodities fraud, wire fraud, and money laundering, with potential sentences totaling up to 50 years in prison. This incident underscores the growing scrutiny of insider trading within emerging financial platforms like prediction markets. It highlights the critical need for robust internal controls and monitoring to prevent the misuse of proprietary information, especially as digital platforms become increasingly integrated into financial activities.
1 month ago
Kill Chain
U.S. Government Targets Southeast Asian Cyber Scam Networks Exploiting Forced Labor
In April 2026, the U.S. government executed a coordinated crackdown on Southeast Asian cyber scam operations targeting American citizens. This initiative led to the indictment of two Chinese nationals managing a scam compound in Myanmar, sanctions against 29 individuals—including a Cambodian senator—and the seizure of over 500 fraudulent investment websites. These operations exploited forced labor to conduct social engineering attacks, deceiving victims into transferring funds to fake cryptocurrency investment platforms. The financial impact on American victims was substantial, with losses amounting to billions of dollars. This incident underscores the escalating threat posed by transnational cybercrime networks employing sophisticated social engineering tactics. The involvement of high-ranking officials and the use of forced labor highlight the complexity and scale of these operations. It also reflects the increasing collaboration between international law enforcement agencies to combat such threats, emphasizing the need for continuous vigilance and adaptive cybersecurity measures.
2 months ago
Kill Chain
Scattered Spider Hacker Arrested in Finland Faces U.S. Charges
In April 2026, a 19-year-old dual U.S. and Estonian citizen, known online as "Bouquet," was arrested at Helsinki Airport in Finland while attempting to board a flight to Japan. U.S. federal prosecutors have charged him with wire fraud, conspiracy, and computer intrusion, alleging his involvement in at least four cyberattacks orchestrated by the Scattered Spider hacking group. These attacks, dating back to March 2023, targeted multiple large corporations, resulting in millions of dollars in ransom payments and significant operational disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-reportedly-charges-scattered-spider-hacker-arrested-in-finland/?utm_source=openai)) This arrest underscores the persistent threat posed by cybercriminal groups like Scattered Spider, which employ sophisticated social engineering tactics to infiltrate organizations. The incident highlights the critical need for robust cybersecurity measures, including advanced threat detection and employee training, to mitigate the risks associated with such attacks.
2 months ago
Kill Chain
DraftKings Credential-Stuffing Attack Results in 30-Month Prison Sentence
In November 2022, DraftKings, a prominent sports betting platform, experienced a credential-stuffing attack that compromised nearly 68,000 user accounts. Attackers utilized previously stolen credentials to gain unauthorized access, leading to the theft of approximately $635,000 from around 1,600 accounts. The perpetrators, including Nathan Austad and Joseph Garrison, sold access to these accounts, with accomplice Kamerin Stokes reselling them through his own platform. Stokes, known online as 'TheMFNPlug,' continued his illicit activities even after initial legal actions, reopening his shop with the tagline 'fraud is fun.' This incident underscores the persistent threat of credential-stuffing attacks, especially in industries handling sensitive financial information. The case highlights the importance of robust cybersecurity measures and the need for users to employ unique, strong passwords across different platforms to mitigate such risks.
3 months ago
Kill Chain
Torg Grabber: The Infostealer Targeting Cryptocurrency Wallets
In March 2026, cybersecurity researchers identified 'Torg Grabber,' a sophisticated infostealer malware targeting 728 cryptocurrency wallet browser extensions. The malware gains initial access through the 'ClickFix' technique, hijacking the clipboard to execute malicious PowerShell commands. Once inside, Torg Grabber exfiltrates sensitive data from 25 Chromium-based browsers and 8 Firefox variants, including credentials, cookies, and autofill data. It also targets 103 password managers and two-factor authentication tools, as well as 19 note-taking applications. The malware employs advanced evasion tactics, such as multi-layered obfuscation and reflective loading, to remain undetected. ([asec.ahnlab.com](https://asec.ahnlab.com/en/92902/?utm_source=openai)) The rapid development and deployment of Torg Grabber underscore a growing trend in the cyber threat landscape: the convergence of infostealers and ransomware. This evolution highlights the increasing sophistication of cybercriminals and the urgent need for organizations to enhance their security measures to protect sensitive data and digital assets. ([cyfirma.com](https://www.cyfirma.com/research/the-convergence-of-infostealers-and-ransomware-from-credential-harvesting-to-rapid-extortion-chains/?utm_source=openai))
3 months ago
Kill Chain
Operation Synergia III: A Landmark in Global Cybercrime Enforcement
Between July 2025 and January 2026, INTERPOL coordinated Operation Synergia III, a global initiative involving 72 countries aimed at dismantling cybercriminal infrastructures. The operation resulted in the sinkholing of 45,000 malicious IP addresses, seizure of 212 electronic devices and servers, and the arrest of 94 individuals, with an additional 110 suspects under investigation. Notable actions included the arrest of 10 individuals in Togo involved in social engineering schemes and the identification of over 33,000 phishing websites in Macau impersonating financial institutions to steal sensitive information. This operation underscores the escalating sophistication and global reach of cybercrime, highlighting the necessity for international collaboration in combating these threats. The success of Operation Synergia III demonstrates the effectiveness of coordinated efforts in disrupting cybercriminal networks and mitigating their impact on global security.
4 months ago
Kill Chain
INTERPOL's Global Crackdown: 45,000 Malicious IPs Dismantled, 94 Arrested
Between July 18, 2025, and January 31, 2026, INTERPOL coordinated a global operation involving 72 countries, resulting in the dismantling of 45,000 malicious IP addresses and servers associated with phishing, malware, and ransomware activities. This effort led to the arrest of 94 individuals and the seizure of 212 electronic devices and servers. Notable actions included the arrest of 40 suspects in Bangladesh linked to various cybercrimes and the identification of over 33,000 fraudulent websites in Macau targeting critical infrastructure. This operation underscores the escalating threat of transnational cybercrime and the necessity for coordinated international responses. The increasing sophistication and scale of cybercriminal activities highlight the urgent need for enhanced cybersecurity measures and global cooperation to protect individuals and organizations from emerging digital threats.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports