Tag
Adversary-in-the-Middle Phishing via Legitimate Cloud Platforms
2 TTPs 1 IOCThreat actors are increasingly abusing reputable PaaS providers to host multi-stage AitM phishing campaigns that use browser service workers and the Ultraviolet library to intercept credentials and MFA tokens.
Atomic Arch Campaign Leverages Orphaned AUR Packages for Linux Payload Deployment
3 rules 14 TTPs 6 IOCsThe Atomic Arch campaign compromises orphaned Arch User Repository (AUR) packages, modifying their PKGBUILDs to install malicious npm/Bun dependencies like 'atomic-lockfile,' which deploy a Linux payload with credential harvesting, eBPF-based stealth, anti-debugging, and data exfiltration capabilities, impacting approximately 1,500 packages.
SaaS Notification Pipeline Abuse for Phishing and Spam Campaigns
3 rules 1 TTP 2 IOCsAttackers are abusing notification pipelines in SaaS platforms like GitHub and Jira to deliver phishing and spam emails by exploiting legitimate platform features and bypassing traditional email security measures.
Democratization of Business Email Compromise (BEC) Attacks
2 rules 2 TTPs 1 CVE 6 IOCsAttackers are leveraging AI to rapidly reconnoiter and tailor content for smaller organizations, making it easier to execute business email compromise (BEC) scams and scam smaller sums from many victims, as demonstrated by a recent attack targeting a small community organization.