Tag

Phishing

6 stories

Antino: A Stealthy Backdoor That Hides in Outlook and OneDrive

A new espionage campaign tracked by Cisco Talos has exposed a sophisticated Windows backdoor, nicknamed Antino, that uses Microsoft 365 services as its covert communications channel. Targeting government and policy organizations across Asia — including Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar — the activity centers on highly tailored spear‑phishing lures and a multi-stage infection chain that culminates in a Rust-compiled implant communicating through Outlook and OneDrive. The…

Saugata DattaOct 3, 20265 min read107

Cybersecurity

Photo ZIP Campaign Targets Hospitality Industry with Node.js Implant for Persistent Access

Microsoft Threat Intelligence has identified an active, multi-stage intrusion campaign that has targeted organizations in the hospitality and hotel industry since April 2026. Attackers delivered browser-downloaded photo-themed ZIP archives that contained executable shortcut files disguised as images. When opened, these shortcuts kicked off an obfuscated PowerShell chain that fetched a Node.js–based implant, established dual registry persistence, and initiated command-and-control (C2) communications over non-standard ports. Observed post-compromise behaviors include beaconing to…

Saugata DattaJun 26, 20265 min read92

Cybersecurity

Breaking the code: how a multi-stage “code of conduct” phishing campaign led to AiTM token compromise

Phishing has evolved from crude scams to carefully engineered deceptions that mimic trusted internal processes. In mid‑April 2026, Microsoft Defender Research observed a large, multi‑stage campaign that did exactly that: it masqueraded as internal “code of conduct” notifications, used polished templates and legitimate delivery services, and funneled victims through a sequence of CAPTCHA and staging pages that ultimately proxied real authentication flows. The result was an adversary‑in‑the‑middle (AiTM) compromise capable…

Saugata DattaMay 12, 20266 min read151

Cybersecurity

Hackers Leverage Microsoft Teams to Breach Organizations: Inside UNC6692’s SNOW Campaign

In late 2025 and into early 2026, a sophisticated intrusion campaign used the everyday familiarity of Microsoft Teams to turn routine collaboration into a direct route for enterprise compromise. By posing as IT helpdesk staff and exploiting users’ trust in external Teams invitations, the threat group tracked as UNC6692 moved from a simple chat message to full domain-level access—without exploiting a software vulnerability. The result was a carefully staged, cloud-hosted…

Saugata DattaApr 24, 20265 min read279

Cybersecurity

New RDP Alert After April 2026 Security Update Warns of Unknown Connections

Microsoft’s April 2026 Patch Tuesday introduced a small-looking but important change to how Windows handles Remote Desktop (.rdp) files. What used to be a silent, one-click experience can now surface clear warnings about unknown connections and requested local resource access, closing an easy door attackers have been exploiting for phishing and session hijacking. For organizations and individual users alike, the update shifts the default toward safer, more explicit consent when…

Saugata DattaApr 20, 20264 min read242

AI Agents and Frameworks

AI as Tradecraft: How Threat Actors Operationalize Artificial Intelligence

Organizations are facing a subtle but powerful shift: adversaries are not inventing wholly new attacks so much as adopting artificial intelligence to make existing tradecraft faster, cheaper, and more resilient. Microsoft’s threat intelligence and other industry observers show that generative AI is being embedded across the attack lifecycle to accelerate reconnaissance, scale social engineering, and shorten the time between detection and re‑deployment. The result is a landscape where familiar threats…

Saugata DattaMar 20, 20264 min read593

Antino: A Stealthy Backdoor That Hides in Outlook and OneDrive

Photo ZIP Campaign Targets Hospitality Industry with Node.js Implant for Persistent Access

Breaking the code: how a multi-stage “code of conduct” phishing campaign led to AiTM token compromise

Hackers Leverage Microsoft Teams to Breach Organizations: Inside UNC6692’s SNOW Campaign

New RDP Alert After April 2026 Security Update Warns of Unknown Connections

AI as Tradecraft: How Threat Actors Operationalize Artificial Intelligence

Free Tools: IP, DNS, SSL