Jeff Davies - f4n6 (Page 118)

notes

Ransomware: stormous named eogb.co.uk (GB)

1. Executive summary On 2026-06-28, the actor "stormous" publicly claimed a ransomware attack against eogb.co.uk, a UK-registered domain. The

29 Jun 2026 · 5 min read read →

notes

FBI: Russian hackers now target Signal backup recovery keys

1. Executive summary The FBI and CISA have published an updated public service announcement warning that a phishing campaign attributed to Russian Intelligence Services (RIS) — publicly

26 Jun 2026 · 6 min read read →

notes

Malware steals Chrome session cookies to take over your accounts

1. Executive summary A phishing campaign delivering a Windows backdoor via a malicious Chrome extension is actively targeting users. The malware abuses Chrome Native Messaging to

26 Jun 2026 · 6 min read read →

notes

New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

1. Executive summary CVE-2026-46331 ("pedit COW") is an out-of-bounds write vulnerability in the Linux kernel's traffic-control packet-

26 Jun 2026 · 6 min read read →

Bluekit

Bluekit and the AI Impersonators: A Phishing Kit Hunt That Uncovered a Fraud Empire

Bluekit and the AI Impersonators: A Phishing Kit Hunt That Uncovered a Fraud Empire 26 June 2026 · FindEvil — dAIffed / Adverse Trace · Case Refs: BLUEKIT-PHA-2026-

26 Jun 2026 · 17 min read read →

notes

Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

1. Executive summary A new wave of the Miasma/Mini Shai-Hulud supply-chain malware family has compromised at least 24 npm packages (LeoPlatform, RStreams, and

26 Jun 2026 · 13 min read read →

notes

Mirage2FA phishing kit uses HTML smuggling to steal Microsoft 365 credentials

1. Executive summary Fortra researchers have identified "Mirage2FA," a phishing kit that uses short-lived HTML smuggling and obfuscated JavaScript loaders to deliver fake

26 Jun 2026 · 6 min read read →

notes

Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs

1. Executive summary A new backdoor tracked as Mistic (also tracked as MLTBackdoor) has been deployed in financially motivated intrusions since April 2026, targeting organisations across

26 Jun 2026 · 8 min read read →

notes

Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses

1. Executive summary The Gamaredon Group (MITRE G0047) — a Russia-linked APT operation attributed to FSB state sponsorship — has reportedly upgraded its malware-loading capabilities and

26 Jun 2026 · 4 min read read →

notes

Bluekit phishing kit adopts browser-in-the-middle for login theft

1. Executive summary The Bluekit phishing-as-a-service (PaaS) platform has added browser-in-the-middle (BitM) capabilities, replacing its previous adversary-in-the-middle

25 Jun 2026 · 7 min read read →

notes

Stealthy new backdoor emerges in attacks on multiple sectors

1. Executive summary Symantec and Carbon Black's Threat Hunter Team have identified a new backdoor dubbed Mistic (also tracked as MLTBackdoor by Zscaler) deployed

25 Jun 2026 · 8 min read read →

AI

EvilTokens

Original inspiration for this from https://abnormal.ai/blog/eviltokens-oauth-device-codes-bec-operations EvilTokens Is Still Live: Three Months On, the PhaaS Platform Has

25 Jun 2026 · 19 min read read →