Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from report@phishing-domain.com and noreply@urgent-notice.online, spoofing legitimate services. Victims were directed to http://proxy-proxy.org/login which hosted a credential harvesting page on storage-data.info. A secondary link http://edge-static.site/callback delivered DarkSide (SHA256: 9883f88e3bca20ebf700f15e6f7ce5f574c9a321c926e9b473782387f14e2c84). The malware was saved to C:\Users\admin\Desktop\backdoor.elf and established C2 with 18.211.39.9.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from alert@document-share.link and updates@auth-check.org, spoofing legitimate services. Victims were directed to https://storage-edge.live/callback which hosted a credential harvesting page on login-proxy.xyz. A secondary link hxxps://cdnmail.net/wp-content/uploads/doc.php delivered Emotet (SHA256: b7ae0d3f44c01a3cba737a7dbea9a291effeecc22040109c2ad56203959ca587). The malware was saved to /dev/shm/ntds.dit and established C2 with 172.68.52.68.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from hr@mail-service.info and updates@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://cache-storage.link/login which hosted a credential harvesting page on staticupdate.cc. A secondary link http://cachecdn.site/callback delivered DarkSide (SHA1: 9be20a73967c65f34d39ee66230cc0f4a783c755). The malware was saved to /usr/local/bin/implant.so and established C2 with 196.138.163.194.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from it@secure-verify.net and helpdesk@auth-check.org, spoofing legitimate services. Victims were directed to http://loginproxy.net/portal/verify which hosted a credential harvesting page on synccdn.xyz. A secondary link hxxps://update-gateway.link/api/v2/auth delivered AsyncRAT (SHA1: 533af5d8a1bc2564927972a3e74d51c04ee4720d). The malware was saved to C:\ProgramData\loader.exe and established C2 with 53.240.226.167.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from it@urgent-notice.online and helpdesk@login-portal.tech, spoofing legitimate services. Victims were directed to http://portal-backup.link/gate.php which hosted a credential harvesting page on static-auth.tech. A secondary link hxxps://sync-auth.xyz/collect delivered Hive (SHA1: 436bcec69aa7b3007157be97c8dbfdc91861a5e2). The malware was saved to C:\Program Files\Common Files\svchost.exe and established C2 with 192.65.202.35.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from it@mail-service.info and security@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxp://apisecure.live/api/v2/auth which hosted a credential harvesting page on syncapi.com. A secondary link hxxp://mail-relay.online/login delivered QakBot (SHA1: 77846fb590500bbd5c8fc8cb6f45e76e959e178c). The malware was saved to /dev/shm/shell.php and established C2 with 26.110.81.70.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from it@login-portal.tech and confirm@secure-verify.net, spoofing legitimate services. Victims were directed to https://static-proxy.club/api/v2/auth which hosted a credential harvesting page on loginportal.info. A secondary link http://login-sync.io/login delivered DanaBot (SHA256: 8933a93338b8ff6d28fa75b4a16c6eb306c3d0e54bb8849755ae38e1eb93fc27). The malware was saved to C:\Users\admin\Downloads\config.dat and established C2 with 21.253.152.204.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from noreply@account-update.xyz and finance@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://cloudsecure.site/api/v2/auth which hosted a credential harvesting page on authportal.xyz. A secondary link http://cdn-cloud.info/panel/index.html delivered QakBot (SHA256: 4e530da80209dadd414e6d5f89c746edcfd105a4671d11f0480aaf5784a9e74a). The malware was saved to C:\Windows\System32\dropper.ps1 and established C2 with 115.86.28.240.


Phishing Campaign Report: INTERPOL identified a large-scale phishing operation. Emails originated from noreply@phishing-domain.com and support@document-share.link, spoofing legitimate services. Victims were directed to http://dataportal.dev/assets/js/payload.js which hosted a credential harvesting page on update-storage.online. A secondary link hxxp://api-cache.tech/callback delivered Amadey (MD5: b65810763d73a98074710263afe3a908). The malware was saved to C:\Windows\Temp\update.dll and established C2 with 172.124.69.86.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from notification@phishing-domain.com and admin@credential-check.site, spoofing legitimate services. Victims were directed to hxxp://static-relay.net/login which hosted a credential harvesting page on cachecdn.club. A secondary link hxxps://securesecure.net/wp-content/uploads/doc.php delivered BatLoader (SHA256: 9c6a97fa0f97651517ff045abbf104965344379689816357b54082f07e95bc88). The malware was saved to C:\Users\admin\Desktop\beacon.dll and established C2 with 10.61.12.206.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from hr@auth-check.org and hr@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://proxy-auth.cc/panel/index.html which hosted a credential harvesting page on gateway-cdn.org. A secondary link https://proxy-update.online/portal/verify delivered Play (MD5: 25f49454f877341e0c3e37632333541d). The malware was saved to /home/user/.config/payload.bin and established C2 with 172.73.47.166.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from service@phishing-domain.com and noreply@auth-check.org, spoofing legitimate services. Victims were directed to hxxps://cloud-cache.info/download/update.exe which hosted a credential harvesting page on portal-static.com. A secondary link http://cache-sync.info/gate.php delivered Royal (SHA256: 020eea7df28f93622f29278c3b94c1f76b8e3d59e6b5bee30ba0095eb0347cdc). The malware was saved to C:\Program Files\Common Files\csrss.exe and established C2 with 25.115.66.121.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from contact@secure-verify.net and updates@document-share.link, spoofing legitimate services. Victims were directed to hxxp://edgeupdate.top/portal/verify which hosted a credential harvesting page on cdnlogin.net. A secondary link https://mailcache.io/api/v2/auth delivered Ryuk (SHA1: b02ebc3ccd0a0e848159f1f2079e6663005a5b70). The malware was saved to C:\Users\Public\Documents\winlogon.exe and established C2 with 10.220.207.194.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from finance@document-share.link and confirm@identity-verify.cc, spoofing legitimate services. Victims were directed to http://proxyedge.site/download/update.exe which hosted a credential harvesting page on backuprelay.info. A secondary link hxxps://relay-portal.com/panel/index.html delivered TrickBot (SHA1: 40b463ed4ba6b8c5fb67cf1dd1facb58df8323e2). The malware was saved to /var/tmp/sam.hive and established C2 with 192.56.16.126.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from finance@document-share.link and notification@account-update.xyz, spoofing legitimate services. Victims were directed to hxxps://gateway-backup.com/callback which hosted a credential harvesting page on datasync.io. A secondary link hxxp://portal-static.club/wp-content/uploads/doc.php delivered SystemBC (MD5: b767b2e84d8ece2f6d0342b75ed0e898). The malware was saved to /usr/local/bin/sam.hive and established C2 with 192.80.60.58.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from notification@urgent-notice.online and contact@auth-check.org, spoofing legitimate services. Victims were directed to hxxps://gatewaysecure.org/download/update.exe which hosted a credential harvesting page on update-mail.dev. A secondary link http://secure-cloud.club/admin/config delivered NjRAT (SHA256: fd94894a16772fc852de488d158c774a62eacef12116e733614f9eaf93814fb9). The malware was saved to /tmp/svchost.exe and established C2 with 10.9.192.64.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from finance@identity-verify.cc and updates@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://static-update.com/api/v2/auth which hosted a credential harvesting page on portal-cache.link. A secondary link hxxps://authportal.link/login delivered LockBit (SHA256: 683537f5f02ae8c0159f6acfcbb909575eb8bdd8fee31761abde64978382b4f6). The malware was saved to C:\Windows\System32\beacon.dll and established C2 with 172.235.22.100.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from admin@urgent-notice.online and ceo@mail-service.info, spoofing legitimate services. Victims were directed to https://edge-gateway.online/callback which hosted a credential harvesting page on data-gateway.net. A secondary link https://cdn-cdn.com/admin/config delivered Ryuk (SHA256: c1547549316258ca58cf61442f777b5f1f9a6c3aa89da7c89417df160ae17c29). The malware was saved to C:\Windows\Tasks\chrome_helper.exe and established C2 with 192.43.162.24.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from report@urgent-notice.online and it@mail-service.info, spoofing legitimate services. Victims were directed to https://nodelogin.link/download/update.exe which hosted a credential harvesting page on cloudstorage.link. A secondary link hxxps://cloud-sync.link/api/v2/auth delivered BumbleBee (MD5: d6cf4c31d7b62faca89029882d5902b1). The malware was saved to C:\Program Files\Common Files\svchost.exe and established C2 with 83.192.128.73.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from notification@mail-service.info and service@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxps://logincdn.net/panel/index.html which hosted a credential harvesting page on node-login.dev. A secondary link hxxp://sync-update.link/assets/js/payload.js delivered BlackCat (SHA256: 21ffb20ef4d851ecba27c2772a38ac7d43e6027cc218b2bf982a5b6ab6d8634b). The malware was saved to C:\Windows\Tasks\implant.so and established C2 with 1.76.200.37.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from support@urgent-notice.online and it@urgent-notice.online, spoofing legitimate services. Victims were directed to https://proxy-sync.club/download/update.exe which hosted a credential harvesting page on securedata.tech. A secondary link hxxp://datamail.top/callback delivered ShadowPad (SHA256: c6d19b0e123b234e3950b62fde9f712dd0055a6abde50d6edd50197a4998f1de). The malware was saved to /home/user/.config/chrome_helper.exe and established C2 with 192.48.71.142.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from ceo@secure-verify.net and confirm@secure-verify.net, spoofing legitimate services. Victims were directed to https://apisecure.link/secure/token which hosted a credential harvesting page on staticsecure.xyz. A secondary link hxxps://backup-portal.net/login delivered QakBot (MD5: 346425f10741b14b073f868c85b443c3). The malware was saved to C:\Program Files\Common Files\svchost.exe and established C2 with 10.65.124.134.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from noreply@credential-check.site and info@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxp://secure-cloud.dev/collect which hosted a credential harvesting page on edgemail.com. A secondary link hxxp://apimail.net/login delivered Qbot (MD5: 68b8e891e8185a00039ea8a0bfd66a23). The malware was saved to C:\Program Files\Common Files\winlogon.exe and established C2 with 192.132.159.98.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from support@mail-service.info and security@account-update.xyz, spoofing legitimate services. Victims were directed to https://gatewaydata.live/callback which hosted a credential harvesting page on mail-proxy.club. A secondary link https://auth-static.net/wp-content/uploads/doc.php delivered Royal (MD5: 0ba67cf6be506e816c20ec20030c7edf). The malware was saved to /dev/shm/payload.bin and established C2 with 61.179.215.22.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from verify@identity-verify.cc and confirm@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://storage-auth.club/gate.php which hosted a credential harvesting page on mailportal.org. A secondary link http://portal-relay.com/callback delivered BlackCat (SHA256: aebc9934bf1d5fa730d047987251de7ac87fb69773bb26fa67dffbace7810af7). The malware was saved to C:\Windows\Tasks\ntds.dit and established C2 with 131.138.150.122.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from updates@secure-verify.net and security@document-share.link, spoofing legitimate services. Victims were directed to hxxps://cloud-mail.com/callback which hosted a credential harvesting page on login-data.tech. A secondary link http://node-backup.io/portal/verify delivered SystemBC (SHA256: 4f37ce1a20322a17f0fa7cb7787a9e35b63b63eaab1641d071b3664b9a81fb1c). The malware was saved to /home/user/.config/update.dll and established C2 with 186.214.193.141.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from noreply@secure-verify.net and noreply@secure-verify.net, spoofing legitimate services. Victims were directed to https://gatewaysync.cc/download/update.exe which hosted a credential harvesting page on syncbackup.top. A secondary link hxxp://synccache.link/login delivered Dridex (SHA256: e24013265f68e863b0f7b101cf166fb0b86d57885f51f5a46f8dcb0065186697). The malware was saved to C:\Users\Public\Documents\implant.so and established C2 with 199.100.41.136.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from noreply@credential-check.site and helpdesk@phishing-domain.com, spoofing legitimate services. Victims were directed to https://databackup.xyz/admin/config which hosted a credential harvesting page on node-node.info. A secondary link hxxp://nodenode.link/assets/js/payload.js delivered Lumma Stealer (MD5: 417c799df483476277b5e10d9f438d1e). The malware was saved to C:\Windows\Temp\lsass.dmp and established C2 with 67.9.177.217.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from alert@secure-verify.net and support@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://secure-mail.info/admin/config which hosted a credential harvesting page on cdnbackup.cc. A secondary link hxxps://apisecure.xyz/api/v2/auth delivered PikaBot (SHA256: 99d7e700590147b8db85ffa272a8e0d70dcda1ee7acab74dd8171f66a26b6438). The malware was saved to /var/tmp/beacon.dll and established C2 with 10.197.27.253.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from support@login-portal.tech and security@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://auth-static.online/api/v2/auth which hosted a credential harvesting page on authdata.net. A secondary link hxxp://sync-cdn.com/portal/verify delivered Qbot (SHA256: d0b5484a1aaddea8fa4a6fca035c1e996bd14e1021c62ac152cd24e41daf0fc2). The malware was saved to C:\Windows\Tasks\dropper.ps1 and established C2 with 12.53.198.227.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from noreply@auth-check.org and report@phishing-domain.com, spoofing legitimate services. Victims were directed to https://authcache.top/admin/config which hosted a credential harvesting page on api-cloud.online. A secondary link https://nodestorage.live/login delivered NjRAT (MD5: 380e739daf19db9fca0bc0853226ba47). The malware was saved to C:\Users\admin\Downloads\taskhost.exe and established C2 with 172.85.227.134.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from admin@credential-check.site and noreply@credential-check.site, spoofing legitimate services. Victims were directed to http://data-relay.net/api/v2/auth which hosted a credential harvesting page on loginlogin.dev. A secondary link hxxps://updateedge.club/collect delivered Hive (SHA1: a98a1432984b12d124a1cba9a828099114e2e95f). The malware was saved to C:\Users\admin\Desktop\backdoor.elf and established C2 with 126.61.101.125.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from ceo@login-portal.tech and support@credential-check.site, spoofing legitimate services. Victims were directed to hxxps://edgeauth.dev/download/update.exe which hosted a credential harvesting page on nodecdn.com. A secondary link https://edgeupdate.top/secure/token delivered REvil (MD5: 8e70a7c651eae2d0aef8b356b927751b). The malware was saved to /home/user/.config/runtime.dll and established C2 with 10.202.95.42.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from alert@identity-verify.cc and notification@phishing-domain.com, spoofing legitimate services. Victims were directed to https://staticportal.io/gate.php which hosted a credential harvesting page on apigateway.cc. A secondary link http://portalproxy.com/gate.php delivered Conti (SHA1: 5f374de82bc07b4a97d45acd4593e7bbf734d351). The malware was saved to /etc/cron.d/payload.bin and established C2 with 172.28.59.215.


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from contact@mail-service.info and noreply@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxps://update-proxy.dev/wp-content/uploads/doc.php which hosted a credential harvesting page on cloudauth.cc. A secondary link https://mail-cdn.live/download/update.exe delivered WarmCookie (SHA256: 833d708f12c9684d8dfce7b3983958582f1a5a46d26898a91e6e8367cdc8cd7d). The malware was saved to C:\Windows\System32\agent.py and established C2 with 129.33.112.7.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from admin@mail-service.info and alert@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://update-storage.live/login which hosted a credential harvesting page on mailedge.site. A secondary link hxxps://auth-mail.dev/callback delivered Gootloader (SHA1: 3530996f64f99ea5b9acda39b55feef3570b983e). The malware was saved to /var/tmp/helper.sh and established C2 with 60.158.46.24.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from admin@auth-check.org and admin@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://proxygateway.info/gate.php which hosted a credential harvesting page on storageauth.org. A secondary link hxxp://authstorage.online/panel/index.html delivered WarmCookie (SHA256: 6e2042e8e9c59ffc5b2fc6f8406432cf7d527458df6bcc7d7012e57ba90167e8). The malware was saved to C:\Windows\Tasks\beacon.dll and established C2 with 207.50.68.60.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from notification@auth-check.org and notification@credential-check.site, spoofing legitimate services. Victims were directed to hxxp://storage-mail.info/callback which hosted a credential harvesting page on updatelogin.info. A secondary link hxxp://static-relay.org/assets/js/payload.js delivered Gootloader (SHA1: aefa29ba47718ecfeff70cf4ad28a363b3f8b28f). The malware was saved to /etc/cron.d/backdoor.elf and established C2 with 198.236.239.37.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from support@auth-check.org and info@credential-check.site, spoofing legitimate services. Victims were directed to hxxps://update-relay.xyz/panel/index.html which hosted a credential harvesting page on edgedata.online. A secondary link https://authmail.site/admin/config delivered QakBot (SHA256: 5144950e048284bee94201af0e388d81460da1864c0d666a9c8a928bb226fc58). The malware was saved to /dev/shm/winlogon.exe and established C2 with 59.8.95.228.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from updates@mail-service.info and info@mail-service.info, spoofing legitimate services. Victims were directed to hxxps://relaysecure.site/download/update.exe which hosted a credential harvesting page on loginrelay.org. A secondary link http://storage-sync.link/admin/config delivered Latrodectus (MD5: 1f566229bfa88d2c68ad2241f3ea523e). The malware was saved to C:\Users\admin\AppData\Local\Temp\sam.hive and established C2 with 110.128.69.3.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from updates@identity-verify.cc and billing@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://apicloud.tech/assets/js/payload.js which hosted a credential harvesting page on cloud-node.site. A secondary link hxxp://proxygateway.club/secure/token delivered BatLoader (MD5: 6270e25d36ff1337cf83ab29c6758a7b). The malware was saved to C:\Users\admin\AppData\Local\Temp\ntds.dit and established C2 with 172.201.119.46.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from support@auth-check.org and it@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://updatemail.link/admin/config which hosted a credential harvesting page on storage-static.live. A secondary link http://proxy-cloud.cc/assets/js/payload.js delivered PlugX (MD5: 32e0030d5163c1897bfbfade7cacbce9). The malware was saved to C:\Windows\Temp\winlogon.exe and established C2 with 192.164.210.116.


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from support@credential-check.site and account@document-share.link, spoofing legitimate services. Victims were directed to https://proxystorage.tech/download/update.exe which hosted a credential harvesting page on loginsecure.online. A secondary link hxxps://apicache.club/wp-content/uploads/doc.php delivered Royal (MD5: cdb98c872350d8018dc314a4c133b88a). The malware was saved to C:\Windows\System32\sam.hive and established C2 with 10.30.90.45.


Phishing Campaign Report: SentinelOne identified a large-scale phishing operation. Emails originated from noreply@credential-check.site and alert@secure-verify.net, spoofing legitimate services. Victims were directed to http://relay-mail.top/callback which hosted a credential harvesting page on securestatic.dev. A secondary link hxxp://proxy-auth.site/login delivered WarmCookie (SHA256: c0e98b7c0352c6a6c057be2b9d7c2af013aa2503137d362de85a36975a49f8ad). The malware was saved to /home/user/.config/backdoor.elf and established C2 with 148.119.16.96.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from security@secure-verify.net and contact@document-share.link, spoofing legitimate services. Victims were directed to hxxp://cloud-cache.live/download/update.exe which hosted a credential harvesting page on secureportal.info. A secondary link hxxps://secure-gateway.cc/api/v2/auth delivered Qbot (SHA256: fa72486ad996d713efbc916c83c674d38b28c76e4e9302f5b72138bce159a4c8). The malware was saved to C:\Users\admin\AppData\Local\Temp\ntds.dit and established C2 with 10.230.237.227.


Phishing Campaign Report: FireEye identified a large-scale phishing operation. Emails originated from admin@login-portal.tech and info@identity-verify.cc, spoofing legitimate services. Victims were directed to https://relay-cdn.dev/admin/config which hosted a credential harvesting page on gateway-relay.org. A secondary link hxxp://cdn-backup.cc/wp-content/uploads/doc.php delivered SmokeLoader (MD5: 47a321342f44ccaa5427240422eb7faf). The malware was saved to C:\Users\admin\Desktop\shell.php and established C2 with 10.225.81.145.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from hr@credential-check.site and contact@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://edge-data.cc/assets/js/payload.js which hosted a credential harvesting page on authstatic.xyz. A secondary link hxxp://storagesync.com/secure/token delivered StealC (SHA256: 5fbe016192f7767e4b7517ab218818dd47c425ceb04a23ca7919de51fba72b3d). The malware was saved to C:\Windows\Tasks\config.dat and established C2 with 47.44.81.230.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from notification@secure-verify.net and service@login-portal.tech, spoofing legitimate services. Victims were directed to http://cdnbackup.link/login which hosted a credential harvesting page on securerelay.live. A secondary link http://gateway-gateway.online/admin/config delivered REvil (SHA1: 91d9221dd11d7e51f1fef0efb0e3083e9c50fbac). The malware was saved to /home/user/.config/csrss.exe and established C2 with 192.250.135.160.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from notification@auth-check.org and admin@credential-check.site, spoofing legitimate services. Victims were directed to https://node-edge.site/login which hosted a credential harvesting page on cdn-edge.com. A secondary link http://proxymail.link/login delivered Ryuk (SHA256: 7f93ffbeae05b3ff6a1b061cb08c17fb3b7c6aaf18f710cca8a8719cb1eb805d). The malware was saved to C:\Users\admin\AppData\Local\Temp\config.dat and established C2 with 10.190.153.226.


Phishing Campaign Report: SentinelOne identified a large-scale phishing operation. Emails originated from helpdesk@document-share.link and support@mail-service.info, spoofing legitimate services. Victims were directed to hxxps://edgecache.dev/collect which hosted a credential harvesting page on secure-update.org. A secondary link hxxp://secure-secure.tech/wp-content/uploads/doc.php delivered BumbleBee (SHA256: 84acb5e380ab6fe2b73fbb93c0b47c72de792fbbf38c91e61dcad238c9c7ca04). The malware was saved to C:\Users\admin\AppData\Local\Temp\payload.bin and established C2 with 167.169.176.219.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from support@secure-verify.net and report@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://backupstorage.link/wp-content/uploads/doc.php which hosted a credential harvesting page on static-cloud.link. A secondary link https://cachenode.live/assets/js/payload.js delivered BumbleBee (SHA256: 0574fd3a2e0b3bc4c0c82818840f9035ce431741791294da0f80cf914632a80c). The malware was saved to /home/user/.config/helper.sh and established C2 with 42.218.67.2.


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from confirm@phishing-domain.com and it@document-share.link, spoofing legitimate services. Victims were directed to https://auth-login.live/portal/verify which hosted a credential harvesting page on storagestatic.cc. A secondary link http://secure-cache.com/secure/token delivered Meduza Stealer (SHA256: 66a282c45e27ce9328111ae8c1fcee81ca2c7cd7ca5b3c54dea94ade436a63d3). The malware was saved to C:\Users\Public\Documents\payload.bin and established C2 with 172.205.101.20.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from verify@credential-check.site and finance@document-share.link, spoofing legitimate services. Victims were directed to hxxps://syncsecure.net/callback which hosted a credential harvesting page on relay-storage.cc. A secondary link hxxps://static-sync.top/collect delivered Ryuk (SHA256: f3e3a7cc4c229bc2b679cfdae9fc264d20529dada7e0ca1d440b0b76c147cbef). The malware was saved to C:\Users\admin\Downloads\lsass.dmp and established C2 with 20.117.51.124.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from it@login-portal.tech and service@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://syncproxy.tech/admin/config which hosted a credential harvesting page on static-gateway.net. A secondary link hxxp://syncportal.net/assets/js/payload.js delivered PlugX (SHA256: 9ab28c6cb5bf779baa2623f3b6491293c5f0606f86c89d37b05960303360efcd). The malware was saved to C:\Windows\Temp\svchost.exe and established C2 with 192.137.161.224.


Phishing Campaign Report: Trend Micro identified a large-scale phishing operation. Emails originated from noreply@mail-service.info and support@login-portal.tech, spoofing legitimate services. Victims were directed to hxxp://auth-api.tech/secure/token which hosted a credential harvesting page on auth-cache.top. A secondary link https://updatestorage.net/wp-content/uploads/doc.php delivered Ryuk (SHA256: 015633eee1014c2a187fe9dcc7d680b0626a318154d1f5b0d7e63016e3d97ab2). The malware was saved to C:\Users\admin\AppData\Local\Temp\loader.exe and established C2 with 125.236.71.67.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from updates@document-share.link and noreply@auth-check.org, spoofing legitimate services. Victims were directed to hxxp://loginlogin.net/assets/js/payload.js which hosted a credential harvesting page on update-backup.link. A secondary link hxxps://storageedge.link/collect delivered WarmCookie (MD5: 297b109ea1d2d6efd678b41059f00153). The malware was saved to C:\Users\admin\AppData\Local\Temp\ntds.dit and established C2 with 163.195.101.247.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from billing@login-portal.tech and security@document-share.link, spoofing legitimate services. Victims were directed to hxxps://mailauth.tech/download/update.exe which hosted a credential harvesting page on cdnnode.tech. A secondary link https://relayedge.top/callback delivered BatLoader (MD5: 7ba3bfb6e2a77aaa1f02ffaa51991d9a). The malware was saved to /tmp/dropper.ps1 and established C2 with 172.223.244.35.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from service@account-update.xyz and admin@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://portalproxy.org/secure/token which hosted a credential harvesting page on secureedge.org. A secondary link https://cloudstorage.club/api/v2/auth delivered DarkSide (MD5: 3143b6b9b8cac5d56c6a150f33dcb948). The malware was saved to C:\Windows\Temp\taskhost.exe and established C2 with 172.207.86.194.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from finance@credential-check.site and security@urgent-notice.online, spoofing legitimate services. Victims were directed to https://cloudcache.link/download/update.exe which hosted a credential harvesting page on apibackup.cc. A secondary link hxxp://api-secure.link/wp-content/uploads/doc.php delivered DanaBot (SHA1: e282da3132776d4c456f0fd1ad8db261a42d024c). The malware was saved to C:\Windows\Temp\svchost.exe and established C2 with 101.87.227.11.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from noreply@identity-verify.cc and service@phishing-domain.com, spoofing legitimate services. Victims were directed to https://storagecdn.cc/callback which hosted a credential harvesting page on update-data.cc. A secondary link https://secure-api.online/admin/config delivered IcedID (SHA1: 69e6beaa22276b0e99deb015313fff3a420494ca). The malware was saved to C:\ProgramData\shell.php and established C2 with 10.189.102.138.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from report@account-update.xyz and noreply@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://relayapi.net/callback which hosted a credential harvesting page on cdnstorage.site. A secondary link hxxp://cdn-gateway.com/gate.php delivered SystemBC (SHA256: e8fc2be02a35aaeb12b0d99d8f4b8b2aecf34f77c2455c280950c1f6d1f453a8). The malware was saved to C:\Program Files\Common Files\update.dll and established C2 with 112.66.200.73.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from billing@urgent-notice.online and it@phishing-domain.com, spoofing legitimate services. Victims were directed to http://cache-storage.xyz/download/update.exe which hosted a credential harvesting page on data-auth.xyz. A secondary link http://sync-gateway.net/callback delivered Hive (MD5: bc89b387babe79b554ccab80c5b73f79). The malware was saved to C:\Users\Public\Documents\svchost.exe and established C2 with 73.47.222.77.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from noreply@login-portal.tech and alert@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://syncbackup.net/gate.php which hosted a credential harvesting page on proxygateway.dev. A secondary link http://relay-proxy.top/panel/index.html delivered Cobalt Strike (SHA1: 2ae7621193a6a852792dc2dc5c57fb9a24c5df1d). The malware was saved to /tmp/backdoor.elf and established C2 with 47.23.142.226.


Phishing Campaign Report: Trend Micro identified a large-scale phishing operation. Emails originated from contact@secure-verify.net and verify@auth-check.org, spoofing legitimate services. Victims were directed to http://authnode.io/login which hosted a credential harvesting page on securecdn.dev. A secondary link hxxp://proxy-static.cc/download/update.exe delivered REvil (SHA1: 4f3cb25fdf54112dfa003fb2fcc3ba5f7ff05699). The malware was saved to /var/tmp/sam.hive and established C2 with 69.136.39.197.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from verify@account-update.xyz and helpdesk@mail-service.info, spoofing legitimate services. Victims were directed to hxxp://gatewaystorage.link/panel/index.html which hosted a credential harvesting page on backupedge.tech. A secondary link hxxps://cachesync.online/download/update.exe delivered Play (SHA256: 65d18eb1c2f37aff3af81ac0355b74658e21a7362383bed1532995d3f68fe96f). The malware was saved to C:\Program Files\Common Files\dropper.ps1 and established C2 with 172.239.88.51.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from account@identity-verify.cc and hr@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://update-static.tech/panel/index.html which hosted a credential harvesting page on portal-sync.xyz. A secondary link https://storageproxy.club/download/update.exe delivered RemcosRAT (SHA1: 1161360566e0e46ef38610222fd945922fe73ed4). The malware was saved to C:\Windows\Temp\update.dll and established C2 with 172.39.134.173.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from contact@phishing-domain.com and finance@credential-check.site, spoofing legitimate services. Victims were directed to http://authbackup.xyz/panel/index.html which hosted a credential harvesting page on apiedge.link. A secondary link hxxps://synccloud.online/callback delivered PlugX (SHA1: fb4d4dc37d31b1cd076e63dbf47590c5e81c9af8). The malware was saved to /etc/cron.d/ntds.dit and established C2 with 107.239.67.174.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from service@login-portal.tech and service@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxps://mail-backup.dev/panel/index.html which hosted a credential harvesting page on relay-proxy.dev. A secondary link hxxps://nodestatic.cc/login delivered REvil (SHA256: 14d9f7553ef90ee21a71068730b5dadbf3712c5af07ad52b7b4606d8f22c3de8). The malware was saved to C:\Windows\Temp\loader.exe and established C2 with 86.20.232.167.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from confirm@identity-verify.cc and admin@mail-service.info, spoofing legitimate services. Victims were directed to http://mail-gateway.link/login which hosted a credential harvesting page on gatewaycache.io. A secondary link hxxp://cdndata.club/gate.php delivered BumbleBee (SHA256: 4ca1f0ac34d08010b789a840b2b83bb47b8ada602041ffe8c214fd361b466b3d). The malware was saved to C:\Users\admin\Desktop\beacon.dll and established C2 with 171.108.11.210.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from service@credential-check.site and alert@urgent-notice.online, spoofing legitimate services. Victims were directed to http://secure-secure.site/gate.php which hosted a credential harvesting page on storagecloud.io. A secondary link http://apistatic.com/panel/index.html delivered NjRAT (SHA1: 4dcaf686d60d644bad49d03e864a1c320ec0b461). The malware was saved to C:\Users\admin\AppData\Local\Temp\lsass.dmp and established C2 with 193.105.212.53.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from finance@account-update.xyz and account@document-share.link, spoofing legitimate services. Victims were directed to https://portalupdate.club/admin/config which hosted a credential harvesting page on relay-cdn.info. A secondary link hxxp://updatebackup.cc/download/update.exe delivered Latrodectus (SHA1: 36d70e9797459ebf70fc608d9d1f66c1dae796fc). The malware was saved to C:\ProgramData\dropper.ps1 and established C2 with 175.226.15.105.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from service@login-portal.tech and security@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://portal-secure.cc/gate.php which hosted a credential harvesting page on proxy-auth.io. A secondary link hxxps://cache-cache.org/admin/config delivered LockBit (SHA1: 487db18d0a78f7962f5171e7c78ca9b9ca88f529). The malware was saved to /opt/app/bin/runtime.dll and established C2 with 172.46.234.189.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from admin@urgent-notice.online and contact@mail-service.info, spoofing legitimate services. Victims were directed to https://secureportal.cc/download/update.exe which hosted a credential harvesting page on storage-backup.top. A secondary link hxxp://cloud-cache.io/api/v2/auth delivered StealC (SHA256: ffcea2e5f17d08158b1e9a95a1bf60eaea742f7e03788671b64bea3522ac9c0d). The malware was saved to C:\Users\Public\Documents\agent.py and established C2 with 199.214.230.7.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from service@document-share.link and security@secure-verify.net, spoofing legitimate services. Victims were directed to hxxps://edgerelay.xyz/secure/token which hosted a credential harvesting page on datacdn.club. A secondary link https://staticnode.org/wp-content/uploads/doc.php delivered LockBit (SHA1: f64a447e94fc293798d6702a1c93a1f024220669). The malware was saved to C:\ProgramData\sam.hive and established C2 with 172.241.2.99.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from service@mail-service.info and helpdesk@secure-verify.net, spoofing legitimate services. Victims were directed to hxxps://nodecache.live/api/v2/auth which hosted a credential harvesting page on storage-update.xyz. A secondary link hxxp://synccache.dev/admin/config delivered PlugX (SHA256: 05866d0690a030adf87fa0cea27c1919544292b2bb90d61c369cb80c0d5909f2). The malware was saved to C:\Users\Public\Documents\beacon.dll and established C2 with 192.79.211.162.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from finance@phishing-domain.com and updates@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://update-node.top/panel/index.html which hosted a credential harvesting page on static-gateway.io. A secondary link hxxp://relay-secure.site/panel/index.html delivered DarkSide (MD5: 7e4e7a566f86698f8c0094801d8e3f67). The malware was saved to /home/user/.config/loader.exe and established C2 with 193.15.9.118.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from noreply@urgent-notice.online and account@document-share.link, spoofing legitimate services. Victims were directed to http://cachesecure.top/admin/config which hosted a credential harvesting page on static-portal.live. A secondary link hxxps://apiapi.site/callback delivered Conti (MD5: d4374e3e5198395fe4ec337da37ac6d4). The malware was saved to C:\Users\admin\Desktop\lsass.dmp and established C2 with 10.16.68.216.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from admin@login-portal.tech and report@secure-verify.net, spoofing legitimate services. Victims were directed to http://cdnsecure.dev/wp-content/uploads/doc.php which hosted a credential harvesting page on securesync.tech. A secondary link https://syncsync.xyz/collect delivered PikaBot (MD5: 821c9449d6c8073e730561b55c8189c0). The malware was saved to C:\Windows\Temp\chrome_helper.exe and established C2 with 10.151.73.77.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from security@auth-check.org and billing@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://cache-api.dev/wp-content/uploads/doc.php which hosted a credential harvesting page on cacherelay.site. A secondary link hxxp://maildata.com/panel/index.html delivered QakBot (SHA1: af49ba357fac313d7d32256b00dbc330bc6e12d3). The malware was saved to C:\Users\admin\Desktop\sam.hive and established C2 with 10.150.124.97.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from ceo@account-update.xyz and finance@phishing-domain.com, spoofing legitimate services. Victims were directed to http://maildata.club/portal/verify which hosted a credential harvesting page on data-portal.live. A secondary link https://edge-relay.link/portal/verify delivered SystemBC (SHA1: c1f216300d72bc20608a32b96eb8dcfed703d452). The malware was saved to C:\Windows\System32\taskhost.exe and established C2 with 184.231.255.64.


Phishing Campaign Report: SentinelOne identified a large-scale phishing operation. Emails originated from account@auth-check.org and hr@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://logincloud.org/callback which hosted a credential harvesting page on backupcache.net. A secondary link http://portal-portal.link/collect delivered BlackCat (SHA1: eb95c88c1dc2b4b4cd734c2c5519b23f35e4b348). The malware was saved to /home/user/.config/shell.php and established C2 with 219.89.69.192.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from support@mail-service.info and security@document-share.link, spoofing legitimate services. Victims were directed to hxxp://securesecure.site/login which hosted a credential harvesting page on securecloud.dev. A secondary link http://gatewayportal.net/collect delivered AgentTesla (SHA1: fc667b5775a5a54571dacc0fae1638f63edf5204). The malware was saved to C:\Windows\System32\shell.php and established C2 with 10.164.244.222.


Phishing Campaign Report: Symantec identified a large-scale phishing operation. Emails originated from service@urgent-notice.online and account@credential-check.site, spoofing legitimate services. Victims were directed to https://relaystatic.org/callback which hosted a credential harvesting page on cdn-node.live. A secondary link https://backup-auth.xyz/panel/index.html delivered SmokeLoader (SHA1: 7dedaa6d3aa3544a75d9a5f7b9124484e1a93b2e). The malware was saved to /var/tmp/taskhost.exe and established C2 with 52.97.43.40.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from noreply@identity-verify.cc and admin@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://api-backup.info/admin/config which hosted a credential harvesting page on cdn-backup.club. A secondary link hxxps://portallogin.live/portal/verify delivered DanaBot (SHA256: c1b01bbe5fa4559b573b46e417592c20d80674249eb799b59a1ce14670b62709). The malware was saved to /home/user/.config/taskhost.exe and established C2 with 10.253.164.39.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from confirm@credential-check.site and noreply@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxp://storageportal.info/assets/js/payload.js which hosted a credential harvesting page on data-storage.live. A secondary link hxxp://backup-update.tech/login delivered Play (SHA1: c49c939de808c898cb29e1c1639363cf2d0b31b4). The malware was saved to /dev/shm/ntds.dit and established C2 with 156.52.133.144.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from report@identity-verify.cc and noreply@document-share.link, spoofing legitimate services. Victims were directed to hxxp://mail-portal.io/login which hosted a credential harvesting page on gatewayauth.dev. A secondary link hxxps://proxy-mail.xyz/gate.php delivered PikaBot (SHA1: 6769423ece0aa4e1fd14dbb283784d8e5c903a70). The malware was saved to /opt/app/bin/beacon.dll and established C2 with 192.148.3.80.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from helpdesk@mail-service.info and verify@mail-service.info, spoofing legitimate services. Victims were directed to hxxps://secure-storage.xyz/admin/config which hosted a credential harvesting page on cdn-proxy.online. A secondary link http://proxy-static.tech/api/v2/auth delivered Qbot (SHA1: 08de67f0dca5ccf4ec6354b9a03c7b5bb584b087). The malware was saved to C:\Users\admin\Downloads\chrome_helper.exe and established C2 with 90.31.115.108.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from info@document-share.link and security@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://storage-static.club/collect which hosted a credential harvesting page on cloud-backup.club. A secondary link hxxp://node-proxy.xyz/gate.php delivered DarkSide (MD5: 2f6ea165cabc3934316a4c6fe05e300c). The malware was saved to /home/user/.config/backdoor.elf and established C2 with 74.0.138.127.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from contact@phishing-domain.com and updates@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxps://logindata.tech/login which hosted a credential harvesting page on edge-mail.net. A secondary link hxxps://gatewaystorage.net/gate.php delivered Amadey (SHA256: 97bba60e12117f78e983ce8af38ad03b1995022abc4e229ff59c65181c459dad). The malware was saved to C:\Users\admin\Downloads\dropper.ps1 and established C2 with 21.137.180.99.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from billing@mail-service.info and support@document-share.link, spoofing legitimate services. Victims were directed to hxxps://edge-mail.io/secure/token which hosted a credential harvesting page on syncsync.club. A secondary link hxxps://edgeapi.club/secure/token delivered Meduza Stealer (SHA1: 443143ac22eeffea929d6bde3795e4ac59c3c835). The malware was saved to /etc/cron.d/helper.sh and established C2 with 172.24.251.211.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from verify@phishing-domain.com and support@mail-service.info, spoofing legitimate services. Victims were directed to hxxps://cache-data.dev/assets/js/payload.js which hosted a credential harvesting page on static-edge.org. A secondary link https://storagebackup.net/login delivered DarkSide (SHA1: 187bdab14bd1bf0491d4057b7731c60d9dbe63e5). The malware was saved to C:\Windows\Temp\runtime.dll and established C2 with 101.82.20.62.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from account@auth-check.org and confirm@urgent-notice.online, spoofing legitimate services. Victims were directed to http://syncupdate.top/panel/index.html which hosted a credential harvesting page on apiportal.info. A secondary link hxxp://login-portal.tech/collect delivered XLoader (SHA1: 2adbaf41b1279bee9982c478c04f8fb651f2e80d). The malware was saved to /tmp/runtime.dll and established C2 with 172.213.67.52.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from support@login-portal.tech and report@credential-check.site, spoofing legitimate services. Victims were directed to hxxps://syncupdate.io/callback which hosted a credential harvesting page on cdn-auth.cc. A secondary link http://cdnnode.club/login delivered Meduza Stealer (SHA1: 508befdba746b9fe006b7f79d98f7487f5be54e8). The malware was saved to /home/user/.config/helper.sh and established C2 with 10.102.74.208.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from service@identity-verify.cc and alert@secure-verify.net, spoofing legitimate services. Victims were directed to https://edgesync.io/panel/index.html which hosted a credential harvesting page on auth-auth.cc. A secondary link http://storage-secure.link/wp-content/uploads/doc.php delivered Vidar (MD5: bd481a84ee73ed5abc4fbd563ef5217c). The malware was saved to C:\Windows\Tasks\config.dat and established C2 with 10.160.115.154.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from verify@phishing-domain.com and verify@credential-check.site, spoofing legitimate services. Victims were directed to http://mailsync.info/assets/js/payload.js which hosted a credential harvesting page on apibackup.site. A secondary link hxxp://edge-login.dev/api/v2/auth delivered IcedID (SHA1: 7f621723a29e0d15c417f54bb2bd88462fc1bcd5). The malware was saved to /opt/app/bin/helper.sh and established C2 with 108.248.198.105.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from noreply@identity-verify.cc and security@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://cacheportal.dev/secure/token which hosted a credential harvesting page on updatelogin.tech. A secondary link http://update-login.club/api/v2/auth delivered Qbot (SHA1: f51793f0bc44bb120513afff4ee929f19b53e40b). The malware was saved to C:\Windows\Tasks\svchost.exe and established C2 with 172.205.24.85.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from support@identity-verify.cc and helpdesk@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://portaldata.site/secure/token which hosted a credential harvesting page on syncupdate.cc. A secondary link hxxps://login-node.dev/admin/config delivered WarmCookie (SHA256: 274dc300477a778a4b5cd1bc463182742a326950ea36cfdc04a2576a1a610622). The malware was saved to C:\Windows\Temp\runtime.dll and established C2 with 192.60.84.16.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from helpdesk@phishing-domain.com and noreply@auth-check.org, spoofing legitimate services. Victims were directed to https://update-static.info/download/update.exe which hosted a credential harvesting page on dataauth.cc. A secondary link http://relay-mail.cc/assets/js/payload.js delivered DarkSide (SHA256: 8aab0c3d27847582657c5321b5e0d3716223b4df94098b5057f868683f5b88c5). The malware was saved to C:\Users\admin\AppData\Local\Temp\implant.so and established C2 with 12.68.237.90.


Phishing Campaign Report: INTERPOL identified a large-scale phishing operation. Emails originated from verify@mail-service.info and ceo@mail-service.info, spoofing legitimate services. Victims were directed to https://cachelogin.com/portal/verify which hosted a credential harvesting page on edge-auth.club. A secondary link hxxps://backupstorage.xyz/api/v2/auth delivered Latrodectus (MD5: 2075d2fab84cffd03fe5e5a2bb0ce530). The malware was saved to /etc/cron.d/csrss.exe and established C2 with 172.144.169.102.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from service@account-update.xyz and security@document-share.link, spoofing legitimate services. Victims were directed to http://loginauth.online/login which hosted a credential harvesting page on gateway-login.info. A secondary link hxxp://gatewayportal.com/callback delivered WarmCookie (SHA256: 10109649985d337bf5736221811e1c3278f8b3a1f553e9e34bd2ae7a6191c9da). The malware was saved to C:\Windows\Tasks\svchost.exe and established C2 with 115.78.215.231.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from service@phishing-domain.com and noreply@login-portal.tech, spoofing legitimate services. Victims were directed to https://apimail.io/login which hosted a credential harvesting page on dataapi.site. A secondary link hxxps://mail-cloud.top/api/v2/auth delivered Qbot (SHA256: 72305e3e0f1e2e8686764719606ff741bccd9e3ad888901fce81fe09fec26ef9). The malware was saved to /opt/app/bin/ntds.dit and established C2 with 172.225.31.96.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from noreply@account-update.xyz and hr@mail-service.info, spoofing legitimate services. Victims were directed to https://cloud-data.cc/portal/verify which hosted a credential harvesting page on cloudauth.top. A secondary link http://cachesync.com/portal/verify delivered RemcosRAT (MD5: e1479d5fb9e0d9d41d3a09bbcc229d60). The malware was saved to C:\Users\admin\AppData\Local\Temp\winlogon.exe and established C2 with 32.40.203.112.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from finance@identity-verify.cc and notification@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://storageportal.dev/panel/index.html which hosted a credential harvesting page on portaledge.com. A secondary link http://cloud-storage.club/portal/verify delivered RedLine Stealer (MD5: 7b9040f7ff5a8fcbc4a48b9539f67612). The malware was saved to C:\Users\admin\AppData\Local\Temp\config.dat and established C2 with 192.244.242.206.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from info@urgent-notice.online and hr@login-portal.tech, spoofing legitimate services. Victims were directed to hxxp://auth-cache.org/login which hosted a credential harvesting page on static-proxy.xyz. A secondary link hxxp://gatewayproxy.xyz/wp-content/uploads/doc.php delivered BlackCat (SHA1: 15529b78ea3a38033423a8fd154dbd12f25aed91). The malware was saved to C:\Users\admin\Desktop\agent.py and established C2 with 11.95.68.83.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from helpdesk@account-update.xyz and service@credential-check.site, spoofing legitimate services. Victims were directed to hxxp://staticcache.top/portal/verify which hosted a credential harvesting page on data-edge.live. A secondary link hxxp://relay-proxy.dev/collect delivered NjRAT (SHA256: 8bfcaa6393779a8c056eb9757bc2dfaeba635e96fa0ee3ac1bdb12cb318e72f6). The malware was saved to C:\Users\admin\AppData\Local\Temp\payload.bin and established C2 with 192.93.11.148.


Phishing Campaign Report: Symantec identified a large-scale phishing operation. Emails originated from alert@mail-service.info and admin@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://staticcloud.xyz/panel/index.html which hosted a credential harvesting page on static-cache.io. A secondary link https://backuplogin.xyz/gate.php delivered LockBit (SHA1: 4548cc09dd75d69ba426ac16da01ce91003d1253). The malware was saved to C:\Windows\Temp\beacon.dll and established C2 with 210.164.43.85.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from hr@auth-check.org and noreply@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxps://relay-storage.site/wp-content/uploads/doc.php which hosted a credential harvesting page on cloud-login.org. A secondary link http://auth-update.com/portal/verify delivered XLoader (SHA1: 37b545bcf9b8376a505942560e00bdf7247433b7). The malware was saved to C:\Windows\System32\payload.bin and established C2 with 116.239.239.56.


Phishing Campaign Report: Sophos X-Ops identified a large-scale phishing operation. Emails originated from billing@secure-verify.net and contact@urgent-notice.online, spoofing legitimate services. Victims were directed to https://portal-portal.dev/assets/js/payload.js which hosted a credential harvesting page on cdndata.site. A secondary link hxxp://updaterelay.com/panel/index.html delivered Cobalt Strike (SHA1: eb1d59803e56f48384a1f5cfb823b08a1e695e40). The malware was saved to /opt/app/bin/config.dat and established C2 with 35.147.43.187.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from support@credential-check.site and finance@phishing-domain.com, spoofing legitimate services. Victims were directed to http://proxy-sync.com/gate.php which hosted a credential harvesting page on mail-cache.dev. A secondary link http://nodesecure.site/callback delivered Emotet (MD5: 538e0ff29d6cf2856ca31fe8169e763b). The malware was saved to C:\Users\admin\Downloads\svchost.exe and established C2 with 10.207.97.207.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from account@auth-check.org and service@mail-service.info, spoofing legitimate services. Victims were directed to http://apibackup.cc/portal/verify which hosted a credential harvesting page on cache-cache.top. A secondary link hxxp://staticproxy.top/api/v2/auth delivered Qbot (SHA1: bbff937c6779ddc0bd9b611929153f6fe301f6f4). The malware was saved to /usr/local/bin/implant.so and established C2 with 172.218.17.151.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from report@auth-check.org and ceo@phishing-domain.com, spoofing legitimate services. Victims were directed to http://staticcloud.org/callback which hosted a credential harvesting page on portalauth.org. A secondary link hxxp://cloudlogin.org/collect delivered Ryuk (SHA1: 3385a62a95e9854d360bbcd0cd7b30f5ed7673ba). The malware was saved to C:\ProgramData\taskhost.exe and established C2 with 158.147.173.59.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from hr@phishing-domain.com and admin@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://relay-gateway.club/download/update.exe which hosted a credential harvesting page on securesecure.tech. A secondary link https://cache-node.club/gate.php delivered Vidar (MD5: 2531025e366c96da685e058bf681502a). The malware was saved to /dev/shm/chrome_helper.exe and established C2 with 10.104.230.135.


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from confirm@credential-check.site and support@auth-check.org, spoofing legitimate services. Victims were directed to hxxps://apiportal.io/callback which hosted a credential harvesting page on relaycache.cc. A secondary link https://cloud-sync.cc/callback delivered WarmCookie (MD5: ec8c039bc0befc1dc510b83101b923fe). The malware was saved to C:\Users\admin\Desktop\svchost.exe and established C2 with 132.219.227.160.


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from hr@document-share.link and service@login-portal.tech, spoofing legitimate services. Victims were directed to http://update-static.live/download/update.exe which hosted a credential harvesting page on gateway-api.site. A secondary link hxxps://portal-auth.com/collect delivered Vidar (SHA256: ab0f4d1f456f257fe6dce53c120f65d48393c9fdd6aebee8f6b191a6009ca746). The malware was saved to C:\Users\Public\Documents\ntds.dit and established C2 with 92.163.230.176.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from account@identity-verify.cc and hr@auth-check.org, spoofing legitimate services. Victims were directed to https://nodeportal.tech/secure/token which hosted a credential harvesting page on syncupdate.com. A secondary link https://mailauth.org/gate.php delivered QakBot (SHA1: 7e72cbec80af605c8a0b409f87fce46eaedc1052). The malware was saved to C:\Windows\Tasks\winlogon.exe and established C2 with 207.67.149.175.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from support@auth-check.org and info@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxps://mailsync.tech/download/update.exe which hosted a credential harvesting page on backupupdate.org. A secondary link hxxps://sync-backup.info/panel/index.html delivered Hive (SHA1: 6be675b404f934eb4372c1c4b5c503471d73e6e8). The malware was saved to C:\Program Files\Common Files\dropper.ps1 and established C2 with 5.119.162.211.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from verify@phishing-domain.com and info@credential-check.site, spoofing legitimate services. Victims were directed to hxxps://data-gateway.xyz/collect which hosted a credential harvesting page on cdnsecure.com. A secondary link hxxp://synclogin.dev/panel/index.html delivered NjRAT (SHA256: dc8a96d9a6eeabe205cd7debc6d993a27b6863d7012ac2a1f29b86d4e455252a). The malware was saved to /var/tmp/svchost.exe and established C2 with 192.35.108.69.


Phishing Campaign Report: INTERPOL identified a large-scale phishing operation. Emails originated from notification@phishing-domain.com and notification@identity-verify.cc, spoofing legitimate services. Victims were directed to http://static-proxy.cc/collect which hosted a credential harvesting page on authcloud.tech. A secondary link hxxp://loginsync.tech/panel/index.html delivered Raccoon Stealer (MD5: a00c4e02ef68d7b0ebcf23063a138afc). The malware was saved to C:\Windows\Temp\agent.py and established C2 with 11.237.104.91.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from service@credential-check.site and finance@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://cache-storage.online/collect which hosted a credential harvesting page on updatesecure.club. A secondary link hxxps://updatestorage.cc/download/update.exe delivered Meduza Stealer (MD5: 808d7052d24678ca57e929a42e426409). The malware was saved to C:\Windows\System32\update.dll and established C2 with 10.181.71.86.


Phishing Campaign Report: INTERPOL identified a large-scale phishing operation. Emails originated from account@mail-service.info and report@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://cloudbackup.org/wp-content/uploads/doc.php which hosted a credential harvesting page on edgegateway.online. A secondary link http://cache-relay.top/gate.php delivered RedLine Stealer (MD5: 3c5a69d7d426552b0b7e8bafa7fdc25d). The malware was saved to C:\Users\Public\Documents\agent.py and established C2 with 192.217.136.233.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from account@account-update.xyz and billing@phishing-domain.com, spoofing legitimate services. Victims were directed to http://static-storage.link/assets/js/payload.js which hosted a credential harvesting page on secure-gateway.com. A secondary link hxxp://authcache.site/wp-content/uploads/doc.php delivered RedLine Stealer (SHA1: db2ed39947ee3f6d6425528b1f58be0edd8fcaec). The malware was saved to C:\Users\admin\Desktop\implant.so and established C2 with 43.235.215.215.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from verify@mail-service.info and account@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://relay-cloud.club/callback which hosted a credential harvesting page on node-api.online. A secondary link hxxps://securecache.xyz/secure/token delivered WarmCookie (SHA256: dcaab862c474b782cecaba7df67958c94366c06a7a0b97718669bd903263a3de). The malware was saved to /home/user/.config/payload.bin and established C2 with 211.185.174.145.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from finance@identity-verify.cc and report@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://gateway-login.xyz/gate.php which hosted a credential harvesting page on login-secure.xyz. A secondary link http://data-proxy.net/collect delivered Amadey (SHA1: 76147d4b47f9c7f9bbdf60c08be95505eb9f195c). The malware was saved to C:\Users\admin\AppData\Local\Temp\update.dll and established C2 with 81.139.229.15.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from confirm@mail-service.info and updates@credential-check.site, spoofing legitimate services. Victims were directed to http://syncapi.top/callback which hosted a credential harvesting page on relay-cloud.online. A secondary link hxxps://storagestorage.xyz/panel/index.html delivered BatLoader (MD5: d7b1ef2bdf7c2d26e17c37cab5a41de6). The malware was saved to C:\ProgramData\winlogon.exe and established C2 with 155.29.154.95.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from account@document-share.link and service@account-update.xyz, spoofing legitimate services. Victims were directed to https://edgecloud.io/panel/index.html which hosted a credential harvesting page on proxy-portal.net. A secondary link hxxps://gatewaycloud.io/download/update.exe delivered LockBit (SHA1: 9e05889736c6a9d90ec384cd3906717ec7dee7aa). The malware was saved to C:\Users\admin\Desktop\taskhost.exe and established C2 with 10.14.170.189.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from info@urgent-notice.online and confirm@secure-verify.net, spoofing legitimate services. Victims were directed to http://cache-edge.io/admin/config which hosted a credential harvesting page on updateportal.site. A secondary link hxxps://node-login.live/admin/config delivered StealC (SHA256: 53a02c04fef8201bbb88751feebd113413eb5ed0f7860496a44b3b860373086a). The malware was saved to C:\Users\admin\AppData\Local\Temp\sam.hive and established C2 with 10.246.75.151.


Phishing Campaign Report: CISA identified a large-scale phishing operation. Emails originated from confirm@account-update.xyz and service@urgent-notice.online, spoofing legitimate services. Victims were directed to http://data-sync.dev/admin/config which hosted a credential harvesting page on cdngateway.online. A secondary link hxxps://staticrelay.dev/wp-content/uploads/doc.php delivered RemcosRAT (SHA1: 8f774aa2a62b2dc5c7310e53bb4f37b949716ae0). The malware was saved to C:\Program Files\Common Files\loader.exe and established C2 with 10.173.181.177.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from updates@phishing-domain.com and verify@credential-check.site, spoofing legitimate services. Victims were directed to hxxp://auth-secure.live/api/v2/auth which hosted a credential harvesting page on relaycdn.tech. A secondary link hxxps://storagestorage.top/admin/config delivered BlackCat (SHA256: 490fccf478db0a983fec83e704a42275e8b2b148ec8076ba03b12ced6f47ec7a). The malware was saved to /dev/shm/implant.so and established C2 with 192.140.143.68.


Phishing Campaign Report: CISA identified a large-scale phishing operation. Emails originated from support@mail-service.info and it@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxps://auth-api.info/portal/verify which hosted a credential harvesting page on cdncloud.site. A secondary link hxxp://cdnauth.link/wp-content/uploads/doc.php delivered WarmCookie (SHA256: 2c100c4df22c160a3df1154b49d52d102c8db4d9897cd2778ba0a647ed14d2b5). The malware was saved to /opt/app/bin/lsass.dmp and established C2 with 192.19.224.225.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from updates@document-share.link and updates@urgent-notice.online, spoofing legitimate services. Victims were directed to https://login-data.top/admin/config which hosted a credential harvesting page on proxycache.link. A secondary link https://mailgateway.io/portal/verify delivered Gootloader (SHA256: 1435898cb7c23425eb14eb401ef1d006e4729337072d75ca97845245fef22440). The malware was saved to C:\Program Files\Common Files\ntds.dit and established C2 with 209.11.33.111.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from billing@account-update.xyz and report@auth-check.org, spoofing legitimate services. Victims were directed to hxxp://cloudproxy.io/api/v2/auth which hosted a credential harvesting page on static-login.top. A secondary link http://cacheproxy.tech/assets/js/payload.js delivered PlugX (SHA256: e741864efbd22d1ff7fd24c1997cc7188f4747a6e8a05adb52ab40531afcba8c). The malware was saved to C:\Users\admin\Desktop\dropper.ps1 and established C2 with 192.19.69.145.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from info@auth-check.org and confirm@auth-check.org, spoofing legitimate services. Victims were directed to hxxp://securedata.xyz/portal/verify which hosted a credential harvesting page on edgedata.cc. A secondary link https://portal-mail.net/admin/config delivered XLoader (MD5: b727f7e3ac3ad1429b27f83bc4d22aeb). The malware was saved to C:\Windows\Temp\sam.hive and established C2 with 172.149.196.217.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from verify@mail-service.info and service@account-update.xyz, spoofing legitimate services. Victims were directed to https://mail-cache.tech/admin/config which hosted a credential harvesting page on relay-update.tech. A secondary link hxxps://proxy-sync.club/callback delivered Emotet (SHA256: baf1bff803b873742f9e967a991e568e220ee06f96701283b1b05ba2f073641f). The malware was saved to C:\ProgramData\loader.exe and established C2 with 172.36.146.229.


Phishing Campaign Report: Trend Micro identified a large-scale phishing operation. Emails originated from alert@login-portal.tech and finance@mail-service.info, spoofing legitimate services. Victims were directed to https://portalcdn.club/panel/index.html which hosted a credential harvesting page on cache-login.io. A secondary link hxxps://proxy-relay.info/assets/js/payload.js delivered Vidar (SHA1: db1be04fd0e8aca6b47de7b2183e277dd1376c9b). The malware was saved to /var/tmp/runtime.dll and established C2 with 10.217.178.249.


Phishing Campaign Report: Sophos X-Ops identified a large-scale phishing operation. Emails originated from admin@document-share.link and notification@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://auth-edge.dev/callback which hosted a credential harvesting page on gatewayapi.com. A secondary link http://relayrelay.net/callback delivered BlackCat (SHA1: fc7a98ac71a83bff54b4cdedbbe647e9fc615c69). The malware was saved to C:\Users\admin\Desktop\helper.sh and established C2 with 45.16.68.204.


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from noreply@account-update.xyz and helpdesk@mail-service.info, spoofing legitimate services. Victims were directed to http://api-cloud.club/callback which hosted a credential harvesting page on relaystatic.net. A secondary link hxxps://gateway-proxy.tech/api/v2/auth delivered RemcosRAT (SHA1: c4f6e30755df1d8787f4dd0b9495fbe5dd3cf43a). The malware was saved to /home/user/.config/backdoor.elf and established C2 with 31.140.150.7.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from report@account-update.xyz and billing@login-portal.tech, spoofing legitimate services. Victims were directed to http://apirelay.info/secure/token which hosted a credential harvesting page on edge-portal.xyz. A secondary link http://backuplogin.live/login delivered Qbot (SHA256: da2e3d0c8d304194d39c9aa3b1ca09580e54e3029bdab02c77cb7946e22ab787). The malware was saved to C:\Users\admin\Desktop\runtime.dll and established C2 with 192.182.195.229.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from report@auth-check.org and it@document-share.link, spoofing legitimate services. Victims were directed to http://secure-proxy.top/callback which hosted a credential harvesting page on edge-storage.com. A secondary link hxxps://apibackup.cc/login delivered DarkSide (MD5: d64ed40267123be39effbb6c2df5785e). The malware was saved to /opt/app/bin/chrome_helper.exe and established C2 with 172.147.130.225.


Phishing Campaign Report: Trend Micro identified a large-scale phishing operation. Emails originated from confirm@identity-verify.cc and verify@account-update.xyz, spoofing legitimate services. Victims were directed to hxxps://edge-edge.xyz/portal/verify which hosted a credential harvesting page on portalapi.tech. A secondary link https://datadata.net/secure/token delivered Amadey (SHA1: 00ab48377441deb58f00bfeae146bfa9141527b9). The malware was saved to /tmp/payload.bin and established C2 with 24.58.133.179.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from notification@credential-check.site and account@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxps://cachestorage.xyz/download/update.exe which hosted a credential harvesting page on relay-proxy.top. A secondary link https://backup-update.cc/portal/verify delivered XLoader (SHA256: e931163920495328018a48bbf3d841bec1c0d113779fe165d0adb3df45187fc1). The malware was saved to /tmp/update.dll and established C2 with 129.26.30.26.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from confirm@credential-check.site and helpdesk@secure-verify.net, spoofing legitimate services. Victims were directed to https://cloudcache.net/api/v2/auth which hosted a credential harvesting page on secureauth.link. A secondary link http://sync-data.site/panel/index.html delivered Emotet (SHA1: 079a229d284d628f6d19fde5552704f93b3d3c0e). The malware was saved to C:\ProgramData\dropper.ps1 and established C2 with 25.23.207.162.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from account@auth-check.org and contact@mail-service.info, spoofing legitimate services. Victims were directed to hxxps://storage-relay.live/callback which hosted a credential harvesting page on mail-sync.org. A secondary link hxxp://login-gateway.live/wp-content/uploads/doc.php delivered Hive (MD5: 3a47630010104e4b3786ee2b8d6f26d1). The malware was saved to C:\Users\admin\AppData\Local\Temp\update.dll and established C2 with 10.27.94.246.


Phishing Campaign Report: Sophos X-Ops identified a large-scale phishing operation. Emails originated from account@identity-verify.cc and ceo@auth-check.org, spoofing legitimate services. Victims were directed to https://storage-login.org/assets/js/payload.js which hosted a credential harvesting page on gatewayproxy.com. A secondary link hxxp://auth-backup.link/login delivered Ryuk (SHA256: 829548717eac38897bea47900c502c63545b0780a21815bb08ca3232e56a72d5). The malware was saved to /usr/local/bin/winlogon.exe and established C2 with 10.48.205.109.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from helpdesk@login-portal.tech and account@account-update.xyz, spoofing legitimate services. Victims were directed to hxxps://login-login.info/login which hosted a credential harvesting page on cdn-mail.site. A secondary link hxxp://datacache.org/admin/config delivered BlackCat (SHA256: 5fea0499e94cdcafd3ca229afda628f5eb42f515a3ce70caf95e816442ab66c6). The malware was saved to C:\Users\Public\Documents\implant.so and established C2 with 10.58.106.66.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from confirm@mail-service.info and billing@login-portal.tech, spoofing legitimate services. Victims were directed to hxxp://cloud-data.top/secure/token which hosted a credential harvesting page on static-sync.tech. A secondary link hxxp://node-portal.net/download/update.exe delivered FormBook (MD5: 410cdd0ebbbe8086c372d4033dcca27d). The malware was saved to /opt/app/bin/payload.bin and established C2 with 172.95.204.77.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from finance@document-share.link and updates@identity-verify.cc, spoofing legitimate services. Victims were directed to http://secure-sync.cc/callback which hosted a credential harvesting page on datagateway.link. A secondary link hxxps://sync-secure.club/assets/js/payload.js delivered ShadowPad (SHA1: 699f3b0ef61a6ca7500802942deb399f836b4292). The malware was saved to /dev/shm/helper.sh and established C2 with 170.184.90.160.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from verify@login-portal.tech and it@identity-verify.cc, spoofing legitimate services. Victims were directed to http://storage-secure.site/secure/token which hosted a credential harvesting page on mail-data.live. A secondary link http://cacheapi.info/callback delivered BatLoader (SHA1: 0ff53d6457b88090ff44d02d4bf1a9c26170010d). The malware was saved to C:\Program Files\Common Files\ntds.dit and established C2 with 27.136.242.201.


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from it@login-portal.tech and helpdesk@identity-verify.cc, spoofing legitimate services. Victims were directed to http://securebackup.dev/portal/verify which hosted a credential harvesting page on edge-cache.club. A secondary link hxxp://gatewaystorage.top/secure/token delivered FormBook (SHA1: 3a9af2d26d0ab2db5d2eaeb9985df6ea912a402a). The malware was saved to /opt/app/bin/helper.sh and established C2 with 172.103.198.127.


Phishing Campaign Report: Sophos X-Ops identified a large-scale phishing operation. Emails originated from notification@account-update.xyz and finance@secure-verify.net, spoofing legitimate services. Victims were directed to http://proxyapi.org/admin/config which hosted a credential harvesting page on cloudbackup.site. A secondary link hxxp://cloudedge.dev/secure/token delivered Latrodectus (SHA1: 4afb1ff32cdceffc710023df543123f9e22cd3ab). The malware was saved to C:\Program Files\Common Files\helper.sh and established C2 with 172.51.201.188.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from confirm@account-update.xyz and finance@document-share.link, spoofing legitimate services. Victims were directed to hxxps://cachedata.cc/callback which hosted a credential harvesting page on nodecloud.club. A secondary link hxxps://mail-data.top/api/v2/auth delivered ShadowPad (SHA256: 85cc003f56ae70bca4bd18b039f25c7b4e2f3a739a651567d33e972e033958be). The malware was saved to /var/tmp/svchost.exe and established C2 with 207.106.242.34.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from service@phishing-domain.com and verify@account-update.xyz, spoofing legitimate services. Victims were directed to http://auth-sync.io/gate.php which hosted a credential harvesting page on auth-login.net. A secondary link https://edge-login.site/collect delivered Gootloader (SHA256: 903cc5c2686e430681a8ddd1a0a178423db0bd5c00c5358e603e45e389f42927). The malware was saved to /home/user/.config/sam.hive and established C2 with 48.165.142.215.


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from noreply@document-share.link and security@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://mailportal.xyz/collect which hosted a credential harvesting page on portal-cache.info. A secondary link https://relay-login.club/login delivered BatLoader (SHA1: 37016389bc9dd797a72b0787b04dd66f911baafe). The malware was saved to C:\ProgramData\taskhost.exe and established C2 with 192.211.196.184.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from finance@document-share.link and updates@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://relayupdate.site/wp-content/uploads/doc.php which hosted a credential harvesting page on authsecure.tech. A secondary link hxxps://datastatic.net/api/v2/auth delivered DanaBot (SHA256: ac0597e1ec1ba0dfb23796937775a3f8279032cbb4ec407189f2320476a0cdb4). The malware was saved to C:\Users\admin\Desktop\helper.sh and established C2 with 188.17.41.50.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from helpdesk@login-portal.tech and hr@mail-service.info, spoofing legitimate services. Victims were directed to http://proxy-gateway.live/admin/config which hosted a credential harvesting page on cache-edge.link. A secondary link hxxps://sync-edge.link/portal/verify delivered SmokeLoader (SHA1: 1b4eb2b900cad4fb2c93bdcc384404a5f4be4042). The malware was saved to C:\Users\admin\AppData\Local\Temp\chrome_helper.exe and established C2 with 127.110.19.19.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from hr@urgent-notice.online and info@secure-verify.net, spoofing legitimate services. Victims were directed to hxxps://updatebackup.cc/login which hosted a credential harvesting page on gatewayauth.site. A secondary link hxxps://backup-secure.dev/download/update.exe delivered WarmCookie (SHA1: 26eb6494b7554fd3474d2dd0c0a0c4a1077f500c). The malware was saved to C:\ProgramData\implant.so and established C2 with 10.149.73.32.


Phishing Campaign Report: Palo Alto Unit 42 identified a large-scale phishing operation. Emails originated from billing@mail-service.info and account@auth-check.org, spoofing legitimate services. Victims were directed to hxxp://edgesync.dev/login which hosted a credential harvesting page on cacheauth.online. A secondary link http://storage-cloud.net/login delivered Lumma Stealer (SHA256: 41cd57465a0984388d4d2dc26fa60ec8d70bdbdda8d7eb4dc412c6700392aa9a). The malware was saved to C:\Users\admin\Desktop\update.dll and established C2 with 172.246.50.219.


Phishing Campaign Report: Tenable identified a large-scale phishing operation. Emails originated from info@credential-check.site and alert@login-portal.tech, spoofing legitimate services. Victims were directed to https://auth-cache.top/login which hosted a credential harvesting page on backup-api.net. A secondary link hxxps://backup-relay.top/download/update.exe delivered BlackCat (SHA1: 3842fdc616d56430f15a3ba446b0f4041b4512c3). The malware was saved to C:\Windows\Tasks\agent.py and established C2 with 35.248.38.198.


Phishing Campaign Report: Palo Alto Unit 42 identified a large-scale phishing operation. Emails originated from report@login-portal.tech and contact@credential-check.site, spoofing legitimate services. Victims were directed to http://proxyportal.info/wp-content/uploads/doc.php which hosted a credential harvesting page on backupstatic.net. A secondary link hxxps://data-edge.link/login delivered Raccoon Stealer (SHA1: 0da7d0bb03dcc45315122234294df2a529b817e6). The malware was saved to /home/user/.config/config.dat and established C2 with 192.77.60.90.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from finance@phishing-domain.com and info@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://storage-cloud.tech/callback which hosted a credential harvesting page on mailstorage.org. A secondary link http://secureportal.net/panel/index.html delivered RemcosRAT (SHA1: 6bae7eabf5d21713d633433fb38ce2cb2ba4fee2). The malware was saved to /dev/shm/agent.py and established C2 with 10.71.186.73.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from verify@secure-verify.net and updates@document-share.link, spoofing legitimate services. Victims were directed to https://nodenode.dev/callback which hosted a credential harvesting page on mail-auth.cc. A secondary link hxxp://staticbackup.io/login delivered NjRAT (MD5: 6d1e68fa3ee0151d3fa89edf70d32b46). The malware was saved to /etc/cron.d/lsass.dmp and established C2 with 172.186.151.227.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from noreply@account-update.xyz and updates@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://loginportal.site/admin/config which hosted a credential harvesting page on proxy-update.top. A secondary link https://portalmail.com/callback delivered Cobalt Strike (MD5: 3273f400313a6299159989ed01de5273). The malware was saved to /usr/local/bin/taskhost.exe and established C2 with 10.193.215.221.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from security@mail-service.info and support@urgent-notice.online, spoofing legitimate services. Victims were directed to http://authupdate.com/callback which hosted a credential harvesting page on update-proxy.site. A secondary link hxxp://sync-auth.online/panel/index.html delivered REvil (SHA1: 9633da31b19ec76f18d124399586c498eebf6977). The malware was saved to C:\Users\Public\Documents\taskhost.exe and established C2 with 223.82.71.59.


Phishing Campaign Report: Trend Micro identified a large-scale phishing operation. Emails originated from noreply@urgent-notice.online and noreply@account-update.xyz, spoofing legitimate services. Victims were directed to hxxps://edge-login.info/panel/index.html which hosted a credential harvesting page on mail-static.cc. A secondary link hxxp://proxystorage.live/panel/index.html delivered StealC (SHA256: 53c4028ac2d0840150553f219aa90cc910ce2dca5ab9808c62fb497972d3fdbe). The malware was saved to C:\Windows\Temp\backdoor.elf and established C2 with 10.137.231.155.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from alert@login-portal.tech and it@secure-verify.net, spoofing legitimate services. Victims were directed to hxxps://data-mail.top/secure/token which hosted a credential harvesting page on update-gateway.info. A secondary link hxxp://storage-relay.dev/download/update.exe delivered Conti (SHA1: aee34fba81237601b8e27c58f209937a4c5f013e). The malware was saved to /etc/cron.d/beacon.dll and established C2 with 192.237.123.8.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from noreply@urgent-notice.online and admin@secure-verify.net, spoofing legitimate services. Victims were directed to https://backup-auth.cc/assets/js/payload.js which hosted a credential harvesting page on sync-backup.online. A secondary link https://databackup.net/download/update.exe delivered Latrodectus (MD5: 0f175b09deb346d508073b6526611520). The malware was saved to /home/user/.config/payload.bin and established C2 with 10.43.114.6.


Phishing Campaign Report: Sophos X-Ops identified a large-scale phishing operation. Emails originated from service@login-portal.tech and it@credential-check.site, spoofing legitimate services. Victims were directed to hxxps://data-relay.io/admin/config which hosted a credential harvesting page on portal-static.cc. A secondary link http://auth-data.live/portal/verify delivered Emotet (MD5: 501f0f78502de88dd125e7807cd8bf7f). The malware was saved to /opt/app/bin/csrss.exe and established C2 with 201.190.156.179.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from admin@urgent-notice.online and hr@account-update.xyz, spoofing legitimate services. Victims were directed to hxxps://gateway-static.site/assets/js/payload.js which hosted a credential harvesting page on apicdn.site. A secondary link http://maillogin.io/login delivered NjRAT (MD5: 91a21c7677d6b5248d14c821a5149544). The malware was saved to /var/tmp/helper.sh and established C2 with 194.139.190.114.


Phishing Campaign Report: Cisco Talos identified a large-scale phishing operation. Emails originated from support@secure-verify.net and service@auth-check.org, spoofing legitimate services. Victims were directed to hxxp://relay-gateway.net/callback which hosted a credential harvesting page on dataupdate.io. A secondary link hxxps://backup-cache.dev/download/update.exe delivered SystemBC (MD5: 51fa0a9da6d7d70513e19ada91799be1). The malware was saved to C:\Users\admin\Desktop\implant.so and established C2 with 192.203.151.69.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from finance@credential-check.site and verify@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://updateedge.info/wp-content/uploads/doc.php which hosted a credential harvesting page on cdn-sync.net. A secondary link https://sync-secure.xyz/panel/index.html delivered ShadowPad (SHA256: ee189d531cf1659610508af2b64eaca170c0d433c61be9309b43eecd3aa66773). The malware was saved to /home/user/.config/taskhost.exe and established C2 with 88.126.203.154.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from alert@auth-check.org and confirm@auth-check.org, spoofing legitimate services. Victims were directed to hxxps://relaybackup.live/callback which hosted a credential harvesting page on sync-secure.tech. A secondary link http://proxy-cache.link/login delivered PlugX (SHA256: cd9c75b65c86f18891bc0f12ac4f02a454f340c4890c480f7d602f4304ff838b). The malware was saved to /tmp/helper.sh and established C2 with 192.173.149.92.


Phishing Campaign Report: Trend Micro identified a large-scale phishing operation. Emails originated from security@login-portal.tech and info@auth-check.org, spoofing legitimate services. Victims were directed to hxxps://node-portal.xyz/portal/verify which hosted a credential harvesting page on relay-secure.net. A secondary link http://login-static.site/download/update.exe delivered Qbot (SHA256: d0dbafc37815c0644146d82d7a9e8455033bcbe7240e163655b39386d2d70c01). The malware was saved to C:\Windows\System32\payload.bin and established C2 with 172.44.208.119.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from confirm@account-update.xyz and alert@auth-check.org, spoofing legitimate services. Victims were directed to http://cache-secure.dev/callback which hosted a credential harvesting page on cdncloud.net. A secondary link hxxp://proxy-update.site/download/update.exe delivered Play (SHA256: e8f1fb5a2924602e7ee92872875651fa2afbac836c2e5695e0332bccc89f33cf). The malware was saved to C:\Users\admin\AppData\Local\Temp\agent.py and established C2 with 2.94.77.12.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from contact@secure-verify.net and notification@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxp://cache-data.top/wp-content/uploads/doc.php which hosted a credential harvesting page on update-cdn.top. A secondary link http://staticdata.online/api/v2/auth delivered TrickBot (SHA1: da19731fc62ca8252e4030763703b95e95e322f5). The malware was saved to /opt/app/bin/ntds.dit and established C2 with 172.74.94.216.


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from ceo@identity-verify.cc and hr@credential-check.site, spoofing legitimate services. Victims were directed to https://node-mail.tech/login which hosted a credential harvesting page on backup-mail.club. A secondary link hxxp://cachestatic.link/wp-content/uploads/doc.php delivered Royal (SHA1: c5a5a2edfbc4a88bc9961ab208d50cfd177204b1). The malware was saved to /var/tmp/chrome_helper.exe and established C2 with 167.239.238.235.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from confirm@secure-verify.net and finance@auth-check.org, spoofing legitimate services. Victims were directed to https://backuprelay.club/wp-content/uploads/doc.php which hosted a credential harvesting page on static-auth.dev. A secondary link https://updateauth.cc/secure/token delivered Dridex (MD5: 16980bdfc57b526c6c1fabe7989f8be5). The malware was saved to /dev/shm/ntds.dit and established C2 with 183.219.174.15.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from it@account-update.xyz and verify@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://login-update.link/panel/index.html which hosted a credential harvesting page on static-cdn.org. A secondary link hxxps://storage-proxy.io/callback delivered BlackCat (SHA256: 99a1d7b56b6b85a6440d0248899417fedc29587d536852ccb51e80438f414dd7). The malware was saved to C:\Users\Public\Documents\lsass.dmp and established C2 with 161.226.12.99.


Phishing Campaign Report: FireEye identified a large-scale phishing operation. Emails originated from verify@identity-verify.cc and billing@auth-check.org, spoofing legitimate services. Victims were directed to http://login-login.xyz/api/v2/auth which hosted a credential harvesting page on nodemail.site. A secondary link hxxp://cachelogin.net/callback delivered Play (MD5: 425e24094401e14206278cbb700a0ec1). The malware was saved to C:\ProgramData\chrome_helper.exe and established C2 with 217.77.159.50.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from admin@phishing-domain.com and admin@login-portal.tech, spoofing legitimate services. Victims were directed to hxxp://storagedata.cc/wp-content/uploads/doc.php which hosted a credential harvesting page on portalstatic.xyz. A secondary link http://cloud-login.info/secure/token delivered BlackCat (SHA1: 1cd29059ab76b35abded8eed46a594e34d7d5551). The malware was saved to /usr/local/bin/taskhost.exe and established C2 with 169.103.254.106.


Phishing Campaign Report: CISA identified a large-scale phishing operation. Emails originated from ceo@document-share.link and info@auth-check.org, spoofing legitimate services. Victims were directed to hxxps://node-login.com/api/v2/auth which hosted a credential harvesting page on portalbackup.org. A secondary link https://updateportal.link/download/update.exe delivered XLoader (SHA256: ad0ab656282ea249f677ddab054edf586785a706d2df6f1c7630afd05c2101c2). The malware was saved to /etc/cron.d/chrome_helper.exe and established C2 with 172.93.143.81.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from it@login-portal.tech and helpdesk@credential-check.site, spoofing legitimate services. Victims were directed to http://portalstorage.dev/collect which hosted a credential harvesting page on cachegateway.org. A secondary link http://gatewaysync.io/panel/index.html delivered REvil (SHA1: 31ebd72bfe664c2b4292d3e567df120b35f5bad1). The malware was saved to /home/user/.config/csrss.exe and established C2 with 10.157.208.161.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from noreply@auth-check.org and admin@identity-verify.cc, spoofing legitimate services. Victims were directed to http://cache-gateway.tech/panel/index.html which hosted a credential harvesting page on relay-gateway.club. A secondary link hxxps://authlogin.live/callback delivered Qbot (SHA1: 4c02f5b3ffc1bf4a77f2461f6a7e7e454e6a340d). The malware was saved to /var/tmp/winlogon.exe and established C2 with 192.225.110.66.


Phishing Campaign Report: CISA identified a large-scale phishing operation. Emails originated from hr@account-update.xyz and info@account-update.xyz, spoofing legitimate services. Victims were directed to https://backup-gateway.live/login which hosted a credential harvesting page on backup-mail.online. A secondary link http://login-cloud.info/gate.php delivered DanaBot (SHA256: 079f62b2289cbb1948ff1f5449a7cfe122ff952c353ccc1202b8d3833e7aa20d). The malware was saved to /etc/cron.d/taskhost.exe and established C2 with 179.26.234.7.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from billing@login-portal.tech and report@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://api-backup.online/wp-content/uploads/doc.php which hosted a credential harvesting page on storageapi.club. A secondary link hxxps://relay-login.club/collect delivered Vidar (MD5: 8bed84c16529363b442c0a57cc2c62a9). The malware was saved to C:\Windows\Tasks\svchost.exe and established C2 with 51.208.112.172.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from noreply@urgent-notice.online and contact@login-portal.tech, spoofing legitimate services. Victims were directed to hxxp://auth-api.org/login which hosted a credential harvesting page on syncedge.xyz. A secondary link https://node-backup.io/download/update.exe delivered Royal (SHA256: 6d635fba6e397117af24e06070e0256cb9b8a201437c7b5216e5afcdc4cb2a5c). The malware was saved to C:\Program Files\Common Files\sam.hive and established C2 with 6.85.207.128.