Netcrook
#Credential Harvesting
Insurance Phishing Has Learned to Move at the Speed of a Login
CTM360-linked research points to a shift from delayed credential theft to real-time account hijacking, a change that shrinks the defender’s window from hours to seconds.
Portuguese Language, Criminal Precision: Why a Brazilian Banking Trojan Fits Portugal So Well
A banking trojan moving through Portugal highlights a familiar fraud tactic: attackers often win by matching the victim's language, not just their code.
The AI Control Plane Just Became Botnet Terrain
A Go-written malware operation reported to use 20+ RCE vectors shows how quickly AI connectors and MCP-style services can become a practical target for automation.
When a Mac Stealer Learns Your Secrets, the Crypto Raid Can Happen Later
A macOS-focused information stealer detected by MistEye is reported to collect wallet databases, Keychain material, browser data, and Apple Notes, then use those fragments for offline cryptocurrency theft attempts.
Trust-Path Phishing: Kratos Turns Microsoft 365 Sharing Into a Credential Trap
A subscription phishing kit is using familiar cloud-sharing patterns and bot checks to steer Microsoft 365 users toward fake sign-in pages.
Fake Security Alerts Turn Password Trust Into a Phishing Trap
A campaign using spoofed security notices against LastPass and Bitwarden users shows how attackers can weaponize the very language of account protection to lure victims onto fraudulent websites.
Fake Microsoft Sign-In Pages Turn a Phone Call into an Identity Trap
A vishing campaign is steering Microsoft 365 users toward counterfeit Microsoft Entra ID login pages, showing how social engineering now targets the identity layer itself.
When Ransomware Borrows the Admin Desk: PsExec, Password Stores, and the Quiet Road to Encryption
A GodDamn ransomware incident highlights a familiar but dangerous pattern: legitimate Windows tooling, credential harvesting, and rapid internal spread.
The Phishing Page That Waited to Wake Up
A ghost-phishing campaign is reportedly hiding malicious pages until they decrypt inside the browser, a trick that can leave traditional email and URL checks staring at an empty frame.
When a Firewall Login Becomes the Front Door for Ransomware
A credential-harvesting campaign tied to FortiGate access puts a spotlight on how stolen perimeter logins can move from IT inconvenience to industrial extortion risk.
Kratos Phishing Grows Harder to Spot as Operators Refine the Login Trap
A newer Kratos PhaaS flow is drawing attention because it appears designed to look more like routine sign-in friction while reducing the cues defenders normally use to triage phishing.
Hiring Lure, Hidden Hop: Gmail Phishing Is Smuggling Trust Through Redirect Chains
A targeted credential-phishing run is blending recruiter impersonation with layered redirects, turning ordinary job-seeker behavior into a trap for Google accounts.
2.3 Million Emails, One Extortion Playbook: Why This Breach Matters Beyond the Inbox
A confirmed data breach at Moody Bible Institute shows how a large email exposure can become a launchpad for phishing, impersonation, and leak-driven pressure.
When Firewall Logins Become Ransomware Fuel
A credential-harvesting campaign tied to FortiGate devices shows how edge access can be repurposed into a ransomware foothold, even without a flashy new exploit.
When Firewall Logins Become Ransomware Fuel
A reported FortiGate credential-harvesting campaign tied to INC Ransom and Lynx shows how edge access can matter more to criminals than a new exploit.
When Firewall Credentials Become Extortion Fuel
A FortiGate credential-theft campaign is drawing attention not just for access theft, but for how stolen perimeter identities can feed ransomware operations.
When Firewall Logins Turn Into Ransomware Fuel
A Fortinet credential-harvesting campaign known as FortiBleed highlights how stolen perimeter access can matter more than a new exploit.
Inside the Credential Harvest: Why Edge Logins Became the Prize
A reported FortiBleed campaign shows how stolen credentials, not flashy malware, can become the most valuable product in an access-broker economy.
When the Firewall Starts Watching the Users
A Go-based tool tied to compromised FortiGate appliances turns the network edge into a credential risk, not just a traffic-control point.
When a Firewall Becomes a Vault Door: The FortiGate Credential Snatch That Changed the Threat Model
A credential-harvesting operation tied to FortiGate appliances shows how exposed remote access can turn trusted security gear into an identity-risk magnet.