Netcrook
#cookie theft
Claude-Brand Lures Turn a Search Habit Into a Remote-Control Trap
A Claude Desktop-themed download flow is being used to deliver SectopRAT, showing how ad-driven redirection and fake installers can turn brand trust into a credential and file theft problem.
Inside the Blow to Kratos: Why a Phishing Empire Needed 200 Servers to Stay Alive
A cross-border seizure of Kratos infrastructure shows how phishing-as-a-service survives on scale, redundancy, and the ability to keep identity theft running like a business.
Browser Fraud Gets a Sharper Edge as TELEPUZ Enters the Session
A reported ClickFix-to-VIDAR chain ends in a web injector that can steal cookies, run JavaScript, and alter IBAN details inside live banking sessions.
One Loose Server, Three Phishing Cells: How a Public Python Port Unraveled an Evilginx Network
A small operational mistake on a public host exposed live Microsoft 365 phishing infrastructure, revealing how fragile attacker tradecraft can be when shell history and directory listings are left in plain sight.
When Phishing Meets Browser Theft: The Armored Likho Playbook
A newly named threat group is being tied to phishing, AI-generated loaders, and BusySnake Stealer, a mix that turns one bad click into a broader credential risk.
Phishing at the Front, Stealth at the Core: The Armored Likho Case Exposes a Deeper Playbook
A reported phishing campaign tied to Armored Likho shows how stolen browser data and covert access tools can turn a simple lure into a long-lived intrusion risk for government and energy organizations.
BusySnake Turns One Windows Intrusion Into a Multi-Secret Heist
A Python-based infostealer is being tracked as a focused grab for browser logins, Telegram sessions, screenshots, clipboard data, and crypto material - a reminder that one endpoint can hold many forms of usable trust.
BusySnake and the New Face of Low-Noise Espionage
A newly named cluster tied to government and power-sector targeting shows how credential theft, tunneling, and persistence can be fused into one access pipeline.
Bluekit and the New Login Trap: When Phishing Starts Acting Like a Service Platform
A fast-moving phishing kit is being watched as it shifts from early testing to live deployment, with Microsoft sign-ins in its sights and proxy-style attacks at the center of the risk.
How Minecraft Mods and Ethereum Smart Contracts Can Power Harder-to-Disrupt Credential Theft
A malware package tied to a Minecraft modding path and on-chain control logic shows how ordinary-looking software can be turned into a resilient access theft tool.
Chrome’s Cookie Shield Meets a Rust-Built Burglar
A tracked infostealer family kept changing shape, and its latest move highlights how browser protections and session theft are locked in a race that defenders cannot afford to lose.
When Phishing Starts Reusing Trust: The Microsoft 365 Session Trap
A reported multi-organization campaign shows how adversary-in-the-middle kits are moving past password theft and toward session replay, where a stolen sign-in can outlive the click that triggered it.
When the Login Page Becomes the Trap: The New Microsoft 365 Phishing Playbook
A tenant-aware phishing kit tied to Microsoft 365 shows how real-time credential replay and session theft can turn a successful sign-in into an identity breach.
Browser Secrets in the Crosshairs: What SolyxImmortal Reveals About Modern Infostealers
A reported Python-based Windows infostealer combines browser credential theft, cookie harvesting, and Discord webhook exfiltration, showing how ordinary user data can become the fastest path to account takeover.
Python Stealer Pushes Browser Loot Through Discord Webhooks
SolyxImmortal shows how a Windows infostealer can turn saved browser data, live keystrokes, and a commodity webhook into a compact theft pipeline.
Why a Python Stealer Like SolyxImmortal Matters More Than Its Name
A compact infostealer can pack password theft, cookie theft, keylogging, and screen capture into one script-driven workflow, turning everyday browser trust into a high-risk target.
Chrome Turns a Stolen Cookie Into a Much Worse Bet for Thieves
Google has moved Device-Bound Session Credentials to general availability in Chrome for Windows, making off-device session replay harder where the browser, platform, and service all support it.
The Real Break-In Is the Login: Why Stolen Credentials Keep Winning
AI can make phishing faster and cleaner, but the deeper problem is older: once attackers capture a password, session cookie, or token, they can often act like a real user.
Chrome’s Protected Memory Isn’t the Finish Line for Infostealers
VoidStealer is a reminder that browser hardening can still be undercut when malware waits for secrets to appear in memory, where encryption no longer helps.
When a Home Laptop Becomes the Key to Corporate Systems
Infostealer malware on personal devices is less about nuisance and more about identity theft: browser cookies, VPN logins, and cloud tokens can be reused against business systems later.