Loading story…
A sophisticated spear-phishing campaign orchestrated by the threat group SHADOW-VOID-042 targeted critical infrastructure sectors, including defense, energy, and chemical organizations, by impersonating cybersecurity vendor Trend Micro. The attackers sent emails purporting to be urgent security advisories from Trend Micro, warning of a fictitious vulnerability in the Apex One Web Reputation Service module. Victims were directed to a decoy website mimicking Trend Micro’s branding, where tailored payloads were delivered in a multi-stage attack designed to breach select targets. Trend Micro’s investigation revealed that the campaign also attempted to infiltrate the company and its subsidiaries, leveraging the vendor’s reputation to increase credibility and success rates.
This campaign was identified as the second phase of a broader operation, with earlier activity in October 2025 using different lures such as workplace harassment and academic research to target executives and HR personnel. The attackers demonstrated a high level of sophistication by customizing each stage of the attack to the specific target environment and by linking the November and October campaigns through shared tactics and infrastructure. The operation highlights the ongoing threat posed by advanced phishing campaigns that exploit trusted brands to compromise critical infrastructure and underscores the need for heightened vigilance and robust email security controls in these sectors.
Get the infrastructure and lures behind it.
11 events from the most recent confirmed update back to the earliest known activity.
By 15 December 2025, CISA had updated its Known Exploited Vulnerabilities catalog with additional actively exploited vulnerabilities. The update reflected ongoing government tracking of in-the-wild exploitation.
By 15 December 2025, a breach affecting the French Interior Ministry had been reported. The Risky Biz bulletin identified it as one of the notable incidents disclosed that day.
By 15 December 2025, MangaGamer had reported a game release distributed on a USB device that was infected with malware. The case was noted as a distinct supply-chain style security incident.
By 15 December 2025, a data breach at 700Credit had been disclosed as affecting 5.6 million customers. The incident was cited among the major cybersecurity events in the Risky Biz bulletin.
By 15 December 2025, Google reported that multiple Chinese cyber-espionage groups were exploiting the React2Shell vulnerability. This added new technical and attribution detail about active exploitation of the flaw.
By 15 December 2025, Apple had released fixes for two WebKit zero-day vulnerabilities that were being actively exploited in the wild. The patching was highlighted as a significant security development in the Risky Biz bulletin.
In December 2025, Germany publicly attributed a 2024 intrusion affecting its air traffic control agency to Russia's GRU-linked APT24. This marked a new official attribution development for the earlier incident.
By December 2025, Meta had taken down a Russian influence operation across Africa that used local freelancers to spread anti-US and anti-French messaging and amplify pro-Russian narratives. The disruption was reported in Risky Biz's 15 December bulletin.
By mid-December 2025, Trend Micro researchers reported that the November campaign significantly overlapped with tactics associated with the Russian-aligned Void Rabisu (ROMCOM/Storm-0978) group, though they stopped short of definitive attribution. Researchers also noted the attacks were interrupted before a final payload could be observed, preventing confirmation of ROMCOM backdoor deployment.
In November 2025, SHADOW-VOID-042 began a spear-phishing campaign impersonating Trend Micro and targeting critical infrastructure organizations in the defense, energy, and chemicals sectors. The operation used urgent security-advisory lures, a decoy Trend Micro-branded site, fake Cloudflare redirection, and JavaScript-based exploitation, including use of CVE-2018-6065.
In October 2025, the threat group later tracked as SHADOW-VOID-042 conducted an earlier operation using HR-related lures. Trend Micro researchers later linked this activity to a subsequent campaign based on overlapping tactics and tradecraft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcenews.risky.biz
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have intensified their use of phishing campaigns by impersonating well-known brands and trusted online services to deceive victims and steal sensitive credentials. In one campaign identified by the Cofense Phishing Defense Center, attackers targeted individuals in social media and marketing roles by sending fake job application emails that appeared to originate from major companies such as Red Bull, Tesla, Google, and Ferrari. These emails used convincing language and branding, including up-to-date logos and tailored subdomains, to increase their legitimacy and lure recipients into clicking malicious links. The attackers further enhanced the credibility of their messages by spoofing the sender address to appear as if it came from a legitimate domain, such as Xero, which has been abused in previous phishing incidents. The phishing process often began with a CAPTCHA page to create a sense of security before redirecting victims to fraudulent login pages designed to harvest credentials. This approach demonstrates a sophisticated understanding of social engineering tactics and the value of resume and personal information in targeting specific job seekers. In a separate but similarly themed incident, a Malwarebytes employee was targeted by a phishing email that impersonated 1Password, a popular password manager. The email falsely claimed that the recipient's 1Password account had been compromised and urged immediate action, including changing the account password and enabling two-factor authentication. The message mimicked legitimate security alerts, referencing 1Password's Watchtower feature, but included subtle red flags such as a sender address not associated with 1Password and a malicious link disguised as a legitimate action button. The phishing link directed users to a typosquatted domain, onepass-word[.]com, rather than the official 1Password website. Interestingly, the email's 'Contact us' link routed through a legitimate support page but used a redirect service, further complicating detection. The use of Mandrillapp, a transactional email delivery service, added another layer of apparent legitimacy to the phishing attempt. Both campaigns highlight the increasing sophistication of phishing attacks, with threat actors leveraging trusted brands and services to bypass security filters and exploit user trust. The attackers' use of brand-specific subdomains, authentic-looking graphics, and familiar communication styles makes these phishing emails particularly convincing. By targeting individuals with tailored messages, such as job seekers or users of specific online services, the campaigns increase the likelihood of successful credential theft. The abuse of legitimate infrastructure, such as Xero's email services and Mandrillapp, demonstrates how attackers can exploit trusted platforms to evade detection. Security teams are advised to educate users about the signs of phishing, including checking sender addresses, scrutinizing URLs, and being wary of urgent requests for sensitive information. Organizations should also monitor for abuse of their brand in phishing campaigns and work with email providers to block malicious domains. The incidents underscore the need for robust email security solutions and ongoing vigilance against evolving social engineering tactics. As phishing campaigns continue to evolve, both individuals and organizations must remain alert to the latest techniques used by cybercriminals to compromise accounts and steal valuable data.
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026