Loading story…
Security researchers reported two active phishing operations that relied on social engineering rather than mass malware spam to compromise organizations and steal high-value data. Proofpoint said the cluster it tracks as UNK_DeadDrop, likely aligned with North Korea, targeted developers at nearly 100 organizations in cryptocurrency, finance, technology, and education. The attackers used fake recruitment, code review, and technical assessment lures to push victims to attacker-controlled GitHub and GitLab repositories, where hidden Visual Studio Code tasks and a malicious VSIX extension triggered malware on macOS, Linux, and Windows. The campaign stole browser credentials, cryptocurrency wallets, cookies, and keychain or keyring data, while maintaining persistence through the extension and removing repository artifacts to reduce detection.
A separate campaign tracked by Palo Alto Networks Unit 42 as CL-CRI-1147 and publicly associated with the Pink extortion group targeted enterprise users through voice phishing and credential theft. Researchers said Pink impersonated internal IT staff to direct employees to phishing pages that captured credentials, MFA codes, and session cookies, enabling access to Microsoft 365 services including OneDrive and SharePoint. The group then used legitimate Microsoft automation tools to exfiltrate data and sent extortion demands through compromised Microsoft Teams accounts and email, typically giving victims 72 hours to pay. Unit 42 linked Pink to the broader Com cybercriminal ecosystem and noted overlaps with groups such as Lapsus$, Scattered Spider, and ShinyHunters, while Google Threat Intelligence Group assessed it may be a rebrand of the BlackFile operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-09, Gurucul published detection content for the UNK_DeadDrop phishing campaign, including a query to identify email activity involving a defined set of suspicious addresses. The published indicators spanned multiple domains and HR-themed aliases, providing additional infrastructure details for threat hunting.
Palo Alto Networks Unit 42 identified Pink as a newly tracked extortion group, CL-CRI-1147, and linked it to the broader Com cybercriminal community. Researchers noted similarities to Lapsus$, Scattered Spider, and ShinyHunters, and described Pink's use of vishing, credential theft, cloud data exfiltration, and extortion via compromised Microsoft 365 accounts.
Google Threat Intelligence Group assessed that Pink may be a rebrand of the BlackFile operation and said BlackFile retired in May 2026. The report also suggested there may have been a brief Redact phase between BlackFile and Pink.
Between April and May 2026, a phishing campaign tracked by Proofpoint as UNK_DeadDrop targeted developers at nearly 100 organizations, particularly in cryptocurrency, finance, technology, and education. The activity used recruitment, code review, and technical testing lures to direct victims to attacker-controlled GitHub and GitLab repositories.
Proofpoint disclosed a likely North Korea-aligned campaign cluster named UNK_DeadDrop on 2026-06-05. The company said the operation abused Visual Studio Code and Cursor workflows, hidden VS Code tasks, and a malicious VSIX extension to deliver malware across macOS, Linux, and Windows.
The extortion group Pink launched a dedicated data leak site on 2026-05-31. The group uses voice phishing and credential theft to compromise enterprise users and extort victims after data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcerhisac.org
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourceproofpoint.com
Open sourcearcticwolf.com
Open sourceany.run
Open sourceabout.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly tracked extortion group known as **Pink** is using voice phishing and fake internal help-desk calls to trick employees into entering credentials and MFA codes on attacker-controlled phishing pages. Researchers tracking the activity as `CL-CRI-1147` said the actor appears likely **Com-affiliated** and follows a social-engineering playbook associated with groups such as Lapsus$, Scattered Spider, and ShinyHunters. After account takeover, Pink rapidly accesses Microsoft cloud services including **SharePoint** and **OneDrive**, steals sensitive data, and then uses the compromised accounts to send extortion emails and internal **Microsoft Teams** messages to pressure victims. Investigators said the group has also stood up a leak site and typically gives organizations **72 hours** to respond to extortion demands. The campaign shows repeated infrastructure reuse across victims, with common second-level domains and victim-specific subdomains, and phishing hosting frequently tied to **DDoS-Guard**. Reported indicators include the domains `passkeyadd.com`, `passkeydeploy.com`, and `deploypasskey.com`, along with the IP addresses `185.178.208.153`, `172.93.100.252`, and `96.232.20.66`, giving defenders concrete artifacts for threat hunting and blocking.
Jun 29, 2026
Multiple reports describe a broader **credential-theft trend** in which attackers abuse trusted services and familiar business workflows to make phishing more convincing and harder to detect. One campaign used **compromised WordPress sites** and redirects through `skimresources[.]com` to deliver pixel-perfect fake login pages for **Microsoft Teams**, **Xfinity**, and **UAE Pass**, with lures such as missed voicemail and shared-document alerts. Another campaign abused **LiveChat**'s `lc[.]chat` infrastructure to impersonate brands like **PayPal** and **Amazon**, moving victims into fake support conversations designed to extract sensitive information under the guise of refunds or order issues. A separate industry report reinforces the same operational pattern: attackers increasingly rely on **valid credentials** and trusted collaboration tools rather than software exploits, with cloud identity compromise driving most investigated incidents and some intrusions using **Microsoft Teams voice phishing** and **Quick Assist** to gain access, move laterally, and deploy ransomware. Other references in the set cover different stories entirely, including the **CamelClone** espionage operation, a **FancyBear/APT28** infrastructure exposure, and a general weekly security recap, and do not describe the same phishing activity. This is **not fluff** because the relevant items contain substantive threat intelligence on active attack methods, delivery infrastructure, and attacker tradecraft.
Jun 29, 2026
Multiple reports highlight a surge in **social-engineering-led initial access**, with attackers increasingly relying on trusted-looking delivery mechanisms rather than novel exploits. Microsoft-described activity impersonates *Zoom*, *Microsoft Teams*, and *Adobe Reader* updates and uses **stolen Extended Validation (EV) code-signing certificates** (including one issued to **TrustConnect Software PTY LTD**) to make malicious executables appear legitimate; lures include fake meeting invites and deceptive download sites, and payloads commonly install **RMM tooling** such as *ScreenConnect* and *MeshAgent* for persistent access, followed by additional tooling via encoded PowerShell. Separately, Moonlock reported a **ClickFix**-style operation targeting crypto/Web3 professionals via **fake venture capital personas on LinkedIn**, redirecting victims through Calendly to spoofed video-conferencing pages to induce execution of attacker-supplied commands, with infrastructure tied to multiple fake firms (e.g., *SolidBit Capital*, *MegaBit*, *Lumax Capital*) and domains attributed to a single registrant. In parallel, NCC Group’s Fox-IT assessed that **messaging platforms** (e.g., WhatsApp, Telegram, Discord, Signal, LinkedIn messaging) are increasingly used to deliver phishing links, malicious attachments, QR codes, and fake invitations while bypassing traditional email controls, and that Telegram in particular is also used to host phishing infrastructure, malware repositories, and bot-enabled fraud services. One referenced item is materially different from the above social-engineering theme: reporting on suspected **DPRK-linked intrusions** into cryptocurrency organizations describes web-app exploitation (including `CVE-2025-55182` in *React2Shell*) and the use of pre-obtained **AWS access tokens** to steal source code, private keys, and cloud secrets—an intrusion set focused on direct compromise and theft rather than the phishing/update-impersonation and messaging-platform delivery techniques described elsewhere.
Jun 29, 2026