Loading story…
Threat researchers reported coordinated spearphishing activity targeting energy, oil and gas, electronics, and related supply-chain organizations, with notable focus on South Korean firms and entities in the UAE and Qatar. The lures impersonated legitimate business correspondence using spoofed or typosquatted email accounts and referenced real tenders, RFQs, procurement documents, executives, and major projects such as ADNOC and Doha airport work to increase credibility.
The emails delivered malicious IMG, ISO, CAB, PDF, ZIP, and .NET loader chains, often hosted through legitimate services including WeTransfer and Mega, to install information-stealing malware such as AZORult, Agent Tesla, Formbook, Loki, and Snake Keylogger. Researchers said the malware was used to steal credentials, banking and browsing data, and keystrokes, while some samples used fileless execution, anti-analysis checks, and process hollowing to evade detection; one campaign also appeared to target suppliers as a path to compromise trusted downstream business relationships.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
GustoMSC publicly warned that its domain was being typosquatted and that scammers were sending emails in employees’ names. This warning aligns with the broader phishing activity targeting energy-sector firms and suppliers.
Zscaler observed the same Middle East-focused campaign increase starting in July 2020, with phishing emails impersonating ADNOC officials and using tender and RFQ themes tied to regional projects. The operation targeted organizations especially in the UAE and Qatar.
Zscaler reported that a targeted spearphishing campaign against supply chain-related and government organizations in the Middle East was seen at low volume from January through May 2020. The lures used project-themed PDFs and ultimately delivered the AZORult information stealer.
Researchers described a spearphishing campaign active for at least one year that targeted large international companies, especially in energy, oil and gas, electronics, and related suppliers, with a strong focus on South Korean firms. The attackers used spoofed and typosquatted business email lures with IMG, ISO, and CAB attachments to deliver infostealers including Formbook, Agent Tesla, Loki, Snake Keylogger, and AZORult.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 204 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourceintezer.com
Open sourceblogs.blackberry.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026
A phishing campaign is distributing **Agent Tesla** through Spanish-language business emails that impersonate purchase orders and invoices, targeting organizations across Latin America and Spain. Broadcom reported that the attack delivers a RAR attachment disguised as a PDF, then executes a multi-stage chain involving a JScript loader, PowerShell downloaders, an in-memory .NET loader, and a final **Agent Tesla** payload that runs largely in memory. The campaign uses obfuscation, masquerading, urgency-themed messaging, and an **AMSI bypass** to evade detection while minimizing disk artifacts. The malware is designed to steal credentials, system information, and other sensitive data, then exfiltrate it over encrypted HTTP(S) channels. The activity aligns with earlier large-scale Agent Tesla spam operations that used polished corporate-themed lures and impersonated legitimate companies to infect business users at scale, with especially high impact in Mexico and Spain. Across observed campaigns, Agent Tesla variants have targeted credentials stored in browsers, email clients, FTP and VPN tools, remote access software, and messaging applications, while also supporting screenshot capture, keylogging, and clipboard theft.
Aug 15, 2026
Multiple security reports and investigations highlighted active threats spanning software supply chain abuse, phishing operations, and commodity malware delivery. Socket identified **four malicious NuGet packages** (e.g., *NCryptYo*, *DOMOAuth2_*, *IRAOAuth2.0*, *SimpleWriter_*) published by `hamzazaheer` that targeted **ASP.NET** developers by exfiltrating ASP.NET Identity data (users/roles/permissions) and manipulating authorization to maintain persistence; the campaign used a staged loader that set up a local proxy on `localhost:7152` to relay traffic to dynamically resolved C2 infrastructure. Separately, investigators disrupted a logistics-focused **phishing-as-a-service** operation (“**Diesel Vortex**”) tied to Russian/Armenian operators, which used dozens of domains to target users of platforms such as **DAT**, **Truckstop**, **Penske Logistics**, **EFS**, and **Timocom**, resulting in theft of over **1,600 credentials** and attempted **EFS check fraud**. Fortinet also detailed a **multi-stage Agent Tesla** infection chain delivered via phishing with RAR attachments leading to `.jse` and PowerShell stages, culminating in in-memory execution and process hollowing into `C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe`. Threat intelligence and ecosystem reporting also underscored how attackers are scaling operations and bypassing traditional controls. Group-IB reported **MuddyWater** (“Operation Olalampo”) targeting the **MENA** region with new tooling including **GhostFetch** and a Rust backdoor (**CHAR**) controlled via **Telegram**, plus variants that deploy **AnyDesk**; the report noted indicators consistent with **AI-assisted development**. Dark Reading described the rise of **telephone-oriented attack delivery (TOAD)** emails—messages containing only a phone number—which accounted for a significant share of gateway-bypassing detections in StrongestLayer’s dataset, reflecting a shift toward social-engineering paths that evade link/attachment scanning. Confiant reported disrupting **D-Shortiez** malvertising operations after discovering exposed internal testing/admin infrastructure, attributing **59 million** malicious ad impressions (primarily US-targeted) to scam campaigns, while Interpol-backed **Operation Red Card 2.0** reported **651 arrests** and **$4.3M** recovered across 16 African countries in actions against fraud rings and cybercrime syndicates.
Jun 29, 2026