Social Engineering

Russia's FSB-linked Star Blizzard used a new delivery technique, RedFlick, in 13 phishing campaigns affecting 100+ US and UK organizations to deploy its CosmicPulse backdoor in 2026.

Clover Health (138,677) and AngMar Management Services (126,196) disclosed separate US healthcare breaches in September 2026 — one social engineering of three staff accounts, one Interlock ransomware attack — paired in coverage as '250,000 impacted'.

Two former US airmen got 111 and 78 months for a BEC and card-fraud scheme that diverted $1.68M and $720K wires. The docket shows conspiracy pleas, overlapping restitution and a pending appeal; 15 victims and $2.4M are not DOJ figures.

Astrana Health's Item 1.05 8-K (filed September 23, 2026): attackers posing as staff called employees from its spoofed main number, and data on servers was accessed or acquired. Actor, patient count and exfiltration remain unconfirmed.

Microsoft's Digital Crimes Unit seized 50 sites and 150+ domains behind EvilTokens, a cybercrime-as-a-service platform pairing device-code phishing with an AI chatbot for inbox analysis and BEC targeting. It hit 12,000+ inboxes across 10,000+ orgs. The AI did the targeting, not the intrusion.

The Rust project warned that crate maintainers and rust-lang members are being lured into fake job/contract video calls, then pushed to install a bogus codec or paste a clipboard command — aiming to hijack accounts and publish malware. Tactics resemble DPRK 'contagious interview' campaigns.

Blackpoint APG documented ChainScript, a full-featured RAT pushed via ClickFix lures (fake Spotify/Zoom/Teams installers) that reads a Polygon smart contract to find its live WebSocket C2 — an EtherHiding-style design built to survive takedowns and defeat indicator-based blocking.

A hardcoded Cloudflare API key let attackers rewrite Brevo's web pages and the JavaScript widgets 100,000+ customer sites embed, serving a fake-CAPTCHA "ClickFix" clipboard-hijack lure and a password-bypassing WordPress backdoor for over five hours on September 14, 2026.

A joint NCSC/FBI/AIVD advisory published September 15, 2026 details HEAVYGRAM (CHOSEN BRICK), a Telegram-controlled Windows backdoor Iran's MOIS-linked Handala Hack uses to surveil dissidents and journalists — the same actor behind the Stryker wiper attack and DOJ domain seizures.

Revolut answered a fraudulent Italian government data request and disclosed ~680 customers' KYC files and Bitcoin histories. A threat-intel firm disputes the attacker's own six-month RAT story; independent researchers found the real targeting method, an unresolved second compromised mailbox

A classified Customs directive published by Netzpolitik shows German agencies link a police computer to a suspect's messenger account using the apps' own multi-device feature. The BGH ruled in January that seizing chat history this way is unlawful; the directive, dated a month later.

A Russian national extradited from Cyprus faces trial over a 2016–17 campaign that used 225 fake accounts on a Santa Clara freelance platform to send Excel macros dropping the TeamViewer-abusing TVRAT. The unsealed indictment gives numbers the press release rounded away.

A Russian web developer extradited from Georgia faces trial over a 2023–25 operation that bought search ads impersonating banks, harvested 5,000+ logins and 2FA codes on cloned pages, and tried to wire $5.58 million from one Atlanta company in a day. The mule LLC was registered in Georgia two months

ShinyHunters says it vished McKesson employees, took over Okta sessions, and pulled a terabyte from Salesforce and Snowflake between 20 and 25 August 2026. McKesson has confirmed exfiltration of patient data and nothing about how.

The transition of the global cyber threat landscape from traditional network intrusions to decentralized, identity-centric attacks is exemplified by the RedLine infostealer. First identified in March...