ThreatPaper

#phishing

5 cases

Star Blizzard's RedFlick technique delivers the CosmicPulse backdoor to 100+ organizations

Russia's FSB-linked Star Blizzard used a new delivery technique, RedFlick, in 13 phishing campaigns affecting 100+ US and UK organizations to deploy its CosmicPulse backdoor in 2026.

State-SponsoredSocial EngineeringMalware
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million

A Russian web developer extradited from Georgia faces trial over a 2023–25 operation that bought search ads impersonating banks, harvested 5,000+ logins and 2FA codes on cloned pages, and tried to wire $5.58 million from one Atlanta company in a day. The mule LLC was registered in Georgia two months

Financial FraudSocial EngineeringIdentity Theft
GuardBreaker: Malware That Weaponises AI Safety Refusals to Block Its Own Analysis

Attackers put a request for nuclear weapon instructions inside a malicious script, not to attack anyone, but so an AI reviewing the code would refuse to read further. The defender's safety guardrail becomes the evasion.

MalwareState-SponsoredAI & Machine Learning
Apollo Global Management Cloud Data Breach via Voice Phishing

Apollo Global Management confirmed on August 21, 2026 that it had suffered a data breach stemming from a social engineering attack. Between July 6 and July 10, 2026, attackers used voice phishing,...

Data Breach
India Orders Takedown of Fraudulent Google Firebase Accounts Used in Banking Fraud

India's cybercrime agency identified a wave of fraudsters using Google Firebase to host phishing pages and collect stolen banking credentials from millions of users.

Financial Fraud