Trend Micro identified a large-scale tech support scam campaign that shifted from traditional malvertising to sustained, high-volume email distribution, delivering over 13 million emails over 165 days predominantly to Japanese (.jp) recipients. The campaign leverages spoofed senders, over 240,000 globally distributed sending IPs (likely compromised IoT/MikroTik devices), and more than 33,000 short-lived fake alert sites hosted on Azure Blob Storage to funnel victims toward fraudulent tech support call centers and remote-access-enabled financial theft. A notable evolution since May 2026 is the targeting of employees within organizations using internal-corporate-themed lures, suggesting an effort to secure larger financial payouts.
japan
19 posts
13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan Ransom & Dark Web Issues Week 3, July 2026 AhnLab's ASEC blog published a weekly roundup covering three notable ransomware and cyberattack incidents from Week 3 of July 2026. DragonForce ransomware struck a Saudi Arabian chemical manufacturer, AiLock ransomware hit Japan's largest taxi and limousine operator, and a separate cyberattack on Japan's largest frozen food company caused broader supply chain disruption. No technical IOCs, attack chain details, or detection rules are provided in the public article; full analysis is available via AhnLab TIP subscription.
June 2026 Dark Web Threat Actor Trend Report The June 2026 Dark Web Threat Actor Trend Report from AhnLab ASEC summarizes broad activity across hacktivist, APT, and cybercrime ecosystems. Key developments include ShinyHunters' migration to dark web infrastructure, North Korean supply chain attacks on npm AI-framework packages via Sapphire Sleet, a RaaS group's EDR-killing toolkit targeting European defense/aerospace, and TA569's Web Inject framework leveraging fake browser updates. Law enforcement achieved notable wins including a Scattered Spider conviction and multiple arrests across Europe.
June 2026 Dark Web Breach Incident Trend Report The June 2026 Dark Web Breach Incident Trend Report summarizes major data breach cases observed on deep web and dark web forums. ShinyHunters claimed breaches across multiple sectors in North America and Europe, while Operation FortiBleed exposed large-scale credentials for security equipment and VPN accounts. The report also highlights emerging threats including AI-generated fake breach data, ransomware negotiation brokerage services on Russian-language forums, and potential manipulation of AI assistant platform response layers in the Middle East.
6th July – Threat Intelligence Report This weekly threat intelligence bulletin covers multiple active ransomware campaigns, four critical vulnerabilities under active exploitation, and emerging AI-driven threats. Notable items include actively exploited RCE flaws in Oracle E-Business Suite and Progress Kemp LoadMaster, a Citrix NetScaler memory disclosure flaw exploited within 24 hours of disclosure, a North Korean supply-chain campaign (PolinRider) deploying 108 malicious packages, and a proof-of-concept browser-native ransomware generated by an LLM abusing Chrome's File System Access API.
An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails LevelBlue GSOC has identified accelerating ValleyRAT campaigns delivered through fake installers and malicious emails targeting Chinese and Japanese-speaking users. The email-based attack chain uses DLL sideloading via a legitimate VLC executable to load a malicious DLL that downloads an RC4-encrypted, Donut-generated ValleyRAT payload, which is then injected into a suspended rundll32.exe process for fileless execution. The malware incorporates extensive anti-analysis checks (memory size, sleep timing, CPU count, VHD boot detection) and establishes persistence via registry Run keys.
29th June – Threat Intelligence Report This weekly threat intelligence bulletin highlights multiple active exploitation campaigns targeting network infrastructure (Cisco SD-WAN, Ubiquiti UniFi OS, FortiGate firewalls) and AI platforms (Dify, Langflow), alongside supply chain attacks against Polymarket and AI agent ecosystems. Notable emerging threats include EvilTokens phishing-as-a-service abusing device-code authentication for M365 token theft, the FortiBleed campaign converting 430,000+ firewalls into credential stealers, and Turla's StockStay espionage malware targeting Ukrainian entities. Cloud extortion group FulcrumSec and the DCloud Uni-App fraud framework (236,493+ scam domains) represent additional significant threats requiring defensive attention.
FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems The FortiBleed campaign involves the exposure of valid administrative and SSL VPN credentials for over 73,000 FortiGate firewalls worldwide. A Russian-speaking threat group intercepted authentication hashes, likely via exported configuration files, and cracked them offline using Hashtopolis to gain initial access. Subsequent post-compromise activity targeted internal Active Directory environments with enumeration, password spraying, and SMB/DFS data collection scripts.
Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign A sophisticated malvertising campaign abused Google Ads to deliver ClickFix social engineering attacks disguised as popular AI developer tools and Mac utilities. The threat actors initially leveraged GitLab Pages before pivoting to weaponize claude.ai's shared chat feature, tricking macOS users into executing terminal commands that deploy the MacSync infostealer.
AI brands as bait: How threat actors are using the AI hype in social engineering Threat actors are increasingly leveraging the hype around AI platforms like ChatGPT, Claude, and DeepSeek to conduct social engineering attacks. These campaigns utilize phishing, malvertising, and SEO poisoning to distribute infostealers such as Vidar or facilitate credential theft via adversary-in-the-middle (AiTM) infrastructure.
- 8 minWeekly Recap — 2026-05-25 -> 2026-06-01
Session Hijacking and Developer Tool Poisoning Collapse Authentication Trust This week, attackers proved that multi-factor authentication is no longer a reliable gatekeeper. Campaigns like Tycoon 2FA and Chinese-language PhaaS platforms intercept one-time passwords in real time and steal session tokens to maintain persistent access, while infostealers like EKZ Infostealer harvest browser cookies to bypass authentication entirely. Even when victims reset passwords and revoke sessions, attackers retain access through hidden device registrations — meaning standard incident response playbooks are now incomplete. Developers remain the preferred entry point for supply chain compromise. The Glassworm botnet was disrupted after hiding malware in VSCode extensions and npm packages, while the Megalodon campaign poisoned GitHub Actions workflows across 5,500 repositories. A malicious Sicoob.Sdk NuGet package stole banking certificates from Brazilian developers, and North Korea's Lazarus group compromised the widely used axios npm library — a single attack touching millions of downstream applications. Organizations must move beyond password-and-MFA reliance: adopt hardware security keys, shorten session lifetimes, delete attacker-registered devices before resetting credentials, and audit developer toolchains and CI/CD pipelines for tampering.
ESET APT Activity Report Q4 2025–Q1 2026 ESET's Q4 2025–Q1 2026 APT Activity Report highlights global espionage and destructive campaigns by state-aligned actors. Notable incidents include a major supply chain compromise of the 'axios' npm library by Lazarus, destructive wiper attacks on Polish critical infrastructure by Sandworm, and the deployment of new edge-device implants like PhiliKit against Ivanti VPNs by China-aligned groups.
Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability A critical ViewState deserialization vulnerability (CVE-2026-5426) in the KnowledgeDeliver LMS allows unauthenticated remote code execution due to shared ASP.NET machine keys across deployments. Threat actors are actively exploiting this flaw to deploy the BLUEBEAM in-memory web shell and modify application JavaScript, ultimately distributing targeted Cobalt Strike BEACON payloads to end-users visiting the compromised sites.
The State of Ransomware – Q1 2026 In Q1 2026, the ransomware ecosystem experienced significant consolidation, with top groups like Qilin, Akira, The Gentlemen, and LockBit 5.0 dominating the landscape. Notably, The Gentlemen leveraged a massive stockpile of pre-exploited FortiGate devices (CVE-2024-55591) to rapidly scale operations, while LockBit 5.0 returned with multi-platform capabilities and a strategic shift away from US targets to evade law enforcement.
Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India The Silver Fox threat group is conducting a phishing campaign targeting organizations in Russia and India with tax-themed lures. The attack chain utilizes a modified RustSL loader featuring geofencing and Phantom Persistence to deploy ValleyRAT. ValleyRAT subsequently downloads a novel Python-based backdoor called ABCDoor, which masquerades as a Tailscale VPN client and provides remote control and screen broadcasting capabilities.
Tropic Trooper: AdaptixC2 + Custom Beacon | ThreatLabz Tropic Trooper is conducting a cyber espionage campaign targeting Chinese-speaking individuals in Asia using military-themed lures. The threat actors employ a trojanized SumatraPDF reader (TOSHIS loader) to deploy a custom AdaptixC2 Beacon that uses GitHub for command-and-control, ultimately establishing persistent remote access via VS Code tunnels.
Evolution of Chinese-Language Guarantee Telegram Marketplaces Dabai Guarantee is a decentralized, Telegram-based marketplace utilized by Chinese-speaking cybercriminal syndicates to coordinate global fraud, ghost-tapping, and money laundering operations. The platform acts as an escrow service using USDT, enabling siloed teams to execute retail and financial fraud across various countries while minimizing trust issues among criminals and reducing law enforcement visibility.
International security chiefs to convene in Glasgow for flagship CYBERUK conference The UK's National Cyber Security Centre (NCSC) has announced the speaker lineup and core themes for the CYBERUK 2026 conference in Glasgow. The event will bring together international security leaders to discuss accelerating global cyber defenses against evolving threats over the next decade.
Banners, Bots and Butchers: An Automated Long Con Targeting Japan, Asia, and Beyond A hybrid investment scam campaign is targeting users in Asia and globally by combining malvertising with pig butchering tactics. Threat actors use RDGA-generated domains and AI chatbots on popular messaging apps to automate social engineering, impersonate financial experts, and extract funds from victims.
