Telegram

2026-07-019 minCofensehigh

Cofense Intelligence reports a strategic shift in phishing operations toward platform-aware delivery, where threat actors fingerprint victim devices via browser User-Agent strings and deliver OS-specific payloads from a single landing page. Windows users receive legitimate remote access tools like ConnectWise RAT or Itarian RAT repurposed as malware, while MacOS and Android users are redirected to credential phishing pages. The abuse of legitimate RATs evades signature-based detection, and platform-siloed security tools fail to correlate the campaign across operating systems, leaving organizations with an incomplete picture of the intrusion scope.

2026-07-0116 minESEThigh

ESET Research contributed to Operation Endgame, a coordinated global disruption targeting the Amadey botnet and Stealc infostealer MaaS ecosystems. The operation seized or rendered inoperative approximately 50 domains and nearly 200 active IP-based C&C servers. ESET provided technical analysis, C&C server lists, RC4 encryption keys, campaign/build identifiers, and clustering methodology based on long-term tracking of both malware families. The fragmented, affiliate-operated infrastructure model used by both services required advanced graph-based clustering of RC4 keys, build IDs, and C&C URL paths to identify high-priority targets for disruption.

2026-07-0112 minESEThigh

Gamaredon, a Russia-aligned APT group attributed to the FSB, maintained high operational tempo throughout 2025 with 35 spearphishing campaigns exclusively targeting Ukrainian government and military institutions. The group introduced six new PowerShell tools, resurrected the PteroSetup VBScript weaponizer for lateral movement, and began abusing CVE-2025-8088 (WinRAR) for persistence via the Startup folder. A significant infrastructure evolution occurred: C&C servers are now hidden behind tunnel services (Cloudflare tunnels, Cloudflare workers, Microsoft devtunnels, Loophole) and dead-drop resolutions on legitimate platforms (Telegram, Telegra.ph, Rentry, GoFile, Dropbox, and others), while stolen data is exfiltrated to S3-compatible cloud storage (Wasabi, Tebi, Intercolo) rather than attacker-owned servers.

2026-06-245 minSentinelOnehigh

SentinelLABS identified macOS.Gaslight, a DPRK-aligned Rust backdoor targeting macOS systems. The implant establishes a resilient C2 channel via the Telegram Bot API using AES-GCM over pinned TLS and achieves persistence via a masqueraded LaunchAgent. Notably, it embeds a 38-message prompt-injection payload designed to feed fabricated system errors to LLM-assisted triage tools, aiming to abort or corrupt automated analysis. The malware also stages a standalone Python environment to execute a credential and data stealer.

2026-06-087 minTrend Microcritical

Multiple Russia-aligned threat actors, including SHADOW-EARTH-066 and Earth Dahu, are actively exploiting a patched WinRAR path traversal vulnerability (CVE-2025-8088) to target Ukrainian organizations. The attackers use crafted RAR archives with NTFS Alternate Data Streams to silently drop malicious payloads, such as the evolved GIFTEDCROOK infostealer or HTA-based espionage tools, into the Windows Startup folder and ProgramData directories.

2026-06-036 minSekoia.iohigh

Gamaredon, a Russia-nexus threat actor, utilizes a multi-stage VBScript loader framework named GammaLoad to establish persistent access and deploy subsequent payloads like GammaSteel. The infection chain leverages Dead Drop Resolvers on legitimate platforms, stores C2 configurations in the Windows Registry, and uses Alternate Data Streams (ADS) combined with Scheduled Tasks for stealthy execution.

2026-06-026 minArctic Wolfhigh

The operators behind the Kali365 Phishing-as-a-Service (PhaaS) kit have expanded their infrastructure to target a wider array of services, including Microsoft 365, Okta, and Russia's MAX Messenger. The threat actors utilize OAuth 2.0 device authorization grant abuse and fake prize-claim lures to bypass MFA and exfiltrate credentials via Telegram.

2026-06-017 minSekoia.iohigh

Gamaredon (FSB) is conducting an ongoing cyberespionage campaign against Ukrainian targets using a modular, fileless infection chain. The attack leverages HTML smuggling and archive path traversal (CVE-2025-8088) for initial access, followed by the deployment of GammaWorm, which utilizes NTFS Alternate Data Streams (ADS) and Dead Drop Resolvers (DDRs) on legitimate platforms for persistence, propagation, and C2 communication.

2026-05-285 minWithSecurehigh

WithSecure identified GREYVIBE, a Russia-nexus threat group targeting Ukrainian entities using spear-phishing, ClickFix, and fraudulent websites. The group systematically leverages Generative AI to develop custom malware (PhantomRelay, LegionRelay, FallSpy) and obfuscators, blending state-aligned intelligence gathering with cybercrime ecosystem overlaps.

2026-05-255 minCheck Pointhigh

This threat intelligence report highlights multiple high-profile breaches, including 7-Eleven and GitHub, alongside the active exploitation of vulnerabilities in Windows Defender, Trend Micro, and Drupal. It also details emerging threats such as the Kali365 phishing kit, AI-driven prompt injection attacks, the Nimbus Manticore IRGC-linked campaign deploying the MiniFast backdoor, and a supply chain attack on Laravel Lang packages.

2026-05-255 minMandianthigh

Chinese-language Phishing-as-a-Service (PhaaS) platforms are evolving to utilize real-time interception and AI-driven automation to bypass MFA and tokenize stolen payment data into digital wallets. Threat actors leverage encrypted messaging protocols like RCS and iMessage for delivery, while platforms like YY Lai Yu provide highly localized, dynamic phishing infrastructure to target global consumers.

2026-05-215 minTrend Microhigh

A solo Russian-speaking threat actor tracked as 'bandcampro' leveraged jailbroken AI models to automate a multi-year influence operation and cryptocurrency fraud campaign targeting American conservative communities. The actor utilized AI for content generation, infrastructure management, password mutation for WordPress brute-forcing, and distributed a fake crypto wallet that installed the legitimate GoToResolve RMM tool for remote access.

2026-05-147 minSentinelOnehigh

SentinelLABS discovered PCPJack, a cloud-focused worm designed to harvest credentials at scale while actively evicting artifacts of a rival threat actor, TeamPCP. The framework targets exposed cloud services like Docker, Kubernetes, and Redis for propagation and lateral movement, notably omitting cryptomining payloads in favor of credential theft and Sliver C2 deployment.

2026-05-146 minInfobloxhigh

Infoblox Threat Intel uncovered a thriving underground economy on Telegram dedicated to unlocking stolen iPhones. Threat actors utilize specialized Windows binaries to extract device information and deploy targeted smishing campaigns via Apple lookalike domains to steal iCloud credentials, allowing them to bypass Activation Lock, wipe the device, and resell the hardware.

2026-05-134 minCofensehigh

Threat actors are increasingly leveraging Vercel's GenAI capabilities, specifically v0.dev, to rapidly generate and host highly convincing credential phishing pages. By combining AI-generated frontends with Telegram Bot API integrations for real-time credential exfiltration, attackers can deploy resilient, low-effort phishing infrastructure on legitimate cloud services that evades traditional detection mechanisms.

2026-05-135 minVaronishigh

Varonis Threat Labs analyzed Bluekit, a comprehensive Phishing-as-a-Service platform that consolidates domain management, site creation, credential harvesting, and session token theft into a single dashboard. Notably, the kit integrates an AI Assistant powered by uncensored LLMs to draft phishing lures and features advanced post-login session hijacking capabilities, including automated cookie dumping and live target monitoring to bypass standard MFA controls.

2026-05-139 minArctic Wolfcritical

Arctic Wolf Labs identified a highly targeted campaign by the DPRK-nexus threat actor BlueNoroff against the Web3 sector. The attackers utilize sophisticated social engineering, including AI-generated deepfakes and stolen webcam footage, to lure victims into fake Zoom or Teams meetings. Once engaged, a ClickFix clipboard injection attack deploys a fileless PowerShell C2 implant, leading to the theft of cryptocurrency wallets, browser credentials, and Telegram sessions.

2026-05-135 minRecorded Futurehigh

Dabai Guarantee is a decentralized, Telegram-based marketplace utilized by Chinese-speaking cybercriminal syndicates to coordinate global fraud, ghost-tapping, and money laundering operations. The platform acts as an escrow service using USDT, enabling siloed teams to execute retail and financial fraud across various countries while minimizing trust issues among criminals and reducing law enforcement visibility.

2026-05-136 minANY.RUNhigh

Lazarus Group is conducting a new ClickFix campaign targeting macOS users in high-value sectors via Telegram. The attackers trick victims into executing a terminal command that deploys 'Mach-O Man,' a multi-stage Go-based malware kit designed to steal credentials, browser data, and macOS Keychain secrets, exfiltrating the data via Telegram.

2026-05-136 minElastic Security Labshigh

Threat actor REF6598 is targeting the financial and cryptocurrency sectors using social engineering to trick victims into opening a malicious Obsidian vault. The attack leverages Obsidian's community plugins to execute cross-platform attack chains, culminating in the deployment of the PHANTOMPULSE RAT on Windows and an AppleScript dropper on macOS.

2026-05-135 minTrend Microhigh

Following an accidental leak of Anthropic's Claude Code source material, threat actors rapidly deployed a social engineering campaign using fake GitHub repositories. The campaign distributes trojanized archives containing a Rust-compiled dropper that deploys Vidar stealer and GhostSocks proxy malware, specifically targeting developers seeking AI tools.

2026-05-135 minRecorded Futurehigh

In 2025, the Latin America and the Caribbean (LAC) region faced escalating cybercriminal activity driven by rapid digital adoption and economic instability. Threat actors heavily utilized Telegram and dark web forums to distribute ransomware, banking trojans, and infostealers, increasingly targeting the healthcare, manufacturing, and government sectors while adapting to law enforcement disruptions.

2026-05-137 minANY.RUNhigh

March 2026 saw a surge in sophisticated, multi-stage cyber attacks designed to evade early detection. Key threats included OAuth device code phishing (EvilTokens) for M365 account takeover, registry-hidden RAT staging (RUTSSTAGER), macOS backdoors delivered via ClickFix lures, and resilient botnets utilizing Dead Drop Resolvers.

2026-05-135 minSocketcritical

A supply chain attack campaign utilizing five typosquatted npm packages targets Solana and Ethereum developers. The packages silently intercept private keys during routine cryptographic operations and exfiltrate them to a Telegram bot, leveraging transitive dependencies and obfuscation to evade detection.

2026-05-135 minANY.RUNhigh

Kamasers is a sophisticated, multi-vector DDoS botnet and loader that leverages resilient Dead Drop Resolver (DDR) mechanisms via legitimate public services to maintain command-and-control communication. It poses significant enterprise risk by turning infected hosts into attack infrastructure and facilitating follow-on payload delivery, including potential ransomware deployment.

2026-05-137 minArctic Wolfhigh

AI-assisted malware development has rapidly matured, driven largely by the adoption of models like DeepSeek R1, which lowers the barrier to entry for threat actors. This surge has resulted in a high volume of structurally novel malware, including infostealers, RATs, and ransomware, many of which evade traditional signature-based detection while leaving distinct LLM-generated artifacts in their code.

2026-05-135 minCofensehigh

A novel phishing campaign is abusing the legitimate LiveChat SaaS platform to impersonate brands like PayPal and Amazon. By engaging victims in real-time chat interfaces using automated bots or human operators, attackers successfully harvest sensitive information, including account credentials, multi-factor authentication (MFA) codes, personally identifiable information (PII), and credit card details.

2026-05-135 minCofensehigh

Threat actors are increasingly weaponizing the legitimate Telegram Bot API to establish Command and Control (C2) channels and exfiltrate stolen data. This technique is widely adopted across credential phishing campaigns and malware families like Agent Tesla and Pure Logs Stealer, allowing attackers to bypass traditional network defenses by blending malicious traffic with legitimate Telegram communications.

2026-05-136 minMicrosoftcritical

Tycoon2FA is a widespread Adversary-in-the-Middle (AiTM) Phishing-as-a-Service platform operated by the threat actor Storm-1747. It enables cybercriminals to bypass standard multifactor authentication (MFA) at scale by intercepting session cookies and credentials using spoofed sign-in pages, custom CAPTCHAs, and complex redirect chains.