cyber campaign Archives

Tech Optimizer

August 8, 2026

Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here’s what to look out for

Securonix Threat Research has identified a cyber campaign called SMOKE#SCREEN that uses deceptive tactics to trick users into installing weaponized versions of ScreenConnect, a legitimate remote monitoring software. The attackers disguise their malicious intent with fake update notifications for applications like Zoom and Adobe, as well as counterfeit business documents. This campaign allows attackers to gain persistent remote access to victims' systems, disable security protections, and exploit trusted services like Dropbox and Cloudflare for delivering malicious payloads. Victims have been reported on both Windows and macOS platforms. Businesses are advised to verify updates through official channels and train staff on the risks of unexpected software installations.

AppWizard

March 22, 2026

Russian Intelligence targets American messaging app users, FBI says

FBI Director Kash Patel revealed that hackers linked to Russian intelligence are targeting the messaging accounts of high-profile U.S. individuals, including current and former government officials, military personnel, political figures, and journalists. The FBI has identified these cyber actors, who have gained unauthorized access to thousands of accounts globally, allowing them to view private messages, send impersonating messages, and conduct phishing attempts. The campaign specifically targets users of commercial messaging applications like Signal, which has been blocked in Russia due to alleged legal violations. Dutch intelligence agencies reported that Russian hackers are also engaged in a global cyber campaign against WhatsApp and Signal accounts, using phishing tactics to access sensitive information. Signal acknowledged recent targeted phishing attacks leading to account takeovers. Since Russia's invasion of Ukraine, its cyber operations have increasingly focused on disruptive tactics against Western allies.

AppWizard

March 11, 2026

Russian Hackers ‘Targeting Messaging Apps,’ Dutch Spies Say

Russian hackers are targeting messaging applications used by Dutch officials, including WhatsApp and Signal, as part of a global cyber campaign. They aim to infiltrate conversations of high-ranking officials, military personnel, and civil servants. Hackers are using tactics such as impersonating the Signal Support chatbot to obtain security credentials and exploiting the "linked devices" feature to access messages. The AIVD warns that this could lead to significant privacy and security breaches. Peter Reesink, director of military intelligence, cautions against using these apps for sensitive communications, echoing a Pentagon memo advising against the use of Signal due to threats from Russian hackers.

AppWizard

August 26, 2025

77 Malicious Android Apps With 19M Installs Targeted 831 Banks Worldwide

Zscaler’s ThreatLabz team identified 77 malicious applications on the Google Play Store with over 19 million installations, which target financial institutions and compromise user data. A new variant of the Anatsa banking trojan, also known as TeaBot, now targets over 831 banks globally, up from 650, and has expanded its reach to countries like Germany and South Korea. Many of these apps disguise themselves as document readers, with some exceeding 50,000 downloads. The malware downloads the Anatsa payload after installation and uses Android’s Accessibility Services to automate malicious activities, including stealing financial information and facilitating fraudulent transactions. The malware employs techniques to evade detection, such as obfuscating its code and using corrupted ZIP archives. The most prevalent Android malware identified was Joker, found in nearly 25% of the analyzed applications, known for stealing contacts and device data. A smaller subset of apps contained “maskware,” which engages in credential theft and personal data collection.

Winsage

March 8, 2025

Nearly 1 million Windows devices targeted in advanced “malvertising” spree

A recent cyber campaign targeted nearly 1 million devices across various sectors, using GitHub as the primary platform for hosting malicious payloads, with Discord and Dropbox also involved. The malware exfiltrated sensitive information from infected systems, including critical browser files that store login cookies, passwords, and browsing histories. Compromised files included specific SQLite and JSON files from Mozilla Firefox, Google Chrome, and Microsoft Edge, as well as files stored on Microsoft's OneDrive. The malware also targeted cryptocurrency wallet applications like Ledger Live and Trezor Suite. Microsoft identified that the domains hosting malicious advertisements were linked to unauthorized streaming platforms. Microsoft Defender has been updated to detect the attack-related files, and guidance has been provided for those who may have been affected.