Threat actors are adapting @signalapp phishing campaigns: Ukrainian users now receive messages allegedly from Signal about “mandatory 2FA” due to ongoing attacks.
No codes are requested yet – this is a trust-building step before attempts to steal login codes and hijack accounts.
🔎 New analysis of a credential phishing campaign
It leverages domain-adaptive infrastructure to evade detection and increase the success rate of account compromise.
Details: https://t.co/VifSEAnGwl
Large-scale phishing attacks keep evolving, abusing trusted platforms like Google, Cloudflare, Vercel, and Telegram. Pre-built kits enable massive scaling. A new “Meta Verified” tactic steals credentials and bypasses 2FA in real time via Telegram exfiltration.
Today we observed an active phishing campaign linked to Russia-aligned threat actors.
Emails impersonated Ukrainian government institutions and delivered malicious attachments. The campaign is aimed at infecting Windows endpoints and establishing persistent remote access.
Find more domains on @ValidinLLC :
CERT_FINGERPRINT-HOST: 1fa3e6f0a65b7429219022eee3a7976f6761aba0
HOST-JARM: 27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6
DSLU is tracking a phishing campaign targeting Facebook accounts. Attackers are abusing Meta Business Suite invites and using two attack vectors: a link to a phishing website and a link prompting users to join a fake Facebook page.
👉 More IOCs:
https://t.co/mr8gmzwAo0
👉 Track IOCs in VT:
entity:domain ukr-one.* AND jarm:"00000000000000000042d43d00041da8040ca1d7d1b3e955a3535eb361ef06"
⚠️ Attackers are using hacked Telegram accounts to spread fake invitations to “vote for kids in a drawing contest.” The links lead to phishing sites stealing account credentials.
🚨 Six months of prep. One day targeting Ukraine’s humanitarian networks including individuals from the @ICRC, @UNICEF, and @NRC_Norway.
New from @LabsSentinel and the @DSLab_Ukraine: A one-day spearphishing operation — PhantomCaptcha — that targeted humanitarian organizations in Ukraine using a fake Cloudflare captcha page to deliver a WebSocket RAT. https://t.co/G8jD84vSSS
SentinelLABS, together with Digital Security Lab of Ukraine, has uncovered a coordinated spear-phishing campaign targeting organizations critical to Ukraine’s war relief efforts. https://t.co/zkOAEwPraR
4/ The PhantomCaptcha campaign highlights a highly capable adversary collecting intelligence on humanitarian and reconstruction operations in Ukraine.
➡️ Full details in report: https://t.co/LIvciCD6YD
🚨 @SentinelLabs, together with the Digital Security Lab of Ukraine, has uncovered a coordinated spearphishing campaign targeting members of the Red Cross, Norwegian Refugee Council, UNICEF, and other NGOs supporting Ukraine, as well as regional government officials.
3/ Despite six months of preparation, the attackers’ infrastructure was active for only one day – reflecting meticulous planning, compartmentalized setup, and strong operational security.