Sotwe logo Sotwe logo

Top Tweets for #MailMarshal

SpiderLabs's profile image
SpiderLabs @SpiderLabs
🪝🚨#PhishingAlert: #MailMarshal detected an active hiring-themed #phishing campaign that impersonates the background-screening provider HireRight and abuses #Calendly to deliver #ScreenConnect. The email links to an attacker-created Calendly routing form with a fake document-review button, such as 'View Document' or 'View Proposal'. Clicking it submits a Calendly Form Builder request that returns an 'arbitrary_url' result pointing to a ScreenConnect MSI installer. The browser then downloads the MSI from the attacker-controlled ScreenConnect instance, and running it gives the attacker remote access to the device. IOCs: Example abused Calendly URLs: hxxps[://]calendly[.]com/d/dt89-7hh-5ww hxxps[://]calendly[.]com/d/dvcz-23t-bf6 hxxps[://]calendly[.]com/d/d4jf-gpc-ddy ScreenConnect instance payload URL: hxxps[://]treffert[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest #RMM #IOC #cybersecurity #spiderlabs
SpiderLabs's tweet photo. 🪝🚨#PhishingAlert: #MailMarshal detected an active hiring-themed #phishing campaign that impersonates the background-screening provider HireRight and abuses #Calendly to deliver #ScreenConnect. The email links to an attacker-created Calendly routing form with a fake document-review button, such as 'View Document' or 'View Proposal'. Clicking it submits a Calendly Form Builder request that returns an 'arbitrary_url' result pointing to a ScreenConnect MSI installer. The browser then downloads the MSI from the attacker-controlled ScreenConnect instance, and running it gives the attacker remote access to the device. IOCs: Example abused Calendly URLs: hxxps[://]calendly[.]com/d/dt89-7hh-5ww hxxps[://]calendly[.]com/d/dvcz-23t-bf6 hxxps[://]calendly[.]com/d/d4jf-gpc-ddy ScreenConnect instance payload URL: hxxps[://]treffert[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest #RMM #IOC #cybersecurity #spiderlabs
0
11
4
4
917
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🪝 We are observing active PDF #phishing campaigns impersonating #Adobe and #Microsoft that redirect victims to #Wazza Kit device code phishing pages hosted on https://t.co/CHDeYp0J6n. - #MailMarshal detected phishing emails from compromised accounts containing PDF attachments with document-themed lures - The broader campaign leverages Google Sites (https://t.co/Vh1HaUH8bz), Cloudflare Workers (https://t.co/CHDeYp0J6n), and .eu Top Level Domains to host phishing content and related infrastructure - Wazza kit supports 19 themes via the ‘?thm=‘ URL parameter across six lure categories: file-sharing, account, document, payment, HR, cloud and brand impersonation. - The kit validates URL patterns, including subdomain and slug checks, to selectively serve phishing content and redirect non-targets to decoy pages.   #IOCs: beacon-surge-sync[.]workers[.]dev beton-beton[.]eu bike-msca[.]eu bodi-project[.]eu bruoth-family[.]eu cardamomo[.]eu coppietersrecherche[.]eu diabetesnet[.]eu dymowski[.]eu euniverza[.]eu hutspotmaken[.]eu illuminatedminds[.]eu jetcapital[.]eu languagesforwork[.]eu lesbolides[.]eu mdiament[.]eu nbi-training[.]eu nellarmonia[.]eu originalpizza[.]eu polskaprezydencjacsr[.]eu robologic[.]eu safetystock[.]eu electroloys[.]com hacsg[.]com sites[.]google[.]com/view/hgfdsqazxcvhjoswwqq/home sites[.]google[.]com/view/adobe-docus/home sites[.]google[.]com/view/miticabo/home sites[.]google[.]com/view/ctfvygbuhgyftvbgyfpoiuytrftgyh/home sites[.]google[.]com/view/kjvcfdswqazxcfvghjoplkjmnbvcf/home sites[.]google[.]com/view/securespdf/home sites[.]google[.]com/view/onwajuly/home dv0psh-purv3w-azfn-b2c0-msauth3-m365svc-s3ntln-4zrfn3x-cntnrx[.]workers[.]dev ssosvc-m365s-kvl-dv0pshb-s3ntln-c0mply-4zrmonx-apimgwx-evnthb[.]workers[.]dev wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev purv3w3-t3ms4pp-certs-intun3-sbussvx-4zredg-siemsv-pip3ln-0ffc3[.]workers[.]dev
SpiderLabs's tweet photo. 🪝 We are observing active PDF #phishing campaigns impersonating #Adobe and #Microsoft that redirect victims to #Wazza Kit device code phishing pages hosted on https://t.co/CHDeYp0J6n. - #MailMarshal detected phishing emails from compromised accounts containing PDF attachments with document-themed lures - The broader campaign leverages Google Sites (https://t.co/Vh1HaUH8bz), Cloudflare Workers (https://t.co/CHDeYp0J6n), and .eu Top Level Domains to host phishing content and related infrastructure - Wazza kit supports 19 themes via the ‘?thm=‘ URL parameter across six lure categories: file-sharing, account, document, payment, HR, cloud and brand impersonation. - The kit validates URL patterns, including subdomain and slug checks, to selectively serve phishing content and redirect non-targets to decoy pages.   #IOCs: beacon-surge-sync[.]workers[.]dev beton-beton[.]eu bike-msca[.]eu bodi-project[.]eu bruoth-family[.]eu cardamomo[.]eu coppietersrecherche[.]eu diabetesnet[.]eu dymowski[.]eu euniverza[.]eu hutspotmaken[.]eu illuminatedminds[.]eu jetcapital[.]eu languagesforwork[.]eu lesbolides[.]eu mdiament[.]eu nbi-training[.]eu nellarmonia[.]eu originalpizza[.]eu polskaprezydencjacsr[.]eu robologic[.]eu safetystock[.]eu electroloys[.]com hacsg[.]com sites[.]google[.]com/view/hgfdsqazxcvhjoswwqq/home sites[.]google[.]com/view/adobe-docus/home sites[.]google[.]com/view/miticabo/home sites[.]google[.]com/view/ctfvygbuhgyftvbgyfpoiuytrftgyh/home sites[.]google[.]com/view/kjvcfdswqazxcfvghjoplkjmnbvcf/home sites[.]google[.]com/view/securespdf/home sites[.]google[.]com/view/onwajuly/home dv0psh-purv3w-azfn-b2c0-msauth3-m365svc-s3ntln-4zrfn3x-cntnrx[.]workers[.]dev ssosvc-m365s-kvl-dv0pshb-s3ntln-c0mply-4zrmonx-apimgwx-evnthb[.]workers[.]dev wndws-pip3ln-sql3-waf3-purv3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev purv3w3-t3ms4pp-certs-intun3-sbussvx-4zredg-siemsv-pip3ln-0ffc3[.]workers[.]dev
1
8
4
5
1K
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🪝#Phishing Alert: LevelBlue #MailMarshal has detected a phishing campaign targeting hotels, venues, and wedding service providers. Threat actors are sending convincing fake business inquiries covering wedding venues, event planning, and related services to trick recipients into responding. The initial emails contain no links or attachments and use recently registered Reply-To domains. Once a target replies, attackers follow up with another email with either phishing links or malware attachments. IOCs: absolutdmc[.]com apexvistaventures[.]com aurellefashion[.]com eu-starstups[.]com eventr[.]cc grandcrestevents[.]com grandstayrental[.]com inwoods-hotels[.]com iwonderpicture[.]com quantumtradecollective[.]com shinilglobals[.]art sophiaevent10[.]com sophiatech[.]xyz westsinvalencia[.]com westpeakproperties[.]net
SpiderLabs's tweet photo. 🪝#Phishing Alert: LevelBlue #MailMarshal has detected a phishing campaign targeting hotels, venues, and wedding service providers. Threat actors are sending convincing fake business inquiries covering wedding venues, event planning, and related services to trick recipients into responding. The initial emails contain no links or attachments and use recently registered Reply-To domains. Once a target replies, attackers follow up with another email with either phishing links or malware attachments. IOCs: absolutdmc[.]com apexvistaventures[.]com aurellefashion[.]com eu-starstups[.]com eventr[.]cc grandcrestevents[.]com grandstayrental[.]com inwoods-hotels[.]com iwonderpicture[.]com quantumtradecollective[.]com shinilglobals[.]art sophiaevent10[.]com sophiatech[.]xyz westsinvalencia[.]com westpeakproperties[.]net
0
7
6
1
916
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨 Phishing Alert: New phishing mail mimics urgent #Zoom invites from colleagues. Victims are led to a fake meeting page with video of “participants” to steal login info. Don’t click suspicious links — always verify! 🔒 #CyberSecurity #Phishing #Scam #MailMarshal   IoCs: hxxps://tracking[.]cirrusinsight[.]com/e39ee0e9-c6e2-4294-8151-db8d9e454e24/one-ebext-in-openurl#targetid=john[.]doe@company[.]com&uname=john[.]doe&4030483277383-2874893
hxxps://pub-51656ae3d0ef4f2ba59cdfc6830c8098[.]r2[.]dev/meeting[.]htm?utm_campaign=8634688-zm-30000&utm_source=ppc#targetid=john[.]doe@company[.]com&uname=john[.]doe&4030483277383-2874893
POST: hxxps://api[.]telegram[.]org/bot7643846141:AAH3xkttszS0hQgqj7PaS_f7XetLz-_DTQc/sendMessage   
SpiderLabs's tweet photo. 🚨 Phishing Alert: New phishing mail mimics urgent #Zoom invites from colleagues. Victims are led to a fake meeting page with video of “participants” to steal login info. Don’t click suspicious links — always verify! 🔒 #CyberSecurity #Phishing #Scam #MailMarshal   IoCs: hxxps://tracking[.]cirrusinsight[.]com/e39ee0e9-c6e2-4294-8151-db8d9e454e24/one-ebext-in-openurl#targetid=john[.]doe@company[.]com&uname=john[.]doe&4030483277383-2874893
hxxps://pub-51656ae3d0ef4f2ba59cdfc6830c8098[.]r2[.]dev/meeting[.]htm?utm_campaign=8634688-zm-30000&utm_source=ppc#targetid=john[.]doe@company[.]com&uname=john[.]doe&4030483277383-2874893
POST: hxxps://api[.]telegram[.]org/bot7643846141:AAH3xkttszS0hQgqj7PaS_f7XetLz-_DTQc/sendMessage   
0
39
12
21
9K
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨🪝 Phishers impersonate The New York Times to deliver a #fakenews about Trump's assassination. The link on the email points to a credential #phishing page hosted at #cloud platform Timeweb. #PhishingAlert #MailMarshal #SpiderLabs #USAElection2024
SpiderLabs's tweet photo. 🚨🪝 Phishers impersonate The New York Times to deliver a #fakenews about Trump's assassination. The link on the email points to a credential #phishing page hosted at #cloud platform Timeweb. #PhishingAlert #MailMarshal #SpiderLabs #USAElection2024 https://t.co/dV2aU2MfKF
0
5
1
0
508
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨🪝 #PhishingAlert: This Microsoft phishing page uses two layers of captcha verification to evade security crawlers. The first one is a simple math problem followed by a Cloudflare turnstile. #MailMarshal #IoCs: hxxps://trailer[.]web-view[.]net/Links/0X04F1AC49BF369B793BB5EC207083308ACDFF05DA592FD1CD7F0EFD49645C4BDA934262F42A9D6229E051ECAB18E836AACC8A02FBD3EF44EC046ED1B003034C97CF9966854362669D.htm hxxps://booniecart[.]com/serverprotocoltls/?id=q9w8nfu29dk&tracking=4jfn92x!@&session=88kfl03pf&user=visitor987#info=secureMode&data=z9x8sjs7k2!&log=timeout@ssl#extra-check=kdm92lmn&flag=end-session!fsd@4 hxxps://kxbvp[.]nr3xc[.]com/wko/
SpiderLabs's tweet photo. 🚨🪝 #PhishingAlert: This Microsoft phishing page uses two layers of captcha verification to evade security crawlers. The first one is a simple math problem followed by a Cloudflare turnstile. #MailMarshal #IoCs: hxxps://trailer[.]web-view[.]net/Links/0X04F1AC49BF369B793BB5EC207083308ACDFF05DA592FD1CD7F0EFD49645C4BDA934262F42A9D6229E051ECAB18E836AACC8A02FBD3EF44EC046ED1B003034C97CF9966854362669D.htm hxxps://booniecart[.]com/serverprotocoltls/?id=q9w8nfu29dk&tracking=4jfn92x!@&session=88kfl03pf&user=visitor987#info=secureMode&data=z9x8sjs7k2!&log=timeout@ssl#extra-check=kdm92lmn&flag=end-session!fsd@4 hxxps://kxbvp[.]nr3xc[.]com/wko/
0
3
1
0
681
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨 #PhishingAlert: Fraudsters abuse Paypal's payment note feature for Callback Phishing scheme to steal Paypal login credentials. #MailMarshal #PayPal #Phishing
SpiderLabs's tweet photo. 🚨 #PhishingAlert: Fraudsters abuse Paypal's payment note feature for Callback Phishing scheme to steal Paypal login credentials. #MailMarshal #PayPal #Phishing https://t.co/rSjwDWque6
0
4
0
0
604
SpiderLabs's profile image
SpiderLabs @SpiderLabs
[1/2] 🚨 #MalspamAlert: WSHRAT is being distributed using a payroll lure to trick users into opening an HTML attachment. This attachment downloads a JS file that ultimately leads to #WSHRAT. IoCs coming soon... #MailMarshal #HTML #malspam
SpiderLabs's tweet photo. [1/2] 🚨 #MalspamAlert: WSHRAT is being distributed using a payroll lure to trick users into opening an HTML attachment. This attachment downloads a JS file that ultimately leads to #WSHRAT. IoCs coming soon... #MailMarshal #HTML #malspam https://t.co/qedEsAxmfU
0
4
0
0
953
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🎣📨 #PhishingAlert: Fake IT email notification related to recent #CrowdStrike issue leads to #Microsoft phishing page through multiple open redirects. #MailMarshal #Trustwave #SpiderLabs #EmailSecurity
SpiderLabs's tweet photo. 🎣📨 #PhishingAlert: Fake IT email notification related to recent #CrowdStrike issue leads to #Microsoft phishing page through multiple open redirects. #MailMarshal #Trustwave #SpiderLabs #EmailSecurity https://t.co/14PiW1QEkQ
0
5
1
1
520
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨 #MalspamAlert: A large-scale batch file attachment spam campaign distributing StrelaStealer is targeting users in Europe. IoC: 45[.]9.74.32 #MailMarshal #SpiderLabs #Trustwave #Cybersecurity
SpiderLabs's tweet photo. 🚨 #MalspamAlert: A large-scale batch file attachment spam campaign distributing StrelaStealer is targeting users in Europe. IoC: 45[.]9.74.32 #MailMarshal #SpiderLabs #Trustwave #Cybersecurity https://t.co/kEI1KVS1RR
0
5
1
1
537
SpiderLabs's profile image
SpiderLabs @SpiderLabs
1/2 🚨 #MalspamAlert: We've detected an XWorm campaign using payment-themed emails with ZIP attachments containing suspicious URL files. These URLs facilitate the download of XWorm payloads from remote SMB servers. #MailMarshal #XWorm
SpiderLabs's tweet photo. 1/2 🚨 #MalspamAlert: We've detected an XWorm campaign using payment-themed emails with ZIP attachments containing suspicious URL files. These URLs facilitate the download of XWorm payloads from remote SMB servers. #MailMarshal #XWorm https://t.co/xX3zqB0jGw
0
3
1
0
1K
SpiderLabs's profile image
SpiderLabs @SpiderLabs
#IOCs: hxxps[://]adclick[.]g[.]doubleclick[.]net/pcs/click?26June_20245958505-2024-B2CS62&&adurl=hxxps[://]kiuestasi[.]com/ 26-June-<random strings>.vbs d485880398bf810e1370079c63910bec DarkGate C2: 91[.]222.173.170 For prevention help, check out @Trustwave #MailMarshal.
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨 #MalspamAlert: Beware of #DarkGate #malware! Victims receive emails with either payroll or payment PDF lures. These PDFs contain links that download a VBS loader, leading to the deployment of AutoIT scripts and the DarkGate payload.
SpiderLabs's tweet photo. 🚨 #MalspamAlert: Beware of #DarkGate #malware! Victims receive emails with either payroll or payment PDF lures. These PDFs contain links that download a VBS loader, leading to the deployment of AutoIT scripts and the DarkGate payload. https://t.co/QgBCiKQEku
0
2
1
0
1K
0
3
0
0
656
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨 #Malspam campaign abusing MS Project file spotted. The MPP file has a macro that will download an executable file through a JScript hidden in itself. Send us a message for additional details. #MailMarshal #malware #cybersecurity
SpiderLabs's tweet photo. 🚨 #Malspam campaign abusing MS Project file spotted. The MPP file has a macro that will download an executable file through a JScript hidden in itself. Send us a message for additional details. #MailMarshal #malware #cybersecurity https://t.co/g6MFTWbY2x
0
3
1
2
794
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨 #PhishingAlert: Phishing campaign using Microsoft Authenticator lure abuses QR code generator to redirect to Microsoft phishing log-in page. #MailMarshal #Phishing #QR #Microsoft
SpiderLabs's tweet photo. 🚨 #PhishingAlert: Phishing campaign using Microsoft Authenticator lure abuses QR code generator to redirect to Microsoft phishing log-in page. #MailMarshal #Phishing #QR #Microsoft https://t.co/Heb5HUr8zj
0
3
2
0
633
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🪝🎣 #Phishing Alert: QR hidden on the MHT file embedded on the document attachment. Emails observed are HR-themed. #quishing #MailMarshal
SpiderLabs's tweet photo. 🪝🎣 #Phishing Alert: QR hidden on the MHT file embedded on the document attachment. Emails observed are HR-themed. #quishing #MailMarshal https://t.co/i1uHG5jjOs
0
4
0
2
413
SpiderLabs's profile image
SpiderLabs @SpiderLabs
🚨 #Malspam Alert: #MailMarshal identifying HTML smuggling embedded in a PDF delivering the notorious #AgentTesla. Threat actors deploy crafty PDFs, using OpenAction & JavaScript to auto-open embedded HTML, creating a seamless and stealthy delivery pathway for the payload.
SpiderLabs's tweet photo. 🚨 #Malspam Alert: #MailMarshal identifying HTML smuggling embedded in a PDF delivering the notorious #AgentTesla. Threat actors deploy crafty PDFs, using OpenAction & JavaScript to auto-open embedded HTML, creating a seamless and stealthy delivery pathway for the payload. https://t.co/uEFnmtuouQ
1
2
1
3
733
sysob's profile image
sysob IT-Distributor @sysob
E-Mails – das größte Potenzial für Cyberkriminalität Wieso sollten Hacker die Kellertüre benutzen, wenn der Hauseingang weit offensteht. #emailsecurity #datasecurity #mailmarshal #trustwave https://t.co/DfWVgFtTiW
0
1
0
0
39
sysob's profile image
sysob IT-Distributor @sysob
E-Mails – das größte Potenzial für Cyberkriminalität Wieso sollten Hacker die Kellertüre benutzen, wenn der Hauseingang weit offensteht. #emailsecurity #datasecurity #mailmarshal #trustwave https://t.co/DfWVgFtTiW
0
1
0
0
32
sysob's profile image
sysob IT-Distributor @sysob
Die #EmailSicherheit von @Trustwave heißt in Zukunft wieder #MailMarshal. https://t.co/hXwTg3ITHW #cybersecurity #datasecurity #emailsecurity #pentesting #compliance
sysob's tweet photo. Die #EmailSicherheit von @Trustwave heißt in Zukunft wieder #MailMarshal. https://t.co/hXwTg3ITHW #cybersecurity #datasecurity #emailsecurity #pentesting #compliance https://t.co/voPrccwXEU
0
2
2
0
0
AgainstScams's profile image
FriendsAgainstScams @AgainstScams
Are you, or someone you know, inundated with scam mail? ✉️ Sign up as a #MailMarshal today! For more info on what a Mail Marshal is, please visit our webpage: https://t.co/ciRYaUOSXh #FriendsAgainstScams #ScamAware #FASMillion
AgainstScams's tweet photo. Are you, or someone you know, inundated with scam mail? ✉️ Sign up as a #MailMarshal today! For more info on what a Mail Marshal is, please visit our webpage: https://t.co/ciRYaUOSXh #FriendsAgainstScams #ScamAware #FASMillion https://t.co/4SLKayWmSK
0
2
1
1
0

Last Seen Hashtags on Sotwe

shoplyfterfull
Seen from Turkey
parmaklama
Seen from Turkey
เอ้าท์ดอ
Seen from United States
brosis
Seen from Colombia
school pussy
Seen from Turkey
minecraftnsfw
Seen from United States
TrafficOnTheOnes
Seen from United States
mom #anal
Seen from Turkey
ManuelFerrara
gazianteptraveſti
Seen from Turkey

Trends for you

1
#UFC334
Under 10K tweets
2
#AEWFullGear
Under 10K tweets
3
Arch Manning
Under 10K tweets
4
Wonderboy
Under 10K tweets
5
Texas
Under 10K tweets
6
Ciampa
Under 10K tweets
7
#OlandriaxBaby2Baby
Under 10K tweets
8
Sark
Under 10K tweets
9
Stein
Under 10K tweets
10
Beamer
Under 10K tweets

Most Popular Users

elonmusk's profile image
1
Elon Musk Verified account
@elonmusk
240.8M followers
barackobama's profile image
2
Barack Obama Verified account
@barackobama
118.8M followers
cristiano's profile image
3
Cristiano Ronaldo Verified account
@cristiano
114.5M followers
realdonaldtrump's profile image
4
Donald J. Trump Verified account
@realdonaldtrump
111.9M followers
narendramodi's profile image
5
Narendra Modi Verified account
@narendramodi
107M followers
rihanna's profile image
6
Rihanna Verified account
@rihanna
98.7M followers
nasa's profile image
7
NASA Verified account
@nasa
92.2M followers
justinbieber's profile image
8
Justin Bieber Verified account
@justinbieber
91.8M followers
katyperry's profile image
9
KATY PERRY Verified account
@katyperry
90M followers
taylorswift13's profile image
10
Taylor Swift Verified account
@taylorswift13
84M followers
ladygaga's profile image
11
Lady Gaga Verified account
@ladygaga
75.5M followers
imvkohli's profile image
12
Virat Kohli Verified account
@imvkohli
73.4M followers
kimkardashian's profile image
13
Kim Kardashian Verified account
@kimkardashian
70.8M followers
youtube's profile image
14
YouTube Verified account
@youtube
68.7M followers
neymarjr's profile image
15
Neymar Jr Verified account
@neymarjr
66.4M followers
billgates's profile image
16
Bill Gates Verified account
@billgates
65.2M followers
selenagomez's profile image
17
Selena Gomez Verified account
@selenagomez
63.1M followers
theellenshow's profile image
18
The Ellen Show
@theellenshow
62.2M followers
cnn's profile image
19
CNN Verified account
@cnn
61.7M followers
x's profile image
20
X Verified account
@x
60.6M followers