Proofpoint found the PackClient RAT sold on Telegram and used by Chinese-speaking TA4922 malware operators in tax-themed phishing attacks. Related Posts: Malicious Browser Extensions Drain Crypto Wallets Amatera Password Stealer Abuses Service Workers and Smart Contracts Miraak Post Exploitation Framework Adopts Database C2 The post PackClient RAT: New C2 Framework Sold on Telegram appeared first on Daily CyberSecurity.

Russian hackers from the TA488 group exploited a Zimbra webmail flaw triggered when emails were opened or previewed, stealing credentials and up to 90 days of messages from victims.

Proofpoint details how attackers spoof OAuth client IDs to probe Microsoft Entra accounts, test credentials and bypass common sign-in detections at cloud scale.

Proofpoint says TA4922, a suspected China aligned cybercrime group, is targeting UK and European organisations with tax, payroll and benefits themed malware campaigns.