Discover how the Spring Ring vishing campaign uses Microsoft Teams phishing tactics to trick employees into installing malware and giving up remote access.

Related Posts:

• US Offers $10M for IRGC Cyber Leader
• Coder Registry Attack: Hijacked Cloudflare Pool Served Malicious Terraform Modules
• Toy Ghouls Backdoor Uses HiveMQ and Element for C2

The post Spring Ring Vishing Campaign Targets Microsoft Teams appeared first on Daily CyberSecurity.

Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling. Instead of using these characters to hide instructions from people while exposing them to AI models, the attacker used them to split financial lure words such as ‘funding’ to prevent email filters from parsing them.

The finding emerged from Microsoft Defender for Office 365 prompt injection protection research, showing how AI-era evasion techniques can surface in traditional phishing campaigns. In Microsoft telemetry, hits on a hunting signature designed to detect ASCII-smuggling increased sharply beginning February 9, 2026, and remained elevated on weekdays for approximately three months. Microsoft Defender for Office 365 telemetry showed that the majority of messages were flagged by layered protections rather than by reliance on a single Unicode-specific signal.

What is ASCII smuggling?

“ASCII smuggling” refers to the use of invisible or non-rendering Unicode characters to hide content inside text that looks normal. The most abused range is the Unicode Tags block, U+E0000 to U+E007F. This block contains a shadow copy of the printable ASCII characters (for example, U+E0041 mirrors ‘A’, U+E0061 mirrors ‘a’). The block was originally intended for language tagging and is now largely deprecated.

The important property for an attacker is this: most of these code points are not rendered by typical fonts and user interfaces. A string can therefore carry a message that is not readable to a human but will be processed by any language model or other software that receives a copy of the email content.

Why the AI-security world made it famous

Over the past year, ASCII smuggling became a recurring technique in the prompt injection and cross-prompt injection (XPIA) literature. The attack pattern is straightforward:

1. An attacker hides instructions inside invisible tag characters embedded in a web page, document, email, or other content.
2. A human (and many user interfaces) sees nothing unusual.
3. An AI assistant that ingests the raw text does “see” the hidden characters, decodes them as text, and may be induced to follow threat actor-controlled instructions, potentially including data exposure or unauthorized actions depending on the assistant’s permissions and safeguards.

Because this technique cleanly demonstrates the gap between what the human sees and what the model reads, it appeared frequently in AI red-teaming write-ups, conference talks, and tooling throughout 2025. That attention put a spotlight on the U+E0000-U+E007F range.

Because tag characters are invisible to humans but exist at the text-processing level, the same property that makes them useful for smuggling instructions into a model also makes them useful for obfuscating keywords before a detector evaluates them. The intent is inverted, but the mechanism is similar and a user’s suspicions are not raised.

Writing a practical ASCII-smuggling signature

As part of work on Microsoft Defender for Office 365 prompt injection protection, we built hunting logic for email-borne XPIA and prompt obfuscation patterns: content that looks harmless to users but may carry hidden instructions for an AI system that ingests the raw message. The same hunt designed to identify prompt injection risk in email became the starting point for this phishing-evasion discovery.

One practical way to hunt for ASCII smuggling is to look for messages carrying characters from the Unicode tags block (U+E0000-U+E007F), the hallmark of attempts to hide instructions from, or for, an AI model. That broad signature is a useful starting point, but it needs enough Unicode context to avoid mistaking legitimate tag-character sequences for abuse.

The first version simply flagged any code point in that range, which proved too blunt. It kept firing on a small subset of perfectly legitimate messages – which, on inspection, all contained one of three subdivision flag emojis: the flags of England, Scotland, and Wales – because those emojis are encoded using tag characters.

After those exclusions, remaining hits were mostly benign artifacts from email-security gateways, mailbox providers, and security or AI researchers forwarding or testing messages that contained tag characters. This provided a good baseline where any spikes would indicate abuse of this technique by attackers.

Figure 1. The three subdivision flag emojis – England, Scotland, and Wales – that tripped the naive signature. Each is encoded as a sequence of invisible Unicode tag characters (U+E0000-U+E007F).

Figure 2. The Wales flag emoji pasted into the ASCII Smuggler tool from Embrace The Red. What renders as a single flag is actually a base flag code point (U+1F3F4) followed by an invisible tag-character sequence spelling gbwls (U+E0067 U+E0062 U+E0077 U+E006C U+E0073) and a terminating tag (U+E007F) – the same U+E0000-U+E007F range the signature watches for.

What we observed: ASCII smuggling repurposed for phishing

New activity emerges in telemetry

The tuned ASCII-smuggling signature began as an AI-security hunt for hidden prompt injection content in email. Instead, it surfaced finance-themed phishing messages using the same Unicode range for filter evasion.

On February 9, 2026, signature hits increased sharply. The following chart reflects Microsoft Defender for Office 365 telemetry for the hunting signature over the measured period:

The day before onset (February 8) the signature fired on roughly 21,000 messages; the next day it fired on more than 1.3 million. Most of the emails can be formed into a cluster of roughly 150 finance-themed sender domains.

Observed over three months with a weekly rhythm

Continuing to track the clustered sender domains forward in time, we measured messages matching the activity described every day. The high-volume phase persisted for roughly three months after February 9 and dropped sharply after May 15, 2026. These dates bound the observed use of the specific technique in our telemetry, not the broader campaign, which started earlier without it and continued without it.

Two characteristics stand out:

• A strict weekly cadence. The campaign ran hard on weekdays and went almost completely silent every weekend. Sundays’ volume collapsed to a near-zero and then back to full volume the next day. This on/off pattern is typical of scheduled bulk-sending infrastructure.
• A long, gradual decline. After an intense first phase, with weekday volumes of 1 to 2.37 million messages, peaking on February 26, the numbers stepped down slowly to roughly 80% less per weekday by late March. The high-volume usage of the technique dropped sharply after May 15, with lower residual activity through mid-June and occasional smaller spikes.

After identifying the activity through this technique-specific signal, we connected it to a broader ActiveCampaign-delivered SBA-themed phishing campaign that Fortra had documented earlier. That earlier reporting indicates the campaign predated the adoption of Unicode tag characters; our analysis focuses on the period and messages in which this method was present, not the full lifetime of the broader campaign.

Not instruction smuggling, but filter evasion

Observed obfuscation pattern

When we looked at a sampling of the flagged messages, the surprise was there were no smuggled instructions to an AI assistant. Instead, the invisible tag characters were inserted inside common financial keywords, splitting them apart so that a literal signature or keyword match would fail.

For example, a finance lure term that appeared normal to the recipient could be transmitted with an invisible tag character in the middle:

funding

became:

fun⟨U+E0020⟩ding

Here, ⟨U+E0020⟩ represents the invisible Unicode TAG SPACE inserted between letters. In the messages we examined, the campaign did not encode a hidden ASCII message in the tag block; it used a single invisible tag character as a separator sprinkled inside high-signal words. Strictly speaking, this is invisible-character insertion using a code point from the ASCII-smuggling tag block, rather than full message smuggling.

Why it can affect detection

To a recipient, and to parsing pipelines that drop or normalize these characters, the word still reads as funding. To a detector matching the literal string funding, or a regex that does not account for interleaved invisible code points, the byte sequence no longer contains the contiguous keyword. Whether real-world detectors behave that way depends on their normalization step, which is examined below.

The bigger prize for the attacker, though, is not preventing the literal string matches; it is the ML- and NLP-based models that increasingly drive modern spam and phishing classification. Unless a filtering system takes a picture of a message and does OCR extraction over the visual image, it may miss this type of attack. A standard email classifier may not reason over whole words exactly as a human sees them; for efficiency, they can first split text into tokens or sub-word pieces. A clean lure term such as funding may be represented as a familiar token or a familiar sequence of sub-tokens. Insert an invisible U+E0020 into the middle, however, and the tokenizer may no longer see that same familiar unit. It might split the text into fun, an unexpected tag character, and ding; it might emit rare or unknown sub-tokens; or, if normalization runs first, it simply removes the U+E0020 character, leaving funding.

Why it can help defenders

There is also a defensive opportunity. Since this kind of manipulation appears so seldom in normal traffic, its presence becomes a high-confidence signal. A technique meant to make messages look more benign to ML models can instead give defenders a low-false-positive indicator to detect on.

What is known and what is new

Inserting invisible or look-alike characters to break keyword and signature matching is a long-standing evasion technique used in spam and phishing: defenders have for years seen zero-width spaces (U+200B), zero-width non-joiners, the no-break space (U+00A0), soft hyphens, and homoglyph substitutions used to fracture words so naive string matchers fail.

What is new is the specific characters and scale of the campaign:

• The character choice. Instead of the usual zero-width space or NBSP, this campaign reached for the Unicode Tags block. That block went from forgotten to famous over the past year because of AI security research into ASCII smuggling and prompt injections.
• The scale and discipline. At its peak in Microsoft telemetry, the campaign generated multi-million message daily volume.
• A possible detection blind spot. Because the Unicode Tags block is less commonly abused than zero-width spaces or NBSP, defenders should verify that normalization and tokenization pipelines handle tag characters consistently.

Financially themed sending domains

The campaign ran on hundreds of disposable, finance-themed sender domains with lures that resembled business loan, line-of-credit, and advance-funding phishing patterns often associated with fraud or credential-harvesting funnels. This pattern accounted for roughly 96% of the volume flagged by the hunting signature. The signature also fired on other domains, but those were unrelated senders – chiefly email-security gateways and personal mailbox providers – not part of the campaign.

A partial sample of sender domains counts from February 9, 2026 alone illustrates both the naming pattern and the per-domain volume:

Table 1. Top 20 (by signature hits) of the 148 finance-themed campaign sender domains seen on February 9, 2026, illustrating the naming convention and per-domain volume.

Every domain is just a recombination of the same small vocabulary. The 20 domains above are built from only 28 word-tokens:

advance · boost · business · capital · catalyst · choice · digital · direct · elevate · express · finance · funding · growth · guardian · harbor · loan · loans · loc · online · our · pulse · rocket · rush · the · united · wave · way · your

Sent through a legitimate email-marketing platform

The finance-themed domains in Table 1 are the brand (header / P2) domains the recipient sees, but the actual mail was relayed through infrastructure associated with the legitimate email-marketing platform ActiveCampaign. The platform, which is used widely for marketing, rewrites every outbound link in the message body to route through its own click-tracking domains (acemlnd[.]com and activehosted[.]com), so the URLs the recipient clicks do not point at the brand domain at all – they look like:

hxxps://＜account-id＞.acemlnd[.]com/＜tracking-token＞
hxxps://＜brand-subdomain＞.activehosted[.]com/＜tracking-token＞

Most of the flagged messages carried links associated with the platform’s tracking domains rather than direct links that point directly to the sender-branded domains. The envelope (P1) senders were platform subdomains of the form em-<id>.<brand-domain>.

ActiveCampaign response

Before we published this information, we shared our findings with ActiveCampaign to help them with this abuse, and they wanted us to share the following statement on their work to detect it:

“We appreciate Microsoft’s research and welcome collaboration with the security community to combat this activity. We take abuse, fraud, and security extremely seriously. We tested the specific technique described in this research against our content-moderation systems: messages containing invisible Unicode characters receive the same moderation verdicts as their unobfuscated equivalents, and heavy use of the technique is itself treated as a suspicious signal. We continually invest in improving our detection and prevention capabilities, including expanding our use of AI and machine learning to identify abusive sending behavior earlier in the account lifecycle.” — ActiveCampaign spokesperson

As with any shared sending service, attacker abuse of customer accounts or workflows can complicate reputation-based filtering. By originating from a reputable marketing platform with established IP reputation and authentication, the activity may appear more similar to legitimate marketing traffic and can complicate reputation-based filtering.

Most observed volume also originated from cloud-hosting ranges consistent with the platform’s outbound infrastructure, with the vast majority coming froma single network block, 173.236.20[.]0/24. This indicator helped us cluster the campaign more precisely but note that this is a legitimate segment that belongs to the abused service, and not an IOC on its own.

Identifying the campaign

Content and infrastructure remained consistent for a long time span, providing an effective way to easily fingerprint this phase of the campaign:

• Unicode content (primary). Invisible Unicode tag characters in the range U+E0000-U+E007F – specifically U+E0020 – spliced inside keywords. Legitimate mail rarely ever carries these code points: the one routine exception, the England/Scotland/Wales flag emojis, is easily excluded.
• Lure and brand pattern. Sender (header / P2) domains assembled from a small finance vocabulary – capital, fund/funding, loan, loc, lend, finance, business, express, growth, solutions, choice, hedge, pillar – recombined into fresh, disposable domains and rotated.
• Envelope (P1) pattern. The bulk of mail is relayed through a single email-marketing platform, recognizable by envelope shape rather than any one name:
  • per-account subdomains shaped em-<digits>.<brand-domain> (regex em-\d+\.), where a small set of reused account numbers fans out across hundreds of brand domains; and
  • the platform’s shared sending pool, shaped acems<N>[.]com and emsd<N>[.]com (e.g. emsd4[.]com, s9.acems10[.]com). Across the measured activity, ~98.5% of messages matched this envelope pattern, and ~99.8% matched the envelope pattern or the platform’s tracking-URL pattern (below).
• Tracking-URL pattern. Click/tracking links on the platform’s domains activehosted[.]com and acemlnd[.]com.
• Sending-origin pattern. The bulk of daily volume – about 92% across two measured weeks – originated from a single /24 network block, 173.236.20[.]0/24.

For a high-precision rule, look for the Unicode content pattern combined with the finance-brand pattern, using the sender infrastructure patterns as corroboration.

However, this is just a phase in a long-running broader campaign, that keeps adapting and evolving. The campaign was observed months earlier following a different set of behaviors and continued even after the usage of the specific technique was dropped. During these shifts in behavior, one signature may no longer describe the campaign, while another still matches.

Is there a detection gap?

The potential gap for mail-defense pipelines is whether Unicode tag characters are normalized or flagged before content detections run. In Defender, our filter stack can take a picture of message contents, extract visible text through OCR, and run analysis over that extracted text to avoid these types of tricks. Implementations vary, so defenders should test how these characters are handled in their own pipelines. For MDO protection, over 99% of messages were flagged by layers that did not depend on catching the tag characters directly, including sender, IP, URL and domain reputations, ML spam/phishing classification, brand-impersonation detection, authentication checks and more.

Emerging techniques don’t stay in one domain

ASCII smuggling earned its reputation as an AI attack, hiding instructions from people while leaving them visible to models. This campaign shows the same technique being repurposed for a different objective: obscuring phishing content from detection systems while remaining readable to the intended target.

The broader lesson is that security techniques rarely stay confined to a single domain. As AI-era attack methods become better understood, threat actors may adapt them for use in more traditional threats such as phishing and spam. This case illustrates how techniques that emerge in AI security research can quickly cross over into established attack ecosystems, reinforcing the need for defenders to view emerging threats through a cross-domain lens.

Mitigation and protection guidance

The core defensive principle is simple: normalize before you match. Any content that will be evaluated by keyword, signature, or regex logic should first have invisible and non-rendering Unicode code points stripped or folded, so that splicing them into a word no longer defeats the match.

Recommended controls

• Strip or normalize Unicode tag characters (U+E0000-U+E007F) – and other zero-width / invisible code points – from email subject and body text before applying spam and phishing content signatures.
• Treat the presence of tag-block characters as a strong anomaly signal. Outside known legitimate tag-sequence uses such as certain subdivision flag emojis, these code points are rare in ordinary mail and can be a high-value anomaly signal.
• Look for the behavioral fingerprint. The observed activity had a distinctive shape: bulk volume from churning, finance-themed disposable domains, on a strict weekday-on / weekend-off schedule. A sudden spike of tag-block characters concentrated on finance-themed senders, switching on and off weekly, is a high-confidence campaign indicator.
• Apply the same normalization upstream of AI ingestion. The same control that defeats this evasion also reduces XPIA / ASCII-smuggling exposure for AI assistants that ingest email content.

Microsoft protections

Microsoft Defender for Office 365 has heuristic detections in place to flag these the tactics employed in this type of campaign. The detection that first surfaced the spike continues to flag messages carrying Unicode tag-block characters, and the financially themed sending domains are being tracked and blocked as they rotate. Microsoft uses layered email protections, including standard and OCR content analysis, sender and domain reputation, URL detonation and reputation, bulk-mail detection, and anti-phishing models, to reduce reliance on any single signal that an attacker can try to evade.

Microsoft Defender for Office 365 prompt injection protection further helps protect against emails that contain prompt injection attempts, including cases where invisible characters are used to hide instructions from users while exposing them to AI systems. The same normalization and detection principles that reduce ASCII-smuggling-based prompt injection risk also help blunt this email-borne reuse of the technique for phishing evasion. Investments in AI security and traditional email security increasingly reinforce one another.

Coverage depends on product licensing, configuration, and telemetry.

Advanced hunting

These queries run against the EmailEvents Advanced Hunting table (and EmailUrlInfo for URL joins). They hunt the campaign by its infrastructure fingerprint – the finance-vocabulary brand senders and the marketing-platform envelope shape – rather than by the invisible tag characters, as the mail body is not exposed through the table’s columns. These queries are starting points and may require environment-specific tuning. The proactive defense is implemented with multiple layers of the enterprise mail-filtering pipeline.

1. Infrastructure pattern – finance-vocabulary senders relayed with the campaign’s envelope shape. Combines the brand-domain pattern (a header sender built from three or more adjacent finance/brand keywords, e.g. digital+capital+boost) with the envelope (MAIL FROM) shape em-<digits> / acems<digits> / emsd<digits> – the durable fingerprint that held across the entire period we measured.

// Finance/brand vocabulary the operator recombines into disposable domains.
let kwds = @"(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)";
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound"
// Header sender domain made of 3 or more adjacent finance/brand tokens.
| where SenderFromDomain matches regex strcat("(?i)", kwds, kwds, kwds)
// Envelope (MAIL FROM) shape: em-[digits] | acems[digits] | emsd[digits].
| where SenderMailFromDomain matches regex @"(?i)(em-|acems|emsd)\d"
| sort by Timestamp desc

For extra corroboration you can scope to the single dominant /24 that carried the bulk of this campaign’s volume, 173.236.20[.]0/24, by adding | where ipv4_is_in_range(SenderIPv4, “173.236.20.0/24”). Like the tracking URLs, that network block is shared platform space (it also carries unrelated legitimate newsletters), so use it to scope, never as a standalone filter.

2. Pivot on the platform tracking URLs. Start from the click/tracking links and join back to the mail events. Useful for scoping, but treat it as corroboration, not a verdict: the tracking domains activehosted[.]com and acemlnd[.]com are shared by every legitimate customer of the same marketing platform, so the URL on its own is not a malicious indicator. The finance-brand filter is what keeps this on the campaign; drop it only if you deliberately want a wider search.

let kwds = @"(capital|fund|hedge|express|solutions|choice|lend|growth|loan|loc|finance|business|pillar|advance|boost|catalyst|digital|direct|elevate|guardian|harbor|online|pulse|rocket|rush|united|wave|way|surge|swift|elite)";
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex strcat("(?i)", kwds, kwds, kwds)
| join kind=inner (
    EmailUrlInfo
    | where Timestamp > ago(30d)
    | where UrlDomain endswith "activehosted.com" or UrlDomain endswith "acemlnd.com"
    | distinct NetworkMessageId
  ) on NetworkMessageId 
| sort by Timestamp desc

3. Filter for prompt injection detection in emails

The feature used in the query below is available for Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5 customers.

EmailEvents
| where DetectionMethods has "Prompt Injection Protection"

MITRE ATT&CK techniques observed

This campaign exhibits the following MITRE ATT&CK® techniques. The table includes MITRE ATT&CK for phishing/evasion behavior and MITRE ATLAS for the AI-security technique class related to prompt obfuscation.

Indicators and hunting pivots

References

• Unicode Standard Annex #45 – Tags (U+E0000-U+E007F) – the deprecated Unicode tags block abused for ASCII smuggling
• ASCII Smuggler Tool: Crafting Invisible Text and Decoding Hidden Codes | Embrace The Red – public write-up showing how Unicode tag characters can hide text from users while remaining present to language models
• LLM Prompt Obfuscation | MITRE ATLAS™ – the AI-security technique class this evasion crossed over from
• Attackers exploit ActiveCampaign to deliver thousands of AI-generated SBA phish | Fortra – earlier reporting on the broader ActiveCampaign-delivered SBA-themed phishing campaign, before the Unicode tag-character evolution examined here

Learn More

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.  

• Learn more about securing Copilot Studio agents with Microsoft Defender 
• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation
• How Microsoft discovers and mitigates evolving attacks against AI guardrails

• Manipulating AI memory for profit: The rise of AI Recommendation Poisoning | Microsoft Security Blog – a related example of an AI-era technique observed in email traffic
• Defending the inbox against prompt injection attacks | Microsoft Defender for Office 365 Blog – feature announcement introducing prompt injection protection in Microsoft Defender for Office 365.
• Prompt injection protection in Microsoft Defender for Office 365 – official documentation of the prompt injection protection in Microsoft Defender for Office 365.
• How Microsoft discovers and mitigates evolving attacks against AI guardrails | Microsoft Security Blog

The post ASCII smuggling crosses over from AI prompt injection to phishing evasion appeared first on Microsoft Security Blog.

Ring’s new TAKE encryption limits video-key retention while keeping cloud AI features, Ring Verify, and optional end-to-end encryption in play.

The post Ring’s New TAKE Encryption Deletes Video Keys Without Giving Up AI Features appeared first on TechRepublic.

OpenAI disrupted a social engineering group from Cambodia that used ChatGPT. Its scope is impressive:

The network simultaneously conducted multiple types of scams, often blending elements from different schemes. For instance, operators used dating personas to build trust before introducing fraudulent investment opportunities involving cryptocurrencies and spot gold trading. Other users engaged in lengthy romantic conversations with targets using fictitious identities, posed as representatives of online gambling platforms offering fake bonuses and winnings, or impersonated law enforcement agencies to tell targets they needed to pay fines for committing serious criminal offenses.

Although the narratives varied, users across the network consistently displayed the same underlying pattern of deceptive behavior. For example, they created and operated fake dating profiles, fictitious investment experts, and fraudulent law enforcement personas. They also generated images of forged documents, including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.

Reverse engineering shows Microsoft's Paint app embeds an invisible, server-issued watermark into every AI-generated image, one users cannot fully disable.

Related Posts:

• Google Cloud Launches Gemini Enterprise for Finance and Law
• EA Anti-Cheat Secures Support for RTX SPARK
• Uber Fined $966 Million for Automated Driver Terminations

The post Reverse Engineering Reveals Microsoft’s Hidden InvisMark Watermark in Paint appeared first on Daily CyberSecurity.

INTERPOL’s Operation Jackal IV made 58 arrests and exposed global networks laundering money from scams, fraud and sextortion.

INTERPOL announced that Operation Jackal IV, running from November 2025 to June 2026, led to 58 arrests and identified 263 suspects tied to West African organized crime networks, groups like Black Axe that are responsible for a huge share of the world’s romance scams, crypto fraud, and business email compromise (BEC) schemes.

“Operation Jackal IV (November 2025 – June 2026) aimed to disrupt money laundering, identify high-value targets, seize assets, and support arrests and prosecution.” Interpol announced. “The operation, which brought together 22 countries from six continents, is a response to the escalating global threat posed by West African criminal networks – such as the Black Axe and other similar groups. These groups are responsible for a significant share of the world’s cyber-enabled financial fraud, typically through romance scams, cryptocurrency and investment scams or business email compromise fraud, as well as other serious and violent crimes.”

The goal wasn’t to chase individual scammers. Investigators followed the money behind the scams: shell companies, mule accounts and criminal services that help move and hide stolen funds. Tomonobu Kaya of INTERPOL’s Financial Crime and Anti-Corruption Centre explained the approach: By following illicit financial flows across borders, we are attacking the very lifeblood of organized crime.

Argentina turned up one of the operation’s biggest finds. Investigators identified 196 individuals connected to a crime-as-a-service network suspected of supplying website domains and laundering support specifically for West African criminal groups, resulting in 17 arrests. INTERPOL sent an Operational Support Team to help analyze seized data and map out the wider network of suspects, the kind of cross-border analytical work that individual national police forces usually can’t pull off on their own.

South African authorities raided seven locations in Johannesburg linked to a group running romance and investment scams against retirees in English-speaking countries.

The syndicate assigned members to specific roles, such as “conversion” and “retention” agents. The operation led to 39 arrests, $2.67 million seized and 257 bank accounts frozen, the largest number of arrests in the operation.

Italy’s case shows how much damage a single laundering account can absorb. One individual was tied to a pan-European laundering network moving money through shell companies and remittance services, and investigators traced €845,000 laundered through a single account across 560 separate transactions using 20 different financial instruments. That’s not a careless operator; that’s someone who understood exactly how to fragment a large sum into a pattern designed to look unremarkable at every individual step.

Romania’s case was the biggest by dollar value, and arguably the most brutal in its simplicity. A call center ran a fake investment scheme promising big returns on stocks and crypto, funneling victims’ money into wallets the operators controlled, and by the time authorities dismantled it, the estimated theft and laundering total had climbed to around €143 million globally. Eleven arrests and roughly €379,000 in cash and crypto seized, plus six properties and several luxury watches, is a real result, but it’s a fraction of what actually got stolen.

“Beyond individual cases, Operation Jackal IV also enabled the analysis of critical and emerging trends, including a rise in West African organized crime groups using sextortion to target minors, with victims as young as 14. Offenders typically contact minors via social media, build trust and coerce them into sharing explicit images or videos.” concludes INTERPOL. “They then threaten to distribute this material to the victim’s contacts unless a ransom is paid.”

The report’s darkest finding sits outside any single country’s arrest count. INTERPOL flagged a rising trend of these same criminal networks using sextortion against minors as young as 14, building trust through social media before coercing victims into sharing explicit images and then threatening to distribute that material unless a ransom gets paid. Some of these groups were even observed buying crime-as-a-service support through the dark web specifically to outsource pieces of that operation, treating exploitation infrastructure as just another service line alongside laundering and fraud.

That’s the uncomfortable throughline connecting every case here: these aren’t scattered opportunists, they’re networks running organized business models with specialized roles, outsourced services, and financial engineering sophisticated enough to move hundreds of millions across borders. Twenty-two countries coordinating for eight months produced real numbers, real arrests, real frozen accounts. It also produced a fairly clear picture of how much more organized this side of cybercrime has become, and how much further there is to go.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Operation Jackal)

Operation Jackal IV Targets West African Organized Crime Groups

Major Arrests and Financial Crime Investigations

Sextortion and Crime-as-a-Service Emerge

Apollo Global Management confirmed a social-engineering breach exposing sensitive personal data amid a wider hacking campaign targeting financial firms.

The post Apollo Confirms Data Breach Amid Cyberattacks Targeting Financial Firms appeared first on TechRepublic.

Four Spring vulnerabilities hit Spring Data REST and Spring AI, including CVE-2026-47849, a privilege escalation flaw. Patch to the fixed versions now.

Related Posts:

• EverShop CVE-2026-72843 Flaw Allows Unauthenticated Account Takeover
• CVE-2026-77806: SPIP Unauthenticated RCE Exploited in the Wild as Public Exploit Lands
• CVE-2026-75501: Public PoC for Calix Router Flaw That Bypasses NAT and Firewall Protections

The post Spring Data REST and Spring AI Vulnerabilities: Four High-Severity Flaws Patched appeared first on Daily CyberSecurity.

A company can have strong firewalls, modern endpoint protection, and carefully controlled access—and still find its brand being used as a weapon against customers, employees, and partners. 

That is the new reality of digital impersonation. Attackers can register lookalike domains, clone websites, create fake executive profiles, publish fraudulent job advertisements and imitate customer-support accounts without ever breaking into the legitimate organization. 

The objective is pretty simple. Borrow the credibility that a trusted brand has already built and use it to make a scam look legitimate. For professional services, financial, legal, and consulting organizations, that risk can be particularly damaging because trust is central to the business model. 

The Numbers Show Why Speed Matters 

The scale of digital fraud makes slow brand-abuse response difficult to justify. 

The FBI's 2025 Internet Crime Report recorded 1,008,597 complaints, marking the first time the Internet Crime Complaint Center (IC3) exceeded 1 million in a year. Reported losses reached $20.877 billion, up 26% from 2024. Phishing and spoofing were among the most frequently reported complaint types. 

Business email compromise was even more costly, producing approximately $3.05 billion in reported losses from 24,768 complaints. 

The Federal Trade Commission provides another measure of the impersonation problem. Consumers reported $3.5 billion in losses to imposter scams during 2025, with nearly one in three fraud reports involving impersonation. People reported losing nearly $1 billion to business impersonators alone. 

These figures represent reported losses, not the full economic impact. Fraudulent domains and profiles can disappear quickly, victims may never report incidents, and reputational damage is difficult to quantify. 

Professional Services Have More Than a Brand to Protect 

Consulting and professional services firms often handle sensitive client information, financial models, strategic plans, legal documents and confidential communications. That makes their identities valuable to criminals. 

The legal sector provides a useful comparison. The American Bar Association's cybersecurity research has previously found that 29% of surveyed lawyers reported that their firms had experienced a security breach. 

Impersonation adds another layer because the attacker may never enter the firm's network. A counterfeit website can steal credentials. A fake executive can request a payment. A fraudulent recruiter can collect applicant information. A fake support account can redirect customers to a malicious login page. 

The brand becomes the attack surface. 

Why Traditional Takedowns Become a Whack-a-Mole Exercise 

Conventional brand protection is often reactive. Someone discovers a suspicious domain, reports it to the registrar, contacts the hosting provider or social platform, and waits. 

That process can work—but it does not scale well against automated adversaries. 

By the time one fraudulent domain is removed, another may have appeared. A fake executive account can be recreated under a slightly different name. A phishing kit can be deployed against several brands simultaneously. Fraudsters can also move between websites, social networks, advertisements, application stores and messaging platforms. 

Counting the number of takedowns therefore tells only part of the story. A more meaningful measurement is the time from discovery to verification and from verification to removal. 

The shorter that window, the fewer opportunities an attacker has to reach victims. 

What AI Changes 

Artificial intelligence has made impersonation faster, cheaper, and more convincing. 

Attackers can generate polished phishing messages, translate campaigns for different markets, create synthetic personas, clone websites and produce increasingly convincing voice or video content. The FBI has also warned about scams involving AI-generated videos and spoofed websites used to create false legitimacy. 

Europol's 2025 Internet Organised Crime Threat Assessment similarly described a cybercrime economy increasingly powered by stolen data, which can support fraud, ransomware, extortion and other criminal activity. 

That means defenders face an uncomfortable imbalance: criminals can create fraudulent content almost instantly, while organizations may still investigate abuse manually. 

Brand security consequently must become faster without becoming careless. 

The Most Common Brand-Abuse Tactics 

Security teams should watch for a broad range of impersonation signals, including: 

• Typosquatting: domains using misspellings or visually similar characters. 

• Combosquatting: brand names combined with words such as “login,” “support” or “secure.” 

• Fake social profiles: cloned executive, employee, or company accounts. 

• Account takeovers: legitimate accounts hijacked and used to exploit an existing audience. 

• Cloned websites: replicas designed to collect credentials or payment information. 

• Fake mobile applications: counterfeit apps using familiar names, icons, or branding. 

• Fraudulent marketplace listings: fake products or services presented as legitimate. 

• Malicious QR codes: QR-based redirects leading victims to phishing infrastructure. 

• AI-generated impersonation: synthetic voices, images, video, and written communications. 

• Business email compromise: messages designed to trigger payments or sensitive disclosures. 

• Fake customer-support accounts: fraudulent profiles responding to real customer complaints. 

• Malicious search advertisements: paid placements directing users toward counterfeit sites. 

• Fake recruitment campaigns: fraudulent jobs used to collect personal or financial information. 

• Fake press releases: fabricated announcements intended to mislead customers, investors or the public. 

• Dark-web brand abuse: stolen credentials, data, and brand-specific fraud resources circulating in criminal communities. 

Conclusion 

Brand impersonation is no longer just a reputation issue—it can quickly become a pathway to phishing, fraud, credential theft, and customer harm. As AI enables attackers to create convincing fake websites, domains, social profiles, and campaigns at unprecedented speed, organizations need equally fast detection and response.  

Cyble’s brand monitoring and takedown services help organizations detect impersonation, validate malicious activity, and coordinate the removal of fraudulent assets before they can cause greater damage.  

With continuous visibility and managed takedown support, Cyble helps security teams stay protected from brand threats and protect customer trust.

See Cyble’s brand monitoring and takedown capabilities in action—request a demo today. 

Frequently Asked Questions (FAQs)  

1. What is brand impersonation in cybersecurity? 

Brand impersonation occurs when attackers imitate a legitimate company, executive, employee or digital channel to deceive customers, employees or business partners. Common examples include fake websites, lookalike domains, fraudulent social profiles, counterfeit applications and phishing emails. 

2. Why is AI making brand impersonation more dangerous? 

AI allows attackers to create convincing emails, websites, social profiles, synthetic identities, voice messages and other fraudulent content much faster and at greater scale. This makes it harder for organizations to rely on manual monitoring and reactive investigations. 

3. What brand impersonation tactics should security teams monitor? 

Security teams should monitor for typosquatting and lookalike domains, fake executive profiles, cloned websites, counterfeit apps, fraudulent job postings, fake customer-support accounts, malicious advertisements, phishing campaigns, AI-generated impersonation, and brand abuse on underground platforms. 

4. Why is rapid takedown important for brand protection? 

A fraudulent website or social profile can cause harm within minutes by stealing credentials, collecting personal information, or redirecting payments. Faster verification and takedown reduce the amount of time attackers have to reach potential victims. 

5. Can smaller and mid-sized organizations also be targeted? 

Yes. Attackers are not limited to globally recognized brands. Smaller and mid-sized organizations can also be attractive targets because they may have fewer resources dedicated to continuous brand monitoring and digital risk management. 

6. How can Cyble help with brand impersonation? 

Cyble’s brand monitoring and digital risk protection capabilities help organizations identify suspicious domains, fake profiles, fraudulent websites and other forms of digital brand abuse across the online ecosystem. By bringing detection and threat intelligence together, Cyble can help security teams investigate impersonation faster and take action before fraudulent assets cause greater damage. 

References 

• FBI 2025 Internet Crime Report 

• FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025 

Media Disclaimer: This blog was compiled from publicly available government advisories and open-source security reporting. It is provided for reference purposes only; readers bear full responsibility for their reliance on it. 

The post When the Attacker Wears Your Logo: Detecting and Taking Down Impersonation at AI Speed appeared first on Cyble.

Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies.

The post Identity Abuse Through Trusted Communication Channels appeared first on Unit 42.

MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure.

Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration. The findings demonstrate that although domains may rotate quickly, repeated execution patterns, request characteristics, staging behavior, and upload methods provide defenders with more durable opportunities to investigate MacSync Stealer activity. 

Activity overview 

Microsoft Defender Experts reviewed endpoint and network telemetry to determine which MacSync Stealer behaviors persisted as infrastructure changed. The investigation followed the activity from C2 communication through collection, staging, and exfiltration, using recurring technical traits to connect activity across rotating domains. Execution began from an interactive shell session consistent with ClickFix social engineering, where users are tricked into pasting or running commands in Terminal. The shell session used curl to retrieve attacker-controlled payload content, followed by script-driven execution and outbound communication. 

After execution, the malware communicated with attacker-controlled infrastructure using recurring URI paths, macOS User-Agent strings, API-key headers, and curl command-line options. These request traits became durable behavioral pivots because they remained consistent even as domains changed. The activity then progressed into collection behavior targeting macOS Keychain material, browser data, locally stored credentials, cloud and Secure Shell (SSH) credentials, and sensitive files from common user directories. 

The investigation also confirmed active data exfiltration, not just beaconing. Collected data was staged under temporary paths, compressed into an archive, split into chunks, and uploaded through HTTP PUT requests using curl with the –data-binary argument. Upload parameters such as upload_id, chunk_index, and total_chunks provided additional hunting opportunities that could be correlated with process, command-line, file, and network telemetry across the attack chain. 

Discovery of additional rotating infrastructure 

To identify related MacSync Stealer infrastructure, Microsoft Defender Experts required multiple endpoint and network behaviors to align before treating a domain as connected. Correlation focused on recurring traits across payload retrieval, C2 check-in, and exfiltration, including process ancestry, command-line patterns, request paths, headers, and upload parameters. Applying this standard linked more than 30 domains, making the domain count an outcome of the behavioral methodology rather than the primary finding. 

The strongest pivots combined network request shape with endpoint execution context. Related infrastructure shared recurring URI patterns such as /curl/, /dynamic?txd=, and /gate?buildtxd=; curl command lines using -k, -s, –max-time, and –data-binary; macOS User-Agent strings; API-key headers; and HTTP PUT uploads that included upload_id, chunk_index, and total_chunks parameters. RST Cloud used recurring URI patterns to surface eleven additional candidate domains and found a static API-key value shared across four confirmed C2 domains while the build token rotated per deployment. Domains were treated as related when multiple behavioral traits aligned across process, command-line, and network telemetry, reducing reliance on any single domain indicator. 

This finding reinforces a practical defender lesson: rotating infrastructure can weaken static domain blocking and retrospective IOC matching, but repeated request patterns and process behaviors create durable hunting opportunities. Figure 1 shows representative defanged command-line patterns used as pivots across payload retrieval, C2 check-in, and chunked upload activity. 

Figure 1. Representative behavioral pivots associated with MacSync Stealer payload retrieval, C2 check-in, and chunked HTTP PUT exfiltration. 

The same behavioral patterns used to identify additional infrastructure also map to the broader end-to-end activity observed on affected macOS devices. 

Attack chain overview

The observed MacSync Stealer activity followed a fast, script-driven attack chain designed to execute quickly on macOS, collect high-value local data, stage the results, and exfiltrate the archive through rotating web infrastructure. This sequence matters because each phase produces telemetry that can be correlated across processes, command-line, file, and network events. Rather than relying on any individual domain, defenders can track the chain through recurring execution tools, URI paths, staging locations, and upload parameters. 

Figure 2. MacSync Stealer attack chain showing payload retrieval, AppleScript-assisted execution, collection, staging, chunked exfiltration, and cleanup mapped to behavioral hunting opportunities. 

Phase 1: Initial access and payload execution

Observed execution began from an interactive zsh terminal session, where curl retrieved payload content over a /curl/ path before the payload was decoded or unpacked using native utilities such as Base64 and gunzip. This phase is useful for hunting because the combination of user-facing shell activity, curl retrieval, and unpacking behavior is more durable than any single download domain. 

Phase 2: AppleScript-assisted execution

The payload used osascript to run AppleScript-assisted shell commands, blending macOS scripting with Unix command-line tooling. Observed activities included sh, cp, rm, curl, mkdir, and killall operations. This phase creates hunting value when osascript launches shell activity that quickly chains into network communication, staging, or cleanup behavior. 

Phase 3: Discovery and data collection

After execution, the malware collected host and user information, enumerated running processes and system details, and checked for cryptocurrency wallet applications, including Ledger and Trezor-related local artifacts. It then targeted macOS Keychain material, browser Safe Storage keys, browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, extension storage, Safari data, Apple Notes, SSH keys, AWS credentials, Kubernetes configurations, browser profiles, browsing history, and sensitive files from common user directories. The hunting value comes from correlating sensitive data access with the later staging and upload sequence. 

Phase 4: Data staging and compression

Collected data was staged under /tmp/sync* paths and compressed into /tmp/osalogging.zip before uploading. The archive was split into multiple chunks, creating a repeatable staging and transfer pattern that defenders can correlate with preceding collection behavior and subsequent outbound curl traffic. 

Phase 5: Exfiltration over rotating infrastructure

The staged archive was uploaded through rotating infrastructure using curl and HTTP PUT requests. Observed requests included –data-binary, API-key headers, macOS User-Agent string, upload_id values, chunk_index values, and total_chunks parameters. These upload traits confirmed active data exfiltration and provided durable hunting pivots even when domains rotated. 

Phase 6: Cleanup and evidence removal

After exfiltration, the malware removed temporary archives, staging folders, lock files, and other artifacts. Although this cleanup reduced on-disk evidence, the sequence of archive creation, chunked upload, and deletion can still provide a useful behavioral correlation for defenders. 

Mitigation and protection guidance

The attack chain findings point to three mitigation priorities.

1. Organizations should reduce the risk of user-initiated Terminal execution by educating users and using platform controls that interrupt suspicious paste-and-run workflows. Microsoft’s ClickFix reporting recommends educating users not to run commands from untrusted sources and monitoring suspicious Terminal or shell activity associated with these lures. 

2. Defenders should monitor post-execution behavior when initial prevention does not stop activity, including suspicious shell usage, AppleScript-assisted commands, curl-based payload retrieval, credential-store access, temporary staging paths, and archive creation.  

3. Detection should include exfiltration monitoring for HTTP PUT uploads, –data-binary usage, upload identifiers, chunk indexes, total chunk counts, and recurring /gate URI patterns that can reveal active data theft even when C2 domains rotate. 

In macOS 26.4 and later, Apple introduced protections designed to disrupt ClickFix-style attacks, including warnings that can block potentially malicious Terminal pastes and XProtect checks that can prevent detected malicious scripts from running.

When a user attempts to paste a potentially malicious command into Terminal, macOS displays a warning that blocks the paste and explains that scammers may use Terminal instructions to compromise the Mac or the user’s privacy. 

“Possible malware, Paste blocked” 

“Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy. These instructions are commonly offered via websites, chat agents, apps, files, or a phone call.” 

Organizations can also follow these recommendations to mitigate threats associated with this threat: 

• Reduce Terminal execution risk. Educate users not to paste or run Terminal commands from untrusted websites, chat messages, apps, files, or phone-based instructions. 

• Monitor suspicious Terminal usage. Alert on unusual Terminal, zsh, or shell sessions that retrieve payloads, decode content, or execute commands shortly after user interaction. 

• Detect native tool abuse. Flag unusual sequences of macOS utilities such as curl, Base64, gunzip, osascript, cp, rm, mkdir, and killall. 

• Hunt for post-execution behavior. Correlate AppleScript-assisted shell activity, curl-based payload retrieval, credential-store access, temporary staging paths, archive creation, and cleanup behavior. 

• Protect credential stores. Detect unauthorized access to Keychain material, browser credential stores, SSH keys, cloud credentials, and sensitive files in common user directories. 

• Monitor data staging. Alert on sensitive artifact collection followed by compression, archive creation, or staging under temporary paths such as /tmp/sync*. 

• Monitor exfiltration patterns. Identify curl-based HTTP PUT uploads that use –data-binary, API-key headers, upload_id, chunk_index, total_chunks, or recurring /gate URI patterns. 

• Restrict suspicious outbound traffic. Block or investigate connections to suspicious, newly registered, or behaviorally related domains while continuing to hunt on request patterns that may persist after domains rotate. 

Microsoft also recommends the following mitigations to reduce the impact of this threat. 

• Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. 

• Enable network protection and web protection to help prevent connections to malicious websites, phishing pages, and attacker-controlled infrastructure used for malware delivery, command-and-control communication, and data exfiltration. 

• Enable tamper protection to help prevent unauthorized changes to Microsoft Defender security settings and reduce the risk of attackers disabling or weakening endpoint protections. 

Microsoft Defender XDR detections 

Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog. 

Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence. 

 Threat intelligence reports

Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat, malicious activity, infrastructure, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments. 

Microsoft Defender XDR Threat analytics

From ClickFix to code signed: the quiet shift of MacSync Stealer malware. 

Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat. 

Advanced hunting queries

The following advanced hunting queries can help identify MacSync Stealer behaviors observed with this threat. Use these queries as starting points and tune the time range, device scope, and allowlists for your environment. 

Hunting objective: Identify rotating infrastructure by request shape

This query looks for curl-initiated network activity that matches recurring MacSync Stealer URI paths and upload parameters across domains. 

DeviceNetworkEvents 
| where InitiatingProcessFileName =~ "curl" 
| where RemoteUrl has_any ("/curl/", "/dynamic?txd=", "/gate?buildtxd=", "upload_id=", "chunk_index=", "total_chunks=")

Hunting objective: Detect payload retrieval over /curl/ 

This query focuses on initial payload retrieval behavior where curl reaches a /curl/ path, helping identify delivery activity without relying on a specific domain. 

DeviceNetworkEvents 
| where InitiatingProcessFileName =~ "curl" 
| where RemoteUrl has "/curl/" 

Hunting objective: Detect chunked exfiltration over curl HTTP PUT 

This query targets active exfiltration behavior by looking for curl HTTP PUT uploads that use –data-binary and chunked upload parameters. 

DeviceNetworkEvents 
| where InitiatingProcessFileName =~ "curl" 
| where InitiatingProcessCommandLine has_all ("-X PUT", "--data-binary") 
| where RemoteUrl has_any ("upload_id=", "chunk_index=", "total_chunks=", "/gate?buildtxd=") 

Hunting objective: Find curl command lines with MacSync infrastructure traits 

This query searches endpoint process telemetry for curl command lines containing the headers, URI paths, and upload parameters used as durable behavioral pivots. 

DeviceProcessEvents 
| where FileName =~ "curl" 
| where ProcessCommandLine has_any ("api-key", "/curl/", "/dynamic", "/gate", "--data-binary", "upload_id=", "chunk_index=", "total_chunks=", "%{http_code}") 

Hunting objective: Identify AppleScript-launched shell activity 

This query looks for osascript activity that launches shell commands or native utilities commonly seen in the observed post-execution chain. 

DeviceProcessEvents 
| where FileName =~ "osascript" 
| where ProcessCommandLine has_any ("sh -c", "cp ", "rm ", "curl ", "mkdir ", "killall", "dscl") 

MITRE ATT&CK techniques observed

The following MITRE ATT&CK mappings reflect behaviors observed during the MacSync Stealer investigation. The mapping emphasizes the same behavioral pivots used throughout this blog, including shell and AppleScript-assisted execution, payload retrieval, credential and browser data theft, sensitive file collection, staging, chunked exfiltration, cleanup, and rotating infrastructure. 

Execution 

• T1059.004 Command and Scripting Interpreter: Unix Shell | An interactive zsh terminal session was used to run curl commands, decode or unpack payload content with base64 and gunzip, and execute shell commands. 

• T1105 Ingress Tool Transfer | curl downloaded payload content from attacker-controlled infrastructure using recurring payload retrieval paths. 

Discovery 

• T1082 System Information Discovery | The malware collected host and user information during environment discovery. 

• T1057 Process Discovery | The malware enumerated running processes and system configuration before continuing collection and credential-access activity. 

• T1518 Software Discovery | The malware checked for cryptocurrency wallet applications such as Ledger and Trezor. 

Credential Access 

• T1555.001 Credentials from Password Stores: Keychain | The malware created a temporary keychain-grabbing script, attempted to extract browser Safe Storage keys, and accessed or attempted to unlock the macOS Keychain. 

• T1555.003 Credentials from Password Stores: Credentials from Web Browsers | The malware collected browser credentials, cookies, login databases, session data, IndexedDB, LevelDB, and extension storage from Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, and other browsers. 

Collection 

• T1005 Data from Local System | The malware searched Downloads, Documents, and Desktop and collected sensitive file types including PDF, DOCX, TXT, KEY, PEM, KDBX, OVPN, WALLET, and SEED files. 

• T1552.001 Unsecured Credentials: Credentials in Files | The malware harvested SSH keys, AWS credentials, Kubernetes configurations, browser profiles, Apple Notes, Safari data, and other locally stored secrets. 

• T1560.001 Archive Collected Data: Archive via Utility | Collected data was staged under /tmp/sync* and compressed into /tmp/osalogging.zip before upload. 

Command and Control 

• T1071.001 Application Layer Protocol: Web Protocols | C2 communication used web protocols with recurring paths such as /dynamic?txd= and /gate?buildtxd=, macOS User-Agent strings, API-key headers, and rotating domains. 

Exfiltration 

• T1041 Exfiltration Over C2 Channel | Collected data was uploaded to attacker-controlled infrastructure using recurring /gate URI patterns and chunked HTTP PUT requests. 

• T1020 Automated Exfiltration | The malware automated upload activity using curl with HTTP PUT, –data-binary, upload identifiers, chunk_index, and total_chunks parameters. 

• T1030 Data Transfer Size Limits | The archive was split into multiple chunks before upload, as shown by repeated chunk_index and total_chunks parameters in exfiltration requests. 

Defense Evasion 

• T1070.004 Indicator Removal: File Deletion | Temporary archives, staging folders, lock files, and other artifacts were removed after exfiltration. 

• T1140 Deobfuscate/Decode Files or Information | Payload content was decoded or unpacked using base64 and gunzip before execution. 

Behavioral Hunting Pivots 

The following command-line patterns, URL paths, and URL parameters were observed in activity consistent with MacSync Stealer. Use these durable behavioral pivots with process and network context to investigate related activity as infrastructure rotates; then use the point-in-time domain indicators in the IOC section to enrich and validate those findings. 

Indicators of compromise (IOC)

The following domain indicators were observed in activity consistent with MacSync Stealer. Treat them as point-in-time evidence: use them to enrich and validate matches from the behavioral pivots above, and correlate any hits with process and network context because related infrastructure may rotate quickly. 

References

References used for external context and related defensive guidance: 

• MacSync Stealer: C2 Infrastructure Rotation – RST Cloud. RST Cloud, May 8, 2026. 

• ClickFix campaign uses fake macOS utilities lures to deliver …. Microsoft, May 6, 2026. 

• Protecting against malware in macOS – Apple Support  December 19, 2024 

Learn more

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.   

• Learn more about securing Copilot Studio agents with Microsoft Defender  
• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation 
• How Microsoft discovers and mitigates evolving attacks against AI guardrails 

The post Hunting MacSync Stealer infrastructure through behavioral pivots appeared first on Microsoft Security Blog.

Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve — phishing pages and fake executive profiles often do their damage within hours of going live, while manual removal can take days. A managed takedown program pairs continuous, verified monitoring with pre-authorized removal (in-certain cases), cutting the exposure window from days to hours. This matters most for consulting and professional services firms, where a spoofed domain or fake executive profile can compromise the client trust the business is built on.

How UNC3753 targeted US professional services firms in 2026

Between January and May of 2026, Google's Mandiant threat intelligence team tracked a financially motivated extortion campaign — attributed to a group known as UNC3753, or "Luna Moth," or "Silent Ransom Group" — working its way through dozens of professional, legal, and financial services organizations across the United States. The approach was almost old-fashioned. A benign-looking email about a data migration or an unpaid invoice, a follow-up phone call from someone posing as IT support, and a request to install "remote monitoring" software to fix the problem. No exploit. No malware dropped on day one. Just a firm's own trust in its brand and its people, turned against it.

It's a useful — if unsettling — reminder of why brand and executive impersonation isn't a side issue for professional services firms. It's often the entry point.

How much does phishing and impersonation actually cost US businesses

The scale of the problem, in dollar terms, is no longer subtle. The FBI's Internet Crime Complaint Center logged just over one million complaints in 2025 — the highest volume in the program's history — with phishing and spoofing making up roughly a fifth of all reports. Losses tied to phishing alone roughly tripled year-over-year, and business email compromise, which almost always starts with an attacker impersonating someone the victim trusts, accounted for over $3 billion in reported losses on its own. The mechanics of that damage matter too: the overwhelming majority of BEC losses move through wire transfer or ACH, rails that are fast, largely irreversible, and unforgiving of a slow response.

Put those two facts together and a pattern emerges. Impersonation attacks — of a brand, a partner, an executive, a vendor invoice — aren't rare or exotic. They're the default opening move. And once the fraudulent domain, profile, or listing is live, the clock the defender is racing isn't measured in days. It's measured in hours, sometimes less, before money moves or credentials are harvested.

Why are consulting and professional services firms specifically targeted?

Professional services firms occupy a strange position in the threat landscape. They're rarely the most technically fortified target, but they're consistently one of the most valuable ones. A consulting firm doesn't just protect its own data — it holds engagement records, financial models, and confidential strategy documents belonging to dozens of clients across industries. About 29% of U.S. law firms reported having experienced a security breach at some point, according to the ABA's most recent Legal Technology Survey — up from 25% just two years earlier. The same dynamic applies to consultancies. The firm is a single point of entry into a much larger web of client relationships.

That's precisely the exposure described in Cyble's case study of a U.S. consulting organization managing highly sensitive engagement data, confidential client information, and a large, distributed workforce operating across the country. As the case study describes it, the firm's brand, executives, and digital infrastructure were frequent targets specifically because of the trust clients placed in them as an advisor. Senior partners were likely of being impersonated through fake social profiles and spoofed domains. Fraudulent job postings and phishing campaigns leaned on the firm's own credibility to look legitimate. The attacker doesn't need to breach the firm's network if a client can be convinced, through a look-alike domain or a cloned executive profile, to simply hand over what the attacker wants.

That's the mechanism UNC3753 exploited nationally in 2026, and it's the exact exposure this consulting firm was trying to close.

Also read: Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors

What is the "whack-a-mole" problem in brand protection?

Here's where most brand protection programs quietly fail, and it isn't a detection problem — it's a speed problem.

A typical manual takedown workflow looks something like this: someone on the security or marketing team spots a phishing page or a fake LinkedIn profile impersonating a partner. They file an abuse report with the registrar or the platform. They wait. Maybe they follow up. Eventually, the page comes down — but by then, a new one has often already gone live, sometimes registered by the same actor under a slightly different domain.

This was exactly the challenge the consulting firm faced before its engagement with Cyble. Identifying and removing phishing pages, fraudulent job postings, and impersonating domains was, in the case study's own words, reactive and resource-intensive, leaving the brand exposed for longer than the firm considered acceptable. It's a program that looks active — tickets filed, pages eventually removed — while the actual window of exposure, the hours where a client or job candidate could act on the fake page, stays wide open. Volume of takedowns filed is an easy number to report. Speed of resolution is the number that actually protects anyone.

What does managed takedown response actually involve

The shift the case study describes isn't just "faster takedowns" — it's a change in the operating model, from reactive point-solution to continuous, managed coverage. Three pieces work together in the deployment:

• Brand and Executive Monitoring continuously scans for phishing domains, fraudulent job postings, and impersonation attempts using the firm's name, alongside dedicated monitoring of senior leadership profiles across social platforms — catching the fake partner LinkedIn account or spoofed domain before it's had time to circulate.
• Verification before escalation means the security team isn't drowning in unconfirmed alerts. Threats are validated as genuine before they ever reach someone's desk, which is what separates consolidated intelligence from just another noisy dashboard.
• Managed Takedown Services then handle the actual removal — confirmed phishing pages, impersonating domains, and fraudulent listings — without the internal team having to individually chase registrars and platforms one abuse ticket at a time.

The outcome is a meaningfully shortened window between detection and removal — turning a slow, manual, ticket-by-ticket grind into something closer to continuous coverage. That's the real distinction between a takedown service and a takedown program: one reacts when someone happens to notice a fake page; the other is built to notice, verify, and resolve on a timeline that assumes attackers move fast, because they do.

Why client trust is the real asset at risk

For a consulting firm, the financial cost of an impersonation attack is rarely the headline risk. The deeper cost is what it does to the relationship a firm's entire business is built on. When a client, a job candidate, or a prospective hire can't tell the difference between a legitimate email from the firm and a spoofed one, the firm's advisory credibility — the thing it's actually selling — starts to erode. That's a slower, quieter kind of damage than a wire fraud loss, but for a professional services firm, it may be the more expensive one.

The lesson from both the national threat data and this specific engagement is the same – brand and executive impersonation isn't a marketing nuisance to be cleaned up occasionally. It's a live attack surface, moving at a speed that manual, ad hoc takedown processes were never built to match. Firms that treat it that way — with continuous monitoring, verified alerts, and managed resolution — are the ones that keep the exposure window measured in hours instead of days.

Frequently asked questions (FAQs)

What is a brand impersonation takedown service?

A brand impersonation takedown service identifies fraudulent domains, phishing pages, fake social media profiles, and impersonating job listings that misuse a company's name or logo, then works with registrars, hosting providers, and platforms to have that content removed.

How long does it take to take down a phishing site?

Timelines vary by registrar and hosting provider, but manual, ticket-based takedown requests commonly take days to resolve. Managed takedown programs that pre-verify threats and maintain direct relationships with providers can shorten that window to hours.

Why do manual takedown processes fail against brand impersonation?

Manual processes fail because they're reactive: a person has to notice the fake page, file a report, and wait for a third party to act, while attackers can register replacement domains faster than any single report gets resolved. The volume of tickets filed can look productive even while the actual exposure window stays open.

What's the difference between takedown volume and takedown speed?

Takedown volume measures how many fraudulent pages were reported or removed over time. Takedown speed measures how quickly a live threat is detected, verified, and taken down after it appears. Speed is the metric that actually limits damage, since most harm from a phishing page happens in its first hours online.

How can consulting and professional services firms protect executives from impersonation?

Dedicated executive monitoring tracks senior leaders' names and likenesses across social platforms and the web to catch fake profiles, spoofed communications, and impersonation attempts early, ideally paired with managed takedown so confirmed threats are removed without requiring the executive or internal team to handle it themselves.

Sources:

FBI Internet Crime Complaint Center, 2025 Internet Crime Report;
Cyble, "How Cyble Delivered Unified Multi-Layered Threat Intelligence to a U.S. Consulting Organization";
Google/Mandiant, "Ongoing Targeted Campaign Against US Law Firms" (2026);
American Bar Association Legal Technology Survey.

The post Brand Impersonation Takedown: From Whack-a-Mole to Managed Response appeared first on Cyble.

Evaluation Environments Face Monitoring Challenges

Security Experts Question Irregular's Response

The Dutch National Cyber Security Centre (NCSC) issued a warning after being notified of several incidents where a vulnerability in Apple’s Screen Sharing feature was exploited to install Monero cryptominers.

The vulnerability, tracked as CVE-2026-65400, was patched by Apple on August 6. It is an authentication-bypass flaw in macOS Screen Sharing that can let an attacker on the network connect without valid credentials.

macOS’s built-in Screen Sharing service is a remote-control feature commonly associated with port 5900. Successful exploitation can allow a remote attacker on a reachable network to authenticate to the service without legitimate credentials.

Apple said the bug was fixed through “improved state management,” which suggests an authentication-flow or session-state validation failure rather than a cryptographic break.

The patch was issued for macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. Practical exposure requires Screen Sharing to be enabled, so the highest-risk systems are those where port 5900 is internet-accessible, typically through a router port-forward, public IP assignment, or hosting-provider setup. Hosts reachable only from an internal network are still potentially exposed, but attackers would have to gain a position on that network.

An attacker could view and control the Mac remotely because that is the function Screen Sharing provides. NCSC says active cases involved attackers gaining root access and installing cryptomining software, specifically for Monero mining.

The criminals likely chose Monero mining because it does not depend on heavily specialized, application-specific integrated circuits (ASICs), but can be done with any CPU or GPU.

Cryptomining isn’t necessarily the worst an attacker could do. With a root-level compromise an attacker could enable persistence, data theft, credential and key harvesting, deployment of additional malware, and lateral movement.

How to stay safe

Install the update

The best way to protect your Mac is to install the update.

To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
• Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
• Make sure your Mac stays plugged in and connected to the internet until the update is done.

Make sure Screen Sharing is disabled

If you can’t update immediately, check whether Screen Sharing is enabled and turn it off if you don’t use it.

1.  Click the Apple menu in the top-left corner of the screen.
2. Select System Settings.
3. In the left sidebar, click General.
4. Click Sharing on the right; you may need to scroll down.
5. Find Screen Sharing:
   • If the switch is off/grey, it is disabled.
   • If the switch is on/colored, click it to switch it off.

Also check Remote Management on that same Sharing page. It provides another remote-control route and should be off unless the owner knowingly uses it for work or IT support.

Macs need protection too

Malwarebytes Premium Security for Mac stops threats and protects your Mac and personal files from hackers and cybercriminals.

Singapore is using simulated AI-enabled scam calls to train the public, offering IT leaders a new model for social engineering security training.

The post Singapore Is Literally Training People to Get Scammed appeared first on TechRepublic.

The Americas carried the heaviest ransomware burden of any region on the planet in the first half of 2026. According to Cyble Research and Intelligence Labs (CRIL), North and South America combined experienced 2,188 documented ransomware attacks between January and June 2026.

That single figure — 2,188 attacks — represents more than 57% of the 3,836 ransomware incidents CRIL tracked worldwide, making the Americas the undisputed center of gravity for global ransomware operations.

But the Americas is not a single threat theatre — it is two. North America alone absorbed 1,981 attacks, driven by a mature, multi-group Ransomware-as-a-Service (RaaS) economy competing for market share. South America, by contrast, recorded 207 attacks concentrated around a much smaller set of operators, with one group — The Gentlemen — claiming nearly a quarter of all regional incidents outright. Understanding the Americas means understanding both halves of that story: a saturated northern market and a consolidating southern one.

North America vs. South America: Two Distinct Ransomware Landscapes

Security leaders operating across the hemisphere cannot apply a single threat model to both sub-regions. The data shows meaningfully different attacker behavior, concentration, and monetization strategy north and south of the equator.

Why the split matters: North America's threat landscape is a genuine marketplace — dozens of RaaS operators compete for affiliate loyalty, and no single group commands more than a fifth of total volume. South America's landscape is more consolidated, with three groups controlling well over half of all attacks.

For defenders, that means North American organizations need broad-spectrum threat intelligence covering a long tail of active groups, while South American organizations can build highly specific defenses against a short list of named adversaries.

The Five Dominant Ransomware Groups Targeting Americas

Across both sub-regions combined, five ransomware operators account for the overwhelming share of documented activity: Qilin, Akira, INC Ransom, Dragonforce, and The Gentlemen. Together, these five groups are linked to roughly 1,148 of the Americas' 2,188 attacks — approximately 52.5% of all regional ransomware activity.

1. Qilin: The Biggest Ransomware Threat in the Americas

Attack Volume: 410 documented incidents across the Americas (370 in North America, 40 in South America) — 18.7% of the regional total.

Qilin is the single most prolific ransomware actor operating in the hemisphere, and its dominance is not evenly spread — it is concentrated hardest in the United States.

Geographic Concentration:

• United States: 323 attacks (the single largest country-level concentration of any group, anywhere)
• Canada: 33 attacks
• Argentina: 13 attacks
• Broader South America: 40 attacks

Worldwide Sectoral Targeting: Qilin's targeting logic is deliberate rather than opportunistic:

• Construction: 108 incidents (primary focus)
• Professional Services: 90 incidents (legal, accounting, consulting firms)
• Manufacturing: 67 incidents
• Healthcare: 53 incidents
• IT & ITES: 43 incidents

Operational Characteristics:

Qilin's affiliate model is built for scale. Initial access brokers handle reconnaissance and compromise, mid-tier operators manage lateral movement, and dedicated crews execute encryption and exfiltration. This compartmentalization lets Qilin run dozens of concurrent operations across the United States without any single point of failure. The group's near-total dominance of the American ransomware market (323 of 1,721 US attacks) suggests either an unusually large affiliate roster or a payout structure attractive enough to pull operators away from competing platforms.

Why Qilin Dominates:

• Affiliate Loyalty: Competitive payout splits keep operators recruiting and retaining talent
• Rapid Exploit Weaponization: Fast turnaround from vulnerability disclosure to active exploitation
• Sector Fluency: Deep understanding of which industries face the highest downtime cost
• Established Data Brokerage Ties: Exfiltrated data reliably reaches monetization channels

Americas Security Implications: Any organization in construction, professional services, manufacturing, or healthcare operating in the US or Canada should treat Qilin as a primary named threat, not a generic ransomware risk.

2. Akira: North America's Persistent Operator

Attack Volume: 268 documented incidents, almost entirely concentrated in North America — 12.2% of the regional total

Akira is the second most active group in the Americas, and unlike Qilin, its footprint is almost exclusively North American. CRIL's data shows Akira's South American presence is negligible to date.

Geographic Concentration:

• United States: 247 attacks (92% of Akira's total Americas volume)
• Canada: Remaining North American activity
• South America: Minimal to no confirmed activity

Worldwide Sectoral Targeting:

• Construction: 57 incidents
• Manufacturing: 54 incidents
• Professional Services: 47 incidents
• Consumer Goods: 19 incidents
• IT & ITES: 16 incidents

Operational Characteristics:

Akira has built a reliable playbook around compromising small-to-medium-sized businesses through unpatched public-facing network devices, then pivoting into construction and manufacturing environments where downtime tolerance is lowest. The group's consistency — rather than explosive growth — is its defining trait; it has neither the explosive scale of Qilin nor the geographic diversification of The Gentlemen, but it reliably executes against the same target profile month after month.

Americas Security Implications: North American SMBs in construction, manufacturing, and professional services should assume Akira is actively scanning for exposed remote access infrastructure. Its South American absence should not be mistaken for permanence — RaaS groups expand geographically once North American markets saturate.

3. INC Ransom: The Law-Firm Specialist

Attack Volume: 171 documented incidents (164 in North America, 7 in South America) — 7.8% of the regional total

INC Ransom distinguishes itself through sector specialization rather than volume. The group shows a clear, repeated preference for Professional Services organizations — particularly law firms — leveraging the sensitive, high-stakes nature of legal client data.

Geographic Concentration:

• United States: 154 attacks
• Canada: 6 attacks
• Brazil: 4 attacks

Worldwide Sectoral Targeting:

• Professional Services: 58 incidents (primary focus, with a documented preference for law firms)
• Construction: 27 incidents
• Manufacturing: 26 incidents
• Healthcare: 21 incidents
• Organisation/Non-profit: 12 incidents

Operational Characteristics:

INC Ransom's rapid operational pace and consistent targeting of law firms, healthcare providers, and transportation/energy operators reflects a strategy built entirely around double-extortion leverage. The sensitivity of the data matters more than the size of the victim. A regional law firm holding privileged client communications is, to INC Ransom, a more valuable target than a much larger manufacturer with less sensitive data.

Americas Security Implications: Law firms, accounting practices, and consulting shops across the US, Canada, and Brazil should assume INC Ransom is actively targeting client confidentiality as leverage — not just encrypting file servers for disruption.

4. Dragonforce: The Cross-Border Supply-Chain Operator

Attack Volume: 153 documented incidents (148 in North America, 5 in South America) — 7.0% of the regional total

Dragonforce maintains an aggressive operational tempo focused heavily on the United States, with a strategy that suggests supply-chain-aware targeting rather than random opportunism.

Geographic Concentration:

• United States: 135 attacks
• Canada: 11 attacks
• South America: 5 attacks

Worldwide Sectoral Targeting:

• Construction: 48 incidents
• Manufacturing: 31 incidents
• Professional Services: 28 incidents
• IT & ITES: 18 incidents
• BFSI: 17 incidents

Operational Characteristics:

Dragonforce's manufacturing and construction focus mirrors Qilin's and Akira's playbooks, but its concentration in the US combined with limited-but-present South American activity hints at interest in transnational manufacturing supply chains. North American organizations with manufacturing partners or subsidiaries in Latin America should treat this as a lateral-access risk, not just a direct-targeting one.

Americas Security Implications: Manufacturers and construction firms with cross-border operations — a common structure across USMCA supply chains — should extend Dragonforce-specific monitoring to subsidiaries and vendors, not just headquarters networks.

5. The Gentlemen: South America's Dominant Threat

Attack Volume: 146 documented incidents (100 in North America, 46 in South America) — 6.7% of the regional total, but the single most active ransomware group in South America specifically.

While The Gentlemen rank fifth across the combined Americas, they are the #1 threat actor in South America on their own — responsible for roughly 22% of every ransomware attack recorded in that sub-region.

Geographic Concentration:

• United States: 77 attacks
• North America: 100 attacks
• Brazil: 15 attacks
• South America: 46 attacks (largest single-group share in the sub-region)

Worldwide Sectoral Targeting:

• Manufacturing: 56 incidents
• Construction: 45 incidents
• Healthcare: 37 incidents
• IT & ITES: 36 incidents
• Consumer Goods: 34 incidents

Operational Characteristics:

The Gentlemen are a relatively new operator that has achieved outsized scale in a short window, and their South American concentration is the most important regional signal in this dataset. Unlike Qilin or Akira — which built North American dominance first and are only beginning to diversify — The Gentlemen appear to have prioritized South America as a primary theatre from early in their operational life, an unusual strategic choice that may reflect lower defensive maturity, less aggressive law enforcement cooperation, or simply less competitive pressure from other RaaS operators in the sub-region.

Americas Security Implications: South American organizations — especially in healthcare, manufacturing, and IT services — should treat The Gentlemen as their single highest-priority named adversary. North American organizations should not discount them either; 100 US-focused attacks is a substantial footprint for a group still building its brand.

Other Notable Threats: Play, LockBit, and CL0P

Three additional groups warrant inclusion in any Americas threat model:

• Play (144 attacks, North America only): Continues its "Big Game Hunting" approach layered with high-volume SMB attacks via unpatched public-facing network devices, concentrated almost entirely on US and Canadian construction, professional services, and manufacturing targets.
• LockBit (80 attacks combined — 47 in North America, 33 in South America): Despite sustained international law enforcement pressure and repeated takedown attempts, LockBit remains operationally resilient across both sub-regions, notably compromising Chile's Clínica Dávila in South America.
• CL0P (93 attacks combined — 91 in North America, 2 in South America): Operated differently from its peers, executing a large-scale campaign concentrated in January and February 2026 that exploited a single zero-day vulnerability across hundreds of organizations at once — reminiscent of the group's historical MOVEit campaign.

Also read: The Most Active Threat Actors of H1 2026

The Five Most Targeted Nations in the Americas

United States: The Global Ransomware Epicenter

Attack Volume: 1,721 ransomware attacks — 78.7% of all Americas ransomware activity, and roughly 45% of every ransomware attack recorded worldwide.

No other country on Earth comes close to the volume of ransomware activity absorbed by the United States in H1 2026. The country functions as the default target for nearly every major RaaS operator active today.

Threat Actor Concentration:

• Qilin: 323 attacks
• Akira: 247 attacks
• INC Ransom: 154 attacks
• Dragonforce: 135 attacks
• Play: 134 attacks

Sectoral Breakdown: Manufacturing, Professional Services, Construction, and Healthcare bear the brunt, consistent with the broader North American pattern of operationally sensitive, low-downtime-tolerance industries.

Why the United States Faces Maximum Pressure

The scale of the US economy, its dense concentration of mid-market manufacturers, law firms, and healthcare providers, and its comparatively high ransom-payment history combine to make it the most economically rational target for every major ransomware operator. US organizations also frequently anchor cross-border supply chains stretching into Canada, Mexico, and South America — meaning a US compromise can cascade into lateral access against hemispheric partners.

Defensive Priority: US organizations across construction, manufacturing, professional services, and healthcare should assume Qilin, Akira, INC Ransom, Dragonforce, Play, and The Gentlemen are all actively scanning for exploitable entry points into their networks simultaneously — not sequentially.

Canada: The Cross-Border Extension

Attack Volume: 179 ransomware attacks — 8.2% of the regional total.

Canada's threat profile closely tracks the United States, reflecting deep economic integration and shared supply chains rather than a distinct targeting logic of its own.

Sectoral Breakdown: Manufacturing, professional services, and construction dominate, mirroring the US pattern almost directly.

Why Canada Faces Sustained Pressure

Canadian organizations are frequently subsidiaries, suppliers, or joint-venture partners of US enterprises, which means the same RaaS groups saturating the US market extend naturally northward. Cross-border manufacturing in particular creates lateral access opportunities that Dragonforce and Akira appear well-positioned to exploit.

Defensive Priority: Canadian organizations should not assume distance from US headquarters provides insulation — the same threat actors, exploiting the same vulnerability classes, are already active on both sides of the border.

Brazil: The Financial Malware and Ransomware Convergence Point

Attack Volume: 71 ransomware attacks — 3.2% of the regional total, but the largest single concentration in South America.

Brazil represents South America's most complex threat environment, combining traditional ransomware pressure with a maturing, sophisticated financial malware ecosystem.

Threat Actor Concentration: The Gentlemen (15 attacks), LockBit, and a fragmented tail of smaller operators.

Sectoral Breakdown: Government & Law Enforcement, BFSI, and Healthcare are the most consistently targeted sectors.

Why Brazil Faces a Dual Threat

Beyond ransomware, Brazil emerged in H1 2026 as a focal point for new Android banking trojan families — TCLBANKER and BTMOB RAT — which use self-propagation, evasion techniques, and Malware-as-a-Service (MaaS) distribution models to target banking and cryptocurrency users directly. Brazil also suffered an alleged 250-million-record breach of Serasa, one of the country's largest credit bureaus, alongside an access sale allegedly targeting the Central Bank of Brazil — a listing that, if genuine, represents one of the most significant initial-access offerings tracked anywhere in the report.

Defensive Priority: Brazilian financial institutions should treat mobile banking malware and ransomware as converging risks rather than separate problems — the same underground economy is monetizing both. Government and BFSI entities should assume access-broker listings referencing critical national infrastructure require immediate incident-response-level validation, not routine monitoring.

Mexico: The Emerging Nearshoring Risk

Attack Volume: 39 ransomware attacks — 1.8% of the regional total.

Mexico's attack volume is meaningfully lower than the US, Canada, or Brazil, but its position within North American manufacturing supply chains — accelerated by ongoing nearshoring trends — makes it a nation to watch closely rather than dismiss.

Why Mexico Warrants Increased Attention

As global manufacturers continue relocating production closer to the US market, Mexican facilities increasingly sit inside the same supply chains that Dragonforce, Akira, and Qilin already target aggressively north of the border. Lower current attack volume may reflect earlier-stage targeting rather than lower risk — a pattern security teams should not mistake for durable safety.

Defensive Priority: Manufacturers with Mexican operations should extend the same OT/IT segmentation and vulnerability management discipline applied to US and Canadian facilities to their Mexican sites, rather than treating them as lower priority.

Colombia: Where Hacktivism Meets Cybercrime

Attack Volume: 33 ransomware attacks — 1.5% of the regional total.

Colombia's ransomware volume is modest, but the country stands out for the density of ideologically motivated activity layered on top of financially driven attacks.

Why Colombia Faces a Blended Threat

Groups such as Anonymous Colombia (#OpColombia) ran active campaigns throughout H1 2026 blending website defacement, DDoS attacks, and data leak activity — consistent with the broader South American pattern in which hacktivist-branded channels frequently overlap with financially motivated cybercrime infrastructure.

Defensive Priority: Colombian government and law enforcement entities — the most frequently targeted sector across South America overall — should treat hacktivist claims as credible threat intelligence signals rather than dismissing them as purely ideological noise.

Where Americas Organizations Face Maximum Risk: A Sectoral Analysis

Professional Services: One of the Top Targets

Attack Volume: The second most heavily impacted sector in North America.

Professional services firms — law, accounting, and consulting practices — are one of the top jobs on North America's ransomware target list, driven overwhelmingly by INC Ransom and AiLock's aggressive targeting of client-confidential data.

Why Professional Services Are Targeted

1. Privileged Data Concentration: Legal privilege and client confidentiality create existential regulatory and reputational exposure that threat actors exploit for maximum ransom leverage.
2. Regulatory Pressure: Breach notification requirements incentivize rapid ransom payment to avoid compounding disclosure penalties.
3. Trust-Based Business Model: A single confirmed breach can permanently damage client relationships built entirely on confidentiality.
4. Documented Actor Preference: INC Ransom has shown a specific, repeated preference for law firms — this is not incidental targeting.

Notable Incident Pattern: AiLock's activity stood out for a coordinated wave of victim disclosures on a single day — March 3, 2026 — a pattern consistent with mass-exploitation of a shared vulnerability rather than individually researched targeting.

Defensive Recommendations:

• Segregate client data on separate network segments with distinct, audited access controls
• Deploy data loss prevention (DLP) with aggressive egress monitoring for client-data exfiltration
• Maintain comprehensive access logs for all sensitive client-data touchpoints
• Evaluate ransomware-specific cyber insurance addressing confidentiality exposure

Construction and Manufacturing: The Downtime Economy

Attack Volume: Construction and Manufacturing rank first and third in North America; combined, they represent the largest share of Qilin, Akira, Dragonforce, and The Gentlemen's worldwide targeting.

Constructions and manufacturing share a common vulnerability across the Americas: both operate on tight, contractually enforced timelines where downtime translates directly into cascading financial penalties.

Why Construction and Manufacturing Are Targeted

1. Time-Sensitive Financial Exposure: Missed construction deadlines trigger contractual penalties; halted production lines trigger lost revenue and breached delivery commitments.
2. OT/IT Convergence: Modern factories and job sites increasingly integrate operational technology with corporate IT, creating exploitation bridges unavailable in pure-IT industries.
3. Supply-Chain Complexity: Both industries depend on dense webs of subcontractors and suppliers — compromising one upstream partner can provide lateral access into prime contractors.
4. Cross-Border Exposure: US-Canada-Mexico manufacturing integration (and increasingly, US-Brazil trade relationships) means a single compromise can propagate across national borders.

Defensive Recommendations:

• Implement airgapped network segmentation between OT and corporate IT environments
• Prioritize vulnerability patching for network appliances and identity systems over blanket patch cycles
• Maintain fully offline, immutable backups of critical project and production data
• Extend third-party risk assessments to subcontractors, suppliers, and cross-border subsidiaries

Healthcare: South America's Critical Infrastructure Threat

Attack Volume: One of the top four most heavily impacted sectors in South America.

Healthcare organizations across the Americas — but particularly in South America — face a threat dynamic distinct from financial pressure alone: ransomware attacks against hospitals directly endanger patient safety.

Why Healthcare Is Targeted

1. Patient Safety Leverage: Downtime in diagnostic systems, pharmaceutical dispensing, and patient records directly threatens continuity of care, creating existential pressure to pay quickly.
2. Documented Regional Incidents: The Gentlemen's claimed attack on Primero Medicina Privada and LockBit's compromise of Chile's Clínica Dávila both illustrate ransomware groups' willingness to target hospital networks directly.
3. Data Value: Patient medical records and clinical data command premium prices on dark web marketplaces.
4. System Complexity: Healthcare IT environments blend legacy diagnostic equipment, electronic health records, and connected medical devices — each with distinct security postures.

Defensive Recommendations:

• Implement complete network isolation between clinical systems and corporate IT
• Deploy redundant diagnostic and pharmaceutical systems capable of manual fallback operation
• Encrypt all patient medical records end-to-end
• Build healthcare-specific incident response plans addressing patient notification and continuity of care

Agriculture & Livestock: The Americas' Emerging Supply-Chain Target

Attack Volume: 33% of all North American initial access listings — the second-most targeted sector in the region's access brokerage market.

A distinctive Americas finding: initial access brokers targeting the region show unusually strong interest in Agriculture & Livestock, second only to Technology.

Why Agriculture & Livestock Is an Emerging Target

North America's food supply chain increasingly depends on connected logistics, cold-chain monitoring, and precision agriculture technology — creating an attack surface that did not meaningfully exist a decade ago. Access brokers appear to be positioning themselves ahead of ransomware operators, selling footholds into agricultural operations before ransomware crews weaponize them. This mirrors a pattern seen elsewhere globally but is particularly pronounced in North America's access brokerage data.

Defensive Recommendations:

• Treat agricultural technology platforms (precision ag, cold-chain IoT) with the same security rigor as manufacturing OT
• Monitor initial access broker markets specifically for agriculture and food-sector listings
• Build incident response plans accounting for food-supply-chain continuity, not just data confidentiality

Geopolitical and Ideological Dimensions: Hacktivism Across the Hemisphere

SOLDADOS DIGITALES – UNIÓN AMERICANA: A Hemispheric Hacktivist Collective

Unlike most hacktivist channels tracked in this report, SOLDADOS DIGITALES – UNIÓN AMERICANA operates across both North and South America, making it one of the few genuinely hemispheric threat actors identified in H1 2026 — a significant finding given how regionally siloed most hacktivist activity tends to be.

Combined Hacktivism Metrics (North + South America):

• ~140 confirmed data leak and dump posts across both sub-regions
• At least 932 unique domains impacted (360 in North America, 572 in South America)
• Primary targets: Government & LEA, Technology, BFSI, Telecommunication, Education

Notable Collectives by Sub-Region:

• North America: SOLDADOS DIGITALES – UNIÓN AMERICANA, Anonymous #FreeTurtleIsland, KERALA HACKERS, LYSTIC TEAM #ID
• South America: SOLDADOS DIGITALES – UNIÓN AMERICANA, Anonymous Colombia (#OpColombia) Y.A.N, BLAZER TEAM ATTACK

The Convergence Problem: As with hacktivist activity documented elsewhere in CRIL's global dataset, several Americas-based channels marketed as ideological collectives function as hybrid operations — logging DDoS attacks and defacement claims alongside stolen-data brokerage and DDoS-for-hire services. Security teams should treat these channels as credible threat intelligence sources rather than dismissing their claims as purely political theater.

Regional Threat Actor Summary: Who Targets Your Americas Organization

If You're in Professional Services:

• Primary Threat: INC Ransom, Qilin
• Secondary Threat: AiLock, The Gentlemen
• Vulnerability: Client data exfiltration, regulatory breach-notification pressure
• Defensive Focus: DLP, client data segregation, ransomware-specific cyber insurance, cyber threat intelligence

If You're in Manufacturing or Construction:

• Primary Threat: Qilin, Akira, Dragonforce
• Secondary Threat: The Gentlemen, Play
• Vulnerability: OT/IT convergence, cross-border supply-chain exposure, contractual downtime penalties
• Defensive Focus: OT segmentation, immutable backups, cross-border third-party risk management

If You're in Healthcare:

• Primary Threat: The Gentlemen (South America), Qilin (North America)
• Secondary Threat: LockBit
• Vulnerability: Patient-safety leverage, legacy medical device integration
• Defensive Focus: Clinical system isolation, redundant critical systems, patient-notification-ready incident response

If You're in BFSI:

• Primary Threat: Data exfiltration actors, mobile banking malware (Brazil)
• Secondary Threat: Qilin, The Gentlemen
• Vulnerability: Financial data value, mobile malware convergence, regulatory exposure
• Defensive Focus: DLP with aggressive egress controls, mobile threat monitoring, data encryption

If You're in Agriculture & Livestock:

• Primary Threat: Initial access brokers
• Secondary Threat: Downstream ransomware operators exploiting sold access
• Vulnerability: Precision agriculture and cold-chain IoT exposure
• Defensive Focus: OT-equivalent segmentation for agricultural technology, access-broker monitoring

If You're in Government & Law Enforcement (South America specifically):

• Primary Threat: RALord/Nova, CoinbaseCartel, hacktivist-branded channels
• Secondary Threat: LockBit, The Gentlemen
• Vulnerability: Public-sector data value, hybrid ideological/financial targeting
• Defensive Focus: Treat hacktivist claims as credible intelligence, harden citizen-data repositories

Strategic Defense Recommendations for Americas Organizations

Based on CRIL's H1 2026 regional data, Americas security leaders should prioritize defensive investment in the following sequence.

Phase 1: Critical Infrastructure Protection (30 days)

• Inventory Network Appliances: Document every internet-facing firewall, VPN, and security gateway
• Patch Critical CVEs: Prioritize Ivanti, Fortinet, Cisco, SolarWinds, and Palo Alto Networks appliances — the vendors repeatedly appearing in both the CISA KEV catalog and active exploitation campaigns
• Harden Remote Access: Enforce phishing-resistant MFA on all administrative and remote access paths
• Deploy Behavioral Monitoring: Watch for anomalous activity on network appliances specifically

Phase 2: Data Protection (60 days)

• Data Inventory: Catalog sensitive holdings — client data, financial records, patient records, intellectual property
• DLP Implementation: Deploy data loss prevention with aggressive egress monitoring
• Encryption Standards: Enforce encryption in transit and at rest across all sensitive data stores
• Access Auditing: Maintain comprehensive logs for every access event touching sensitive data

Phase 3: Operational Resilience (90 days)

• Immutable Backups: Establish offline, immutable backup infrastructure isolated from production networks
• Sector-Specific Incident Response: Build playbooks addressing construction project continuity, manufacturing downtime, and healthcare patient-safety scenarios specifically
• Cross-Border Continuity Planning: For organizations with US-Canada-Mexico or US-Brazil operations, extend continuity plans across all connected facilities
• Recovery Testing: Conduct quarterly backup restoration drills to verify actual recovery capability

Phase 4: Threat Hunting and Detection (Ongoing)

• Named-Actor Threat Intelligence: Subscribe to intelligence feeds tracking Qilin, Akira, INC Ransom, Dragonforce, and The Gentlemen specifically
• Access-Broker Monitoring: Track listings for organizational exposure
• Supply-Chain Monitoring: Continuously assess vendor and subsidiary security posture across borders
• Mobile Malware Awareness (Brazil-specific): Financial institutions should monitor for TCLBANKER- and BTMOB RAT-style Android banking trojan activity targeting customers

Conclusion: The Americas Ransomware Reality

The Americas is not just the largest ransomware theatre in the world by volume — it is two distinct threat environments operating under a single regional label. North America hosts a saturated, competitive RaaS marketplace where no single group dominates outright. South America is consolidating around a smaller set of operators, led decisively by The Gentlemen.

Key Takeaways:

1. The Americas carries the global center of gravity: 2,188 of the world's 3,836 documented ransomware attacks (57%) struck North or South America in H1 2026.
2. Five groups anchor the threat: Qilin (410), Akira (268), INC Ransom (171), Dragonforce (153), and The Gentlemen (146) collectively account for over half of all Americas ransomware activity — but their dominance splits sharply by sub-region.
3. North America and South America require different playbooks: North America's threat model demands broad coverage against a long tail of competing operators; South America's demands deep, specific defense against The Gentlemen, Qilin, and LockBit.
4. The United States remains the world's single largest target: 1,721 attacks — nearly 45% of global ransomware volume — makes the US the default target for virtually every major RaaS operator active today.
5. Brazil's threat is compounding, not singular: ransomware, mass data breach, and mobile banking malware are converging in the same underground economy targeting the same financial institutions.
6. Sector risk follows economic logic, not chance: Professional Services, Manufacturing, Construction, Healthcare, and — distinctively for the Americas — Agriculture & Livestock face targeting because threat actors have identified specific, exploitable economic pressure points in each.
7. Access brokers are a leading indicator: a small number of sellers control the region's initial access market and routinely precede ransomware deployment by weeks.

For security leaders across North and South America, the strategic imperative is the same even where the tactical details diverge: know which named actors are active in your specific country and sector, prioritize risk-based patching over blanket cycles, treat data exfiltration as inevitable rather than optional, and build recovery infrastructure that assumes an attack will happen — not one that hopes it won't. The data confirms the Americas will remain the world's most heavily targeted ransomware region through the remainder of 2026. The only open question is how prepared each organization chooses to be.

Frequently Asked Questions (FAQs)

How many ransomware attacks hit the Americas in H1 2026?

2,188 documented ransomware attacks were observed across North and South America in H1 2026, according to Cyble Research and Intelligence Labs (CRIL) findings.

Which ransomware group is most active in the Americas in H1 2026?

Qilin is the most active group across the combined Americas, with 410 documented attacks (370 in North America, 40 in South America). Within South America specifically, however, The Gentlemen — not Qilin — is the dominant actor.

How many ransomware attacks hit North America in H1 2026?

CRIL recorded 1,981 ransomware attacks in North America during H1 2026, representing roughly 52% of all ransomware activity tracked worldwide.

How many ransomware attacks targeted the US in H1 2026? Is it the highest?

Yes. CRIL observed 1,721 ransomware attacks targeted at the US — which is 78.7% of the American continent (North and South, both), and nearly 45% of every ransomware attack recorded worldwide.

Which sector was the most targeted in South America?

IT & ITES remained the most targeted sector in South America for H1 2026.

Ransomware actors targeted which country the most in South America?

Brazil. With 71 attacks, it was the prime target of ransomware actors in H1 2026.

Is Brazil a significant ransomware target?

Yes. Brazil recorded 71 ransomware attacks — the highest total in South America — and additionally faced an alleged 250 million record breach at credit bureau Serasa, an access sale allegedly targeting the Central Bank of Brazil, and new Android banking trojan families (TCLBANKER, BTMOB RAT) targeting financial and cryptocurrency users.

What is the most targeted industry in the Americas?

Construction tops North America's target list, while IT & ITES, Healthcare, and Professional Services top South America's. Across the whole Americas, Construction and Manufacturing remain consistently high-risk due to their low tolerance for operational downtime.

The post Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors appeared first on Cyble.