🎣 #PhishingAlert: The Zoho Form link from this fake HP printer email notification leads to #Tycoon phishing page. IOCs: hxxps[://]forms[.]zohopublic[.]com/adminlera1/form/August/formperma/eKn5pLDz1u8g7yg3sQ_lKKMf0EaX66YDx87mW6TJolc hxxps[://]vstvq[.]sormanvet[.]su/ZIHH0J/ hxxps[://]kWAS[.]guisx[.]ru #MailMarshal #ZohoForm

🎣 #PhishingAlert: The initial URL from this #phishing campaign by #tycoon #PaaS displays a fake page of an email security vendor before redirecting to the next stage URL. The second URL is a compromised site that redirects to either google.com or the #Microsoft phishing page, depending on its validation of the initial URL's query part. #MailMarshal

🚨 #MalspamAlert: A recent #malware campaign is making rounds, using email subjects related to legal issues or unauthorized content use to lure victims into downloading malware. The email pretends to be from a law firm alleging copyright infringement on a #Facebook page, complete with details of the supposed infringement. It contains a short link that redirects to a Dropbox-hosted archive, which includes a decoy PDF, a law firm logo, an executable misleadingly named "Content that infringes on copyright.exe" to appear as a legitimate document and a malicious DLL. When the executable is run, the DLL is sideloaded, deploying the Rhadamanthys #infostealer. #IoCs: Download URLs: hxxps[://]t[.]ly/R8cBb hxxps[://]www[.]dropbox[.]com/scl/fi/el80dg1rgy1ep7yedvmo2/Content-that-infringes-on-copyright[.]zip?rlkey=mpa7ca3vf3cbvucy6zcptmvpd&st=a9i7grw5&dl=1 File Hashes: Content that infringes on copyright.exe 4864a55cff27f686023456a22371e790 08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2 msimg32.dll 80fa521b6426a4bfdbf86fc236aa1126 87b80761f18389ea14086a4f612d4f9ba9b695f5ef60746bda3e94f6f45552f9 C2 server: 15[.]235.176.166:8344 Leverage Trustwave #MailMarshal to protect against this and other email-borne threats.

Trustwave #SpiderLabs has discovered a 120MB file called "BNKoFAmerica.txt" on the Dark Web, containing 667,599 lines of what looks like sensitive financial data, supposedly from Bank of America. The file includes user IDs, balances, card types, expiration dates, last 4 card digits, and possibly CVV codes. It also mentions the GWIM (Global Wealth and Investment Management) division over 11,600 times. This might be a genuine transaction log.