Threat Intelligence & Research

China-Nexus APT Targets India with Fake Tax Assessment Campaign Using DLL Hijacking

CyberArmor identified a targeted phishing campaign leveraging an Indian Income Tax Department theme to deliver malware through a multi-stage infection chain. Victims receive a PDF attachment that redirects to a convincing fake government portal, ultimately leading to a VHDX disk image containing a DLL hijacking implant. The campaign demonstrates a high level of operational security and evasion techniques commonly associated with advanced persistent threat (APT) activity.

How Threat Actors Abuse Microsoft's Login Infrastructure to Increase Phishing Success Rates

Threat actors are increasingly abusing Microsoft's legitimate authentication infrastructure to improve phishing success rates, evade detection, and gain access to corporate accounts. Learn how these attacks work and what defenders should monitor.

Inside “SalatStealer” — Reverse Engineering a YouTube Bitcoin Brute Tool Malware

When Malware Wears a Brand: Zoom Lure → Fake Microsoft Marketplace → Remote Access via Zoho

A new attack chain uses brand impersonation and legitimate tools to bypass detection—turning everyday collaboration into a covert entry point.

GraphQL Phishing: Gmail-Themed Credential Harvesting Behind Cloudflare

Operation Gauloises: How One Operator Bridges the DarkWeb to the Levant via Whish Money

Technical Analysis of DarkWeb Liquidity Off-Ramping via Levantine Fintech