Posts under the Adversary Intelligence

Articles in Blog Posts

September 5, 2025

Threat Actors Impersonate Microsoft Teams To Deliver Odyssey macOS Stealer Via Clickfix

Threat actors are exploiting a fake Microsoft Teams download site to deliver the Odyssey macOS stealer via Clickfix. Once executed, the malware harvests credentials, cookies, Apple Notes, and crypto wallets, exfiltrating data to a C2 server before ensuring persistence through LaunchDaemons and even replacing Ledger Live with a trojanized version. The campaign poses severe risks of credential theft, financial loss, and long-term reinfection.

Written by

Koushik Pal

August 31, 2025

Racing Into Danger: Advanced Cyber Threats Targeting Formula 1 Fans and Teams Ahead of the Dutch Grand Prix

Cybercriminals are targeting Formula 1 fans and teams ahead of the Dutch Grand Prix on August 31, 2025, with advanced threats including AI deepfakes impersonating executives, malicious F1 mobile apps, fake hospitality packages, crypto/NFT scams, and telemetry data theft. Fraudsters exploit regulatory gaps and fan demand for tickets, travel, and streaming. CloudSEK urges fans to use official sources and teams to strengthen verification, monitoring, and cybersecurity measures.

Written by

Varun Ajmera

August 27, 2025

Ganesh Chaturthi Online Scams: How Cybercriminals Exploit Festive Offers

As Ganesh Chaturthi approaches, cybercriminals exploit festive cheer with fake offers, including sham idols, prizes, and fraudulent loans. These scams spread through social media and phishing websites, targeting Indian consumers. Read the full report to learn how to identify these threats and protect your money and data this festival season.

Written by

Mayank Sahariya

August 25, 2025

Trusted My Summarizer, Now My Fridge Is Encrypted — How Threat Actors Could Weaponize AI Summarizers with CSS-Based ClickFix Attacks

A new ClickFix social engineering attack weaponizes AI summarizers. Threat actors hide malicious instructions in documents using CSS obfuscation and prompt overdose. This makes the code invisible to humans but fully readable to AI models. When a user summarizes the content, the AI-generated output delivers the malicious payload, tricking the user into executing ransomware. Organizations must implement content sanitization and user awareness to mitigate this risk.

Written by

Dharani Sanjaiy

August 21, 2025

The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War

CloudSEK uncovered an advanced cryptojacking campaign by threat actor TA-NATALSTATUS, active since 2020 and now escalating globally in 2025. The group exploits exposed Redis servers in the US, Europe, Russia, India, and beyond, hijacking root access to install miners, disable defenses, and wipe out rivals. Their stealth tactics—binary hijacking, obfuscation, and persistence mechanisms—turn servers into long-term mining assets. CloudSEK advises immediate remediation, reimaging, and securing Redis instances.

Written by

Abhishek Mathew

August 21, 2025

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive. The malware created persistence, evaded detection, and connected to a WebSocket C2 server (seemysitelive[.]store). Investigators urge blocking the C2 domain, scanning for indicators of compromise, and tightening email and endpoint defenses.

Written by

Ayush Panwar

Adversary Intelligence

Articles in Blog Posts

Threat Actors Impersonate Microsoft Teams To Deliver Odyssey macOS Stealer Via Clickfix

Racing Into Danger: Advanced Cyber Threats Targeting Formula 1 Fans and Teams Ahead of the Dutch Grand Prix

Ganesh Chaturthi Online Scams: How Cybercriminals Exploit Festive Offers

Trusted My Summarizer, Now My Fridge Is Encrypted — How Threat Actors Could Weaponize AI Summarizers with CSS-Based ClickFix Attacks

The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War

Investigation Report: APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Articles in Threat Intelligence

Critical CSRF Vulnerability in IBM CICS TX - CVE-2023-42027 Demands Immediate Action

CVE-2023-43792 baserCMS is a website development framework vulnerable to Code Injection attacks

CVE-2023-4197 Vulnerability in Dolibarr ERP CRM 18.0.1 Allows PHP Code Injection

Hoze shell script dropped along with XMRig miners on misconfigured SSH Servers by Brute Forcing

3,20,000+ Patient Records From Ayush Jharkhand Gov. In Shared On Dark Web Hacking Forums

Rogue Scripts Are Exploiting OTP Verification APIs To Send Heaps of OTP SMSes, Hold The Potential Of Triggering Service Disruptions.

Join 10,000+ subscribers