🚨 New threat research: Proofpoint identified a likely North Korea-aligned threat cluster, UNK_DeadDrop, targeting software developers through trusted development platforms and workflows. Read the blog: www.proofpoint.com/us/blog/thre....

Our new @threatinsight report is a comprehensive overview of TA4922, a newly designated Chinese-speaking, financially motivated threat actor that largely targets East Asia. It currently conducts more unique campaigns than any other cybercriminal we track. www.proofpoint.com/us/blog/thre...

Sarah Sabotka, staff threat researcher at Proofpoint, is speaking at #Layer8Conference — the only event dedicated to #OSINT and #socialengineering threats facing businesses today. If you're a security leader, you won't want to miss it! June 5–6 | Boston, MA Event info: layer8conference.com

Device code phishing is exploding across the threat landscape, with new device code phishing tools emerging every week. Our new blog explores why adoption of this technique has surged over the past year. www.proofpoint.com/us/blog/thre... A few key points below. 🧵⤵️

Device code phishing is exploding, and AiTM actors are getting in on it. We found ODx phishing-as-a-service providing device code capabilities in addition to their AiTM offerings. ODx is one of the most popular AiTM kits currently. It's also tracked as Storm-1167 and FlowerStorm.

In a public service announcement, the FBI warned the transportation and logistics industry about a sharp rise in cyber-enabled cargo theft, an attack vector our researchers have been closely tracking since last year. www.ic3.gov/PSA/2026/PSA...

Our award-winning threat research podcast series, Discarded, is celebrating 100 episodes this week! 🎉 Stream now for a trip down memory lane, a few laughs, and a look ahead to what's next in cybersecurity. Cheers to 100 episodes! 🍾 www.proofpoint.com/us/podcasts/...

Proofpoint baited a cargo/transport industry threat actor into performing its malicious activities in a decoy environment operated by Deception.Pro for 30+ days. What resulted: rare, extended visibility into post-compromise operations, tooling, & decision-making. www.proofpoint.com/us/blog/thre...

Our new Discarded podcast episode explores the stealthy world of backdoors, malware detection, and the “secret signals” threat actors use to stay hidden. Stream now for expert insights on signature development, PCAP analysis, and countering espionage tools. 🎙️ www.proofpoint.com/us/podcasts/...

Have you checked your mailbox rules lately? Proofpoint cloud threat researchers found that approx. 10% of compromised accounts in Q4-2025 had malicious mailbox rules created by threat actors shortly after initial access. Details: www.proofpoint.com/us/blog/thre... Here are some highlights. ⤵️

After a lull in activity targeting Europe from mid-2023 to mid-2025, the China-aligned espionage actor #TA416 (RedDelta, Vertigo Panda, Red Lich) has resumed targeting European government and diplomatic entities, with a recent expansion to the Middle East. brnw.ch/21x1f0j

Monetary concerns + federal deadlines + abundance of “time-sensitive” email advertisements. Tax season is a recipe for cybercrime. Proofpoint researchers have seen hundreds of malicious tax-themed campaigns this year. Read the threat brief here: brnw.ch/21x1bsT.

Proofpoint has directly observed a targeted email campaign that delivers DarkSword RCE, and we attribute the messages to Russian FSB threat actor TA446 with high confidence. 🧵

Proofpoint identified a targeted campaign against operations personnel at energy firms linked to projects in Pakistan. The messages were sent on 18 March 2026, and mimicked invitations to the upcoming Pakistan Energy Exhibition & Conference (PEEC). We track the activity as UNK_VaporVibes. 1/8

The cloud threat research team at Proofpoint has discovered an account takeover campaign targeting around 40,000 users. Malicious activity has been recorded as early as Feb. 2nd, with a surge on Feb. 10th and a peak on Feb. 12th.

Interesting poll results from our February session of Intercepted, our monthly interactive threat research webinar! Replay here: brnw.ch/21x0GAL On March 18, Yaniv Miron will share his expert insights on the cloud threat landscape. ☁️ Register now and prepare your questions! brnw.ch/21x0GAR

Conflict in Iran is accelerating cyber espionage across the Middle East. Since the start of Operation Epic Fury on February 28, 2026, Proofpoint researchers have observed heightened cyber activity against Middle East targets tied to the war. Details: brnw.ch/21x0EJi.

Be sure to catch Daniel's presentation, "Welcome to the Endgame," alongside co-presenter @europol.europa.eu during #RSAC 2026. 🗓️ Wednesday, March 25 🕣 8:30 a.m. - 9:20 a.m. ⭐️ Session code FRP-W01

The popular phishing-as-a-service (PhaaS) platform used by threat actors, #Tycoon2FA, has been disrupted by law enforcement and private sector partners, including @microsoft.com, Europol, Proofpoint, @cloudflare.social, and TrendAI. Details in our blog: brnw.ch/21x0s76

On this episode of Discarded, our team explores how #artificialintelligence is shaping modern #malware analysis and detection workflows. Listen now on your favorite #podcast platform, and you'll get a balanced view of AI's growing impact on cybersecurity. 🎙️: www.proofpoint.com/us/podcasts/...

Proofpoint threat researchers identified a new malware-as-a-service named #TrustConnect. Notably, it masquerades as a legitimate remote monitoring and management tool, marking an evolution in how attackers weaponize trust around enterprise tooling. See our blog for details: brnw.ch/21x05Vh.

Wednesday, February 25th, Proofpoint's threat research experts will be live on Intercepted, answering your burning cyber threat questions and responding to your hottest takes. 💬 Register and join live: brnw.ch/21x03VM Stream last month's session: brnw.ch/21x03VL

This Valentine’s Day invite came with a payload no one asked for. 💔 ⚠️ As February 14th nears, Proofpoint researchers ask users to beware of malicious Valentine’s Day-themed lures and threats. The screenshot below is of an actual lure recently sent from a compromised account.

Remote Monitoring & Management (RMM) tooling is taking over the cybercrime landscape. And it keeps growing. Alongside Deception.Pro, we observed follow-on activity from a Bluetrait campaign in an environment built to resemble a travel firm. Result? Even more RMMs. blog.deception.pro/blog/hok-int...

In addition to espionage threat actors, financially motivated cybercriminals have been exploiting the WinRAR vulnerability CVE-2025-8088. The highly effective ecrime actor, typically seen distributing Koi Stealer/Koi Loader (TA4561), was observed doing so in Fall 2025. Details. ⤵️

Alongside this activity recently highlighted by Google (cloud.google.com/blog/topics/...), Proofpoint threat researchers have observed additional exploitation of WinRAR vulnerability CVE-2025-8088 by state‑aligned groups linked to China and the DPRK.

As the security landscape evolves and expands, Proofpoint observed many threat actors disappear from email threat data in 2025. But TA584 maintained operational consistency, w/ recent shifts demonstrating its attempt to infect a broader range of targets. www.proofpoint.com/us/blog/thre...

Cloud threat researchers at Proofpoint have identified a peak in an ongoing brute force campaign targeting ‘Azure Active Directory Powershell.’ Behind the campaign—which has impacted over 100,000 users in over 3,000 tenants—is a cluster tracked as #UNK_BareZilla.

Use of the social engineering tactic, device code phishing, increased significantly in December 2025. Proofpoint observed this technique used at scale across both financially motivated and state-aligned threat clusters.

Looking for expert insights on the latest cyberattacks, emerging trends, and actionable defense strategies? Join @selenalarson.bsky.social & Sarah Sabotka for our new monthly videocast, Intercepted. The first #livestream will happen on Jan 21 at 10 AM ET. Info: www.proofpoint.com/us/resources...

Proofpoint Discarded is a wrap for 2025! 🎬 Our last episode of the year offers grounded, experience-driven perspectives on what really mattered in 2025. Stream now for an end-of-year look at how the cyber threat landscape evolved—and what defenders need to know as we enter 2026. 🎧: brnw.ch/21wYKI6

New research from Proofpoint ‼️ Threat actors are using #phishing tactics to trick users into giving access to #M365 accounts. ⚠️ Successful compromise leads to #accounttakeover, #dataexfiltration, and more. Blog: brnw.ch/21wYtcM Here’s what you need to know. 🧵⤵️

Iran's cyber operations are now a formidable challenge for organizations. Our observations of #UNK_SmudgedSerpent, a newly identified cluster linked to Iran, exemplify the evolving complexity and resourcefulness of the country's modern threat ops. Saher Naumaan shared her insights. brnw.ch/21wYrCZ

WHAT 👏 A 👏 YEAR! Our Discarded podcast increased its listenership by 188% in 2025, and that's all because of 𝘺𝘰𝘶. 🎙️ Here, @selenalarson.bsky.social shares her gratitude and a look at what’s to come in the new year. Stay tuned for more threat insight and behind-the-scenes analysis in 2026! 🎊

New Discarded podcast ‼️ Join our ho-ho-hosts for a fun, insightful and very festive episode that highlights the seasonal threats that might be landing under your digital tree this year. ⛄ Stream now to explore how cybercriminals use seasonal themes to trick consumers & enterprises. brnw.ch/21wYf9o

This time of year, threat actors are attempting to send you gifts you’d rather not receive. 🎁 Proofpoint is seeing an increase in holiday-themed threats. Main #phishing lure themes include party invitations, holiday vouchers, end-of-year bonuses, and holiday travel.

Proofpoint's Emerging Threats "rule magician," Tony Robinson, is featured on this latest Discarded #podcast episode. 🪄 Listen as he shares the story behind his open-source tool, IoT Hunter, and explains how, through automation, it helps defenders cover hundreds of CVEs. brnw.ch/21wXDRr

Proofpoint is proud to have assisted law enforcement in the #OperationEndgame investigation that led to the November 13, 2025 disruption of #Rhadamanthys and #VenomRAT, both malicious infrastructure used by multiple cybercriminals. Rhadamanthys: brnw.ch/21wXsCc VenomRAT: brnw.ch/21wXsCd

Proofpoint researchers say with high confidence that cybercriminals are working with organized crime groups to commit physical cargo theft. 🚚 @bloomberg.com spoke with our #ecrime experts who warned, "It is a full-scale supply chain threat." Read the article: www.bloomberg.com/news/article....

New research from @ThreatInsight 🚨 Deviations in typical activities by known Iranian-linked threat actors has resulted in Proofpoint threat researchers naming a new temporary threat actor cluster, UNK_SmudgedSerpent. Blog: www.proofpoint.com/us/blog/thre...

From Old West train robbers 🚂 to 1960s mobsters 💰, #cargotheft is an age-old problem. Today, cargo theft is commonly conducted digitally by hacking the #supplychain to exploit gaps and steal #freight remotely. 🧵⤵️

Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. 🫆 We use this tool internally to help track multiple threat actors with high confidence.

With the goal of better understanding cloud account takeover (#ATO) attacks, we developed a tool that automates the creation of malicious internal apps within a #compromised #cloud environment. Here, we detail our findings and security implications. ⤵️ brnw.ch/21wWOgL

Since 14 October, we’ve tracked a high volume XWorm campaign targeting Germany. The activity is attributed to TA584, a sophisticated #cybercrime group tracked since 2020. Messages are sent from hundreds of compromised sender accounts impersonating ELSTER and contain malicious URLs.

TA585 is the identifier of the most recent threat actor named by Proofpoint. The sophisticated cybercriminal, notably, appears to own its entire attack chain with multiple delivery techniques. Learn about TA585 and one of its favored payloads, MonsterV2: brnw.ch/21wWAAU.

Researchers at Proofpoint have uncovered a recent brute force campaign, tracked as UNK_CustomCloak, targeting the first-party app, Windows Live Custom Domains. Activity was observed from September 20-30th, affecting nearly half a million users in over 4,000 tenants.

Proofpoint threat researchers have published new research identifying a new cyber-espionage campaign by #TA415 (#APT41), a China-aligned threat actor, exploiting growing uncertainty in U.S.-China economic relations. Blog: www.proofpoint.com/us/blog/thre....

Threat actors continue to abuse GitHub to deliver malware, this time: #LummaStealer. We identified GitHub notification emails that kick off the attack chain. Messages are sent when the threat actor, using an actor-controlled account, comments on existing GitHub issues. 🧵

Threat actors are exploiting #Microsoft365 Direct Send to make their phishing campaigns appear to originate from inside an organization. On this episode of DISCARDED, you'll hear why legacy features like Direct Send are a prime target for cybercriminals. Stream now on our website: brnw.ch/21wVja5

Something #spicy is coming to the next Only Malware in the Building podcast—dropping September 2. 🌶️ Bookmark the show page and reserve your seat at the table 🪑 alongside Selena Larson, Dave Bittner and Keith Mularski. 🔥 You won't want to miss it! thecyberwire.com/podcasts/onl... #podcast #hotones