Gen Threat Labs (@genthreatlabs) 's Twitter Profile
Gen Threat Labs

@genthreatlabs

A global network of #cybersecurity researchers at Gen, protecting nearly 500M people through our Cyber Safety brands - @Norton, @Avast, @LifeLock & more.

ID: 866403347867283458

linkhttps://www.gendigital.com/blog/news/innovation calendar_today21-05-2017 21:20:29

495 Tweet

3,3K Followers

26 Following

Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

๐Ÿšจ New campaign spreading through WhatsApp in CZ๐Ÿ‡จ๐Ÿ‡ฟ asking to vote for a ballerina to win a ballet course. Voting requires WhatsApp verification which in reality gives attackers full access to the victims account via linked devices! URL: aspireglobalplc[.]com

๐Ÿšจ New campaign spreading through WhatsApp in CZ๐Ÿ‡จ๐Ÿ‡ฟ asking to vote for a ballerina to win a ballet course. Voting requires WhatsApp verification which in reality gives attackers full access to the victims account via linked devices!

URL: aspireglobalplc[.]com
Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

"Update Chrome!" โ€“ said #SocGholish again. One-day long #FakeUpdate campaign via hacked legit sites spotted during this week + a file name hiding a homoglyph (๐Ÿ‘€ not all o's are equal). Looks like a test run before something bigger. IoCs: Compromised domain: adomonline.]com JS

"Update Chrome!" โ€“ said #SocGholish again.
One-day long #FakeUpdate campaign via hacked legit sites spotted during this week + a file name hiding a homoglyph (๐Ÿ‘€ not all o's are equal). Looks like a test run before something bigger.

IoCs:
Compromised domain: adomonline.]com

JS
Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

New e-mail #phishing campaign alert: Subject: "Your Email Account Is Scheduled for Migration This Week" ๐Ÿšจ PDF attachment with link to @zoom docs ๐ŸŽฏ Target brand: SaskTel Support on @netlify infra ๐Ÿ“ค Stolen creds exfiltrated via Telegram bot Stay cautious & spread awareness.

New e-mail #phishing campaign alert:
Subject: "Your Email Account Is Scheduled for Migration This Week"
๐Ÿšจ PDF attachment with link to @zoom docs
๐ŸŽฏ Target brand: <a href="/SaskTelSupport/">SaskTel Support</a> on @netlify infra
๐Ÿ“ค Stolen creds exfiltrated via Telegram bot

Stay cautious &amp; spread awareness.
Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

๐Ÿšจ The Q1/2025 Threat Report is here, sharing the major threats this quarter! Hereโ€™s what weโ€™ve discovered โ€ฆ ๐Ÿ’ฅ 4M+ users shielded from Scam-Yourself Attacks โš ๏ธ Fake update scams increased 17 times compared to last quarter ๐Ÿ“ˆ Breached personal records up 186% ๐ŸŽญ Deepfakes +

๐Ÿšจ The Q1/2025 Threat Report is here, sharing the major threats this quarter! Hereโ€™s what weโ€™ve discovered โ€ฆ 

๐Ÿ’ฅ 4M+ users shielded from Scam-Yourself Attacks
โš ๏ธ Fake update scams increased 17 times compared to last quarter 
๐Ÿ“ˆ Breached personal records up 186%
๐ŸŽญ Deepfakes +
Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

๐Ÿ“ท How are attackers using movie streaming sites to stealthily deliver malware? Meet #HelloTDSโ€”a sophisticated infrastructure delivering multiple #FakeCaptcha variants and more. ๐Ÿ“ท Read our latest blog post for the full breakdown: gendigital.com/blog/insights/โ€ฆ

Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

๐Ÿšจ Phishing Alert โ€“ UK ๐Ÿ‡ฌ๐Ÿ‡ง Targeted SMS Campaign ๐Ÿšจ Since late May, a #phishing campaign impersonating Department for Work and Pensions has been circulating via SMS using shortened links leading to fake government websites, peaking in the second half of June. The messages warn of missing Winter Heating

๐Ÿšจ Phishing Alert โ€“ UK ๐Ÿ‡ฌ๐Ÿ‡ง Targeted SMS Campaign ๐Ÿšจ

Since late May, a #phishing campaign impersonating <a href="/DWPgovuk/">Department for Work and Pensions</a> has been circulating via SMS using shortened links leading to fake government websites, peaking in the second half of June. The messages warn of missing Winter Heating
Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

๐Ÿšจ Phishing Alert โ€“ CZ ๐Ÿ‡จ๐Ÿ‡ฟ Subject: โ€œOvฤ›ล™te รบdaje svรฉho รบฤtu UCBโ€ The #phishing campaign impersonating UniCredit Bank via email requires confirmation of updated data. The message warns of blocking an account. Typosquatted domain: cs.aktualizaceudaju-unicreditgroup[.]eu

๐Ÿšจ Phishing Alert โ€“ CZ ๐Ÿ‡จ๐Ÿ‡ฟ
Subject: โ€œOvฤ›ล™te รบdaje svรฉho รบฤtu UCBโ€
The #phishing campaign impersonating <a href="/UniCredit_CZSK/">UniCredit Bank</a> via email requires confirmation of updated data. The message warns of blocking an account.

Typosquatted domain: cs.aktualizaceudaju-unicreditgroup[.]eu
Gen (@gendigitalinc) 's Twitter Profile Photo

๐Ÿ‘Congratulations to Policie ฤŒR, Europol, and all partners on the success of #OperationEastwood against NoName057(16). Weโ€™re glad that Gen Threat Labs was able to contribute a small piece of the puzzle, sharing technical indicators like Telegram activity and C2 infrastructure.

Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

Looks like weโ€™ve got another one decrypted ๐Ÿ™‚ Glad we could help victims of #FunkSec - AI-built ransomware, now out of play. This is what our missionโ€™s about: protecting people and defeating threats. ๐Ÿ”“

Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

๐Ÿšจ Q2/2025 Gen Threat Report is out!๐Ÿšจ Hereโ€™s what we uncovered: ๐Ÿ’Š #PharmaFraud: 5,000+ domains of fake online pharmacies found ๐Ÿ”“ AI-built #FunkSec #ransomware decrypted by us ๐Ÿ’ธ Financial #scams up 340% (many from Facebook ) ๐Ÿ“ฒ Push notification scams up 317% Read the

Gen Threat Labs (@genthreatlabs) 's Twitter Profile Photo

๐Ÿ’Š Our researchers uncovered 5,000+ fake online pharmacies selling counterfeit meds. They looked legitimate. They used AI-generated blogs. They even mimicked real support teams. This is PharmaFraud, and itโ€™s one of the fastest-growing threats we've seen. Read more about this