Sekoia

16 June

#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework. ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sites to serve ClickFix lures. blog.sekoia.io/unveiling-er...

An attacker found our Flowise #honeypot, a decoy #AI platform, and literally tried to turn the agent into its very own attack assistant. They pulled credentials, planted a callback, and fed the model data from a likely iGaming target. buff.ly/AMujIsR

What makes #ShinyHunters hard to stop? Well… the name can survive the people using it. Since 2020, changing operators have used the name to steal data and run extortion schemes. www.sekoia.com/blog/gotta-b...

Sekoia #TDR team traces how the operation reached cloud and SaaS environments, then turned trusted access into money. Written with @BeazleySecurity, the report also draws on first-hand incident response from a zero-day Oracle PeopleSoft compromise.

21 Sept

TDR analysts uncovered #Exvicy, an emerging #ClickFix MaaS sold on Exploit.IN since May 2026. We assess with high confidence that Exvicy is a copycat of #ErrTraffic, reusing its injected JavaScript, ClickFix HTML, and C2 communication logic. buff.ly/nKNSjMy

Exvicy is already widespread in the wild. We identified dozens of active administration panels and more than 100 C2 servers. Its monthly price also jumped from $1,200 to $2,000 in mid-August 2026.

21 Sept

As usual, IoCs are available in our Community GitHub repository: buff.ly/5CISNsZ

Exvicy's affiliates compromise WordPress sites to display a fake Cloudflare Turnstile CAPTCHA in a fullscreen iframe. Victims are told to press Win+R, Ctrl+V, and Enter, executing Base64-encoded PowerShell that drops malware.

21 Sept

Exvicy reuses ErrTraffic's obfuscated JavaScript, ClickFix HTML, FNV-1a hashing and C2 actions. The main advertised change is the use of Win+R instead of Win+X for the ClickFix command.

North Korea’s cyber program was built to serve two purposes: intelligence collection and revenue generation. A new joint report from Sekoia #TDR and @KudelskiSec examines how that system is organized. buff.ly/vmqOr9d

One finding runs throughout the research: espionage and revenue generation are closely linked. Access obtained for financial gain can be reused for intelligence collection. Shared infrastructure can support both missions.

IT workers operating under false identities are part of this model too, functioning as a revenue channel and an insider threat. Read the full report, Beyond Lazarus: Organization of DPRK Cyber Capabilities buff.ly/vmqOr9d

By cross-referencing multiple taxonomies, the report breaks down the former Lazarus umbrella into six distinct sub-clusters. This provides a clearer view of who is operating and how.

The analysis also covers the wider support structure behind North Korea’s cyber operations. Academic institutions train operators and provide cover. Front companies act as proxies across several regions. Criminal networks support fund movements.

The research maps the institutions responsible for North Korea’s cyber offensive operations, including recent reorganizations and the intrusion sets operating under them.

It also addresses a persistent challenge in threat intelligence: cluster deconfliction. Aliases multiply. Boundaries shift between vendors. Different names can hide the same activity.

Don’t Eat The #ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits www.sekoia.com/blog/dont-ea... Discover our joint threat intelligence report with @YesWeHack.

- Targeted Action & Persistence: While the malicious PyPI packages were immediately reported and removed, our analysis shows that parts of the core Command & Control (C2) infrastructure remain active.

- An Ongoing threat: The campaign's structure and persistence indicate a broader, long-term operation aiming directly at cyber defenders rather than an isolated, one-shot attack.

Don’t Eat The #ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits www.sekoia.com/blog/dont-ea... Discover our joint threat intelligence report with @YesWeHack.

Recognising critical anomalies in the code and its malicious imports, the YesWeHack team joined forces with Sekoia’s threat intelligence experts to run a deep-dive investigation. The outcome of this collective defence effort:

- Infrastructure Uncovered: We mapped out a cluster of malicious GitHub repositories and backdoored Python (PyPI) specifically crafted to target the security community.

Don’t Eat The #ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits www.sekoia.com/blog/dont-ea... Discover our joint threat intelligence report with @YesWeHack.

It started when a suspicious GitHub repository, disguised as a harmless Proof of Concept (PoC) for a Nuclei template, was flagged.

26 June

Our latest Threat Intelligence report dives deep into ADINT (Advertisement-based Intelligence) to expose how private companies weaponise AdTech mechanisms to harvest intelligence data, fueling the surveillance solutions they sell. www.sekoia.com/blog/sold-to...

- Ultimately, ADINT can be leveraged as a zero-click intrusion vector through code injection within the ad content, exploiting software vulnerabilities to deploy spyware.

26 June

As the threat landscape expands beyond traditional network perimeters, understanding the security risks of the AdTech ecosystem is becoming critical for enterprise defence.

Key insights from the report: - ADINT can be defined as the weaponisation of legitimate AdTech mechanisms, notably the real-time bidding process and third-party SDKs, to collect, correlate, and operationalise large-scale data for intelligence purposes.

26 June

- ADINT can be used for group-level profiling, identification of geolocation patterns or highly targeted near real-time geolocation tracking.

Online advertising is no longer just a tool for marketers, it has become a sophisticated vector for surveillance and cyber espionage.

Our forensic analysis of compromised WordPress servers helped us to cluster ErrTraffic and map affiliates' TTPs and backdoors. We notably identified two distinct clusters: "Analytics" operated by a single threat actor, and "Beer" likely operated by LenAI for affiliates.

16 June

This blog post details the ErrTraffic threat and its associated ecosystem, highlighting three specific campaigns and their operators’ arsenal. Finally, it provides several analytical hypotheses regarding the MaaS operations and the organisation of these affiliate groups.

The ErrTraffic MaaS offering includes: - The EtherHiding technique to retrieve the C2 from Polygon smart contracts - A Traffic Distribution System (TDS) to filter unwanted traffic - Various ClickFix lures LenAI, the operator behind ErrTraffic, sells subscriptions for $380/month

🇷🇺 Sekoia #TDR team has just released a comprehensive analysis of how #APT28's arsenal has evolved, from its early to its current operations. blog.sekoia.io/apt28-an-evo...

- Return of custom implants: Deploying stealthy, modular toolsets (like Phantom Net Voxel) controlled via cloud infrastructures. - Delegating logic to AI: Experimenting with malware (like LameHug) that queries an LLM on the fly to generate attack commands.

This report is part of a broader coordinated effort, conducted since 2025 in collaboration with foreign and domestic law enforcement and government agencies, including the FBI, to limit APT28's activities and constrain GRU cyber operations.

🇷🇺 Sekoia #TDR team has just released a comprehensive analysis of how #APT28's arsenal has evolved, from its early to its current operations. blog.sekoia.io/apt28-an-evo...

Here are the three major shifts defining APT28's modern operations: - Infrastructure moved to the edge: Compromising SOHO devices and abusing cloud services to mask traffic.

8 June

The second and third parts of our investigation into the #Gamaredon, the cyberespionage group operated by the Russian #FSB, are live! 🪆Part 2 — The loaders buff.ly/bBYZSKa 🪆Part 3 — The stealer & full infrastructure buff.ly/74WHuPd #CTI #TDR #Sekoia

1 June

Russia's #FSB-linked #Gamaredon has been hammering Ukraine's government, military & critical infrastructure for over a decade. We went behind the scenes. Tracked their infrastructure. Recovered artefacts from compromised machines. Here's what we found 🧵 buff.ly/6hR2IMj

1 June

The result: the most complete picture of Gamaredon's current operations to date. A massive campaign. Still running. Right now. We're releasing a 3-part investigation this week — starting today with Part 1: Initial access & the worm.

1 June

📄 Part 1 — Initial access & the worm → buff.ly/6hR2IMj 🔜 Part 2 — The loaders (Wednesday) 🔜 Part 3 — The stealer & full infrastructure (Thursday)

8 Apr

Part 2 of our #EvilTokens analysis is live. TDR analysts uncovered the AI-augmented features that automate and scale #BEC workflows, marking a breakthrough in the #PhaaS ecosystem. blog.sekoia.io/eviltokens-a...

We assess that EvilTokens is the first PhaaS to offer #AI-augmented post-compromise tooling, representing a significant shift in the BEC ecosystem by making advanced, victim-tailored fraud capabilities accessible to a broad audience of financially-motivated threat actors.

8 Apr

Part 1 of our technical deep dive into EvilTokens: blog.sekoia.io/new-widespre...

The EvilTokens PhaaS runs via fully featured Telegram bots and continuously enhances its phishing kit with new capabilities.

8 Apr

TDR analysts gained access to the #EvilTokens backend JavaScript and implemented device code phishing functions and token weaponisation. This script also includes #LLM #prompts to analyse large volumes of emails, construct BEC attack scenarios, and draft targeted #BEC emails.

30 Mar

#TDR analysts uncovered an emerging Phishing-as-a-Service (#PhaaS) platform called #EvilTokens, which offers device code phishing pages and AI-augmented features to automate and scale #BEC workflows. ⬇️ blog.sekoia.io/new-widespre...

Our report offers a technical analysis of the EvilTokens kit, its delivery campaigns, and the adversary's infrastructure.

30 Mar

As usual, IoCs are available in our Community GitHub repository: github.com/SEKOIA-IO/Co...

EvilTokens device code phishing pages allows attackers to capture Microsoft refresh and access token, weaponise them, harvest victims' mailbox, and automatically craft BEC emails using AI.