ThreatInsight

Just announced: CoGUI has been disrupted. Proofpoint supported @microsoft.com in the major takedown of Chinese-speaking cybercrime threat actors and CoGUI, the infrastructure supporting their activities. More details: www.proofpoint.com/us/blog/thre...

The CoGUI phishing kit has made Japan one of the most targeted countries in our data based on campaign volume. Threat actors use it to impersonate well-known Japanese and international companies, stealing usernames, passwords, and payment data.

Just announced: CoGUI has been disrupted. Proofpoint supported @microsoft.com in the major takedown of Chinese-speaking cybercrime threat actors and CoGUI, the infrastructure supporting their activities. More details: www.proofpoint.com/us/blog/thre...

We were proud to provide threat data from our visibility, including malicious domains and information related to CoGUI, CoAceV and CoFish_Ws campaigns, and provided a declaration for the suit.

In July 2026, a China-aligned threat actor, TA419, ran credential-phishing campaigns impersonating prominent economists and AI policymakers, including a former White House Office of Science & Technology Policy leader. More info: www.proofpoint.com/us/blog/thre...

The AitM phishing chain used by TA419 targets Microsoft 365 / Entra ID through the first-party OfficeHome application. TA419 extended the kit with a custom telemetry and automation module that tracks and drives the target's progress through the MSFT sign-in flow, including MFA.

In July 2026, a China-aligned threat actor, TA419, ran credential-phishing campaigns impersonating prominent economists and AI policymakers, including a former White House Office of Science & Technology Policy leader. More info: www.proofpoint.com/us/blog/thre...

TA419 targeted AI experts at US think tanks, universities, and legal-sector orgs and likely served Chinese intel objectives. They began w/ benign outreach, followed up w/ a shortened URL leading to a fake OneDrive AitM cred-phishing page to access the target’s cloud account.

Within 90 seconds of compromise, a threat actor triggered multiple post-access sequences. Our threat researchers believe this activity was AI-enabled. Our new blog examines this active TeamFiltration campaign, tracked as UNK_CondorFiltration. www.proofpoint.com/us/blog/thre...

It targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America. The common theme among compromised accounts: all were service accounts, still open on the tenant’s identity plane, belonging to no specific person.

New research from Proofpoint: BlueMoon, a Chrome-to-Windows exploit kit, has been used by at least four state-sponsored threat actors since late August. www.proofpoint.com/us/blog/thre...

The observed patch-gap weaponization, use of a privilege escalation exploit targeting older Windows builds, and TTPs observed point to an ephemeral capability rushed out ahead of an anticipated patch. This contrasts starkly with the tradecraft typically seen in historical browser exploit activity.

New research from Proofpoint: BlueMoon, a Chrome-to-Windows exploit kit, has been used by at least four state-sponsored threat actors since late August. www.proofpoint.com/us/blog/thre...

We assess most activity to date as China-aligned, but given its ease of adoption, it is likely to proliferate further and be adopted by espionage- and financially motivated threat actors as patched versions roll out across all Chromium-based browsers.

New research from Proofpoint: BlueMoon, a Chrome-to-Windows exploit kit, has been used by at least four state-sponsored threat actors since late August. www.proofpoint.com/us/blog/thre...

Proofpoint has observed a Chinese-speaking threat actor (TA4922) using a command and control (C2) framework called PackClient. The framework enables data theft, surveillance, and downloading of additional plugins and payloads. Blog: www.proofpoint.com/us/blog/thre... #impersonation #phishing

TA4922 used PackClient to deliver payloads inside tax-themed lures, impersonating the Shandong Provincial Tax Bureau and the Government of India Income Tax Department. PackClient dropped ManageEngine RMM. We used the Deception Pro malware observability environment to view follow-on payloads.

Proofpoint has observed a Chinese-speaking threat actor (TA4922) using a command and control (C2) framework called PackClient. The framework enables data theft, surveillance, and downloading of additional plugins and payloads. Blog: www.proofpoint.com/us/blog/thre... #impersonation #phishing

We’ve noticed an increase in new malware from Chinese-speaking ecosystems compared to previous years. This is likely due in part to increased hunting and detection, but also because more malware families are emerging in commodity marketplaces.

A COLDCARD hardware wallet vulnerability is being exploited by threat actors. The reported firmware flaw has led to tens of millions worth of Bitcoin stolen. We've observed social engineering with “hardware audit” themes impersonating #COLDCARD in email-based phishing campaigns.

The #COLDCARD breach may be an effective #socialengineering lure for cybercriminals, preying on the fear and concern people might have for the security of their #cryptocurrency to convince them to take risky decisions.

A COLDCARD hardware wallet vulnerability is being exploited by threat actors. The reported firmware flaw has led to tens of millions worth of Bitcoin stolen. We've observed social engineering with “hardware audit” themes impersonating #COLDCARD in email-based phishing campaigns.

If clicked, the button leads to a BAT file hosted on GitHub, which drops an MSI file and ultimately installs ScreenConnect. This can lead to data or financial theft, or the installation of follow-on malware like ransomware. #dataloss #ransomware #malware #COLDCARD

A COLDCARD hardware wallet vulnerability is being exploited by threat actors. The reported firmware flaw has led to tens of millions worth of Bitcoin stolen. We've observed social engineering with “hardware audit” themes impersonating #COLDCARD in email-based phishing campaigns.

🚨 We are following up with additional observations of the TA488’s use of “half-click” exploits. The group has initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook Web Access (OWA). New blog: www.proofpoint.com/us/blog/thre...

This novel infection chain ends with a previously unknown JavaScript browser-based implant we call OWAReaper, purpose-built for persistent access inside OWA. OWAReaper can survive browser reboots, credential rotation, and a full reimage of the victim's device.

🚨 We are following up with additional observations of the TA488’s use of “half-click” exploits. The group has initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook Web Access (OWA). New blog: www.proofpoint.com/us/blog/thre...

Our Proofpoint AI threat researchers continue to observe activity on underground criminal forums, suggesting that Indirect Prompt Injection (IDPI) could soon be leveraged as an intrusion vector. Explore the methods that are being actively developed and sold: www.proofpoint.com/us/blog/thre....

Case 3 in our blog, "IDPI via calendar invite," is particularly interesting. It involves the threat actor generating calendar invites with an injected prompt in the invite body, appearing as a meeting agenda. When an agent proccesses it, it also processes the malicious prompt.

Our Proofpoint AI threat researchers continue to observe activity on underground criminal forums, suggesting that Indirect Prompt Injection (IDPI) could soon be leveraged as an intrusion vector. Explore the methods that are being actively developed and sold: www.proofpoint.com/us/blog/thre....

Our researchers discovered that a Russia-aligned threat actor was exploiting a previously unknown (zero-day) vulnerability against Zimbra mailservers. We alerted government partners, with whom we have collaborated on further discovery. Blog: www.proofpoint.com/us/blog/thre...

· The activity is attributed to TA488 (AKA Laundry Bear / Void Blizzard). They're likely directed by Russian intelligence w/ the goal of long-term email collection and surveillance. Since at least July 2025, TA488 has exploited Zimbra mailservers to target organizations in Ukraine and the USA.

Our researchers discovered that a Russia-aligned threat actor was exploiting a previously unknown (zero-day) vulnerability against Zimbra mailservers. We alerted government partners, with whom we have collaborated on further discovery. Blog: www.proofpoint.com/us/blog/thre...

· To execute the exploit, the target needs only to open the email. No social engineering is required to entice or trick a user into clicking a link or opening an attachment. This is dangerous, as the average employee has thousands of emails in their inbox that appear ordinary.