Don’t let MFA lull you into complacency. Advanced phishing kits can still slip through.

Before the Thanksgiving holiday, one of our customers alerted us to an Evilginx MITM phishing campaign targeting university students and SSO portals. At least 18 American institutions were targeted.

We tested several approaches for large-scale detection, including analyzing web server fingerprints and HTTP artifacts. However, this proved challenging because Evilginx operates as a proxy between the victim’s browser and the legitimate login page, making its behavior and content nearly indistinguishable from the real site. In the end, we mostly relied on DNS for confirmation and classification.

Here is a short blog about the campaign and actor, including involved domains and IPs.

https://blogs.infoblox.com/threat-intelligence/dns-uncovers-infrastructure-used-in-sso-attacks/

#InfobloxThreatIntel #dns #evilginx #threatintel #threatintelligence #infosec #cybersecurity #cybercrime #infoblox #phishing #mitm #aitm #sso #mfa #university #students #proxy #login

Infoblox published a fantastic writeup of a recent widespread phishing/Evilginx campaign against universities. As the article notes, discovering the entire attack surface is very difficult. I recommend all academic institutions have a look for these indicators.

#ThreatIntel #ThreatIntelligence

https://blogs.infoblox.com/threat-intelligence/dns-uncovers-infrastructure-used-in-sso-attacks/

MISP core format has been updated with a new field to track first-time publication, and a new IETF Internet-Draft has been published.

This minor, fully backward-compatible addition reinforces the long-term stability and extensibility of the MISP standard format.

#cti #opensource #openstandard #threatintelligence #misp

🔗 https://datatracker.ietf.org/doc/draft-dulaunoy-misp-core-format/
🔗 https://www.misp-standard.org/rfc/misp-standard-core.html

@misp

Don’t let MFA lull you into complacency. Advanced phishing kits can still slip through.

Before the Thanksgiving holiday, one of our customers alerted us to an Evilginx MITM phishing campaign targeting university students and SSO portals. At least 18 American institutions were targeted.

We tested several approaches for large-scale detection, including analyzing web server fingerprints and HTTP artifacts. However, this proved challenging because Evilginx operates as a proxy between the victim’s browser and the legitimate login page, making its behavior and content nearly indistinguishable from the real site. In the end, we mostly relied on DNS for confirmation and classification.

Here is a short blog about the campaign and actor, including involved domains and IPs.

https://blogs.infoblox.com/threat-intelligence/dns-uncovers-infrastructure-used-in-sso-attacks/

#InfobloxThreatIntel #dns #evilginx #threatintel #threatintelligence #infosec #cybersecurity #cybercrime #infoblox #phishing #mitm #aitm #sso #mfa #university #students #proxy #login

MISP core format has been updated with a new field to track first-time publication, and a new IETF Internet-Draft has been published.

This minor, fully backward-compatible addition reinforces the long-term stability and extensibility of the MISP standard format.

#cti #opensource #openstandard #threatintelligence #misp

🔗 https://datatracker.ietf.org/doc/draft-dulaunoy-misp-core-format/
🔗 https://www.misp-standard.org/rfc/misp-standard-core.html

@misp

Actual threat intelligence! A few friends and I identified a new reverse phishing campaign leveraging Entra Guest User invitations.

This campaign was newly discovered and corroborated. I recommend reviewing organization email for these invitations.

https://taggart-tech.com/entra-toad/

#ThreatIntel #ThreatIntelligence

Actual threat intelligence! A few friends and I identified a new reverse phishing campaign leveraging Entra Guest User invitations.

This campaign was newly discovered and corroborated. I recommend reviewing organization email for these invitations.

https://taggart-tech.com/entra-toad/

#ThreatIntel #ThreatIntelligence

@AAKL @jerry I think that #malware and #threatintelligence are still less awful, when they're relevant.

New UI to RansomLook.io

The open source project providing real-time ransomware intelligence.

Thanks to @F_kZ_ for the incredible work.

#ransomware #threatintelligence #threatintel #opensource

🔗 https://www.ransomlook.io/

Several people were arrested during an undercover operation targeting child sex predators in Nevada. One of them is Tom Alexandrovich, who turns out to be the Executive Director of the Israel Cyber Directorate. The child predator was released.

I believe the security community must denounce this person and be banned from the conferences, including BlackHat and DefCon.

@fr0gger since, unfortunately, you are in the picture with this person (LinkedIn account of him was deleted already), and you have a good reputation within our community, would be super cool if you'd take a lead and get in touch with the BlackHat/DefCon organizers.

Link to news: https://www.msn.com/en-us/tv/news/israeli-official-arrested-in-nevada-child-sex-operation-is-released-and-back-in-israel/ar-AA1KCpah

#BlackHat#BHUSA#BlackHatUSA2025#Cybersecurity#ThreatIntelligence#DefCon#Israel#DEFCON33#TomAlexandrovich

Several people were arrested during an undercover operation targeting child sex predators in Nevada. One of them is Tom Alexandrovich, who turns out to be the Executive Director of the Israel Cyber Directorate. The child predator was released.

I believe the security community must denounce this person and be banned from the conferences, including BlackHat and DefCon.

@fr0gger since, unfortunately, you are in the picture with this person (LinkedIn account of him was deleted already), and you have a good reputation within our community, would be super cool if you'd take a lead and get in touch with the BlackHat/DefCon organizers.

Link to news: https://www.msn.com/en-us/tv/news/israeli-official-arrested-in-nevada-child-sex-operation-is-released-and-back-in-israel/ar-AA1KCpah

#BlackHat#BHUSA#BlackHatUSA2025#Cybersecurity#ThreatIntelligence#DefCon#Israel#DEFCON33#TomAlexandrovich