Security researcher @bomccss posted on X on 13 November 2026 that Japanese-language emails aiming to infect recipients with malware via an attachment were seen that day. According to the posts, the subject was '2026年1…
Source: x.com · published
Security researcher @bomccss posted on X on 13 November 2026 that Japanese-language emails aiming to infect recipients with malware via an attachment were seen that day. According to the posts, the subject was '2026年12月の給与引き上げに関するお知らせ' (notice about the December 2026 salary increase) and the attachment '12月からの昇給に関するスプレッドシート.zip' (spreadsheet about the raise from December) contains a.js file that installs the Remcos remote-access malware. The researcher listed communication endpoints hxxps://royal-wood-3c0d.julianosilvasantospiresrosa.workers[.]dev/prxyb and hxxps://ii-sen[.]ir/nv/payload_113212.png, and the C2 server winne.mynetav[.]net (185.149.24.166), in a follow-up post (https://x.com/bomccss/status/2121131525156827291). The researcher does not say who controls these hosts: the personal-looking name in the workers.dev subdomain is only a Cloudflare account label and may belong to an abused or stolen account, and ii-sen.ir may be a compromised website, so only the listed paths are reported here. workers.dev is Cloudflare's shared domain; only this subdomain is reported here. Do not open zipped attachments about pay or bonuses from unexpected emails; check with your HR department directly. Source: https://x.com/bomccss/status/2121131522594099200
These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.
Security researcher @masaomi346 posted on X on 13 November 2026 that hxxps://waqfggna.eu.cc/ distributes Android malware posing as FamilyMart (ファミリーマート), the Japanese convenience-store chain, tagging it #Phishing and…
Germany's financial regulator BaFin published a warning dated 13 November 2026 about fixed-term deposit offers sent from the email addresses antrag@raisinfestgeld.de and j.tarrant@raisinangebote.com. BaFin says there…
Help Net Security reported today on research by Cynet into a fake 'GTA 6 EXE file download' promoted from a Google Colab notebook. The link led to a page called 'Windows Software Hub' showing a version number, downloa…
A post on X on 13 November 2026 shared a ScanMalware result rating peee-dash-zim-six[.]vercel[.]app/zimba.html a "CONFIRMED SCAM". ScanMalware's analysis describes a clone of the Zimbra Web Client sign-in page on a Ve…
ScanMalware posted on X on 13 November 2026 that track-lx92f9[.]firebaseapp[.]com is a "CONFIRMED SCAM". Its analysis says the Firebase page is an empty stub that automatically redirects visitors to a Codeanywhere dev…
Web scanner ScanMalware posted on X on 13 November 2026 that chase-acess[.]vercel[.]app is a "CONFIRMED SCAM". Its analysis describes a fake Chase "Document Center" on a lookalike Vercel subdomain that lures visitors…