iiinova — where your digital self keeps evolving

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 11/03/2026

or example: in Dec 2025, we observed a ClickFix campaign that leveraged shared ChatGPT conversations containing malicious links, leading to MacSync infections. A more recent campaign, in February, featured an updated MacSync variant – a multistage […] [Original post on infosec.exchange]

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 11/03/2026

ClickFix is an increasingly common social engineering technique, which threat actors use to trick users into installing malicious software on their devices. Historically, it’s been aimed at Windows users – but recently we’ve seen three ClickFix campaigns […] [Original post on infosec.exchange]

A screenshot of an installer window as part of a macOS ClickFix attack

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/10/2025

A similar trend holds for Vicuna-7B, where the ASR drops from 100% to 1.35% under salting. These results demonstrate that our approach effectively eliminates the subset of jailbreaks that remain robust under traditional defenses, outperforming both parameter-based and prompt-based strategies.

A bar chart showing jailbreak ASR vs MMLU accuracy for Vicuna-7b, across different defences (original model with no fine-tuning; standard fine-tuning; System Prompt Change; and LLM salting)

110 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/10/2025

We evaluated LLM salting against the Greedy Coordinate Gradient (GCG) jailbreak attack. Experiments on LLaMA2-7B-Chat and Vicuna-7B showed that salting consistently breaks intra-model transferability, while preserving the model’s performance on benign […] [Original post on infosec.exchange]

A bar chart showing jailbreak ASR vs MMLU accuracy for LLaMA2-7b, across different defences (original model with no fine-tuning; standard fine-tuning; System Prompt Change; and LLM salting)

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 26/08/2025

91% of #ransomware incidents involve data theft. Is your organization prepared? Explore the latest edition of our Threat Intelligence Executive Report – Volume 2025, Number 4, packed with actionable insights from our CTU Research Team. 🔹 Discover why […] [Original post on infosec.exchange]

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 29/07/2025

Sophos analysts are investigating a new infection chain for the GOLD BLADE cybercriminal group’s custom RedLoader malware, which initiates command and control (C2) communications. The threat actors leverage a LNK file to remotely execute and sideload a […] [Original post on infosec.exchange]

A flow chart describing the infection chain under discussion; full text in article linked from next toot

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 23/07/2025

AI integration may seem very recent, but has been woven into the fabric of cybersecurity for many years. However, there are still improvements to be made. In our industry, models are often deployed on a massive scale, processing billions of events a day […] [Original post on infosec.exchange]

Clustered stacked bar graph showing performance difference between old production model and new, distilled model

013 3

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 04/06/2025

When we analyzed the backdoors, we ended up down a rabbithole of multiple variants, obfuscation, convoluted infection chains, and identifiers. The upshot is that a threat actor seems to be creating backdoored repos at scale, and may have been doing so for some time.

A screenshot of JavaScript code, showing four obfuscated string variables

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 04/06/2025

We’ve previously looked into the niche world of threat actors targeting each other, so we investigated further, and found 133 backdoored repos, most linked to the same threat actor via an email address. Some repos claimed to be malware, others gaming cheats […] [Original post on infosec.exchange]

A screenshot of a YAML file, showing autocommit logic

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 04/06/2025

We often get queries from customers asking if they’re protected against certain malware variants. A recent question seemed no different – a customer wanted to know if we had protections against ‘Sakura RAT,’ an open-source malware project hosted on GitHub […] [Original post on infosec.exchange]

A screenshot of a .NET project file, showing a long truncated string in the PreBuildEvent field

111 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

Operation Destabilise – the NCA-led disruption of a large Russian money laundering network with links to ransomware, drugs, and espionage – showed it’s big business. A recent report by Europol also suggests an increasing overlap between cybercrime and real-world organized crime.

A screenshot from a criminal forum, in which a user provides details on things tax investigators look for and recommends certain businesses

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

Threat actors who expand into new territories and business ventures complicate investigations and draw more victims, collaborators, and innocent people – directly or indirectly – into their orbits.

A screenshot from a criminal forum, in which a user says they have an insider in a company and recommends that other users invest

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

The prospect of cybercriminals insidiously integrating themselves into legitimate industries – as well as being engaged in a wide range of real-world illegal activities – has significant implications for cybersecurity, law enforcement, and wider society.

A screenshot from a criminal forum, in which a user (likely a ransomware affiliate) suggests using “local girls” for laundering money, via OnlyFans

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 15/05/2025

In some cases, the aim is likely money laundering. In others, diversification. Just like wealthy ‘real-world’ criminals, threat actors appear to want to diversify, to increase their profits and reduce the likelihood of disruption if their cybercrime activities are curtailed.

A screenshot from a criminal forum, in which a user says they are able to provide “clean luxury and premium cars in the USA with full legal documents and certificates of ownership”

110 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/04/2025

Also of note is the shift by many criminals away from use of malware to establish a foothold, instead using legitimate software. Commercial remote access and remote machine management tools are being used with greater frequency to gain persistent access to […] [Original post on infosec.exchange]

Remote access tools observed in incidents: In nearly 25% of incidents, PSExec was used; AnyDesk was close behind, followed by ScreenConnect.

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/04/2025

Today, Sophos X-Ops has published Sophos' Annual Threat Report, with a focus on cybercrime affecting small and medium businesses. There are a number of key takeaways from the incident and detection telemetry from 2024: First, network edge devices-and VPN […] [Original post on infosec.exchange]

A chart showing initial compromise types, ranked in frequency seen in incidents by Sophos MDR and Sophos Incident Response. VPNs were the source of initial compromise over 30% of the time.

199 9

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 01/04/2025

The adversary used a lookalike domain and an email crafted to resemble an actual ScreenConnect email alert to lure the administrator to a malicious website posing as the ScreenConnect login page, which acted as a proxy to the actual site. /3

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 01/04/2025

Sophos MDR Threat Intelligence has linked this attack with high confidence to STAC4365, a ScreenConnect adversary-in-the-middle phishing campaign that has been in operation for at least 3 years. /2

Domain registration activity associated with STAC4365

Some of the domain names used in ScreenConnect phishing attacks by STAC4365

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 01/04/2025

In late January, Sophos MDR Incident Response responded to a cluster of simultaneous Qilin ransomware attacks on customers of a managed service provider. The attacks were enabled by the MFA phishing of an MSP administrator's ScreenConnect login. /1

The Qilin ransom note dropped in the attacks

121 2

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/03/2025

Targets are instructed by text on the page to prove they are human by pressing Windows-R, Ctrl-V, and Enter—which open the Windows “Run” command window, paste in content placed in the clipboard by the JavaScript code, and then execute that content. /4

A screenshot of a fake Captcha used by one of the observed ClickFix campaigns dropping SecTopRat.

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/03/2025

We can’t confirm how users were directed to these sites, but PJobRAT previously used a variety of tricks, including third-party app stores, link shortening, phishing pages, fictitious personae, and posting links on forums. Once on a user’s device, the […] [Original post on infosec.exchange]

A screenshot of a function in the source code of a malicious app. This particular function is used to execute a shell command, with a string input as the command to execute

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/03/2025

Back in 2021, researchers reported on PJobRAT, an Android RAT targeting Indian military personnel by imitating various dating and instant messaging apps. After that, everything seemed to go quiet. But during a recent threat hunt, Sophos X-Ops researchers […] [Original post on infosec.exchange]

Three screenshots taken on a mobile phone, arranged in a row. The first is a dialogue message asking the user if they want to stop optimising battery usage. The second is a login screen. The third is a dialogue telling users they are using an old version and providing a download link to download a new version

101 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 13/03/2025

At the end of 2023, Sophos X-Ops noted a 62% year-on-year increase in ‘remote encryption’ attacks – where ransomware attackers compromise an unmanaged or under-protected endpoint, and leverage that access to encrypt data on managed, domain-joined machines […] [Original post on infosec.exchange]

A bar chart (blue background, white bars) showing the number of remote encryption incidents (normalized as percentages) from January 2022 until December 2024, with a red trendline superimposed, rising from left to right

101 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

[re: Thread about malicious SVG files in phishing attacks] So you might ask, what can I do about this? Fortunately there’s a perfectly good answer: You can instruct Windows not to open #SVG files in the browser. Here’s how you do it: Create an empty text […] [Original post on infosec.exchange]

Right click the file, choose Open With, then Choose Another App

Choose Notepad then check “Always use this app to open .svg files” and click OK

101 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

[re: Thread about malicious SVG files in phishing attacks] But we saw even more advanced #SVG #malware than just a static hotlinked image. One version attempted to connect to a local network path; Another contained a malware executable inside a zip that […] [Original post on infosec.exchange]

A page that says “Your browser does not support the correct online display of this document. Use the “Open” button to open the document locally. At the top of the screen a warning reads “This site is trying to open Windows Explorer”

A zip file that contains two compressed files. One is compressed with a password, and has a long name that starts with “Payment_Advice” and the other is not password protected and named “Zip file password dot T X T”

The content of the “Zip file password” is a line that says “File password is” and a long complex password

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

[re: Thread about malicious SVG files in phishing attacks] Once we got past the gatekeepers, we saw a variety of phishing kits. Some loaded a real Microsoft login screen inside of an iFrame that captured all keystrokes. Another used its own login dialog intended to mimic a real one. 6/9

A login dialog on a page that says “Voicemail” at the top and “Confirm identity to prove you are not a robot” with a prompt for a username and password.

A real Microsoft login dialog embedded in a criminal-controlled website that captures keystrokes as you enter your username and password.

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

[re: Thread about malicious SVG files in phishing attacks] What happens if you click anywhere in those pictures is that you end up on a #phishing page. We saw the #SVG files typically link to a site protected by a #captcha, which makes it more challenging […] [Original post on infosec.exchange]

A webpage that says “We have integrated a human verification system to confirm that you are not a robot and to mitigate automated risks” above a Cloudflare “Verify you are a human” captcha.

a phishing page on a Russian domain displays a Cloudflare “Verify you are a human” captcha above the text “Securing safe connection setup.”

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

[re: Thread about malicious SVG files in phishing attacks] So threat actors are now adding JavaScript, embedded images, and their own HTML directly into #SVG files they email to targets. Most people probably don’t recognize the risk of just opening one of […] [Original post on infosec.exchange]

A SVG file that displays a photo which looks like a SharePoint link. The photo contains text and graphics that resemble a SharePoint “share” link, and says in part “Your organization has shared a secure document with you through Microsoft SharePoint. Here’s the file that was shared with you: Updated Compensation and Benefits…” above a blue button labeled “Open”

A fake DocuSign “Review Document” graphic that is hosted on a site that only hosts images associated with this campaign, on a domain named “legal skills training dot C O dot U K”

111 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

[re: Thread about malicious SVG files in phishing attacks] But most computers don’t have a dedicated graphics tool install that can read and edit .svg files, so they default to opening in the browser, and because you can add things like your own HTML code […] [Original post on infosec.exchange]

a malicious SVG file that contains a link to a file hosted in Google’s cloud.

a malicious SVG file that says “You have a new voicemail from envflkcyhuprfp” and “Click the link below to listen to the voicemail” over blue text reading “Listen to voicemail”

200 2

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

[Thread about malicious SVG files in phishing attacks] The “scalable vector graphics” format is designed to draw pictures on a computer screen using human-readable instructions, rather than binary data. That means the picture can stretch or shrink with […] [Original post on infosec.exchange]

ALT: The contents of a regular SVG file that contains instructions to draw a clown face, with an inset thumbnail of what it looks like.

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 06/02/2025

Hi everyone. @threatresearch taking over the X-Ops feed today with a cool story. Beginning in November 2024, we began to see an uptick in the number of spam emails that had an unusual attachment – an .svg file. This is a graphics format, and one might […] [Original post on infosec.exchange]

ALT: An email that says “A new shared file has arrived for you” with other details that make it look like it comes from the target’s own organization. The email has a file attachment with an SVG suffix.

102 2

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 21/01/2025

Sophos X-Ops’ Managed Detection and Response has been tracking two separate clusters of cybercriminal activity that leverage a very similar initial playbook: a torrent of emails at targeted individuals , followed by Teams calls and messages posing as IT support.

110 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/01/2025

[re: Long thread] Nobody knows exactly how the #Gootloader operators are finding and taking control over personal and business websites that use WordPress, but it's likely due to an earlier compromise of the site's administrator credentials, through […] [Original post on infosec.exchange]

Source of the Gootloader landing pages reveal a number of different search terms and phrases the threat actors wanted search engines to index. The linked subpages (selected with green) don't actually exist. The injected WordPress code defines a few hooks, one of them is for non-existing pages. This will serve the fake forum discussion, when the victim clicks on the search result

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/01/2025

[Long thread] While this story links to prior research we've published about Gootloader, including the elaborate, Rube Goldberg-esque techniques its creators have developed to conceal itself in plain sight on the websites it commandeers, we never knew […] [Original post on infosec.exchange]

A list of Gootloader JScript filenames, which correspond to the search query that led victims to download them

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 31/12/2024

Get ready for 2025 by looking back on attack insights from our latest #ActiveAdversary report: news.sophos.com/en-us/2024/12/12/ac… Happy New Year! Have a safe and great 2025. #DeckTheAARs

001 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 24/12/2024

The Sophos X-Ops Teams wish you, yours, and everyone happy, quiet and safe holidays. In the spirit of the holidays, here’s an ornament view of our latest #ActiveAdversary report. news.sophos.com/en-us/2024/12/12/ac… Happy Holidays! #DeckTheAARs

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 19/12/2024

The structure of the phishing portal pages of both platforms is identical, though the code used for the underlying content uses different themes of words and random text strings. /5

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 19/12/2024

Within about a week and a half of the interruption of Rockstar, we saw a surge in activity from another phish-as-a-service player, tagged by some researchers as “FlowerStorm”./3

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 19/12/2024

RockStar’s back-end infrastructure, including the “decoy” pages the diverts unwanted visitors to, became unreachable on November 11, two weeks before TrustWave’s report. Their hosts no longer were communicating with Cloudflare. /2

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/12/2024

Additionally, case data reveals a 3-week delay before Akira posts victim information on their leaksite. Research indicates 127 victims have been posted to their leak site over the last 6 months. Sophos X-Ops is tracking 2 active Akira threat clusters […] [Original post on infosec.exchange]

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 16/12/2024

While the #Akira #ransomware leak site experienced availability issues in October, reports of their demise have been greatly exaggerated. The burst of new victim activity when the site came back online in November caused some speculation that this was their […] [Original post on infosec.exchange]

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/11/2024

While the anti-spam research team continues to investigate, it’s worth remembering that emailbombings are not just a nuisance. Criminals can use the sudden and unexpected deluge of messages to conceal crime in progress by making it difficult to spot that […] [Original post on infosec.exchange]

000 0

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/11/2024

Why would someone do this? In brief, to create a kind of email smokescreen that can conceal fraudulent online purchases or other malicious behavior. One typical example we found among the emailbombings in this time period was this one: The target’s […] [Original post on infosec.exchange]

Email telemetry lists show the target getting one email with a subject of "we're processing your order" then a second "pickup information for order" email two hours later.

The attacker used stolen account info to purchase an expensive, small device and scheduled an in-person pickup, concealing the emails about the purchase within a flood of emailbomb messages

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/11/2024

And yet that’s next to nothing. Another target received 7300 unexpected emails over a two-and-a-quarter hour period on November 7th. That’s more than 54 messages every minute for the entire 135 minute window. The highest proportion of emails – more than […] [Original post on infosec.exchange]

A bar chart shows a two-hour timespan in which a single user received more than 50 messages per minute continuously

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/11/2024

It can be hard to understand what we mean by “flooded inbox” so here’s a chart to illustrate what happened to one unfortunate target: They received 712 emails over a one-hour period (nearly 12 every minute) on November 15. That sounds bad, right? #emailbomb #mailbomb #spam #spammers #email #XOps

A bar chart shows, minute by minute, how many emails were arriving in an inbox during a one hour period in which 712 messages were bombed at the inbox

100 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/11/2024

Many of the emailbomb messages shared certain Subject line text strings: "reset password notification,” “password reset,” “reset your password,” “verify email address,” “confirm your subscription,” “newsletter subscription success,” and “registration info" […] [Original post on infosec.exchange]

Some of the most frequently repeated subject lines from one account. "Verify email address" "confirm your subscription" and "reset your password" were the top items

110 1

Sophos X-Ops @sophosxops.infosec.exchange.ap.brid.gy · 27/11/2024

Since the beginning of September, Sophos X-Ops’ anti-spam research team has registered nearly 150 “emailbomb” attacks that targeted specific Sophos customers’ inboxes. While similar, these are not spam attacks: threat actors use tools provided by otherwise […] [Original post on infosec.exchange]

Frequency of email bombing attacks against individual inboxes, by week. The peaks in this time period were the week of September 22 and the two weeks of October 27 and November 3

113 3