iiinova — where your digital self keeps evolving

Netskope Threat Labs

@threatlabs.netskope.com

Official account for Netskope Threat Labs. Delivering actionable intelligence, research, and real-time insights surfaced from the Netskope platform to help defenders stay ahead of evolving cloud and web threats.

Posts Replies Media

Netskope Threat Labs @threatlabs.netskope.com · 12/10/2026

000

Netskope Threat Labs @threatlabs.netskope.com · 07/10/2026

🎉 Vini Egerland, Threat Researcher at @threatlabs.netskope.com, is joining BSides Barcelona 2026 with: “Hunting Blockchain Dead-Drop Resolvers in Enterprise Traffic.” See full schedule: bsides.barcelona/schedule

020

Netskope Threat Labs @threatlabs.netskope.com · 01/10/2026

Vini Egerland has been tracking the Underground campaign: A crypto-drain operation drains victims' exchange accounts. An injected Vidar-class stealer drives Chrome/Edge from rotating fronted /api/machine gates. It has already stolen ~$100K on-chain.

110

Netskope Threat Labs @threatlabs.netskope.com · 24/09/2026

A fake security locker has been circulating using Google Ads to lure victims into clicking. We have seen clicks across more than 619 organization from 250 campaigns, 284 sites hosting the ads, and 457 domains hosting the content. www.netskope.com/blog/a-fake-...

010

Netskope Threat Labs @threatlabs.netskope.com · 31/08/2026

Malware is resolving its C2 through the Polygon blockchain as of 2 days ago. An eth_call to a verified contract named extractor returns the domain vg5sgxv[.]lol from getServerURL(), ABI-encoded.

curl command pipes into python to decode and extract command and control domain.

110

Netskope Threat Labs @threatlabs.netskope.com · 11/08/2026

Ext. ID: "inhcgfpbfdjbjogdfjbclgolkmhnooop" IoCs: github.com/netskopeoss/...

000

Netskope Threat Labs @threatlabs.netskope.com · 31/07/2026

Tycoon2FA puts a Cloudflare Turnstile bot check in front of fake Microsoft OAuth authorize endpoints, so scanners stop at the gate while human targets carry on to credential and session token capture. Netskope detections of the pattern rose 78% week over week. #phishing #AiTM

110

Netskope Threat Labs @threatlabs.netskope.com · 24/07/2026

TroyDen's Lure Factory continues to exploit AI hype. Lures trick engineers through fake "Portable Offline LLM" repo that - this again delivers a Prometheus Lua payload. Actor split the LuaJIT runtime into stub and DLL, evading the PE rule. @joshnck traces C2 to a Polygon dead drop.

110

Netskope Threat Labs @threatlabs.netskope.com · 23/07/2026

Active phishing wave impersonating Polish marketplaces Allegro and OLX. The multi-brand kit redirects automated scanners to the real site and serves pixel-perfect login clones to human visitors. ~600 DGA-style .lol domains observed. #phishing

110

Netskope Threat Labs @threatlabs.netskope.com · 22/07/2026

Taking a look back at the many malicious World Cup scams, including fake FIFA job posting phishing pages. www.netskope.com/blog/world-c...

010

Netskope Threat Labs @threatlabs.netskope.com · 17/06/2026

The latest ClickFix attack targeting macOS users bypasses OS-level controls meant to mitigate such threats and deploys an infostealer. www.netskope.com/blog/macos-c...

010