SpiderLabs

🪝🚨#PhishingAlert: #MailMarshal detected an active hiring-themed #phishing campaign that impersonates the background-screening provider HireRight and abuses #Calendly to deliver #ScreenConnect.

The email links to an attacker-created Calendly routing form with a fake document-review button, such as 'View Document' or 'View Proposal'. Clicking it submits a Calendly Form Builder request that returns an 'arbitrary_url' result pointing to a ScreenConnect MSI installer. The browser then downloads the MSI from the attacker-controlled ScreenConnect instance, and running it gives the attacker remote access to the device.

IOCs:
Example abused Calendly URLs:
hxxps[://]calendly[.]com/d/dt89-7hh-5ww
hxxps[://]calendly[.]com/d/dvcz-23t-bf6
hxxps[://]calendly[.]com/d/d4jf-gpc-ddy

ScreenConnect instance payload URL:
hxxps[://]treffert[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest

#RMM #IOC #cybersecurity #spiderlabs

🪝🚨Phishing Alert:

Recently, we have observed many phishing URLs on VirusTotal that abuse AWS Lambda Function URLs.

These URLs follow this format:
https://{generated 32-character identifier}.lambda-url.{aws region}.on.aws/?{tracking parameter}={victim's email address}

Lambda Function URLs provide a simple, direct HTTP endpoint for a Lambda event function. Attackers use the Lambda URL as the initial page, which mimics a OneDrive page and shows a pop-up message box. Clicking the pop-up redirects the victim to a fake security check. Then, it leads to a final landing page that imitates a Microsoft login page and uses an adversary-in-the-middle (AiTM) phishing technique.

IoCs:
hxxps://cjoxgdvexb6wyhih45rmzgeram0vijbb[.]lambda-url[.]us-east-1[.]on[.]aws/?meeting=pmvgedxroe={victim's email address}
hxxps://api-63nkaf68d[.]berimazinjagentleman[.]sbs/
hxxps://berimazinjagentleman[.]sbs/common?key=63nkaf68d

#MailMarshal #Phishing #LevelBlue

Ransomware has dominated conversations for years.  

But over this past quarter, we saw the pressure point shifting. 🔃

Across @LevelBlueCyber incident response engagements, data exfiltration appeared in more network and cloud intrusion cases than encryption, indicating that stolen data is becoming a faster route to extortion.  

The numbers from Q3:  

📊 BEC accounted for 32% of incidents
📊 Network intrusion accounted for 22%  
📊 Ransomware accounted for 20%

More attackers are finding they don’t need encryption to create leverage.  

Our Q3 TTP Briefing breaks down what we observed across real-world investigations worldwide. 🔎🌎

View the recap below:

hubs.ly/Q04CB-_W0

🚨 New research: Our team is tracking #Wazza, a multi-stage device code phishing kit targeting #Microsoft 365 accounts. Active since at least July 2026.

Victims receive PDF lures and are routed through a phishing chain using staging and redirector links, Cloudflare Workers and attacker-controlled domains. The kit uses filtering and decoy pages to steer targets to the final device code page. Final pages seen so far impersonate #Adobe, #DocuSign, and #Microsoft services and abuse Microsoft OAuth device authorization.

Read our full analysis: levelblue.com/blogs/spiderla…

The #OpsCTI team analyzed a #PhantomPolia campaign leveraging #ClickFix to deliver #RemusStealer through #DonutShellcode. The investigation also identified Sepolia smart contract addresses relevant to the campaign.

🔍 Read the full #SpiderLabs analysis:
levelblue.com/blogs/spiderla…

IoCs:

Sepolia Smart Contract Addresses
0x4dbdca7277427edee4d5b4e3d012bca73aefadf1
0x28b7605be52b7107cd7710f6f855a1a026e72f4a
0x5ea589954314fe8d5ecb509b35d77a389912b42f
0x5a3589462b41fa8cf91ac2c7773a285d9c790548
0x3b14187b76dc39005e8d568b26455d53bd198749
0x61b3e0681f6485e4e85e5ee981757d8b12ec414f
0x5a155a3f01fa60c3fa0177022ba05fcc6a313a4d

#PhantomPolia domains
voderlence[.]com
nightflamevortex[.]top
voidravenstorm[.]top
velnoderic[.]com
ironphantomcore[.]top
stormvenomforge[.]top
shadowemberstrike[.]top

URL path
/check/update[.]ps1

#RemusStealer C2
oceanvw[.]click
cruahop[.]shop
drepace[.]click
spogear[.]click

Main Installer
05629f35dfe1409ea963c135581c228e3b71869b0707974244f6938af635a70e
8f4903b8b110ec1b9580a5a27bf49c3e4793538a863100559d085b7545fcda25
f02e2fefd74c7268e3aced61017173fff92e2a1d0e7eaf7807189f371fbfcc1f

AutoIt Scripts
61def8b242913b520ec110458a416b02a6a38dc8765bc76bd571ee7ae8350aae
22b0fc350b5e5c557344267b3c44323ac117d3fbeb5cf1bcb8b027352155fa11
a38e6f54efe342b4a2ca9ac4428a5268faed96cd602baa1886efb09f72435abb

Donut Shellcode
5363bc92bac44aa2ba87b46c59fd3f78d5cdd32839efa854e97380a55fdacabb

Remus Stealer
dc0a864f441f0237853b40217eda577defb7c1dd15af407c7241688b1b3a3b46
a0923188fbd52277e1711ae312f3c6fb841f3cdebe1a95d5c89fe2455f8ace32