Proofpoint identifies a surge in 2026 tax scams using RMM tools (39%) to bypass security. Learn how TA4922 and TA2730 target your data this filing season.

Proofpoint uncovers TA416's pivot to EU, NATO, and Middle East diplomacy. Learn how this state-linked actor uses updated PlugX and Cloudflare lures in 2026.

In the modern landscape of Microsoft 365 security, the most dangerous threat might not be a sophisticated piece of malware, but a simple, automated setting you likely haven’t checked in year…

Proofpoint monitors a 30-day supply chain attack using "signing-as-a-service" to bypass Windows security. Protect your load boards and fleet payments now.

Both fraudulent actors and state-sponsored syndicates have commenced the large-scale deployment of a novel stratagem to usurp Microsoft

AI "vibe coding" and the EvilTokens PhaaS platform are supercharging device code phishing to bypass Microsoft 365 MFA. Secure your network today!

TA4922, a suspected China aligned cybercrime group, is targeting UK and European organisations with tax, payroll and benefits themed malware campaigns.

Phishing services are rapidly evolving into sophisticated, turn-key platforms engineered for widespread exploitation. Recently, the novel NovaCookies toolkit enabled attackers to compromise over o…

Sometimes a single opened email is all it takes to compromise a university network. Researchers at Proofpoint have uncovered a campaign they call UNK_MassTraction. A threat group believed to have …

Proofpoint details how attackers spoof OAuth client IDs to probe Microsoft Entra accounts, test credentials and bypass common sign-in detections at cloud scale.

At a Glance Field Detail Actors UNK_pyreq2323 and UNK_OutFlareAZ (two independent, unattributed clusters) Activity Account enumeration and credential validation via OAuth client ID spoofing Target…

At a Glance Actor or group TA488 (Void Blizzard, Laundry Bear) and TA458 (Operation RoundPress), both Russia-aligned Activity type Espionage via cross-site scripting flaws in webmail; credential a…

Follow us on all social media platforms at @HackRead - Thanks!

A single crypter is now hiding malware for many unrelated criminal crews at once. Proofpoint researchers call it Cruciferra. The Cruciferra crypter service wraps remote access trojans and infostea…

At a Glance Malware family PackClient (RAT / C2 framework) Threat actor TA4922 (Chinese-speaking) – confirmed attribution by Proofpoint Targets Organizations in mainland China and India Deli…

At a Glance Attribute Details Actor or Group UNK_Condor Filtration (unattributed cybercrime operator) Activity Type Password spraying, credential validation, cloud data exfiltration Targets or Vic…

A fake IT form told students to type their password into a field labeled “WORDWORD.” The trick dodged the form site’s word filter, and it worked. According to Proofpoint’s …

At a Glance Summary Attribute Details Actor or Group TA419 (China-aligned cyberespionage group) Activity Type Spear-phishing, AitM credential theft, persona impersonation Targets or Victims US art…

A Chinese Spy Group Targets Trust, Not Bugs A Chinese cyber-espionage group has chosen a new way into the circle of American AI experts. It does not use a vulnerability. It uses trust. The group, …

TL;DR Microsoft, Health-ISAC, Proofpoint, and international partners executed a major CoGUI phishing kit takedown alongside connected criminal marketplaces YAM Store and Iron Man. Since January 20…