Weekly Cyber Round-up

GreenSpot APT targets 163[.]com users with malicious download pages and spoofed domains

Hunt[.]io researchers observed a campaign, attributed to the GreenSpot advanced persistent threat (APT) group, targeting 163[.]com users with download pages and spoofed domains. One of the domains hosted a malicious login page, while others contained fake download pages aimed at capturing usernames and passwords. Once a user submits their credentials on the malicious login page, JavaScript code is executed, which dynamically constructs a redirection link based on the URL’s domain and displays a 404 page. The user is then redirected to the legitimate email login page. The researchers also identified the use of multiple web pages, likely distributed via phishing emails, which initiate a countdown once they are visited to pressure victims into entering their credentials and downloading a document.

Phishing campaign spoofs Microsoft ADFS for credential harvesting and account takeover

Abnormal Security researchers identified an ongoing phishing campaign targeting users relying on Microsoft Active Directory Federation Services (ADFS). The attackers use spoofed ADFS login pages to harvest user credentials and bypass multi-factor authentication (MFA), which could be used for account takeover and to gain access to critical systems and data. The attack chain involves spoofed emails made to appear to come from the targeted organisation’s IT help desk. Users are prompted to visit a fake ADFS login page, where usernames, passwords, and MFA codes are collected. To appear more legitimate, the phishing pages are personalised to match the targeted organisation’s specific MFA setup, while lateral phishing involving previously compromised accounts was also observed. The campaign has targeted over 150 organisations to date, the majority of which are in the education sector, followed by healthcare and government. 

Phishing campaign targets high-profile X accounts to promote crypto scams

SentinelLabs researchers reported an ongoing phishing campaign seeking to hijack and exploit high-profile social media accounts to promote cryptocurrency scams. The campaign has been active since mid-2024 and targets accounts linked to United States political figures, international journalists, and cryptocurrency and technology organisations, on X and other social media platforms. The threat actors recently began abusing Google’s ‘AMP Cache’ domain to evade email detections and redirect users to credential harvesting sites. Once attackers gain access to an account, they begin to post fraudulent crypto-related content to lure more victims for financial gain.

Malicious PyPI packages used to target DeepSeek users

Positive Technologies researchers detected and prevented a malicious campaign in the PyPI package repository, which targeted developers, machine learning engineers, and artificial intelligence enthusiasts potentially interested in integrating DeepSeek into their systems. On January 29th, 2025, a user named ‘bvk’ uploaded two malicious packages, dubbed ‘deepseeek’ and ‘deepseekai’, which were designed to collect user and computer data and steal environment variables. The payload is executed when the user runs the commands ‘deepseeek’ or ‘deepseekai’ in the command-line interface. The author of packages used the Pipedream integration platform as the C2 server to receive stolen data.