Weekly Cyber Round-up

Phishing campaign impersonates payroll, HR, and benefits platforms

Malwarebytes researchers discovered a phishing campaign, likely ongoing since July 2024, impersonating payroll, human resources (HR), and benefits platforms to steal banking information and funds. The campaign was initially detected in mid-April 2025, after the researchers discovered a malicious Google Search ad for the payroll and HR company Deel, which redirected victims to a phishing website impersonating the company. The phishing page prompts the user to enter their login credentials, after which they are tricked into entering a security code sent to their email address, allowing the attackers to bypass two-factor authentication.The campaign involves the use of a new phishing kit that aims to not only steal credentials but also commit wire fraud. Using a fully authenticated web worker, the phishing kit uses a legitimately hosted web service called Pusher with the intent of manipulating sensitive data fields related to banking and payment information. 

Meta Mirage phishing campaign steals data and browser cookies from Meta Business Suite

CTM360 researchers discovered a global phishing operation, dubbed ‘Meta Mirage’, leveraging distinct phishing templates to compromise the high-value business assets of Meta Business Suite users. In total, 24 templates have been observed which are designed to mimic specific Meta communications and deceive users into providing their credentials, session cookies, or personal information. Over 14,000 phishing URLs have been observed, with 78% of the identified active URLs still unblocked. Messages are delivered via email or Meta Messenger and feature links that redirect to a specific phishing page. Users are then instructed to enter their personal information, Facebook account password, and a one-time password. The attackers deliberately trigger a series of fake error messages, causing the victim to re-enter their details. A separate technique attempts to harvest victims’ browser cookies. The attackers have exploited 14 hosting platforms, such as Vercel, GitHub Pages, and Netlify, to deploy the phishing kits.

Fake AI tools deliver Noodlophile Stealer to harvest data and deploy XWorm

Morphisec researchers detailed a campaign leveraging fraudulent custom artificial intelligence (AI)-themed platforms promoting free AI tools to deliver a new infostealer, dubbed Noodlophile Stealer. The threat actors advertise their AI platforms on seemingly legitimate Facebook groups and viral social media campaigns. Upon installation, Noodlophile harvests browser credentials, cryptocurrency wallets, and sensitive data, and, in many cases, has been used to deploy remote access trojans like XWorm to establish deeper control over infected systems. The fake Facebook groups encourage visitors to click on links that redirect to a fake AI-powered content creation website, where they are prompted to upload their images or videos for AI editing. The site then claims that the ‘processed’ content is ready to download, delivering Noodlophile, often alongside XWorm, to the targeted system. A Telegram bot is used for exfiltrating stolen information. 

Phishing emails and AutoIt leveraged in attack chain to deliver DarkCloud Stealer

In January 2025, Palo Alto Unit 42 Networks researchers identified a series of attacks deploying DarkCloud Stealer, with the latest attack chain leveraging AutoIt for detection evasion and a file-sharing server to host the malware. The attacks have primarily targeted federal, state, and local government entities, but have also been observed targeting the high technology, finance, manufacturing, and media and entertainment industries. The United States and Brazil are the most targeted countries. The attack chain begins with a phishing email containing an RAR archive or a PDF. The PDF attachment informs the recipient that their Adobe Flash Player is out of date, prompting them to download the RAR archive disguised as the update from a file–sharing service. The RAR archive contains a malicious AutoIt compiled PE file featuring the AutoIt script and two encrypted data files, one of which is an encrypted shellcode and the other an XORed payload. The AutoIt script then builds and runs the final DarkCloud Stealer payload from the two data files.