Weekly Cyber Round-up

Suspected APT36 campaign targets Indians via fake Indian Post Office website

CYFIRMA researchers discovered a phishing page impersonating the Indian Post Office that is targeting both Windows and Android users. Windows users visiting the site are asked to allow clipboard access and prompted to download a PDF containing ClickFix instructions that lead to the execution of PowerShell. Android users are lured into downloading a malicious app that requests extensive permissions and exfiltrates data via a fake Google Analytics domain. The app changes its icon to a Google Accounts icon to hide its activity and prevent it from being uninstalled. It additionally promotes a casino app that prompts users to add their bank card details to load money into a wallet to continue playing. The campaign has been linked to the Pakistani threat actor APT36 with medium confidence.

Google Ads phishing campaign impersonating Semrush aims to steal Google login credentials

Malwarebytes researchers observed threat actors leveraging Google Ads to push fake Semrush login portals. The campaign seeks to steal Google account login credentials, with the Semrush phishing page showing an option to login via Google, while the option to login using email and password is disabled. Each ad uses a unique domain name that redirects victims to static domains dedicated to the fraudulent Semrush and Google account login pages. The researchers noted that Google Analytics and Google Search Console data is often integrated with tools like Semrush, warning that the theft of login credentials could reveal sensitive information that could be leveraged to impersonate an individual or business. 

Fake recruitment schemes target Polish developers to deploy FogDoor backdoor

Cyble researchers identified a fake recruitment campaign leveraging social engineering to deliver a backdoor, dubbed FogDoor, to Polish-speaking developers seeking employment. The backdoor is disguised as a technical coding challenge, called ‘FizzBuzz’, that tricks victims into downloading an ISO file containing a seemingly harmless JavaScript exercise and a malicious LNK shortcut. The campaign has since expanded beyond recruitment-based attacks, with a newly discovered GitHub repository distributing invoice-themed LNK shortcuts. The executable first identifies the victim’s location and proceeds to execute FogDoor only if the user is located in Poland. FogDoor then retrieves instructions embedded within a social media profile for remote code execution and to steal browser cookies, WiFi credentials, and system data.

Operation ForumTroll campaign exploits Google Chrome Zero-day to target Russian institutions

In mid-March 2025, Kaspersky researchers observed a suspected advanced persistent threat group campaign, dubbed Operation ForumTroll, delivering previously unknown malware via the exploitation of a high-severity zero-day flaw, tracked as CVE-2025-2783, in Google Chrome. In all observed cases, infection occurred immediately after the victim clicked on a link in a phishing email, which redirected them to the official website of ‘Primakov Readings.’ The campaign targeted media outlets and educational institutions in Russia, likely with the aim of conducting espionage. The flaw relates to an incorrect handle provided in unspecified circumstances in Mojo on Windows and was exploited by the attackers to bypass Chrome’s sandbox protection. The flaw has since been fixed.