Weekly Cyber Round-up

CoGUI phishing kit targets organisations in Japan

Proofpoint researchers observed an increase in high-volume Japanese language phishing campaigns targeting organisations in Japan to deliver a phishing kit called CoGUI. The campaigns primarily impersonate popular consumer or payment brands, such as Amazon, PayPal, Rakuten, and others, and aim to steal usernames, passwords, and payment data. Several other campaigns were also observed targeting users in Australia, New Zealand, Canada, and the United States. CoGUI has been active since at least October 2024 and uses several advanced defence evasion techniques. Before serving the phishing page, CoGUI uses victim profiling, though this often varies by campaign.CoGUI is likely used by multiple different Chinese-speaking threat actors. The researchers also observed similarities between CoGUI and recent Darcula road toll smishing attacks but stated that Darcula is unrelated to CoGUI and its presence in road toll smishing is notably different. 

Mystery box subscription scams leverage Facebook pages and ads for financial gain

Bitdefender researchers identified an increase in campaigns leveraging sophisticated fraudulent websites to facilitate subscription scams. The threat actors create Facebook pages and ads impersonating content creators to promote the ‘mystery box’ scam, alongside other variants. The scam has recently evolved to include a subscription model that, for a recurring payment, seemingly provides the user with exclusive deals and savings. Several techniques have also been adopted to evade automatic detection, including leveraging multiple versions of an ad, with only one being malicious, uploading images directly from Google Drive, using cropped images to alter visual patterns, featuring text only in images, and leveraging classic homoglyph techniques. Over 200 websites have been observed as part of the campaign, some of which are still in operation. Some of the account pages are newly created, while others are being hacked and taken over by the attackers.

Venom Spider leverages server polymorphism in More_eggs deployment

Since at least October 2023, Arctic Wolf researchers have observed a spear phishing campaign by the financially motivated threat group Venom Spider targeting hiring managers and corporate human resources departments. The campaign abuses legitimate messaging services and job platforms to apply for real jobs using fake resumes that deliver an enhanced version of the More_eggs backdoor. Spear phishing emails sent directly to the victim contain links that redirect to an attacker-controlled website where they are asked to complete a CAPTCHA challenge. If completed, a ZIP file is downloaded, containing a decoy image and a malicious LNK file disguised as a resume. The LNK launches a batch script which triggers a JavaScript payload that drops a complex executable library, dubbed More_eggs_Dropper. Once active, More_Eggs establishes C2 communication to facilitate the execution of various commands.

MacReaper watering hole campaign targets macOS users with Atomic Stealer

BadByte researchers discovered a watering hole campaign, dubbed MacReaper, targeting macOS users with Atomic Stealer malware. The campaign was initially discovered on May 4th, 2025, through a compromised Brazilian news site. The researchers identified approximately 2,800 potentially compromised websites, suggesting the presence of a coordinated operation that is likely exploiting vulnerabilities in website hosting or content management systems. The campaign targets users with a ClickFix fake reCAPTCHA interface, which triggers a Binance Smart Contract leveraging the EtherHiding technique to deliver a base-64 encoded command to the clipboard. Users are prompted to run the command via macOS-specific shortcuts, which downloads a script that retrieves Atomic Stealer.