Netskope
@netskope.com
Netskope, a leader in modern security and networking, addresses the needs of both security and networking teams by providing optimized access and real-time, context-based security for people, devices, and data anywhere they go. https://www.netskope.com/
The new, open-source RedTiger infostealer has recently emerged in the wild, primarily targeting victims’ Discord accounts, Roblox credentials, browser data , and cryptocurrency wallet files.
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts
Summary Gamers are a hot target for infostealers these days. This blog post is the second we have published this month about an infostealer targeting
www.netskope.com
October 23, 2025 at 10:18 PM
The new, open-source RedTiger infostealer has recently emerged in the wild, primarily targeting victims’ Discord accounts, Roblox credentials, browser data , and cryptocurrency wallet files.
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
😱 A creeper just snuck into your storage room! 😱
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
New Python RAT Targets Gamers via Minecraft
Summary During threat hunting activities, Netskope discovered a new, multi-function Python RAT that leverages the Telegram Bot API as a command and
www.netskope.com
October 22, 2025 at 4:23 PM
😱 A creeper just snuck into your storage room! 😱
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
Netskope Threat Labs released a new open-source tool that detects supply chain attacks.
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
Netskope BEAM: Open Source Detector for Supply Chain Compromise
Netskope Threat Labs is pleased to announce the release of a new open-source tool that detects supply chain attacks. Our new tool, Behavioral Evaluation
www.netskope.com
August 8, 2025 at 12:24 AM
Netskope Threat Labs released a new open-source tool that detects supply chain attacks.
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
New Cloud and Threat Report from Netskope Threat Labs dives deep into Shadow AI and Agentic AI, offering crucial insights to help organizations shed light on the shadows along the way.
Read the report: www.netskope.com/resources/re...
Read the report: www.netskope.com/resources/re...
Cloud and Threat Report: Shadow AI and Agentic AI 2025
GenAI adoption is surging, bringing new SaaS apps, genAI platforms, and on-premises AI tools and agents. Uncover shadow AI and mitigate risks with this report.
www.netskope.com
August 5, 2025 at 1:57 AM
New Cloud and Threat Report from Netskope Threat Labs dives deep into Shadow AI and Agentic AI, offering crucial insights to help organizations shed light on the shadows along the way.
Read the report: www.netskope.com/resources/re...
Read the report: www.netskope.com/resources/re...
🤔 To block or not to block Grok? For 29% of enterprises, there is no question.
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
To Grok or Not To Grok: For 29% of Enterprises...There Is No Question
Grok is a chatbot developed by Elon Musk’s xAI. It was initially released to select individuals in November 2023 and became generally available to all X
www.netskope.com
June 10, 2025 at 12:17 PM
🤔 To block or not to block Grok? For 29% of enterprises, there is no question.
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
🚨 New Phishing Alert 🚨 Scammers are targeting Navy Federal Credit Union customers using Glitch-hosted pages, Telegram, and fake CAPTCHAs.
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Glitch-hosted Phishing Uses Telegram & Fake CAPTCHAs to Target Navy Federal Credit Union Customers
Summary From January to April 2025, Netskope Threat Labs tracked a three-fold increase in traffic to phishing pages created on the Glitch platform. These
www.netskope.com
June 2, 2025 at 4:11 PM
🚨 New Phishing Alert 🚨 Scammers are targeting Navy Federal Credit Union customers using Glitch-hosted pages, Telegram, and fake CAPTCHAs.
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Don't get caught in Scattered Spider's web! 🕸️ Our latest blog breaks down how this financially motivated adversary group's TTPs and shares recommendations for Netskope customers. www.netskope.com/blog/netskop...
Netskope Threat Coverage: Scattered Spider
The adversary group commonly referred to as Scattered Spider is also tracked as UNC3944, Muddled Libra, Octo Tempest, Starfraud, Scatter Swine, 0ktapus,
www.netskope.com
May 30, 2025 at 5:20 PM
Don't get caught in Scattered Spider's web! 🕸️ Our latest blog breaks down how this financially motivated adversary group's TTPs and shares recommendations for Netskope customers. www.netskope.com/blog/netskop...
⚠️ Think twice before clicking on that dream job offer. New PureHVNC RAT campaign is preying on job seekers with fake offers from fashion and beauty brands.
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
PureHVNC RAT Using Fake High-level Job Offers from Fashion and Beauty Brands
Summary In recent months, the Netskope Threat Labs team has observed several different campaigns delivering the PureHVNC RAT and its plugins. In 2024, the
www.netskope.com
May 28, 2025 at 9:33 PM
⚠️ Think twice before clicking on that dream job offer. New PureHVNC RAT campaign is preying on job seekers with fake offers from fashion and beauty brands.
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
🌍 The 2025 Netskope Threat Labs Europe report analyzes 3 major cybersecurity risk trends affecting organizations across Europe:
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
Threat Labs Report: Europe 2025
Gain insights into how organizations in Europe are addressing evolving cybersecurity risks, including malware distribution, genAI, and data security.
www.netskope.com
May 27, 2025 at 7:22 PM
🌍 The 2025 Netskope Threat Labs Europe report analyzes 3 major cybersecurity risk trends affecting organizations across Europe:
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
🚨 Netskope Threat Labs has uncovered new “DOGE Big Balls” ransomware tools in the wild.
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
New DOGE Big Balls Ransomware Tools in the Wild
Summary During the Netskope Threat Labs hunting activities, we came across a payload that led us to a multi-stage chain involving several custom
www.netskope.com
May 7, 2025 at 4:37 PM
🚨 Netskope Threat Labs has uncovered new “DOGE Big Balls” ransomware tools in the wild.
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
Netskope Threat Labs discovered a new drive-by download campaign abusing fake CAPTCHA and CloudFlare Turnstile to deliver LegionLoader payload. Get a detailed overview of the entire infection chain. www.netskope.com/blog/new-eva...
New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile
Starting February 2025, Netskope Threat Labs has tracked and reported on multiple phishing and malware campaigns targeting victims searching for PDF
www.netskope.com
April 4, 2025 at 9:11 PM
Netskope Threat Labs discovered a new drive-by download campaign abusing fake CAPTCHA and CloudFlare Turnstile to deliver LegionLoader payload. Get a detailed overview of the entire infection chain. www.netskope.com/blog/new-eva...
🚨 New Netskope Threat Labs research reveals a 30x increase in data sent to #genAI apps by enterprise users in the last year, increasing volume of sensitive data exposure.
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
Cloud and Threat Report - Generative AI 2025
GenAI adoption soars, but security risks rise. Discover top trends & effective controls in our 2025 Generative AI Cloud & Threat Report.
www.netskope.com
March 26, 2025 at 5:10 PM
🚨 New Netskope Threat Labs research reveals a 30x increase in data sent to #genAI apps by enterprise users in the last year, increasing volume of sensitive data exposure.
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
[1/3] Netskope Threat Labs observed multiple phishing pages being sent via Fastmail. The pages are tricking victims to log into a fake Office 365 page in order to access a fake payment document. Once the victim insert the credentials and press "View Payment" the credentials are sent to the attacker.
March 21, 2025 at 7:05 PM
[1/3] Netskope Threat Labs observed multiple phishing pages being sent via Fastmail. The pages are tricking victims to log into a fake Office 365 page in order to access a fake payment document. Once the victim insert the credentials and press "View Payment" the credentials are sent to the attacker.
Netskope Threat Labs analyzes Elysium, a variant of the Ghost (Cring) ransomware family, demonstrating how it works and how it encrypts the affected systems. www.netskope.com/blog/analyzi...
Analyzing Elysium, a Variant of the Ghost (Cring) Ransomware Family
Summary In February 2025, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State
www.netskope.com
March 11, 2025 at 10:59 PM
Netskope Threat Labs analyzes Elysium, a variant of the Ghost (Cring) ransomware family, demonstrating how it works and how it encrypts the affected systems. www.netskope.com/blog/analyzi...
🏦 Read the new Netskope Threat Labs Report for strategic, actionable intelligence on the most significant #cybersecurity risks that financial services organizations face and get recommendations on how to protect against these threats. www.netskope.com/netskope-thr...
Netskope Threat Labs Report: Financial Services 2025
Gain insights into how organizations in financial services are addressing evolving cybersecurity risks, including social engineering, personal app, and generative AI risk.
www.netskope.com
March 6, 2025 at 4:52 PM
🏦 Read the new Netskope Threat Labs Report for strategic, actionable intelligence on the most significant #cybersecurity risks that financial services organizations face and get recommendations on how to protect against these threats. www.netskope.com/netskope-thr...
Netskope Threat Labs found that attackers have been distributing malicious PDFs with fake CAPTCHAs across 260+ domains and 4,000+ keywords to steal credit card data and deliver Lumma Stealer malware. Get the details: www.netskope.com/blog/fake-ca...
Fake CAPTCHAs, Malicious PDFs, SEO Traps Leveraged for User Manual Searches
Summary On February 12, 2025, Netskope Threat Labs reported a widespread phishing campaign using fake CAPTCHA images via Webflow CDN to trick victims
www.netskope.com
February 27, 2025 at 5:51 PM
Netskope Threat Labs found that attackers have been distributing malicious PDFs with fake CAPTCHAs across 260+ domains and 4,000+ keywords to steal credit card data and deliver Lumma Stealer malware. Get the details: www.netskope.com/blog/fake-ca...
Telegram is being abused as command and control (C2) channel for a new Golang backdoor. Get details on the malware features and how it interacts with Telegram to receive commands and send results to it. www.netskope.com/blog/telegra...
Telegram Abused as C2 Channel for New Golang Backdoor
Summary As part of Netskope Threat Labs hunting activities, we came across an IoC being shared by other researchers and decided to take a closer look at
www.netskope.com
February 14, 2025 at 7:15 PM
Telegram is being abused as command and control (C2) channel for a new Golang backdoor. Get details on the malware features and how it interacts with Telegram to receive commands and send results to it. www.netskope.com/blog/telegra...
🚨 New widespread phishing campaign abuses Webflow, SEO, and fake CAPTCHAs to steal credit card information and commit financial fraud.
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
New Phishing Campaign Abuses Webflow, SEO, and Fake CAPTCHAs
Summary Netskope Threat Labs is tracking a widespread phishing campaign affecting hundreds of Netskope customers and thousands of users. The campaign aims
www.netskope.com
February 12, 2025 at 9:45 PM
🚨 New widespread phishing campaign abuses Webflow, SEO, and fake CAPTCHAs to steal credit card information and commit financial fraud.
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
🧵 [1/2] Netskope Threat Labs observed a Duck DNS URL used to host a fake CAPTCHA page that redirects to a website disguised as Orange, a french Telecom company. The page asks for Orange user's credentials and contains a malicious JS script to exfiltrate the inserted data via Telegram API.
#phishing
#phishing
February 3, 2025 at 6:29 PM
🧵 [1/2] Netskope Threat Labs observed a Duck DNS URL used to host a fake CAPTCHA page that redirects to a website disguised as Orange, a french Telecom company. The page asks for Orange user's credentials and contains a malicious JS script to exfiltrate the inserted data via Telegram API.
#phishing
#phishing
New Netskope Threat Labs Report on organizations operating in Canada shows 3.3x year-over-year increase in #GenAI app users, causing a proportional rise in the amount of sensitive data sent to genAI apps.
More on the top cyber risks facing organizations in Canada: www.netskope.com/netskope-thr...
More on the top cyber risks facing organizations in Canada: www.netskope.com/netskope-thr...
Netskope Threat Labs Report: Canada 2025
Gain insights into how organizations in Canada are addressing evolving cybersecurity risks, including social engineering, personal app, and generative AI risk.
www.netskope.com
January 29, 2025 at 4:51 PM
New Netskope Threat Labs Report on organizations operating in Canada shows 3.3x year-over-year increase in #GenAI app users, causing a proportional rise in the amount of sensitive data sent to genAI apps.
More on the top cyber risks facing organizations in Canada: www.netskope.com/netskope-thr...
More on the top cyber risks facing organizations in Canada: www.netskope.com/netskope-thr...
🚨 Netskope Threat Labs observed a new malware campaign using fake CAPTCHAs to deliver Lumma Stealer.
Get the details on the latest campaign and the evasion techniques targeting Windows users worldwide. www.netskope.com/blog/lumma-s...
Get the details on the latest campaign and the evasion techniques targeting Windows users worldwide. www.netskope.com/blog/lumma-s...
Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection
Summary In January, Netskope Threat Labs observed a new malware campaign using fake CAPTCHAs to deliver Lumma Stealer. Lumma is a malware that works in
www.netskope.com
January 23, 2025 at 5:22 PM
🚨 Netskope Threat Labs observed a new malware campaign using fake CAPTCHAs to deliver Lumma Stealer.
Get the details on the latest campaign and the evasion techniques targeting Windows users worldwide. www.netskope.com/blog/lumma-s...
Get the details on the latest campaign and the evasion techniques targeting Windows users worldwide. www.netskope.com/blog/lumma-s...
The first Security Visionaries episode of 2025 kicks off with a conversation with Ben Morris, Group Head of Cyber Security for @worldrugby.bsky.social, about the intersection between cyber and physical security when it comes to major events.
🎧 Listen: www.netskope.com/resources/po...
🎧 Listen: www.netskope.com/resources/po...
January 14, 2025 at 8:18 PM
The first Security Visionaries episode of 2025 kicks off with a conversation with Ben Morris, Group Head of Cyber Security for @worldrugby.bsky.social, about the intersection between cyber and physical security when it comes to major events.
🎧 Listen: www.netskope.com/resources/po...
🎧 Listen: www.netskope.com/resources/po...
🆕 Netskope Cloud and Threat Report shows phishing attempts are increasingly successful, with enterprise employees falling victim nearly 3X more in 2024 than in 2023.
Get the latest research on risks organizations face and the strategies they use to manage risks. www.netskope.com/netskope-thr...
Get the latest research on risks organizations face and the strategies they use to manage risks. www.netskope.com/netskope-thr...
Cloud and Threat Report - January 2025
Gain insights into how organizations manage evolving risks, including social engineering risk, personal app risk, generative AI risk, and adversarial risk.
www.netskope.com
January 7, 2025 at 4:47 PM
🆕 Netskope Cloud and Threat Report shows phishing attempts are increasingly successful, with enterprise employees falling victim nearly 3X more in 2024 than in 2023.
Get the latest research on risks organizations face and the strategies they use to manage risks. www.netskope.com/netskope-thr...
Get the latest research on risks organizations face and the strategies they use to manage risks. www.netskope.com/netskope-thr...
In this episode of the Security Visionaries podcast, host Max Havey and guest @rcanzanese.bsky.social, Director of Netskope Threat Labs, dive into threat trends from the past year, including AI-enabled threats, deepfakes, and nation-state attacks.
🎧 Listen now: www.netskope.com/resources/po...
🎧 Listen now: www.netskope.com/resources/po...
December 18, 2024 at 8:32 PM
In this episode of the Security Visionaries podcast, host Max Havey and guest @rcanzanese.bsky.social, Director of Netskope Threat Labs, dive into threat trends from the past year, including AI-enabled threats, deepfakes, and nation-state attacks.
🎧 Listen now: www.netskope.com/resources/po...
🎧 Listen now: www.netskope.com/resources/po...
⚠️ Netskope discovers side-loaded #backdoor targeting Thai officials.
Get an analysis of the infection chain and dive deep into the backdoor we've dubbed "Yokai." www.netskope.com/blog/new-yok...
#ThreatResearch #cybersecurity
Get an analysis of the infection chain and dive deep into the backdoor we've dubbed "Yokai." www.netskope.com/blog/new-yok...
#ThreatResearch #cybersecurity
New Yokai Side-loaded Backdoor Targets Thai Officials
Summary DLL side-loading is a popular technique used by threat actors to execute malicious payloads under the umbrella of a benign, usually legitimate,
www.netskope.com
December 13, 2024 at 5:51 PM
⚠️ Netskope discovers side-loaded #backdoor targeting Thai officials.
Get an analysis of the infection chain and dive deep into the backdoor we've dubbed "Yokai." www.netskope.com/blog/new-yok...
#ThreatResearch #cybersecurity
Get an analysis of the infection chain and dive deep into the backdoor we've dubbed "Yokai." www.netskope.com/blog/new-yok...
#ThreatResearch #cybersecurity