Recently discovered a webinar hosting platform actively scraping and redistributing public and private Zoom webinars without knowledge or consent of organizers.

Full details, recommendations, and detection opportunities here: cyberalberta.ca/zooming-out-...

#CTI #ThreatIntelligence #InfoSec

CyberAlberta's meta-analysis of the Shai-Hulud worm malware, and how it propagated throughout the npm ecosystem, pieces together the attack chain, detection opportunities, and guidance for maintainers and dependents of OSS packages.

cyberalberta.ca/the-scatteri...

#CTI #ThreatIntelligence #InfoSec

CyberAlberta’s latest strategic report covers the threat of #ElectionInterference, providing new findings of inauthentic accounts and news sites exploiting issues relevant to Alberta to antagonise the federal government.

cyberalberta.ca/system/files...

#CTI #ThreatIntelligence #InfoSec

CyberAlberta recently observed an attempted Vendor Email Compromise (VEC).

This highly convincing attack has been observed by the Irish Government, and researchers at Abnormal AI, who note high user engagement with this tactic.

cyberalberta.ca/the-evolving...

#CTI #ThreatIntel #InfoSec

🎣 Latest observed Tycoon 2FA campaign

At least 2 US based education organizations are spoofed to send HTML files masquerading as voicemail or invoices, directing targets to a pre-filled credential harvesting page hosted on DGA .es domains.

#ThreatIntelligence #CTI #InfoSec

Interlock hard-coded C2 domains

playiro[.]net
basiclock[.]cc
cluders[.]org

Show the following characteristics

Registrar: PDR
Registrant Name: "Brenda Esparon", or "REDACTED", or "None"
Created around: 1330 27/04/25

Pivoting on these data points in @silentpush.bsky.social reveals more 👇

A recent spear phishing campaign leveraged Google Workspace to provide DKIM authentication to a maliciously crafted subdomain. This technique, combined with a misconfigured DMARC policy on the root domain increased delivery rates.

#ThreatIntelligence #CTI #InfoSec

cyberalberta.ca/spear-phishi...

Bots are already at the ballot box 🗳️ 🤖

Ahead of the #2025CanadaElection, the DFRLab uncovered bot-like accounts on X spamming political content—mainly targeting the Liberal Party with recycled, false claims & signs of AI-driven amplification.

🔗 bit.ly/3YgjSD9

CyberAlberta’s latest report analyzes recent #ClickFix infrastructure observed in the wild, and the subsequent attack chain, offerinf examples of what to look out for, and how to mitigate the impacts.

#ThreatIntelligence #CTI #InfoSec

cyberalberta.ca/human-verifi...

LotL isn’t going anywhere. Our latest report highlights how these techniques were recently used to facilitate a recent ransomware deployment, including guidance on detecting and mitigating these all-too-common techniques

cyberalberta.ca/ransomware-t...

#ThreatIntelligence #CTI #InfoSec #Ransomware

1/7 Tracking a #ClickFix cluster mass compromising WordPress sites, injecting code which redirects from a first-stage domain to JavaScript producing fake Cloudflare Turnstiles hosted on caprofklfkzttripwith[.]com

Turns out, information manipulation is a real problem for Canada too.

Explore @dfrlab.bsky.social's review of Canada’s 2025 Public Inquiry into Foreign Interference as we assess the potential impact of foreign interference on Canada's elections 🇨🇦

🔗 dfrlab.org/2025/03/19/c...

#CanadaElections2025

Fake Captcha / #ClickFix campaigns are switching up themes.

We're seeing campaigns beginning to impersonate #GoogleMeet, in addition to the usual fake #Zoom and Booking pages.

Stay safe, and don't paste code from any suspicious sites.

The Pravda network flooded the internet with 3.6 million pieces of pro-Kremlin propaganda in 2024 alone. This disinformation has already found its way into Artificial Intelligence, allowing dangerous lies to spread even faster. www.axios.com/2025/03/06/e...

‘Pro-Kremlin Disinformation Ecosystem Targets Worldwide Audience’ follows on from great research by @viginum.bsky.social & @dfrlab.bsky.social, analysing the latest iteration of Pravda’s operation undermining the integrity of public opinion with disinformation.

cyberalberta.ca/pro-kremlin-...