Dive into data-backed insights from our Threat Labs team. Each report distills real trends uncovered through the Gen family of brands' products, technology and global research, revealing how scams and emerging threats evolve in the real world. We turn billions of signals into stories that help people stay alert, informed, and one step ahead.

Security Evangelist at Gen

Reports

<h3>When you get a message you didn’t expect, and definitely didn’t want</h3>You're having a normal day when your phone buzzes with a new message: "Your parcel couldn’t be delivered – reschedule now: [shortened link]" It even comes from the same thread where you previously got updates from your real delivery company. Seems legit, right?It’s not.That message wasn’t from your courier. It was from a scammer pretending to be one. And if you click the link, enter your details, or install a suggested “app,” you could end up with a drained bank account, lost data, or unwanted spyware or other dangerous applications compromising your device..In this blog, we’ll break down:<ul><li>What SMS threats really are</li><li>The most common types of scams you’ll find in your inbox</li><li>What scammers are searching for</li><li>How to spot scams (and what to do) if one shows up on your phone</li></ul>We’ll even show you real-world examples of these scams in action.<h3>What is smishing?</h3>SMS is the technical acronym meaning Short Message Service – in many places around the world, people refer to SMS messages simply as text messages or texts.&nbsp;Smishing is short for SMS phishing. It happens when scammers use text messages to trick you into taking an action: usually clicking a malicious link, downloading an app, sending a code, or replying with personal or payment information.Sometimes these messages pretend to be your bank. Other times, a government agency, delivery service, family member or even someone offering a too-good-to-be-true job. These messages are designed to look urgent, convincing, and familiar, so you act before thinking.🧠Why SMS? Because it works. We check texts quickly, we trust them more than email, and many phones automatically group texts into brand-labeled threads – making it even easier for scammers to sneak in undetected.&nbsp;<h3>Why you’re seeing more of these messages now</h3><ul><li>Phone numbers are everywhere. Have you shared your number for a raffle? Coupon code? Loyalty card? On social media? That’s all it takes.</li><li>Global scams are industrialized. These are not one-person operations. Criminal groups now run massive SMS campaigns using stolen or breached databases, message automation, and spoofed sender IDs.</li><li>Smartphones are now wallets. With banking, two-factor authentication (2FA), and shopping on your phone, it’s a prime target for fraudsters.</li><li>They only need a few people to fall for it. And statistically, someone always does.</li></ul><h3>The many faces of SMS threats</h3>Let’s walk through the most common SMS scam types. For each one, we’ll explain how it works, what the scammers want, and what you should do.&nbsp;1. The fake account alert (banks, email, crypto, social)Hook: “Unusual login detected” / “Your account is locked” / “Urgent security check.” Goal: Steal your username, password, and possibly 2FA code. How it works: Link opens a perfect copy of a login page (bank, email, crypto exchange). Some variants tell you to call a number to “secure” your account. What to do: Don’t tap. Open the official app or type the address yourself. Never call numbers in the SMS. If you logged in, change your password and enable an authenticator app for 2FA.

2. The OTP (code) theftHook: “Reply with the 6-digit code to cancel your transaction” / “We sent a code to secure your account – please confirm.”&nbsp; Goal: Steal your one-time password to break into your account. How it works: Scammer triggers a real OTP from your service and tries to trick you into sharing it. What to do: Never share codes. If you didn’t request it, someone else probably did.

3. The undelivered packageHook: “We couldn’t deliver your package – pay €1.50 to reschedule.” Goal: Harvest credit card info or trick you into downloading malware. How it works: You’re sent to a fake delivery site with a small payment form or prompted to install a “tracking app” (especially on Android). What to do: Don’t follow the link. Track packages only via the delivery company’s official app or website.&nbsp;

4. The tax refund or fineHook: “You have a tax refund waiting– claim now.” Goal: Payment and identity theft on a convincing look-alike site. How it works: Uses branding from national tax offices, toll agencies, or other government institutions. Creates a sense of urgency with strict deadlines, and asks for card + personal data. Some texts use weird characters to bypass filters. What to do: Always access government and other official &nbsp;portals directly from the official site.&nbsp;

5. The fake refundHook: “You are owed a refund for your flight– click here to claim.” Goal: Steal credit card details, ID info, or sign you up for paid services. How it works: Polished “claim” page with language that creates urgency. Some use homoglyphs (look-alike characters) in brand names to seem legitimate. What to do: Check your account or booking site directly– never through a link in a text.

6. Jobs &amp; side gigs (“mystery shopper”, “brand recruitment”)Hook: “Earn $200/day from home. No experience needed!” Goal: Get you to move to WhatsApp or Telegram and then steal personal info or scam you into paying “recruitment fees.” How it works: Friendly recruiter builds trust, then pressures you into sending personal documents or paying small fees to "start." What to do: Treat unsolicited job texts as scams. Verify roles on official careers pages; never pay to apply.&nbsp;

7. The crypto or investment baitHook: “Hot crypto tip! Double your money in 7 days.” Goal: Move you off-platform and scam you into depositing funds. How it works: Often starts with an SMS and continues on WhatsApp or Telegram. What to do: Ignore unsolicited tips. Real investments don’t arrive by random text.

8. Cloud storage &amp; account expiration scamsHook: “Your storage is full– photos tied to your number will disappear.” Goal: Steal account credentials or payment details; sometimes push you to install a malicious app. How it works: The message warns that your cloud account is about to expire or that photos will be deleted unless you act now. Victims are directed to a fake login page (to harvest credentials) or to a payment form (to steal card details). Some versions even include your phone number in the message to make it feel personal. What to do: Don’t click the link. Instead, check your cloud account directly through the official app or by typing the provider’s website yourself. If you entered your login on a fake page, change your password immediately and turn on two-factor authentication. If you installed an app, uninstall it and run a trusted security scan.

9. The “your phone is infected” / fake tech supportHook: “Phone infected– install our security app” / “Call support now.” Goal: Install a rogue app or gain remote control of your device. How it works: Provides a fake antivirus/security product page, sometimes customized to your device. What to do: Don’t install from links. Use official app stores; never grant remote access to strangers.

10. Prizes, surveys, couponsHook: “You’ve won a phone!” / “Complete a survey for a gift.” Goal: Enroll you in a premium-rate subscription or steal your data. How it works: Fun quiz → “verification” with your number/card → recurring charges. What to do: Skip prize texts. If you clicked, check your mobile bill, Apple subscriptions and cancel new services.

11. Callback smishing → vishing (voice scam)Hook: “There’s a problem with your bank account. Call us now.” Goal: Trick you into calling a scammer pretending to be your bank. How it works: Realistic phone scripts convince you to “verify” your card details or install remote control apps. What to do: Never call back a number from an SMS. Use the number on your card, inside the official app, or on the company’s website.

12. The support link to WhatsAppHook: “Chat with our agent on WhatsApp to verify your identity.” Goal: Move off SMS (harder to monitor) and harvest IDs, selfies, payments. How it works: Deep-link opens a chat with a fake “agent” who requests documents/fees. What to do: Never follow links from SMS to chat apps unless you initiated the conversation.

13. SIM-swap scamsHook: “Your number will be deactivated– update your info.” Goal: Gather enough info to steal your phone number and access your accounts. How it works: Scammers collect info to impersonate you with your mobile carrier. What to do: Contact your phone company directly and ask about SIM-swap protection.

14. Family/friend impersonation (“Hi Mom/Dad, new number”)Hook: “Dad save this new number” / “Hi Mom, I broke my phone– message me here.” Goal: Pull you into a quick “emergency” payment or move you to WhatsApp. How it works: Emotional pressure + urgency; requests instant transfers or vouchers. What to do: Don’t reply. Call the real number you already have for that person to verify.]

15. Messaging-app takeover (“I sent you a code by mistake”)Hook: “I accidentally sent my login code to your number, can you share it back?” Goal: Steal your WhatsApp/other messenger account by grabbing the login code. How it works: If you share the code, they register your account on their device and lock you out. What to do: Never share codes. Turn on in-app two-step verification (a separate PIN).

16. “Recovery” and refund-rescue scams (meta-scam)Hook: “Scammed? &lt;Name&gt; offers trusted recovery support. wa.me/&lt;number&gt;” Goal: Target people who were already scammed and charge “recovery fees.” How it works: Promise to get your money back; ask for upfront payment or more personal data. What to do: Avoid anyone who cold contacts you offering recovery. Report to your bank/police instead.

<h3>Tips &amp; Tricks</h3>There are a number of red flags to watch out for in and SMS. The top signs include:<ul><li>Urgency + consequence: language like “today,” “final notice,” “account lock” drive people to panic and act before they think</li><li>Unexpected links:&nbsp; shortened or unfamiliar domains should always be treated as suspicious</li><li>Code requests: messages like “send back the 6-digit code”</li><li>Channel switch: requests to “Message us on WhatsApp” or “Call this number now” can show intention of planning untraceable, malicious behaviors</li><li>Weird wording/characters: awkward phrasing, unusual spelling or look-alike characters in brand names should always cause pause</li><li>Payment pressure: vouchers, crypto, or wire transfers should be managed carefully over SMS</li></ul>What to do if you receive a suspicious SMS<ol><li>Don’t ever click links and don’t reply. Instead, go to the official website to get information, official phone numbers and emails.</li><li>Do not call any number shown in the SMS. Use the&nbsp;official app, the number on your&nbsp;card, or the company’s&nbsp;website.</li><li>Report it to your mobile provider (many regions use&nbsp;7726/“SPAM”) and to your national reporting channel.</li><li>If you entered details: change passwords immediately; enable 2FA with an&nbsp;authenticator app; watch bank/credit statements and contact your bank if payment info was entered.</li><li>If you installed an app (Android): airplane mode → uninstall → run a trusted mobile security scan; if banking details were involved, contact your bank and consider a full reset as a last resort.</li></ol><h3>Final thoughts: tiny texts, big threats</h3>Scam messages may look harmless (just a few words, maybe a link), but they can be the start of a serious attack. The good news? If you know what to watch for, most of them are easy to spot and avoid.Stay skeptical. Stay informed. And remember: no real service will ever ask for your password or code over SMS.

Scam text messages may be small, but their impact can be huge.

SMS threats: the many faces of a tiny text

Threat Research Team

<h2 class="text-align-justify">Foreword&nbsp;</h2>The third quarter of 2025 confirmed what many of us have felt all year: the center of gravity in cybercrime is people. Criminals are not only trying to break into devices. They are working to walk users into traps that look and feel legitimate, at scale and with speed. Generative AI has lowered the cost of persuasion and raised the polish of deception. The result is a threat landscape where a convincing message, a nicely branded web page, or a friendly voice can be as dangerous as a zero-day exploit.&nbsp;The patterns we highlighted earlier this year have become more pronounced. “Scam-Yourself” techniques continue to spread across everyday channels like SMS, email, and social media. Phishing moved further from crude copies to what we call VibeScams, where the trick is less in the code and more in the feeling a site gives you at first glance. Attackers are also blending formats. A text message can point to a look-alike login, which then routes a victim to a live chat or voice follow-up. The route is simple. The coordination behind it is criminal.&nbsp;Defenders are adapting too. Our Gen Threat Labs work on both sides of the problem: understanding the criminal playbook and delivering protection that helps real people in real time. On any given week, that can mean reverse engineering a ransomware family to help victims recover their files without paying, training models to spot hidden scam patterns inside inboxes, or publishing practical guidance that families can act on in minutes. We believe research must translate into impact.&nbsp;What you will find in this report reflects that approach. Our Feature Stories highlight real-world examples of what we see, the first of which examines VibeScams, the rise of AI-built phishing factories, and why “looking right” for two seconds is now enough to steal money or credentials. The second story zooms in on SMS – text messages remain one of the most universal and most exploited channels, and this quarter brought fresh tactics that pair automation with human-style tone and timing. The third story covers a new decryptor release and what it revealed about attacker tradecraft, economics, and mistakes. It is a reminder that ransomware is not only about prevention. It is also about giving victims a way back when the worst has already happened.&nbsp;Beyond the Feature Stories, the Threat Landscape connects the dots from first touch to final loss. A sponsored link leads to a look-alike page, an SMS nudges the next click, and an inbox “verification” finishes the job. We document these handoffs with telemetry and case studies, highlight malvertising as a frequent starting point, and show the growing link between social browsing and off-platform fraud. Where numbers can be confusing, we add short notes on definitions and scope.&nbsp;We also track social-to-commerce abuse, where “shop now” and creator tagging push users to off-platform checkout traps; the growing role of AI in the loop, with voice clones and live-chat assistants paired with SMS or email to close the scam; and shifts in payment rails toward instant transfers and refund bait that compress the recovery window.&nbsp;Thank you to everyone who contributed, and to every reader using this report to protect families and teams. Criminals trade on trust. We work to deny that trade, click by click.&nbsp;Read on, stay skeptical, and keep the advantage.&nbsp;Luis Corrons, Security Evangelist (aka Threat Whisperer)

<h2>Threat Landscape Highlights: Q3/2025&nbsp;</h2>In Q3 2025, cybersecurity threats continued to evolve across mobile and desktop platforms, with mobile scams and adware dominating the landscape. Mobile users were particularly targeted by <a href="https://www.gendigital.com/blog/insights/research/ai-generated-personas-deepfake-tactics-scam-yourself-attacks" target="_blank" rel="noreferrer noopener">Scam-Yourself Attacks</a> and HiddenAds adware disguised as fake apps, often distributed through official stores. On desktops, Remote Access Trojans like Wincir remained active, while sextortion, gambling scams, and TechScam campaigns persisted in various regions.&nbsp;&nbsp;Beyond device-level threats, data breaches rose in frequency, with financial data remaining an important concern, led by payday loan misuse, suspicious bank activity, and emerging web skimming and invoice scams.&nbsp;<h3 class="text-align-justify">Security Threats &amp; Scams&nbsp;</h3>Q3 highlighted how closely security threats and scams are now intertwined, evolving together across mobile, desktop, and beyond.&nbsp;&nbsp;<a href="https://us.norton.com/blog/malware/adware" target="_blank" rel="noreferrer noopener">Adware</a> shifted from desktop to mobile this quarter. After last quarter’s desktop spike and the return of <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=The%20return%20of%20DealPly%3A%20Adware%E2%80%99s%20unexpected%20revival&amp;text=The%20return%20of%20DealPly%3A%20Adware%E2%80%99s%20unexpected%20revival" target="_blank" rel="noreferrer noopener">Dealply</a>, we saw a clear increase on Android. The number of blocked adware attacks rose by 77% quarter over quarter on mobile, driven mainly by HiddenAds-style apps that use obfuscation and hide after install, often posing as simple games. A notable share came through the official Google Play Store, which helps explain the growth, since people trust the store and many devices still run without active protection.&nbsp;

On desktop, Remote Access Trojans (RATs) remained persistent with a 10.67% Q/Q increase in risk ratio. The <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=Remote%20access%20exploited%20by%20threat%20actors" target="_blank" rel="noreferrer noopener">Wincir-driven</a> rise from last quarter continued after a mid-year lull, and we saw noticeable RAT spikes in regions like Chile (+77.89%), Spain (+43.87%) and Brazil (+40.75%).&nbsp;&nbsp;Some attacks now travel through trusted update channels. In August, criminals briefly slipped a bad update into a popular developer tool (Nx) that tried to copy passwords and other secrets from the computer. The takeaway is simple. Even software from familiar places can be harmful if a bad update runs. Basics still help: keep automatic updates on, install fewer add-ons, stick to well-known publishers, and if something looks odd, change your passwords and sign out of connected apps.&nbsp;These risks are not abstract; they spill into daily life when critical systems go down. We are more dependent on connected systems than ever, which makes outages and attacks felt in the real world. Two Q3 examples show this clearly. Jaguar Land Rover’s UK plants paused production for more than three weeks after a cyberattack, with officials now assessing the wider supply chain fallout. And on September 20, a cyberattack on Collins Aerospace’s MUSE check-in and boarding software disrupted operations at major European airports including Heathrow, Brussels, Berlin, and Dublin, forcing manual check-ins and causing delays and cancellations.&nbsp;Scam-Yourself Attacks, a new type of threat trend we have tracked in previous quarters on web and desktop, clearly extended to mobile in Q3. On Android and iOS we observed a rise in Fake Scans, a type of Scam-Yourself Attack that imitates system warnings, claiming malware was found and steering users to click malicious links. Today’s mobile threats remain mostly scam-driven rather than exploit-driven.&nbsp;Sextortion activity clustered in August, reaching levels similar to previous peaks. Gambling scams also flared briefly, luring users to place bets then refusing payouts, often using URLs with words like “luck” to lure victims. TechScam continued climbing, with notable spikes in Mexico (1,650%), Chile (1,326%), Czech Republic (974%) and Colombia (700%), typically fronted by fake prompts asking for one-time PINs to “restore” access to messaging or social media.&nbsp;Scams are everywhere, and they move across borders as easily as a text message or email. Law enforcement and security companies are pushing back to stop or at least minimize the impact. A good example is an INTERPOL-coordinated sweep this summer called <a href="https://www.interpol.int/en/News-and-Events/News/2025/African-authorities-dismantle-massive-cybercrime-and-fraud-networks-recover-millions" target="_blank" rel="noreferrer noopener">Operation Serengeti 2.0</a>. Running from June to August across 18 African countries with support from the UK, it led to 1,209 arrests, disrupted nearly 88,000 victimizations, recovered 97.4 million USD, and dismantled 11,432 malicious infrastructures used for scams and cybercrime.&nbsp;The Operation Serengeti 2.0 cases ranged from day-to-day fraud to large networks. In Zambia, authorities broke up a crypto investment scheme tied to 65,000 victims and an estimated 300 million USD in losses. In Angola, police shut 25 illicit crypto mining centers and seized 45 illegal power stations. In Côte d’Ivoire, investigators took down a transnational inheritance scam with losses around 1.6 million USD. INTERPOL says the operation worked because police shared indicators like suspicious IPs, domains, and command servers ahead of time, with private-sector partners contributing threat intelligence and training. Results like these show that coordinated action can claw back funds, take down infrastructure, and make the next wave of scams a little less effective.&nbsp;&nbsp;Coordinated action cannot stop every scam, but it raises costs and removes infrastructure that would otherwise keep hitting consumers.&nbsp;&nbsp;<h3 class="text-align-justify">AI-Driven Attacks &amp; Defenses&nbsp;</h3>In Q3, the AI layer moved from the novelty and research sphere to being a serious part of the real attack surface. Three trends stood out: attackers manipulating AI assistants, targeting add-ons and extensions that power AI tools, and experimenting with ways to embed AI directly into attacks. These trends have been building all year, helping explain why scams now feel faster and more convincing.&nbsp;

The most visible pressure point was assistant and agent abuse. Researchers demonstrated ways to nudge or quietly redirect popular enterprise assistants into revealing information or taking unintended actions. The lesson is simple. If an assistant can access your files or calendar, it deserves the same level of care as any powerful app, with strict permissions and a healthy habit of saying no to unexpected prompts.&nbsp;We also saw supply-chain risk emerge inside AI tooling. In July, the Amazon Q Developer extension for Visual Studio Code briefly shipped with malicious commands after an attacker tampered with the code path. Amazon fixed the issue quickly, but the incident showed that even trusted AI extensions can become a delivery route for harmful actions through normal updates. Extensions and plugins should be treated like apps: keep them updated, choose verified publishers, and remove what you do not use.&nbsp;In an example of how AI is shifting traditional threats, our previous Threat Report covered <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=and%20ultimately%2C%20dismantled.-,Beating%20FunkSec%3A%20When%20ransomware%20meets%20AI,-It%20started%20like" target="_blank" rel="noreferrer noopener">FunkSec</a>, the first ransomware where criminals used AI to help them write ransomware code. This quarter, researchers reported a proof-of-concept (not real malware found in the wild) called PromptLock, that goes one step further. Instead of using AI during development, it uses a small model on the device during the attack to generate commands in real time. This makes the behavior more flexible and, in theory, harder for older, static detection methods to catch. Even as a demo, it points to how ransomware might evolve due to AI.&nbsp;Persuasion research also stood out this quarter. Simple framing cues like authority and urgency made chatbots more likely to answer questions they should refuse. That same psychology fuels today’s “vibe-correct” phishing, where fake pages look and feel legitimate at first glance. AI helps criminals scale the look, the language, and the timing, which is why our VibeScams featured story is so timely.&nbsp;We are also seeing state actors adopt the same playbook. In mid-July, security researchers reported a Kimsuky campaign that used ChatGPT to generate realistic images of South Korean military ID cards to make spear-phishing emails look official; the link delivered malware, not an ID. The same report ties the activity to earlier <a href="https://www.gendigital.com/blog/insights/research/deceptive-nvidia-attack" target="_blank" rel="noreferrer noopener">ClickFix</a>-style lures and shows how AI is used to polish the “front end” of an attack. Separately, Anthropic <a href="https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" target="_blank" rel="noreferrer noopener">documented</a> North Korean operators using Claude to fabricate identities and pass coding tests for remote jobs. Together, these cases show AI as a force multiplier for social engineering, not just code writing.&nbsp;&nbsp;The same AI boost shows up in text messages. Our SMS Threats featured story explains how AI tools now draft and localize smishing messages that match brand tone, include believable details, and land at the right hour. This is why delivery notices, bank alerts, and account lock texts feel more urgent and legitimate than they used to.&nbsp;As mentioned previously, <a href="https://lifelock.norton.com/learn/internet-security/ai-scams" target="_blank" rel="noreferrer noopener">AI-enabled scams</a> are now a real part of the threat landscape. Similarly, we are starting to see the early trends of video scams and deepfakes in our Gen telemetry. Q3 is our first quarter with telemetry from Media Shield, our new on-device deepfake protection for Windows AI PCs. The feature is still in early rollout with a limited installed base, so these results are indicative rather than market-wide. Even so, some patterns stand out. Most detections were flagged as deepfake audio, with a smaller share of scam videos. Within those scams, cryptocurrency and financial lures dominated, while the rest were more generic fraud attempts. Importantly, almost all of the scam clips were low-reach, with very few above 10,000 views, suggesting that deepfake scams are more common in niche content than in widely viral videos.&nbsp;These are early indicators, not population-wide trends, but they show how manipulated media is being used today: less about chasing virality, more about convincing smaller audiences to part with money.&nbsp;The picture that emerges is clear. Attackers are getting results through orchestration and persuasion, not only through clever code. Defenders are moving from written rules to built-in protections that act while you use the product: clearer guardrails in the chat, safer default settings, and tighter limits on what assistant tools can access. For consumers, the practical takeaway is to be extra careful with anything that asks an assistant to reach into your files, messages, or finances, to limit what plugins can do, and to treat perfect-looking pages with healthy doubt, especially when they ask for passwords or payments.&nbsp;<h3 class="text-align-justify">Privacy&nbsp;</h3>When you use digital products, you leave a trail. Sites and apps collect details about your device, browser, and how you move around a page. Combined, these signals form a “digital fingerprint” that can identify a person across different sites and sessions. Fingerprinting is widely used on the web and can track people even without cookies, which is why it matters for consumers who think clearing cookies is enough.&nbsp;

Our telemetry shows that since July 2025 we have blocked an average of 247 million trackers per month, and we are seeing almost 37 million digital fingerprints per month, a 1% quarter-over-quarter increase. This tells us that tracking is alive and growing. Fingerprinting keeps you identifiable even without cookies, letting companies and data brokers stitch together a detailed record of what you read, buy, and search. That profile can shape the prices you see, fuel relentless targeting, and give scammers enough detail to make fake messages feel real.&nbsp;While digital fingerprints allow your every move to be tracked online, encryption keeps everyday chats, photos, and backups private – and it can also frustrate criminal investigations. Some policymakers argue for special access for law enforcement, while security and privacy experts warn that any built-in workaround weakens protection for everyone. This quarter, in the UK, encryption policy reminded everyone that this is not a settled debate. In February, Apple removed its Advanced Data Protection option for iCloud in the UK after receiving a secret legal order under the Investigatory Powers Act and took the matter to the Investigatory Powers Tribunal. In August, the tide appeared to turn when the U.S. Director of National Intelligence said the UK had agreed to drop the backdoor demand. For consumers, the signal is simple: strong encryption still has heavyweight defenders, but it remains a live policy fight. &nbsp;Across the EU, governments are still arguing over the proposal nicknamed “Chat Control,” which would let authorities issue detection orders that require services to scan for child-abuse material and grooming. Parliament’s position rejects generalized scanning and seeks to protect end-to-end encryption, while the Council remains split, with several countries including Germany opposing client-side scanning and others backing it ahead of scheduled votes. The upshot is that messaging privacy rules are still being decided, and outcomes could vary by country in the months ahead.&nbsp;&nbsp;Another privacy reminder came to us this quarter from Sam Altman, OpenAI’s CEO. He has warned that therapy-style chats with ChatGPT are not protected like conversations with a doctor or lawyer, and that transcripts could be requested in a lawsuit. Treat AI chats like any other online form: if you would not say it in a crowded room, do not paste it into a chatbot, especially anything about health, legal matters, or finances.&nbsp;&nbsp;<h3 class="text-align-justify">Trust and Identity &nbsp;</h3>Digital identity theft is clustering around fast-cash products and routine account probing. Criminals are applying for short-term loans and new cards in victims’ names, then testing access to existing bank accounts.&nbsp;This quarter we saw more instances of breach events but smaller ones. The total number of breach events increased by 76%, while the overall volume of leaked records fell by 81%. In simple terms, there were more incidents, but each affected fewer people. What makes this trend concerning is the type of data exposed. The share of breaches containing passwords rose sharply to over 83%, even as breaches with email addresses declined. That means the “quality” of stolen data improved from a criminal’s perspective, as credentials are far more valuable than contact lists.&nbsp;A breach event represents each separate case where data was exposed, while breached data refers to the total number of individual records leaked. So even if the total number of records goes down, more events mean more unique services and users potentially affected. The combination of smaller, more frequent breaches with richer data shows that attackers are focusing on precision and value rather than scale.&nbsp;

Across financial alerts in Q3, payday loans represent the largest share of unique alerted users at 32%, followed by new credit card applications at 15%, typically fraudulent attempts to open cards in a victim’s name. Protective lock blocks on payday loans accounted for 10%, reflecting successful blocks applied after a fraud attempt. Existing bank-account updates (unauthorized changes) and new auto applications each represent 6%.&nbsp;On the transaction side, alerts are led by suspicious bank-account activity (42%) and credit card activity (20%). Smaller but notable shares include gray charges -small, technically authorized recurring fees like trial rollovers and add-on “clubs”- (9%), unusual charges (8%), and login errors at financial institutions (7%). The pattern reflects a familiar playbook: move fast to turn access into cash, then test the limits of existing accounts.&nbsp;

Alert patterns mirror a broader trend in which third-party access and support systems serve as frequent entry points. This quarter, a wave of attacks exploited company Salesforce ecosystems, often through connected third-party integrations. The FBI issued an advisory on two clusters—UNC6040 and UNC6395—describing tactics such as vishing for support credentials and abusing compromised OAuth tokens from the Salesloft–Drift integration to export customer data. Those exports can include support ticket text containing names, contact details, and even embedded secrets. The result: highly convincing <a href="https://us.norton.com/blog/online-scams/what-is-phishing" target="_blank" rel="noreferrer noopener">phishing</a> that references real cases.&nbsp;Several firms confirmed exposure tied to this activity. Cloudflare reported exfiltration from its Salesforce tenant between August 12 and 17, 2025, limited to support case objects. Trade and tech press covered similar confirmations and mitigation steps across the industry.&nbsp;A number of breaches also impacted well-known, non-tech brands. Air France–KLM said a third-party platform used by its contact centers was compromised in the week of July 28, exposing customer contact and loyalty details. These incidents do not always include passwords or card numbers, but they give scammers exactly what they need to personalize lures and create successful account-reset attacks.&nbsp;Luxury retail provided another example of why “profile” data matters. In mid-September, Kering confirmed a June intrusion that led to theft of customer data for brands including Gucci and Balenciaga. Reports noted contact details and total spend amounts, which can be used to target high-value buyers with bespoke fraud.&nbsp;<h3 class="text-align-justify">Financial Wellness &nbsp;</h3>Criminals are shifting financial theft to where payments actually happen: online checkout pages and accounts payable. We saw two key patterns emerge in financial theft in Q3: more attempts to skim card data directly from merchant payment pages and a rebound in fake or altered invoices that reroute money during vendor payments.&nbsp;On desktop, web skimming attempts increased quarter over quarter. These are attacks that inject code into a store’s checkout page to capture card numbers and billing details as you type. We also saw invoice-scam activity rise again after a summer dip, with renewed waves targeting people who handle bills and supplier payments.&nbsp;&nbsp;

Independent threat reporting <a href="https://www.recordedfuture.com/research/h1-2025-malware-and-vulnerability-trends" target="_blank" rel="noreferrer noopener">says</a> web skimming levels remained high through 2025, with thousands of ecommerce sites affected in H1 and beyond. One July campaign hit OpenCart shops by hiding skimmers among analytics tags like Google Tag Manager and Meta Pixel. Researchers also described variants that validate cards via a legacy Stripe API and even move skimming into malicious browser extensions. When looking at these trends together, it is clear that client-side checkout is a hot target.&nbsp;Payment industry standards have reacted. PCI DSS 4 emphasizes script authorization and change detection for checkout pages, reflecting how much risk now sits in third-party and client-side code. For consumers, the implication is simple: a site can look trustworthy and still be compromised on the page where you pay.&nbsp;Invoice scams also increased in Q3 after a short summer lull, with attackers impersonating trusted vendors and official bodies to reroute payments. This echoes wider signals from regulators and law enforcement, including a Europol–EUIPO report in May that flagged a significant rise in fraudulent invoices across the EU, often boosted by email spoofing and lookalike domains, and the FBI’s latest IC3 report noting record losses with business email compromise still driving invoice diversion and vendor payment fraud.&nbsp;

Patrik Holop, Principal Data Scientist&nbsp; Luis Corrons, Security Evangelist&nbsp; Peter Kováč, Lead Data Scientist&nbsp; Jakub Vávra, Sr Threat Analysis Engineer&nbsp;<h2 class="text-align-justify">Featured Stories: Consumers Under Siege&nbsp;</h2>Cyber threats don’t usually announce themselves with flashing warnings or complex exploits. Increasingly, they arrive in the everyday moments of people’s lives: a website that “feels” right, a text that buzzes during morning coffee, a file that suddenly locks on your desktop. What unites these attacks isn’t just the technology behind them, but the way they prey on routine, trust, and timing.&nbsp;This quarter’s featured stories spotlight three very different fronts of this same battle. Our story on VibeScams shows how AI-powered web builders are turning phishing into a plug-and-play service, where the danger isn’t a sloppy code but a flawless “vibe.” The SMS Threats feature reveals how the tiniest of texts can funnel victims into large-scale fraud, evolving into one of the most persistent and underestimated attack vectors. And our report on Midnight Ransomware reminds us that even hardened cyber extortion can falter: when copy-paste criminals forget the math, defenders can seize the opportunity to turn the tables.&nbsp;Together, these stories capture the reality of consumers under siege: threats are faster, more deceptive, and closer to daily life than ever before, but also more fragile when exposed to the right defenses.&nbsp;<h3 class="text-align-justify">VibeScams - Phishing factories powered by AI&nbsp;</h3><h4 class="text-align-justify">A new kind of phishing&nbsp;</h4>We call them VibeScams because the trick isn’t in the code, it’s in the feeling. These sites pass the “vibe check”: the colors, the spacing, the logo placement, even the tiny footer links nobody reads but everybody recognizes. They feel right at first glance, and that’s enough to fool people into handing over money or credentials.&nbsp;What makes VibeScams different is that the criminals behind them often aren’t technical experts. Just like VibeCoding lets anyone create software without coding, these platforms let anyone create scams without phishing know-how or web-design skills. A few words typed into an AI-powered builder are enough to generate a polished, brand-like page that can be abused straight away.&nbsp;You open a text that says your DHL or FedEx parcel needs a small fee for delivery. You need your package, so you quickly click the link. The page you see passes a brand audit: the yellow (or purple, depending on brand), the spacing. Tomorrow it’s a Coinbase “wallet verification” or a Microsoft login. Everything looks great, right up until your money’s gone.&nbsp;Thanks to AI, the phishing supply chain has completely upleveled. AI web-builders have turned “make me a page that feels like X” into a one-line prompt. Some even spin up a site from a screenshot. No HTML, no design school, no expensive dev hours—just a credible, on-brand clone in minutes. That shift drops the barrier to entry for scammers and multiplies the risk for everyone else.&nbsp;

<h4 class="text-align-justify">Why this works&nbsp;</h4>Our researchers stress-tested this ourselves. Using free offerings, we asked a handful of popular website builders to help us recreate the vibe of TikTok, Microsoft, Instagram, Coinbase, and Binance. The results were alarmingly realistic: polished layouts, familiar components, auto-generated copy that felt “official enough,” and one-click publishing. In other words: plug-and-play phishing.&nbsp;And it’s not a fringe phenomenon. We’re seeing a surge of AI-built fakes across well-known platforms: think delivery brands, mobile carriers, crypto wallets, insurers, social media apps. Many are near-indistinguishable at a glance, especially on mobile where the URL bar is tiny and the design does most of the convincing. Since January 2025, we have blocked approximately 140,000 different AI-generated websites, roughly 580 new malicious sites every day on average. In the same period, we protected nearly 190,000 of our users, with the U.S., France, Brazil, and Germany among the most affected. That’s a lot of “almost-right” pages catching people on a busy Tuesday.&nbsp;

<h4 class="text-align-justify">Behind the curtain&nbsp;</h4>Why is this working so well on otherwise careful people? Because the old red flags (typos, clunky layouts, weird spacing) don’t show up when the page is composed by an AI design assistant. The scam succeeds on vibe: the color, the logo, the tone of the microcopy, the way the “Continue” button sits exactly where your thumb expects it. Localization is trivial now, too. If a campaign targets Spanish speakers in Madrid today and German speakers in Munich tomorrow, the builder simply re-spins the template with new text. And because set-up is cheap or free, criminals can A/B test headlines, icons, and prompts like growth teams do, then keep only what converts.&nbsp;

Under the hood, the workflow is painfully simple. Step one: prompt the builder to generate a page that looks and feels like a trusted brand or upload a screenshot for it to mimic. Step two: “wire up” the forms, either with built-in tools or by exporting the template and asking another AI to handle submission and exfiltration. Step three: publish, measure, iterate, repeat. When a host removes one site, a fresh copy appears somewhere else in minutes. It’s phishing as a service, and the inventory never runs out.&nbsp;To understand what criminals were actually using these AI-generated sites for, we went beyond blocking the URLs. Our team examined the detected domains and analyzed the structure and behavior of the pages. That included looking at the forms they contained, the data they attempted to capture, and the redirection flows that followed. In some cases, the purpose was obvious: credential fields cloned from bank or email logins. In others, links led to cryptocurrency “investment” portals, payment card skimming forms, or remote-support software downloads. And in the future, attackers could just as easily deploy fake crypto “verification” pages that drain seed phrases. By classifying each site this way, we built the threat type breakdown shown in the chart, with phishing dominating, crypto scams close behind, and a smaller slice made up of tech-support and other fraud attempts.&nbsp;

Real-world outcomes follow predictable patterns. Credential-harvesting logins feed account takeovers. Crypto-themed scams try to funnel victims into fake investments. Delivery-fee pages skim cards for small “tests” before bigger hits. Tech-support look-alikes push remote-control installs. The specifics differ, but the mechanics are the same: a believable façade buys a few seconds of trust, just long enough to steal something valuable.&nbsp;<h4 class="text-align-justify">Turning the tables&nbsp;</h4>Here’s the good news: this is not a losing game. On our side, we’re blocking the funnel. We detect and stop known-bad builder subdomains and typosquats before the page loads, so the “vibe” never gets a chance to trick you.&nbsp;&nbsp;Some builders are stepping up, too. When we flagged abusive sites, providers like Lovable, Elementor, Flazio, Softr, Webflow, and WebWave moved quickly to remove them. It shows that responsible reporting works, and that user vigilance plays a role as well. The faster suspicious sites are reported, the faster they’re taken down. Still, the ease of spinning up new clones means takedowns alone can’t win the race; prevention and protection remain critical.&nbsp;That’s why we also track bursts of brand impersonation across multiple builders and work directly with providers to limit abuse. And in our consumer products, features like Scam Protection and Scam Guardian help people sanity-check links and pages in the moment they need it most.&nbsp;What should readers do differently? Start by distrusting design. If a page “feels” right but the request is unusual—seed phrases, 2FA codes, urgent refunds—treat that mismatch as a siren. Don’t follow login links from texts or DMs; use your own bookmark or the official app. For deliveries, jump to the known URL yourself rather than tapping through. And keep unique passwords with MFA turned on, so one mistake doesn’t unlock everything.&nbsp;<h4 class="text-align-justify">The bottom line&nbsp;</h4>VibeScams don’t mean the web is broken. They mean phishing has matured. Speed, scale, and accessibility are now the attacker’s edge; precision, verification, and layered protection must be ours.&nbsp;&nbsp;Phishing no longer requires phishers, just a prompt. If design can be faked in seconds, then trust has to live somewhere harder to fake—like the URL you typed yourself, the security tools that block bad pages on the way in, and the habit of pausing when something feels a little too perfect.&nbsp;Want to dig deeper? Our full blog post on <a href="https://www.gendigital.com/blog/insights/research/vibe-scams" target="_blank" rel="noreferrer noopener">VibeScams</a> explores detailed case studies, examples of AI-built sites we uncovered, and how criminals are adapting their tactics.&nbsp;<h3 class="text-align-justify">SMS threats: the tiny texts criminals love&nbsp;</h3>A buzz at 8:12 a.m.&nbsp; The message lands while you’re making coffee:&nbsp; “Your account was accessed from a new device. If this wasn’t you, call us now: &lt;Phone Number&gt;”&nbsp;It even appears inside the same branded thread your bank uses. In under a minute you could be talking to a convincing “agent”, handing over one-time codes; because, who ignores a security warning?&nbsp;That’s the power of SMS as an attack vector: it’s cheap, instant and feels personal. And while headlines chase flashier threats, text-initiated fraud keeps quietly scaling. In 2024 alone, people reported <a href="https://www.ftc.gov/news-events/news/press-releases/2025/04/new-ftc-data-show-top-text-message-scams-2024-overall-losses-text-scams-hit-470-million" target="_blank" rel="noreferrer noopener">$470 million in losses</a> that began with a text, 5 times the amount reported in 2020. The U.S. regulator’s summary is blunt: texting is “cheap and easy,” and scammers know the ding is hard to ignore.&nbsp;&nbsp;Carriers and industry monitors don’t expect relief soon. Research with global operators finds over half anticipate more SMS fraud this year, not less, as criminals exploit pricing shifts, routing weaknesses and artificially-inflated traffic. Meanwhile, awareness lags. <a href="https://www.ofcom.org.uk/siteassets/resources/documents/research-and-data/telecoms-research/scams-research/experiences-of-suspicious-calls-texts-and-app-messages-research-2024.pdf?v=373453" target="_blank" rel="noreferrer noopener">In the UK</a>, just 15% of mobile users even know about the free 7726 number to report scam texts; only 6% have used it, meaning networks miss signals that would help them filter faster. And as law enforcement has warned, waves like toll/parking smishing can hop state-to-state in weeks, keeping victims and defenders off-balance.&nbsp;<h4 class="text-align-justify">This quarter’s SMS hall of shame&nbsp;</h4>This quarter we went through millions of malicious SMS hitting users around the globe. Below are the five most widespread campaigns we tracked. Each item refers to one concrete campaign, and the example shown comes from that campaign. The percentages are the share of all scam SMS attributed to that exact campaign in our telemetry during the period. This is not a ranking of scam types overall. Together, these five campaigns account for 26% of all malicious SMS seen this quarter:&nbsp;<ol><li>Employment Scam (8% of all scam SMS)&nbsp;&nbsp;</li><li>Fake Refund (7%)</li><li>Tax Refund / Fine (6%)</li><li>Investment (3%)</li><li>Delivery (3%)&nbsp;</li></ol>

<h4 class="text-align-justify">How the tiny text does outsized damage&nbsp;</h4>The trick isn’t high-end malware. It’s friction—or rather, the lack of it. SMS lives where real life does: delivery updates, two-factor codes, appointment reminders. Scammers hide in that noise and win the first five seconds: a short link, a short deadline, and a decision before coffee kicks in. Industry surveys suggest four in ten smartphone users encountered smishing attempts in 2023, a reminder that the top of the funnel is broad, even before under-reporting narrows official stats.&nbsp;Two dynamics keep SMS underrated and under-discussed. First, it’s cross-channel by design. Many campaigns quickly push you off SMS (onto a callback number or a messaging app) where pressure works better and defenses are weaker. Mobile operators/carriers can filter texts at the network level, and in some markets, regulators require them to do so; they can’t police your phone call in real time. Second, the signals are subtle. Phones can group messages by sender name, so a fake bank alert may land inside your real bank thread. Add a shortened URL and a convincing domain, and most of us are one tap from trouble.&nbsp;<h4 class="text-align-justify">The tricks behind the texts&nbsp;</h4><a href="https://us.norton.com/blog/emerging-threats/smishing" target="_blank" rel="noreferrer noopener">Smishing</a> doesn’t win because attackers out-engineer the phone. It wins because the channel feels routine and the disguises are simple but effective. Most texts arrive in the same inbox as your delivery updates and one-time codes; criminals hide in that noise and ask for something small before your brain has switched from “admin mode” to “security mode.” The playbook is a blend of human psychology (urgency, authority, convenience) and tiny technical tricks that make a dangerous message look ordinary for the three seconds it takes to tap.&nbsp;Under the hood there’s no magic, just throwaway domains, and tricks that defeat quick visual checks and basic filters. When a lure needs more time or pressure, the conversation jumps channels—to a phone call or a WhatsApp chat—where defenses are weaker and a calm “agent” can walk a victim through the rest. And if someone hesitates or realizes too late, a second wave appears offering “recovery services” that charge a fee to “get your money back.”&nbsp;Here are the mechanics doing most of the damage right now, and how they slip past both filters and busy humans:&nbsp;<ul><li>URL masking: public shorteners (e.g., cutt.ly, tinyurl.com, rb.gy) and throwaway domains hide destinations long enough to win a tap.</li><li>Brand-ish web addresses: subdomains that glance official at speed, like flhsmv.govturim[.]vip exploit our habit of only reading the start of a URL.</li><li>Username-in-URL phishing: https://www.fedex.com@… still misleads in SMS because the real hostname is everything after the @.</li><li>Unicode obfuscation: SMS supports UTF-16, so look-alike characters turn Amazon into Αmаzon; filters and humans both slip.</li><li>Pivots to voice/messengers: moving victims to WhatsApp/Telegram or a phone call segments the attack across platforms: harder to detect, easier to pressure. Public warnings around toll/parking smishing illustrate how fast these waves evolve.</li><li>The “rescue” after the scam: recovery-service pitches (“Scammed? We can help—chat here”) target people already hurt, extracting a second fee.&nbsp;</li></ul>For readers who want to see these categories in more detail, our blog post “SMS threats: the many faces of a tiny text” expands this list with screenshots, examples, and step-by-step advice.&nbsp;<h4 class="text-align-justify">When AI enters the picture&nbsp;</h4>Artificial intelligence is quietly reshaping this landscape. Where criminals once leaned on clumsy, typo-filled texts, they can now generate fluent, localized messages at scale, each one tailored to the language and phrasing of its target country. AI can also spin up endless variations, making filters that rely on spotting repeated patterns far less effective.&nbsp;And it’s not just text. Attackers are beginning to pair SMS with AI-generated voice calls or chatbot follow-ups on WhatsApp, creating a seamless multi-channel fraud that feels eerily professional. The result: scams that used to raise suspicion now read like the messages you really do get from banks, couriers, or tax offices. For defenders, this means the bar keeps rising; for consumers, it means skepticism has to become second nature.&nbsp;SMS may not trend like ransomware or zero-day headlines, but its quiet efficiency is exactly the point. It reaches everyone, blends with daily admin, and routes victims into higher-value fraud with almost no friction. Until awareness (and reporting) catches up, the smallest message on your phone will keep doing outsized damage—one buzz at a time.&nbsp;<h3 class="text-align-justify">Cracking Midnight: when copy-paste ransomware forgets the math&nbsp;</h3><a href="https://www.avast.com/c-what-is-ransomware" target="_blank" rel="noreferrer noopener">Ransomware</a> has long been treated as unbeatable: files are locked, the math is unbreakable, and victims are forced into a terrible choice: pay or lose their data. Midnight ransomware tells a different story.&nbsp;Built on Babuk’s leaked source code, Midnight is part of a new wave of copy-paste ransomware projects. But instead of improving on the original, its authors weakened it. In analyzing the code, our researchers uncovered a critical weakness in Midnight’s cryptography, the kind of mistake that is rarely seen in modern ransomware. By identifying and leveraging this flaw, the team was able to develop a free decryptor that gives victims a way out without paying.&nbsp;<h4 class="text-align-justify">Midnight in the wild&nbsp;</h4>At first glance, Midnight doesn’t look much different from other ransomware. It locks files, drops a ransom note called How To Restore Your Files.txt, and demands payment. In most cases, victims see their files renamed with the .Midnight or .endpoint extension, a tell-tale sign of the infection.&nbsp;

Earlier versions of Midnight mainly went after high-value data such as databases and backups, but more recent ones broadened the scope to nearly all common file types, leaving only program files untouched. To move quickly, it also uses a trick called intermittent encryption, touching just enough of a file to make it useless while speeding through the system.&nbsp;On the surface, all of this looks like business as usual for ransomware. But underneath, Midnight’s authors made critical mistakes in the encryption design, mistakes that turned into opportunities for defenders.&nbsp;<h4 class="text-align-justify">From Babuk to broken forks&nbsp;</h4>The 2021 Babuk leak was a turning point for the ransomware ecosystem. Suddenly, sophisticated source code was available to anyone who wanted to try their hand at cyber extortion. That leak spawned numerous spin-offs, some more successful than others. Midnight is one of these, and its story illustrates an important trend.&nbsp;Rather than giving rise to a new “super strain,” the Babuk leak produced a wave of rushed, amateurish forks. Midnight is a textbook case: criminals re-used the code, made “improvements” they didn’t fully understand, and ended up with a product that sabotaged itself.&nbsp;Our researchers uncovered weaknesses in its cryptographic design, rare flaws that opened the door to building a working decryptor. For defenders, even a single mistake of this kind is valuable; in Midnight’s case, the opportunity was even greater.&nbsp;<h4 class="text-align-justify">A free way out&nbsp;</h4>Armed with these insights, we developed a free Midnight Ransomware Decryptor. Victims can use it to recover files safely without paying ransom.&nbsp;Rather than duplicating technical detail here, we’ve published a full breakdown on our research blog, including indicators of compromise, screenshots, and step-by-step decryptor instructions. This report tells the bigger story.&nbsp;For defenders and researchers who want the technical details, our colleague Samuel Vojtáš has published an analysis of Midnight on the Gen blog. His article walks through the ransomware’s evolution from Babuk, highlights its quirks, and provides step-by-step instructions for using our free decryptor. You can read the deep dive here: <a href="https://www.gendigital.com/blog/insights/research/midnight-ransomware" target="_blank" rel="noreferrer noopener">Decrypted: Midnight Ransomwar</a>e&nbsp;<h4 class="text-align-justify">Why Midnight matters&nbsp;</h4>Midnight may not be the most widespread ransomware of 2025. But its lessons resonate far beyond its victim count:&nbsp;<ul><li>Copy-paste criminals. Leaked source code is fueling countless ransomware spinoffs, but not all of them are stronger. Midnight proves that copy-paste shortcuts can weaken attackers.</li><li>Rare crypto flaws. Finding single exploitable vulnerabilities in ransomware encryption is uncommon, but Midnight proves that criminals don’t always get the math right.</li><li>Hope for victims. Midnight shows that ransomware isn’t always the end of the road. Free decryptors exist, and paying isn’t the only option.</li><li>AI hype vs. reality. While headlines spotlight AI-assisted ransomware experiments, Midnight shows the other side of the ecosystem — rushed projects built on leaked code, riddled with rookie mistakes. The ransomware landscape is splitting: some groups experiment with AI, while others sabotage themselves. That fragmentation creates new openings for defenders.&nbsp;</li></ul><h4 class="text-align-justify">The bigger picture&nbsp;</h4>The ransomware ecosystem is fragmenting. Instead of a few large, disciplined groups dominating the field, we’re seeing a growing number of buggy forks, rushed experiments, and copycats built on leaked code. That’s good news for defenders: the more mistakes criminals make, the more opportunities we have to neutralize them.&nbsp;Midnight is a case in point, ransomware that tried to build on Babuk’s legacy, but ended up undermining itself. For victims, our decryptor means recovery without ransom. For the industry, it’s a reminder that ransomware isn’t always unbreakable. And for criminals, the message is clear: recycling someone else’s code won’t guarantee success.&nbsp;Branislav Kramár, Threat Analysis Engineer&nbsp; Daniel Beneš, Senior Threat Researcher&nbsp; Jan Rubín, Threat Research Team Lead&nbsp; Ladislav Zezula, Senior Malware Researcher&nbsp; Luis Corrons, Security Evangelist Samuel Vojtáš, Threat Analysis Engineer&nbsp; Tadeáš Zíka, Threat Analyst&nbsp;<h2 class="text-align-justify">In Closing&nbsp;</h2>This quarter confirmed the shift we have tracked all year: cybercrime targets people first. AI has made scams look right and feel right, from VibeScam lookalikes to SMS lures that hand victims to live “support.” Ransomware remains loud, yet the quiet wins come from shrinking the gap between first contact and first protection. Our focus stays on real-time defenses inside the places people already talk and shop, with clear help in the moment of doubt.&nbsp;With the holiday season nearing comes the peak shopping season. Expect scams tied to deliveries, order issues, too-good-to-be-true deals, fake support, and “in-platform” fraud across marketplaces and social. The playbook for readers is simple: slow one beat, check the sender and the URL, never share one-time codes, use 2FA or passkeys, and pay only inside trusted checkouts. We will meet criminals in the conversation with protections that spot the con and stop the loss. See you next quarter with the results.&nbsp;

<h2 id="download-the-q2/2025-threat-report-key-highlights">Download the <a href="https://cmsb.nortonlifelock.com/sites/default/files/2025-11/Q32025%20Threat%20Report%20PDF%20Highlights.pdf" title="Q3/2025 Threat Report Key Highlights" target="_blank">Q3/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

Tracking the surge of mobile scams, AI-driven attacks, and evolving data threats across Q3 2025.

Gen Q3/2025 Threat Report 

<h2>Foreword</h2>Welcome to our latest Gen Threat Report, this time focused on Q2/2025. April through June brought a complex mix of progress and peril across the cyber threat landscape. Some of the positive aspects included a slight decline in the overall threat risk ratio and several law enforcement operations aimed at disrupting cybercrime groups. At the same time, the threat landscape remained active, with a record volume data breaches, disruptive ransomware incidents and a steady stream of inventive scams. Navigating these signals requires careful interpretation, so let's explore the most significant developments together.One of the busy areas this quarter was the continued targeting of personal data. Breach events increased by nearly 21% quarter-over-quarter, and the number of exposed email addresses rose by over 15%. Also, credit alerts remained the most common identity-related notification in our systems. We also continued to see fallout from the X (Twitter) leak, which went public in early April, with compromised records resurfacing in various contexts. Q2 also brought headlines about the takedown of Lumma Stealer, one of the most notorious infostealers in recent years. While parts of its infrastructure were disrupted, the story didn’t end there. Based on our telemetry, Lumma remains alive and kicking,&nbsp;despite the efforts to dismantle this group. Distribution channels continued to operate, and data exfiltration persisted throughout the quarter. As we’ve seen before, bringing down one part of an ecosystem doesn’t always stop the threat entirely. You can read more about Lumma and the aftermath of the takedown in the featured story below. Still, the effort reflects growing coordination between law enforcement and the security community. Other notable actions this quarter included the indictment of Qakbot’s leader, charges against DanaBot operators and Europol’s Operation Endgame targeting ransomware infrastructure.On the financial-threats front, our research of an illegal pharmacy network&nbsp;revealed over 5,000 scam domains connected to a single cybercriminal group. The operation spans continents, hijacks legitimate websites and uses everything from fake blogs to chatbot-generated recommendations to lure victims. The goal is clear: harvest financial and personal data under the guise of discounted medicine. The full story is covered in our featured section on what we’ve dubbed “PharmaFraud”, which offers a closer look at how scalable and targeted this kind of fraud has become.&nbsp;Not all financial stories this quarter ended in loss. After tracking the FunkSec ransomware for several months, our team discovered a flaw in its encryption logic. This was another case of malware partially created using generative AI,&nbsp;and the first instance we’ve known for ransomware operators. According to the group itself, AI was used to assist with tooling, phishing templates and code snippets. Fortunately, it was still possible to identify a cryptographic weakness. Working quietly with law enforcement, we helped victims recover their data and later released a free decryption tool from the Avast brand. FunkSec has since gone quiet. While rare, this case shows that even AI-assisted threats can contain exploitable flaws when examined closely. You’ll find the full breakdown in the FunkSec featured story.Scams, as usual, remained among the most persistent threats, especially on mobile. Technical Support Scams&nbsp;(TSS) rose by nearly 65% globally, spreading increasingly through social media platforms. On Facebook, they accounted for 14% of the threats we blocked. Geographically, activity expanded beyond the usual hotspot of Japan, doubling in countries like Germany, Austria and France. Sextortion scams&nbsp;also surged, showing over a 100% increase in risk ratio, while financial scams affected users across major economies and platforms. Some impersonated legal services; others relied on urgency and fear. The tactics remained familiar, but the delivery kept evolving. Even malvertising found new ways to stay relevant. While overall volumes dipped slightly, malicious push notifications jumped by over 300%. These deceptive browser alerts, once accepted, gave attackers a way to keep targeting users long after the initial visit, often with scam content or fake system warnings designed to trigger panic clicks.In terms of malware threats, remote access threats&nbsp;saw a notable rise. The Wincir Remote Access Trojan (RAT) continued its resurgence, often delivered through so-called “Scam-Yourself” attacks, where users are tricked into launching the malware themselves. We also looked at how threat patterns differ between individuals and small businesses. On desktops, scams and malvertising led across both groups, though small businesses showed slightly lower risk exposure. The methods were familiar; the targets interchangeable. Finally, DealPly adware returned from near-obscurity in late Q2. Reactivated domains and Chrome extension infrastructure led to a fourfold increase in exposure between April and June. It was a timely reminder that even long-dormant threats can quickly regain traction.Overall, Q2/2025 reflected the complexity of today’s threat landscape. Some threats faded, others adapted, and a few returned in force. Scam and malvertising campaigns continued to lead in volume. Ransomware saw both setbacks and reversals, with at least one case offering real hope for victims. Personal data remained a high-value target. And enforcement efforts, while encouraging, didn’t always stop threats from resurfacing.&nbsp;Thank you for reading. We hope the report brings clarity to a quarter shaped by complexity and contradiction.Jakub Křoustek, Threat Research Director&nbsp;<h2>Threat landscape highlights: Q2/2025</h2>Although the most common types of threats tend to remain consistent over time, the threat landscape is in constant flux as malicious actors adapt their tactics to pursue harmful objectives. These changes are influenced by our evolving digital behavior – ranging from changing social media use and online shopping trends to increased remote learning and high-profile data breaches that impact our digital security. With the global risk ratio being 24%, almost one in four users encountered some kind of threat each month.In this section, we explore emerging threats, evolving techniques and notable shifts in global threat patterns that challenge what has traditionally been expected.

<h3 class="text-align-justify">Remote access exploited by threat actors</h3>Malicious remote access threats showed a significant increase during the first half of Q2/2025. The risk ratio of such threats increased by 62.13% quarter-over-quarter and affected many countries, including France, South Korea, and Brazil.The largest share of malicious remote access activity continues to come from Remote Access Trojans (RATs), led by Wincir, a threat that resurged in Q1/2025. We observed a significant wave of Wincir infections, with the highest risk ratios occurring in African countries and Asia. Wincir is frequently delivered via Scam-Yourself Attacks, and we have seen threat actors abuse the MEGA Cloud storage service to host the final payload.Mirai, the notorious IoT botnet which spreads by attacking vulnerable devices, also ramped up its activity this quarter, prominently targeting China, with notable increases in Hungary, Czechia and Spain.

However, remote access can be also exploited for distribution of malicious files or downloading payloads from file-sharing platforms and cloud services. We’ve spotted threat actors leveraging Microsoft OneDrive more frequently as a key component of their attack chains, exploiting synchronization processes to deliver malicious files.&nbsp;<h3 class="text-align-justify">Scams: Consistent tactics, new channels</h3>Scams are the most prevalent threat on mobile and the second most prevalent malware type overall. Even though the tactics used by scammers are repeated over and over – such as creating a sense of urgency, playing on emotions and vulnerabilities and making potential victims doubt themselves – the specific ways in which scammers achieve their goals evolve over time. Technical Support Scams (TSS)&nbsp;increased their risk in Q2/2025 by 64.69%, marked by systematically higher activity throughout the entire quarter. From a geographical perspective, the distribution of risk has shifted. For the first time in several quarters, Japan was overtaken by other countries in terms of risk ratio. Notably:<ul><li>Austria experienced a quarter-on-quarter increase of 83%.</li><li>Germany saw a dramatic spike of 178%.</li><li>France, while not in the top three, still showed a significant increase of 119%, making it a country to watch closely.</li></ul>A particularly noteworthy development this quarter was the emergence of Facebook as an infection vector, with 14% of all blocked threats on Facebook being Technical Support Scams. While the misuse of Facebook through paid advertisements, fake posts and fraudulent user accounts has long been associated with other scam types such as investment fraud and marketplace scams, its use in Technical Support Scams represents a new trend.The landing page to which users are redirected usually imitates the Facebook Messenger interface.

These pages are typically crafted to prompt user interaction, after which the attackers lock the victim’s browser, creating a sense of urgency and panic. This tactic is consistent with traditional Technical Support Scam behavior but now appears to be expanding into social media environments to increase reach and effectiveness.

As is typical for Technical Support Scam scenarios, a phone number to a fake help line is later presented to the victim, looking for a solution.Sextortion Scams are a serious concern, as they manipulate victims by exploiting fear, shame and blackmail. These threats usually spread via email and often come in waves. This quarter, Sextortion Scams showed a 101% increase in risk ratio, mainly due to two significant waves in April and June, with notably higher peaks. The tactics remained the same: simple emails threatening to expose the content gained by alleged hacking of a victim’s device (usually a video or photos of the victim in sensitive situations, which can be artificially created or don’t exist at all). Their repeated occurrence shows an undying motivation of the attackers combined with a non-zero success rate and ease of carrying out such attacks.

Financial Scams&nbsp;showed a significant 340% increase in risk ratio during Q2/2025. This affected major countries including the United States, France, the UK and Germany. The increased activity of Financial Scams affected both desktop and mobile devices, the latter caused by ads from Meta, especially on Instagram, which are primarily viewed by users on mobile devices. However, ads were shared across all social media platforms.

When it comes to Financial Scams, we have identified three ways in which data is typically obtained from users. In the first, an advertisement redirects to a landing page, which often supports the narrative presented in the advertisement. In another example, an advertisement is used for drawing attention to the risks of scams and at the same time offers help. In some cases, attackers use a Facebook form or a Messenger bot, both serving as a way for the scammers to contact their victims and lure them into their fraudulent schemes.

Alongside financial scams, Invoice Scams became also very active in the second half of Q2/2025, similarly to the previous quarter. This involved the use of fake invoices to impersonate legitimate companies to obtain money.

<h3 class="text-align-justify">Malvertising heavily uses malicious push notifications</h3>Even though malvertising as a potential infection chain was on a slight decline in Q2/2025, this was not the case for malicious Push Notifications employed by malvertising. While their activity was relatively stable in Q1/2025, it grew significantly in Q2/2025 with a 317% increase in risk ratio, spiking primarily at the beginning and end of the quarter.

Push Notifications can take various forms, including pages designed to mimic well-known video players. These prompts often feature multiple animations to entice users to click on them. In the case of the top-hitting sample below, the design mimics CAPTCHA.

The outcome is immediate: users are bombarded with numerous push notifications delivering varied content. These often include affiliate promotions for legitimate antivirus brands with warnings about malware, advertisements for dating sites or imitations of system messages.People are victimized by feeling an urgent need to click something that has popped up on their device without warning, resulting in malicious payloads being downloaded or sensitive information being shared.

<h3 class="text-align-justify">Identity and personal data protection trends</h3>Last quarter, we reported on the severity of data breaches as we entered 2025. This quarter was no different. Data breach events rose by nearly 21% in Q2/2025. Even though the overall number of breached records exposed in this way decreased, the number of breached emails increased by 16%.Among the notable breaches discussed this quarter was an X (formerly Twitter) data leak that likely occurred in Q1/2025 but became public in April 2025. The breach exposed over 200M records of X accounts alongside their correlated emails. This breached information was combined with previously leaked data from 2023. The second notable breach was an exposure of various personal records including employment, WeChat accounts, bank accounts and other personal data in China. Additionally, reports emerged about a massive database containing 16 billion passwords being hacked; however,&nbsp;<a href="https://www.gendigital.com/blog/insights/research/16-billion-passwords-leaked">further analysis</a> revealed that these credentials were largely aggregated from past breaches, many being outdated or duplicates.&nbsp;When it comes to identity protection, Gen saw Financial and Transaction Alerts increase by 22.84% and 7.45% quarter-over-quarter, respectively. However, compared to all identity-related alerts, Credit Alerts were still the most prevalent category, led by monthly credit score updates, instant credit inquiries and new account creations.Credit Alerts originate from multiple credit bureaus tracking changes in people’s credit profiles, such as new accounts and credit inquiries. Their primary goal is to notify an individual of potential fraud attempts, personal information changes or suspicious activity in real time. As this category represents a majority of identity alerts sent, we’ll analyze it in more detail.&nbsp;

The largest portion of these alerts come from Monthly Credit Score updates (65%), which provide routine insights into credit health, helping people track changes and detect unusual drops that may signal identity theft or unauthorized activity. Instant Credit Inquiry alerts (7%) notify individuals when a lender checks their credit, often a first sign of fraudulent applications. Similarly, New Account alerts (7%) flag the creation of new credit lines, which may indicate identity misuse if unrecognized. Credit Balance Change alerts (6%) and Credit Limit Change alerts (5%) help people monitor unexpected changes in credit utilization or available credit, both of which can affect credit scores and signal suspicious behavior.While not all Credit Alerts indicate fraud, these alerts are an important part of protecting yourself and your financial position.<h3 class="text-align-justify">Threats impacting small businesses</h3>While small businesses face distinct cybersecurity challenges, we see a great deal of overlap between what impacts small businesses and the issues individuals face. For both types of victims, social engineering remains king, but while malvertising remains the dominant threat for individuals in Q2/2025, scams top the list for small businesses. Small business threats are also focused more targeted data-stealing malware like infostealers and malicious droppers, followed by exploits and malicious remote access threats. This reflects attackers’ preference for traditional malware methods when targeting business entities.

While the risk ratio for scams on desktop is 10.96% when looking at a combination of both individual and small business users, for small businesses the risk was 5.68% in Q2/2025. The lower risk ratio of scams for businesses can be influenced by many factors, from businesses having their own security measures to people being more careful when it comes to their digital lives at work.<h3 class="text-align-justify">The return of DealPly: Adware’s unexpected revival</h3>Adware saw a decline during the first months of 2025, with strains that saw massive gains at the end of 2024 – such as BrowserKnocker, Popunder and DealPly – seeing sharp drops and BrowserKnocker and DealPly nearly disappearing from our telemetry. We attributed this to the shutting down of host domains, takedowns of hosted browser add-ons and decreased activity of the operators behind these adware threats.

But not one to be kept down, DealPly completely revived its presence in late May, with a more than quadruple increase in protected users. By all accounts, DealPly resurrected several previously used domains that helped propagate its browser add-on activity. Various Google Chrome extensions that were used in the past to harvest statistical and search data appear to be back online. Users worldwide were subjected to an increased barrage of adverts and obstructive redirects due to this resurgence.

On a country-by-country basis, we observe massive spikes in Brazil where DealPly multiplied its presence in terms of risk ratio by a factor of more than 25 in the space of a few days. The US and France saw a similar trend with respective fivefold and threefold increases in a short span of time. India experienced a more than 15 times the risk in a few days as well. In all the above-mentioned countries, DealPly kept the significantly increased impact through the end of the quarter. We estimate that this will continue into the next quarter as well, demonstrating that even though threats may seem extinct one day, they can completely revive the next – and both security companies and people need to ready for such changes.Patrik Holop,&nbsp;Principal Data Scientist Luis Corrons,&nbsp;Security Evangelist Branislav Kramár, Sr Threat Analysis Engineer Jakub Vávra, Sr Threat Analysis Engineer Ondřej Mokoš, Sr Principal Threat Analysis Engineer Alexej Savčin, Threat Analysis Engineering Manager<h2>Featured stories: Q2/2025 – Inside today’s cybercrime empires</h2>Cybercriminal groups today are smarter, faster and increasingly innovative. Their infrastructures rapidly evolve, their tactics grow more deceptive, and their operations span continents. In this section, we expose three distinct threats: MediPhantom's fake pharmaceutical empire, FunkSec's short-lived but destructive ransomware campaign and the relentless data-stealing business model of Lumma Stealer. Explore how these cyber actors operate, adapt and sometimes thrive and learn about the insights and actions essential to disrupting their dangerous endeavors.<h2>PharmaFraud: Exposing the hidden empire of illegal online pharmacies</h2>It's late, and you're urgently searching online for medication, perhaps a crucial antibiotic, an expensive weight-loss treatment or even something you’d rather not discuss openly. Among the search results, a polished website catches your eye: professional graphics, reassuring badges and low prices.&nbsp;It’s exactly what you need, exactly when you need it. It seems perfect, almost too good to be true.&nbsp;Because it is.Over 95% of online pharmacies <a href="https://pmc.ncbi.nlm.nih.gov/articles/PMC9413741/">operate illegally</a>, selling counterfeit, unapproved or prescription drugs without proper authorization. And, when factoring the online pharmacies that only advertise medications to take payment but never actually deliver, the number of fraudulent pharmacies online is likely even higher. These fake online pharmacies are what Gen refers to as PharmaFraud.Behind PharmaFraud’s slick websites lurks a sophisticated, coordinated cybercrime infrastructure, meticulously designed to defraud unsuspecting victims and put their health and safety at serious risk. An extensive investigation by Gen has uncovered the dark machinery powering thousands of fraudulent online pharmacies.<h3 class="text-align-justify">A single shadowy empire</h3>Our analysis connected thousands of seemingly independent pharmacy websites to a single, highly organized cybercriminal group we have named MediPhantom. This cyber gang orchestrates a vast, scalable infrastructure with remarkable precision. MediPhantom leverages advanced techniques such as hijacking legitimate medical websites, manipulating Google search rankings and exploiting public hosting platforms. Their strategy is disturbingly effective: victims are funneled seamlessly through spam emails, advertisements on adult websites, fake health blogs, misleading review platforms and even AI-powered chatbot recommendations.<h3 class="text-align-justify">Exploiting human vulnerability</h3>The cybercriminals target medications driven by desperation or stigma: erectile dysfunction treatments, essential antibiotics like Amoxicillin, trendy and costly weight-loss drugs and even antivirals falsely marketed during flu seasons and global health crises.&nbsp;Victims seeking these medications online unknowingly risk purchasing counterfeit or contaminated products, potentially leading to severe health consequences. Beyond the physical risks, they expose themselves to financial fraud and identity theft, as cybercriminals harvest personal data through malicious payment gateways fully under their control.<h3 class="text-align-justify">How the scam works</h3>We unraveled the cybercriminals' elaborate techniques, starting with a carefully executed reconnaissance phase. Criminals monitor public forums and social media to identify high-demand medications. They then weaponize this information, crafting fake pharmacy websites and registering deceptive domains.Victims are reached via two primary methods:<ul><li>Active methods: Spam campaigns are commonly used, where attackers send promotional emails that closely resemble legitimate pharmacy flyers, enticing victims to click on links that lead directly to fraudulent sites. Another tactic involves deceptive banner advertisements strategically placed on websites hosting adult or explicit content, occasionally appearing even on mainstream platforms like Facebook and YouTube.</li></ul>

Additionally, criminals utilize fake health blogs featuring AI-generated wellness articles. These blogs are multilingual and specifically optimized for search engine visibility, embedding deceptive banners within articles to redirect visitors subtly yet effectively to scam pharmacy websites. Furthermore, fraudulent review sites, such as PharmReviews[.]net, rank fake pharmacies highly and misleadingly, creating an illusion of trustworthiness through manipulated ratings and fabricated positive customer feedback.<ul><li>Passive methods: Criminals manipulate legitimate website rankings and inject malicious content into trusted sites, redirecting unsuspecting users directly into their scams.</li></ul>While active methods often involve legally questionable tactics like spam and fake reviews, passive methods typically require unauthorized access to compromised web servers, making them more technically sophisticated and complex to detect.Once the victim lands on a fraudulent pharmacy website, they proceed through a seemingly typical shopping workflow, ultimately leading to exploitation –usually stolen funds or credentials.The purchasing process mimics legitimate e-commerce platforms: the user adds items to a cart and proceeds to checkout. However, the payment gateway is typically hosted in a separate domain that the attackers fully control, so there is no secure or legitimate payment processor.To complete the purchase, the victim is prompted to enter private contact details and payment information, usually a credit card or cryptocurrency wallet which offers a 10% discount. Since the payment gateway is under the attacker’s control, all submitted data is directly transmitted to the threat actor.

<h3 class="text-align-justify">The invisible infrastructure</h3>Beneath these fraudulent storefronts lies a robust infrastructure, meticulously documented through our investigation:<ul><li>Over 5,000 domains were identified, continually rotating to evade detection.</li><li>Around 60 unique domains host fraudulent payment gateways, most of which reuse a common template, while a few use dynamic gateways that select from over 20 templates based on context.</li><li>Real human operators manage sophisticated live-chat systems to build trust.</li><li>Centralized phone systems operate like call centers to handle victim inquiries.</li></ul>During our research, we simulated the ordering process using test payment cards. Orders were typically confirmed, but when transactions failed, the sites used clever social engineering to push victims toward completing payment. In some cases, users were told, "If our system can't accept your card, you will receive the payment details to complete the payment. In this case, there will be no call confirmation, but make sure that all the information is correct." Other variations included prompts like, "Please make sure your card allows online transactions," or "If your order is not approved within 24 hours, your credit card might be blocked for internet transactions. Please get in touch with your bank and ask to remove the block." These messages are designed to blur the line between technical error and urgency, nudging victims to bypass their security instincts, and complete the transaction at any cost.Despite diverse branding, the infrastructure consistently traces back to MediPhantom, the single, highly organized threat actor orchestrating a vast network of fake pharmacy websites. Frequent changes observed over short timeframes (often within weeks) suggest high operational activity, likely aimed at evading detection or reflecting ongoing infrastructure restructuring.Our telemetry data reveals alarming global reach and scale. Fake pharmacy operations spike during peak periods, notably around holidays like Christmas, leveraging increased online activity. The cybercriminals operate multilingual platforms targeting regions such as Southeastern Europe (Greece, Croatia, Hungary), Central Europe (Germany, Switzerland, Austria), Western Europe (France, Spain) and extend their reach to the USA, Canada, Japan and Australia.<h3 class="text-align-justify">Beyond the scam: Real-world risks of fake medications</h3>The damage caused by PharmaFraud does not end with stolen money or compromised identities. It reaches deep into the lives and bodies of those who take the pills. Counterfeit medications sold by these fraudulent websites often bypass every safeguard built into legitimate pharmaceutical supply chains.Unlike regulated drugs, which undergo strict quality control and precise dosing, fake pills may contain no active ingredients at all or dangerously high amounts. Some are laced with toxic additives, including heavy metals or unknown chemicals. In the most tragic of cases, some medications can be laced with life-threatening substances. In one U.S. enforcement case in late 2024, a network of fake online pharmacies sold millions of fentanyl-laced painkillers, killing at least&nbsp;<a href="https://www.justice.gov/usao-sdny/pr/us-attorney-announces-charges-against-18-defendants-scheme-manufacture-and-distribute">nine confirmed victims</a>. The DEA’s 2023 data showed a record 80 million fake pills seized nationwide; evidence of how deeply the problem has penetrated.

Health risks include everything from allergic reactions to treatment failure. In lab testing, over a third of pills from rogue pharmacies had no active ingredient. Patients depending on these drugs may see their conditions worsen, believing they are being treated when they are not. In the worst cases, a single counterfeit tablet can be fatal.The global nature of this threat is equally alarming. In Europe, despite strong regulations and the EU’s pharmacy logo system, fake sites have surged, especially during drug shortages or health crises. During the COVID-19 pandemic, fake pharmacies in France pushed counterfeit chloroquine as a miracle cure. In Germany and Japan, fake or unauthorized sellers targeted consumers searching for restricted medications or lifestyle treatments like erectile dysfunction drugs and diet pills. Japan’s strict laws prohibit online prescription drug sales, yet customs officials there have intercepted&nbsp;<a href="https://www.jpma.or.jp/english/globalhealth/fake_measures/about_fake_measures.html">hundreds of thousands of counterfeit shipments</a> and shut down over 2,300 websites.Even packaging can mislead. Criminals mimic logos, pill shapes and labels. But there are clues: no lot of numbers, poor-quality printing, suspicious expiry dates or pills that look slightly off. Still, to the average consumer, a fake pill often looks indistinguishable from the real thing until it fails or causes harm.And the demand is high. In the U.S., high drug prices have pushed people to seek alternatives.&nbsp;<a href="https://www.aarp.org/money/scams-fraud/online-pharmacy/">Surveys show</a> that 1 in 9 adults, and 1 in 6 among those over 55, have purchased medication online. That is a massive target audience. And cybercriminals like MediPhantom know it.<h3 class="text-align-justify">Taking action and fighting back</h3>At Gen, we are proactively working to disrupt these PharmaFraud activities. Our dedicated cybersecurity team continuously monitors, identifies and blocks fraudulent domains and payment gateways. By leveraging advanced network analysis, we rapidly detect new malicious sites and quickly neutralize threats, significantly limiting their ability to exploit consumers.But the fight does not end there. We collaborate closely with international law enforcement agencies, sharing intelligence and supporting coordinated global takedown efforts. Together, through constant vigilance, sophisticated technological solutions and strengthened international cooperation, we are committed to dismantling this dangerous empire piece by piece, protecting consumers worldwide from online pharmaceutical fraud. Our goal is clear: to educate people about PharmaFraud and make MediPhantom’s infrastructure visible, vulnerable, and ultimately, dismantled.<h2>Beating FunkSec: When ransomware meets AI</h2>It started like any other ransomware story: encryption, extortion and chaos. But this time, the ending was different, and it’s not because the criminals suddenly grew a conscience.FunkSec ransomware emerged in late 2024, but its full operation unfolded in phases. The gang’s leak site listed its first victim as early as December 4 and suggested that their initial tactic was data exfiltration and extortion without encryption. The ransomware component came later. Based on available evidence, the ransomware development likely began in mid-December, with the first known sample dated December 31, 2024, just in time to ruin someone’s New Year’s Eve. And by January 1, a company working in the child protection sector had already been listed as a victim.FunkSec was written in Rust, a modern programming language gaining traction in both cybersecurity tools and advanced malware due to its speed and memory safety. Leveraging the orion-rs cryptographic library, FunkSec encrypted victims' files using ChaCha20 and dropped a ransom note named README-{random}.md in every folder, appending the extension “.funksec” to all encrypted data. It was designed to kill dozens of services and processes to maximize disruption, including browsers, media players, email clients and even Task Manager.

Interestingly, some samples attempted to load a desktop wallpaper image from imgur[.]com as part of the data-encryption process. While not critical to its function, it shows how threat actors are experimenting with small touches of psychological manipulation or branding, even in destructive tools.

While FunkSec wasn’t the most technically advanced ransomware, the damage was real. In just a few months, the gang targeted over 100 organizations&nbsp;worldwide, including companies in the U.S., Italy, Spain, Brazil among others. The ransom demand was modest: 0.1 Bitcoin per victim. But with 113 companies listed on their leak site, the potential haul amounted to more than $1.1 million at today’s rates. Not bad for a short-lived, bug-prone operation.And behind the scenes, something more alarming was taking shape: AI.The FunkSec operators admitted to using AI to assist in parts of their operations, including tooling, phishing templates, and code snippets. While they estimated that AI accounted for only about 20% of their workflow, it was enough to raise concerns. This may be one of the first publicly known cases of ransomware development partially assisted by generative AI.<h3 class="text-align-justify">Quiet victories and free help</h3>But here’s where the story takes a turn.A team of researchers at Gen quietly discovered a cryptographic flaw in FunkSec’s encryption logic. We won’t reveal the details, even now, to avoid giving future threat actors a blueprint for improvement. But the vulnerability was significant enough to allow us to do what we are committed to doing whenever possible: help victims recover their data without paying the ransom.Over the next few months, Gen collaborated discreetly with global law enforcement agencies, including ransomware investigators across the U.S. and Europe, providing support to help impacted victims regain access to their files through a free decryptor tool. The decryptor remained private throughout this phase to prevent detection or sabotage by the attackers.Now that FunkSec has gone quiet (the last known victim was attacked on March 15), the decryptor is being made publicly available, including through the&nbsp;<a href="https://www.nomoreransom.org/">NoMoreRansom</a> initiative. We’ve made our ransomware decryptor available for direct <a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec64.exe" target="_blank">download here</a>.&nbsp;<h4 class="text-align-justify">Lessons from FunkSec</h4><ul><li>AI is entering the ransomware workflow. Even in limited form, generative AI is speeding up the development of cybercrime tools.</li><li>One crypto mistake can change everything. A flaw in the math helped dozens of victims avoid extortion and recover their data.</li><li>Law enforcement collaboration works. Coordinated, quiet support can stop ransomware without tipping off the enemy.</li><li>Ransomware doesn’t need to be perfect to be dangerous. Even experimental, buggy strains can hit real people and cause real harm.</li></ul>The Avast FunkSec Ransomware Decryptor is just the latest, most recent in a list of over 40 free ransomware decryptors released under the AVG and Avast brands over the past decade. Ransomware isn’t going away. But stories like this remind us: when researchers and law enforcement join forces, it’s the criminals who end up losing control.<h2>Lumma disrupted. But is the beast dead?</h2>Imagine taking down one of the world's largest infostealer infrastructures: servers shut, command centers offline and criminals scrambling.&nbsp;<a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma">Europol</a>, in collaboration with Microsoft, achieved precisely that in a spectacular operation targeting Lumma Stealer, the malware-as-a-service titan notorious for harvesting sensitive data worldwide.But here’s the question: Has the giant truly fallen or merely stumbled?<h3 class="text-align-justify">A long-standing threat</h3>Lumma Stealer has been a recurring subject in our threat reports over the years, known for its adaptability and widespread use in various campaigns. Its operators have employed sophisticated social engineering tactics, such as Fake CAPTCHA pages, to trick users into executing malicious scripts and giving the infostealer access to their devices. These deceptive methods have been documented in multiple analyses, highlighting the malware's evolution and the ingenuity of its distribution strategies.Gen Threat Labs has extensively researched how attackers use&nbsp;<a href="https://blog.avast.com/fakecaptcha-scams">Fake CAPTCHAs</a> to distribute malware, specifically mentioning Lumma Stealer as a commonly deployed threat in these attacks. Additionally, Lumma Stealer has been observed&nbsp;<a href="https://press.avast.com/deepfakes-ai-manipulated-audio-and-hijacked-social-media-surge-in-2024?utm_source=chatgpt.com">exploiting platforms like YouTube</a> to spread via cracked software propagated through Fake Tutorials.The success of all the techniques in Lumma Stealer’s toolbox resulted in a 1154% increase in activity during Q3/2024, indicating its aggressive proliferation and the effectiveness of its distribution tactics.<h3 class="text-align-justify">Distribution uninterrupted: Lumma’s silent persistence&nbsp;</h3>Gen telemetry from May, captured in the aftermath of Lumma Stealer’s takedown by Europol, reveals a troubling but not unexpected resilience. Instead of plunging dramatically, Lumma infection attempts continued steadily. Distribution channels, untouched by the operation, remain open and active, meaning Lumma is still knocking at users' doors. So how is it that Lumma was able to remain undisturbed after a successful governmental takedown?&nbsp;

The answer boils down to how Lumma operates. The Europol and Microsoft intervention primarily targeted the Command-and-Control (C2) servers and administration panels, effectively cutting off the stealer’s ability to relay stolen data. But the malware itself, persistently distributed through phishing emails, fake software updates and other&nbsp;<a href="https://www.gendigital.com/blog/insights/research/lumma-stealer-github">deceptive tactics</a>, still infects new victims' devices daily.In short, while the operation severed Lumma’s command structure, it failed to halt the distribution pipelines. Our internal data, highlighting a stable infection rate throughout May and the rest of Q2/2025, confirms this grim reality: Lumma’s reach remains alarmingly consistent.<h3 class="text-align-justify">Infrastructure resurrection: Lumma's swift recovery</h3>Even though Lumma Stealer continued to be widely distributed after the takedown, the critical question was whether attackers had managed to re-establish their exfiltration infrastructure or if they were simply relying on short-term capabilities of its distribution network. Did the disruption impact its exfiltration capabilities in the long run? Could the attackers recover, restore and deploy new infrastructure to receive logs?We’ve been closely monitoring Lumma’s use of dead drop resolvers,&nbsp;a technique that enables infected machines to dynamically retrieve updated command-and-control (C2) addresses. This mechanism allows threat actors to rotate infrastructure frequently without needing to redeploy the malware itself. In recent weeks, we’ve resolved multiple fresh C2 domains, clearly indicating an active and ongoing effort to maintain exfiltration capabilities.

In parallel, we uncovered a misconfigured administration panel tied to one of Lumma’s ongoing operations. It revealed thousands of logs, over 500 linked to cryptocurrency wallets, and a 3.5% “success rate” (wallets to total logs). Victims span over 100 countries, with Indonesia, the Philippines and Egypt topping the chart. We’ve observed the number of logs continuously increasing, clearly indicating that exfiltration is not just possible; it’s actively happening.

Together, these findings confirm that Lumma’s infrastructure wasn’t dismantled. It’s been resilient all along and barely missed a beat.<h3 class="text-align-justify">The reputational impact</h3>Despite the unsettling evidence of Lumma’s operational recovery, the takedown achieved a critical and perhaps more lasting impact: reputational damage.&nbsp;Lumma’s trustworthiness and reliability, central to its infamous Malware-as-a-Service (MaaS) operations, have dealt a massive reputational blow. Potential affiliate partners are now hesitant, wary of law enforcement scrutiny and the possibility of compromised infrastructures.History teaches us that in the dark corners of cybercrime, reputation often matters as much (if not more) as technological prowess. After all, cybercriminals thrive on trust among thieves. Once broken, regaining credibility can be even harder than rebuilding infrastructure.The partial disruption of Lumma Stealer is not an isolated victory. Recent months have witnessed several notable successes thanks to extensive international collaboration among law enforcement agencies and private sector entities. In the U.S., authorities indicted the leader behind the Qakbot botnet, notorious for facilitating major ransomware attacks. Separately, the DanaBot malware, responsible for infecting countless computers, saw its operators federally charged. Meanwhile, Europol’s Operation Endgame broke critical links in the ransomware kill chain by dismantling vital criminal networks at their very source.What these coordinated takedowns make evident is that cross-border cooperation, information sharing and joint operations between law enforcement and cybersecurity companies are increasingly effective. While no single action fully eradicates cyber threats, each disruption chips away at criminal capabilities, degrades operational trust, and collectively raises the cost for cybercriminals globally.<h3 class="text-align-justify">What happens next?</h3>As our investigation continues, we remain vigilant, closely monitoring Lumma’s evolving activity. For now, the beast appears wounded, not defeated. Its distribution network remains operational, infrastructure reconstruction efforts are ongoing, and yet the trust Lumma once commanded lies significantly damaged.Stay tuned as we keep our finger on the pulse of this evolving story, uncovering whether Lumma Stealer can rise again or if this is the beginning of its ultimate downfall.Jan Rubín, Threat Research Team Lead Ladislav Zezula, Malware Researcher Ľuboš Bever, Malware Researcher Luis Corrons,&nbsp;Security Evangelist Martin Chlumecký, Malware Researcher<h2 class="text-align-justify">In closing</h2>The digital underground is a constantly shifting landscape, marked by rapid adaptation and ruthless innovation. As threat actors become more sophisticated, understanding their operational nuances becomes critical. By analyzing cases like Lumma Stealer infostealer, FunkSec ransomware, and the MediPhantom fake pharmacy gang, we equip ourselves not only to defend against present threats but to anticipate and disrupt emerging ones. Our collective vigilance and adaptability remain our strongest assets in confronting the evolving world of cybercrime.&nbsp;

<h2>Download the <a href="https://cmsb.nortonlifelock.com/sites/default/files/2025-07/Q22025%20Gen%20Threat%20Report%20%20%28Booklets%29%20%284%29.pdf" target="_blank">Q2/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

AI ransomware cracked without paying, fake pharmacy network unmasked and Lumma still alive after takedown

Gen Q2/2025 Threat Report

<h2>Foreword&nbsp;</h2>With this issue of the Gen Threat Report, we are introducing a more streamlined format, making it easier to digest and focusing more on key highlights, trends and emerging threats rather than attempting to catalog every detail. The Threat Landscape Highlights section will capture notable trends and evolving threat dynamics, and Featured Stories will now dive deeper into specific investigations.&nbsp;&nbsp;The threat landscape in Q1/2025 might look surprising to some. At first glance, the decline in the total number of blocked attacks compared to the previous quarter might seem like a welcome reduction in activity. However, this drop is not solely seasonal or due to reduced attacker activity. More importantly, this decrease highlights a deeper evolution in tactics: broad 'spray and pray' campaigns are giving way to more tailored, deceptive and persistent attacks. The threats that did emerge this quarter are more focused, strategic and reflect the growing sophistication of attackers.&nbsp;

Financial threats showed new levels of innovation. The CryptoCore group executed one of its most refined campaigns to date, blending deepfake videos of public figures, compromised YouTube accounts and professionally cloned websites. This most recent campaign resulted in an estimated $3.8 million in illicit profits over 2,200 transactions (although the real number is likely far higher). Mobile financial threats also escalated. The Crocodilus banking trojan, most active in Spain and Turkey, abused accessibility features to overlay fake login pages and steal crypto wallet credentials. Meanwhile, our LifeLock insights showed rising levels of credit and transaction alerts, indicating both increased monitoring activity and more frequent fraud attempts targeting users’ financial footprints.&nbsp;Data-stealing threats also continued to rise across multiple categories based on our telemetry. The number of data breach events — meaning instances where a company or platform was breached — increased by more than 36% quarter over quarter, while the total number of breached records — or personal data such as email, passwords, credit card numbers, etc. — surged by more than 186%. While large-scale service breaches made headlines, attackers were also using direct compromise of user data through infostealers such as Lumma Stealer (which has since been successfully taken down through a <a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma" target="_blank" rel="noreferrer noopener">collaboration between Europol and Microsoft</a>). Furthermore, phishing continued to play a growing role in data compromise — we documented how adversaries are abusing low-code form-building platforms to host phishing campaigns on legitimate infrastructure, making detection and takedown significantly harder. Lastly, ransomware remained a high-risk threat, building over the last three quarters. The majority of cases continued to be driven by the usual suspect, Magniber, but new strains, such as FunkSec, also emerged. FunkSec, in particular, had been allegedly partially generated using AI and large language models (LLMs).&nbsp;Scam threats were marked by significant diversification and reach. We protected more than 4 million people from Scam-Yourself Attacks, a category that now spans platforms and operating systems. FakeCaptcha, once confined to Windows, expanded to macOS and began distributing the infamous infostealer AMOS (Atomic Stealer) under the guise of phishing protection. Touché. Moreover, social media remained a key vector for scams, with compromised Facebook and YouTube accounts used for both distribution and monetization. Attackers combined AI-generated personas, hired influencers and platform-native ad systems to lend legitimacy to fraudulent campaigns. In parallel, Fake Update attacks, another type of Scam-Yourself Attack in which people are asked to update their device or programs but are instead guided to infect their devices, targeted European users causing an unprecedented growth of 17 times of the risk exposure compared to last quarter.&nbsp;We hope you find the Q1/2025 Gen Threat Report engaging and informative and the new format easy to digest. Thank you for reading. &nbsp;Jakub Křoustek, Threat Research Director&nbsp;&nbsp;

<h2>Threat Landscape Highlights</h2>While the list of the most prevalent threat type remains the same or nearly similar throughout the years, the threat landscape continuously evolves through the ways in which threat actors work to achieve their malicious ambitions. How the landscape shifts is inevitably affected by our digital activities, from the use of social media to online shopping and learning to recent events affecting the security of our digital lives, such as data breaches.&nbsp;&nbsp;In this section, we aim to provide insight into emerging threats, new techniques and trends and interesting changes in the otherwise expected behavior of the global threat landscape.&nbsp;

<h3>Global Risk Snapshot&nbsp;</h3>Global risk ratio: 24.53%&nbsp;Cyber risk remained high in Q1/2025, with a global average risk ratio of 24.53%, consistent with the heightened levels observed in late 2024. However, exposure remained highly uneven across regions.&nbsp;

The highest threat activity concentrated in parts of Asia and Eastern Europe. China topped the list with a risk ratio of 48.60%, followed by Georgia (44.51%) and Vietnam (39.06%). These figures reflect a mix of aggressive targeting, insufficient defensive infrastructure and high digital engagement.&nbsp;In contrast, major economies like Japan (16.12%), Germany (20.11%) and France (24.93%) reported significantly lower risk ratios, while Scandinavian countries like Finland (19.36%), Sweden (22.14%) and Norway (23.96%) continued to show resilience against attacks thanks to mature cybersecurity practices.&nbsp;South America remained a region of interest, with Brazil (20.14%) and Argentina (23.24%) experiencing spikes in mobile-specific threats. Meanwhile, countries with limited digital infrastructure — such as Haiti (18.44%) or the Democratic Republic of Congo (16.24%) — saw reduced exposure simply due to lower internet penetration.&nbsp;

<h3>Personal Data at Stake: Data Breaches &amp; Information Stealers&nbsp;</h3>Personal data is like digital gold to criminals, and risks to digital identities continue to increase. Based on our telemetry, data breach events - instances where a company or platform was breached - rose 36.12% quarter-over-quarter. Breached records increased by 186.26%, with breached user emails alone up 102.93%. More than 1.19 million records were reported with high or critical severity, meaning that the breached records also included plaintext passwords, potentially giving cybercriminals the figurative keys to over a million of people’s personal accounts.&nbsp;Large-scale data breaches are no longer rare. Notable digital-identity events in Q1/2025 included:&nbsp;<ul><li>USOSGM: Exposed full names and addresses of U.S. shoppers.</li><li>ALIEN TXTBASE: Huge collection of stolen user credentials published on Telegram channel—493 million unique website and email address pairs, affecting 284 million unique email addresses.&nbsp;</li></ul>One of the protective measures we provide for our users is alerting them when a significant breach happens and their personal data is exposed or possibly affected by a recent data leak. These alerts give our customers the opportunity to responsibly react and secure their personal data in advance of fraudulent activity by attackers. In Q1/2025, alerted users increased too with notable spikes in:&nbsp;<ul><li>Credit Alerts: +13.83%. These alerts are related to new accounts, credit inquiries, changes in credit profiles, etc., and they notify users of potential fraud attempts or suspicious activity in real time.</li><li>Criminal Record Alerts: +11.98%. These are related to users' identity appearing in legal or criminal records, including court cases, judgments, and sex offender notifications. These alerts inform users of potential misuse of their identity or unauthorized legal associations.</li><li>Transaction Alerts: +3.04%. Transaction alerts track financial transactions across users’ bank accounts, credit cards, and investment accounts. These notifications highlight unusual charges, threshold limits were exceeded, or payday loan applications.&nbsp;</li></ul>Data stealing efforts via information stealers also rose in Q1/2025, with a 8.24% increase in risk ratio, again driven by the <a href="https://www.gendigital.com/blog/insights/research/lumma-stealer-github" target="_blank" rel="noreferrer noopener">Lumma Stealer</a> which:&nbsp;<ul><li>saw a +59.4% market share increase, now at 19.51%</li><li>harvested credentials, crypto wallets, 2FA tokens</li><li>delivered via phishing, GitHub abuse, and Scam-Yourself attacks&nbsp;</li></ul>Other prominent infostealers by their malware share were:&nbsp;<ul><li>FormBook (12.47%)</li><li>AgentTesla (10.99%)</li><li>Ramnit, MassLogger, Fareit, SnakeKeylogger, Lokibot&nbsp;</li></ul>

The regions most impacted by information stealers were Turkey, Egypt, Indonesia and Argentina.&nbsp;<h3>&nbsp;Scams &amp; Social Media Exploits&nbsp;</h3>Scams continue to evolve as one of the most widespread and adaptable cyberthreats, exploiting both traditional and modern delivery channels. In Q1/2025, we observed scammers leveraging everything from <a href="https://www.avast.com/c-what-is-malvertising-how-to-stop-it" target="_blank" rel="noreferrer noopener">malvertising</a> (malicious advertising) to social media platforms and push notifications to reach potential victims. This broad attack surface was amplified by the wealth of user data available online, enabling highly targeted and convincing scams. Below, we highlighted some of the key trends and tactics shaping the scam landscape this quarter:&nbsp;<ul><li>Malicious push notifications delivering scams increased 10.26% in the risk ratio for Germany, followed by Norway (+24.85%) and Denmark (+22.42%).</li><li>Financial scams increased 500% in Lebanon, 223% in Moldova, 112% in Portugal and tens of percents also in Slovakia, Serbia, Estonia and Slovenia.&nbsp;</li></ul>Social media also remained a favored delivery mechanism for scams and other related threat types. In Q1/2025, 63% of social-media-related threats were observed on Facebook, followed by YouTube with 22% platform share. Platforms like Reddit and Instagram remained a relevant threat, while X (formerly Twitter) held steady at 7%. LinkedIn, a business and employment-oriented social network, observed a rising trend with 26.23% increase of its share.&nbsp;

The types of threats found on each social media site varied due to user demographics and usage patterns, with malvertising continuing to top the threat types on social media 30% of the total share, followed by phishing (21.72%). &nbsp;Q1 Scam Trends Revealed by Norton Genie&nbsp;Our Norton Genie scam detection tool shows the different type of scams reported by users:&nbsp;<ul><li>Generic scams: 51.4%</li><li>Phishing: 31.9% with a massive 4x increase quarter-over-quarter</li><li>Malvertising: 2.41%&nbsp;&nbsp;</li></ul>

<h3>Ransomware: A Changing Battlefield&nbsp;</h3>The ransomware threat level remains elevated since Q4/2024. In Q1/2025:&nbsp;<ul><li>Magniber dominated (67% of ransomware cases and over 100,000 protected users)</li><li>WannaCry and Enigma trailed far behind&nbsp;</li></ul>

While the notable players maintain the largest share of ransomware threats, there is a new player on the ransomware scene, called FunkSec. Some of their tools were most likely generated by an LLM agent, a sign that AI tools are lowering the barrier for creating ransomware. This also applies to the <a href="https://www.virustotal.com/gui/file/7e223a685d5324491bcacf3127869f9f3ec5d5100c5e7cb5af45a227e6ab4603" target="_blank" rel="noreferrer noopener">template source code</a>, where comments are written in perfect English (as opposed to very basic English in other mediums).&nbsp;Based on a report from <a href="https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/" target="_blank" rel="noreferrer noopener">Chainalysis</a>, the total volume of ransom payments decreased year-over-year (YoY) by approximately 35%. There are a few reasons why the payments declined —companies have adapted to this type of cyber-threat and are understanding the need for cybersecurity while more frequently declining to pay ransomware gangs while law-enforcement agencies have increased pressure on ransomware infrastructure and crypto-mixers. The total amount paid in 2024 was $813 million.&nbsp;<h3>Mobile Threats on the Rise&nbsp;</h3>Mobile threats surged in Q1/2025, with a 25% increase in protected users across adware and spyware categories. Adware, particularly strains like HiddenAds and MobiDash, dominated the mobile threat landscape, while older families like FakeAdBlockers faded from view. Brazil, India, Argentina, and Mexico saw some of the largest country-specific spikes, with Mexico notably experiencing a 42% jump in protected monthly users.&nbsp;

The evolving nature of mobile adware and spyware suggests these threats will continue to escalate in the coming quarters, particularly as attackers experiment with new delivery methods and leverage regional campaigns to maximize impact.&nbsp;

Spyware, though growing more modestly (+6% protected users), revealed worrying trends with new or resurging strains like SpySolr, Tambir and SpyLend, targeting victims in Turkey and India with increasingly aggressive data theft and blackmail tactics. Spain stood out with a 96% spike in spyware risk, while Turkey followed closely behind at +84%.&nbsp;Patrik Holop, Researcher&nbsp; Luis Corrons, Security Evangelist&nbsp; Ladislav Zezula, Malware Researcher&nbsp; Jakub Vávra, Threat Operations Analyst&nbsp; Jan Rubín, Malware Researcher&nbsp; Alexej Savčin, Threat Analysis Engineering Manager&nbsp; Lukáš Zobal, Research Engineering Manager&nbsp;

<h2>Featured Stories: Deception, Innovation and Exploited Trust&nbsp;</h2>The first quarter of 2025 demonstrated that cybercriminals are not merely refining their methods; they’re rewriting the playbook entirely. Our Featured Stories expose how threat actors employed groundbreaking technologies, hijacked trusted platforms and used highly personalized deception to trap victims more effectively than ever.&nbsp;CryptoCore’s manipulation of deepfake technology around President Donald Trump’s 2025 inauguration illustrates how major media events can become powerful tools for financial fraud on a global scale.&nbsp;&nbsp;In parallel, cybercriminals exploit legitimate online website builders, rapidly deploying convincing phishing pages designed to bypass traditional security measures and deceive users into handing over their most sensitive data.&nbsp;We also explore the sophistication of Scam-Yourself Attacks, a disturbing trend where victims are deceived into willingly infecting their own devices. Attackers increasingly use realistic AI-generated personas, cleverly compromised social platforms and sophisticated cross-platform techniques to evade detection and persuade users to lower their defenses voluntarily.&nbsp;Together, these featured stories paint a clear picture of a threat landscape driven by innovation, deception and an alarming exploitation of trust.&nbsp;<h3>Hijacked Inauguration: How CryptoCore Used Deepfakes to Scam Millions&nbsp;</h3>CryptoCore, the sophisticated cybercriminal group that exploits the popularity of cryptocurrencies, has perfected the art of deception. By combining deepfake technology, hijacked YouTube accounts and professionally designed websites, they transform media events into launchpads for sophisticated scam operations targeting cryptocurrency users. Their approach exploits trust, manipulates public attention and turns fabricated reality into a convincing trap. We broke down their methods further in our article about <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore</a>.&nbsp;In Q1/2025, CryptoCore found the perfect stage. As the 2025 inauguration of U.S. President Donald Trump captured global headlines, the group launched one of its most aggressive deepfake campaigns yet, targeting cryptocurrency enthusiasts caught in the media frenzy.&nbsp;Our telemetry shows that during this period, CryptoCore’s activity surged to over four times the typical baseline, reflecting the scale of the operation.&nbsp;&nbsp;

CryptoCore significantly increased its activity on YouTube during the inauguration, hijacking more accounts and rebranding them to look like official accounts linked to Donald Trump. Deepfake technology was at the heart of the operation, creating realistic, fabricated videos featuring both Donald Trump and Elon Musk promoting fraudulent giveaway events.&nbsp;

The scam narrative remained consistent: leveraging the inauguration’s media spotlight to push cryptocurrency investment schemes, promising participants the chance to double their profits. The videos were carefully crafted, often reusing authentic footage with manipulated lip-syncing and embedded QR codes that redirected viewers to sophisticated fake websites. These sites were highly professional in appearance, featuring interactive elements and images of Trump and Musk to enhance their credibility.&nbsp;

In addition to the inauguration event, Donald Trump's meme coin, $TRUMP, officially launched on January 18, 2025, just before Donald Trump's second inauguration. The coin quickly gained public attention, fueled by media coverage and the political spotlight.&nbsp;&nbsp;Seizing the opportunity, CryptoCore created a wave of scam promotional content featuring deepfakes of Trump and other high-profile figures. The scam once again promised exclusive benefits and double profit, this time tied to investments in the $TRUMP coin.&nbsp;&nbsp;Beyond the inauguration, CryptoCore maintained a stable trend of distributing fake videos exploiting the likenesses of other cryptocurrency personalities such as Vitalik Buterin, Michael Saylor and Brad Garlinghouse. These deepfakes were spread across hijacked platforms, extending the reach of their scams far beyond the political event.&nbsp;&nbsp;CryptoCore’s operations in Q1/2025 resulted in estimated profits of $3.8M across 2,200 transactions, based on analysis of cryptocurrency wallets identified on fraudulent sites. As this estimate only includes tracked wallets and visible activity, the actual profit is likely much higher.&nbsp;CryptoCore’s latest campaigns show how quickly attackers adapt, combining deepfake technology, hijacked trusted platforms, and media-driven moments to lure unsuspecting victims. Today’s scams no longer rely on crude deception: they look polished, professional and dangerously convincing. It is crucial to stay vigilant and verify the authenticity of any cryptocurrency-related content, especially that tied to high-profile events or personalities, to avoid deception.&nbsp;<h3>The Hidden Threat of Phishing Attacks Through Online Forms&nbsp;</h3>Cybercriminals have always been on the lookout for simple, effective and low-cost ways to run phishing campaigns. While some invest in elaborate infrastructure—offering realistic phishing pages as part of paid “phishing-as-a-service” kits—others opt for a cheaper, faster approach: abusing legitimate website builders. These low-effort alternatives abuse legitimate tools with drag-and-drop interfaces, enabling anyone to create a website without needing coding skills. This approach allows for a quick, although limited, way to create phishing pages on legitimate hosting domains. Such pages have a higher chance of bypassing standard email filters, which is a significant threat to ordinary users. Therefore, phishing links are predominantly sent via email. The main tactic is to create a sense of urgency about a blocked account or service limitation requiring immediate action. Another type of email is informational, requesting the review of a document accessible online, but only after logging in.&nbsp;Even though many of these websites can be spotted with a bit of scrutiny, they remain consistently present in the wild, and in some regions, increasingly so. They primarily mimic the login screens of major companies providing telecommunications, email and streaming services. Financial institutions and forms requiring payment information, social security numbers and other sensitive data are also common targets. Additionally, the phishing pages appear in various languages across all continents.&nbsp;Attackers often abuse popular website builders, e.g., Weebly or Wix, hosted on trusted domains and infrastructure. These tools are frequently free, making their misuse very simple and anonymous. Phishing pages typically have a legitimate second-level domain, which does not raise suspicion with spam filters or antivirus software. Additionally, attackers can choose arbitrary third-level domains, often using their names to evoke familiarity with the phished brand. A popular tactic is also typo squatting in the subdomain name, such as:&nbsp;<ul><li>updatefacebookmeta[.]weebly[.]com</li><li>microsoftdocumentfile[.]weebly[.]com</li><li>outlookauthenticationmicrosoft[.]weebly[.]com</li><li>myfmsbank[.]weebly[.]com</li><li>onlinedesk[.]wix.com&nbsp;</li></ul>Beyond website builders, attackers increasingly abuse dynamic DNS (DDNS) services and subdomain providers like DuckDNS to host phishing sites. These services allow the creation of custom subdomains that mimic well-known brands, further enhancing the deception. By leveraging such flexible infrastructure, attackers can quickly scale campaigns without requiring extensive technical knowledge, expanding their reach and impact.&nbsp;Some login pages are sophisticated and require greater attention to detect, especially if the legitimate login form is simple to copy. On the other and, there are also many obviously fraudulent pages where, e.g., the entered password is not masked, the footer displays the logo of the abused platform or the header contains links leading to unrelated sites. In any case, the login page sitting on the website builder domain is a red flag indicating that something is wrong.&nbsp;The figure below illustrates an example of an obvious phishing page. Notice the suspicious menu items, including irrelevant options unrelated to the site's purpose. The page layout is also inconsistent and unprofessional, with mismatched fonts and awkward formatting. One of the most obvious red flags, though, is that passwords are displayed in plain text rather than masked—an immediate giveaway that the site is not legitimate.&nbsp;

Phishing attacks of this type are steadily increasing worldwide, with distinct spikes in specific regions.&nbsp;

In the U.S., a significant campaign targeted AT&amp;T and Xfinity customers in early 2025. Conversely, in Australia, we have observed a steadily increasing trend since February, relentlessly targeting Telstra email users.&nbsp;

These regional waves reflect how attackers can easily localize their campaigns using publicly available tools, targeting specific providers, languages and users with minimal effort and maximum reach.&nbsp;The technique remains widely used for a reason: it’s fast, cheap and often effective. Even when phishing pages are poorly made, their trusted hosting domains give them an edge, making them harder to filter and easier to overlook.&nbsp;Notably, Q1/2025 telemetry shows a rising number of phishing campaigns hosted on DDNS services and subdomain providers, adding to the already widespread abuse of site builders. While the overall phishing threat landscape remained relatively stable this quarter, these shifts in hosting methods point to an evolving playbook that emphasizes speed, flexibility and low operational costs.&nbsp;

<h3>The Evolution of Scam-Yourself Attacks: Smarter, Sneakier and Cross-Platform &nbsp;</h3>The most dangerous attacks aren’t always the ones that sneak in unnoticed — they are often the ones that make you open the door yourself.&nbsp;&nbsp;<a href="https://us.norton.com/blog/emerging-threats/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">Scam-Yourself Attacks</a> rely on well-crafted social engineering tactics, designed to trick users into infecting their own devices. The malicious steps don’t hide in the background — they’re laid out in front of the user, disguised as helpful instructions. It’s <a href="https://us.norton.com/blog/emerging-threats/malware" target="_blank" rel="noreferrer noopener">malware</a> you install yourself — and attackers are getting better at convincing you to do it.&nbsp;&nbsp;

In Q1/2025 alone, we protected more than 4 million people from Scam-Yourself Attacks like ClickFix and FakeCaptcha, some of the most widespread and persistent threats across the globe. While the overall “Fake” category, which includes Scam-Yourself Attacks, saw a slight decrease in global risk ratio by 8.96% this quarter, its impact remains massive, with persistent activity observed worldwide.&nbsp;&nbsp;

<h4>AI Personas, Fake Finance Tools and the YouTube Trap&nbsp;</h4>One of the most striking evolutions we observed this quarter is how attackers use AI-generated personas, deepfake influencers and hired actors to deliver Scam-Yourself campaigns, primarily through compromised YouTube accounts.&nbsp;&nbsp;Meet Thomas Harris, also known as Thomas Roberts or Oscar Davies, among other names. He is very active on YouTube, providing advice on how to easily make money using otherwise paid extensions for TradingView, like ChatGPT AI Charts (no matter if such an extension actually exists or not). Typically present as an unlisted video on a compromised YouTube account, "Thomas” verbally and visually explains how to proceed with the installation, effectively performing a Scam-Yourself Attack. The most shocking part is Thomas isn’t real at all but is instead a rising star of an influencer who is completely deepfaked.&nbsp;

Usually, the video is unlisted and is not visible on the compromised YouTube channel where it is hosted, and it cannot be searched for on YouTube. In order for the user to reach the video, the attackers frequently use YouTube’s advertising system, recommending the scam videos when it recognizes the user is interested in the related topic.&nbsp;The attackers also use a lot of tricks to make the compromised accounts look as convincing as possible. To impersonate the original vendor, the attackers made some typical changes:&nbsp;<ul><li>Renaming the channel (arbitrary, perfectly mimicking the original channel)</li><li>Renaming the @handle (must be unique, typo-squatting is typically used)</li><li>Deleting all of the content of the previous owner</li><li>Filling the channel with linked videos leading to the official channel the attackers are impersonating&nbsp;</li></ul>Let us explain the last step more using the example below.&nbsp;&nbsp;Linked videos are a feature of YouTube where the user can link videos from different channels and present them on their own channel. In the screenshot below, we can see a compromised YouTube channel. Because the videos in this case point to the official TradingView channel, they look very convincing and legitimate – that’s because they are legitimate — even though they don’t belong to this channel at all. The user would need to click on the individual videos and observe that they are actually hosted on a different channel to recognize they’re on not on the page of the company, account or vendor that they think they’re on.&nbsp;

For more details about this campaign, <a href="https://www.gendigital.com/blog/insights/research/ai-generated-personas-deepfake-tactics-scam-yourself-attacks" target="_blank" rel="noreferrer noopener">read our blogpost</a>.&nbsp;<a href="https://x.com/GenThreatLabs/status/1894763068313178208" target="_blank" rel="noreferrer noopener">Trading Bot Scam</a> is yet another type of AI impersonation campaign we observed during Q1/2025 (and beyond). In the 500+ videos so far, we observed more than 15 different personas, and we are still counting. Either completely AI-generated, deepfaked, or performed by hired actors, all these personas carry out the Trading Bot Scam.&nbsp;

All of the personas shown above advise users on how to get rich, quickly and easily, by exploiting price differences in cryptocurrency on blockchains. To do so, users are instructed to copy and paste a smart contract code into an online Integrated Development Environment (IDE platform) for the cryptocurrency contract. When the user adds money to the contract, their money is sent to the attacker’s wallet instead. This method takes Scam-Yourself Attacks to the next level. Instead of simply tricking users into pasting malicious commands into their computers, it uses legitimate websites or tools to trick them into setting up a malicious smart contract on the blockchain.&nbsp;&nbsp;The attacker usually hosts their own fake coding platform on a website with a slightly misspelled name. This way, they avoid the warnings and pop-up messages that real platforms show to protect users from copying dangerous code.&nbsp;

By self-hosting the IDE, the attackers are changing its implementation in such a way that these warnings are suppressed, making it a tradeoff between user noticing the typo-squatted domain and the warning dialogue.&nbsp;<h4>FakeCaptcha Gets Smarter (and More Cross-Platform)&nbsp;</h4>ClickFix and FakeCaptcha continue to evolve. One new tactic involves <a href="https://x.com/GenThreatLabs/status/1883930160392778027" target="_blank" rel="noreferrer noopener">interactive image-based</a> CAPTCHAs mimicking the classical “select all the traffic lights” puzzle. However, after selecting the image (quite frankly, any image for that matter), the user is once again redirected to the common set of malicious steps which result in infecting the user’s device.&nbsp;Another FakeCaptcha campaign <a href="https://x.com/GenThreatLabs/status/1888144081869590600" target="_blank" rel="noreferrer noopener">focused on countries in Asia</a>, uses typo-squatted URLs trying to impersonate well-known brands like Pepsi, McDonald's and Coca-Cola. In campaigns like this, we can observe usage of a variety of loaders — programs designed to secretly install malware on a victim’s device, including the well-known Emmenhtal loader. In some cases, the loader is cleverly hidden inside a polyglot MP3 file, which can be played as normal audio but also contains malicious JavaScript. This hidden code is then run by a tool called mshta.exe to install Lumma Stealer malware.&nbsp;

In FakeCaptcha attacks, attackers hide malicious code by adding comments that make the command look harmless. This way, the user only sees the supposed verification message and the malicious command is hidden just before the comment, as can be seen below:&nbsp;

In Q1/2025, we saw an <a href="https://x.com/GenThreatLabs/status/1899855568451367330" target="_blank" rel="noreferrer noopener">improvement of this technique</a>. The attackers started to use Unicode characters in these comments in an attempt to avoid detection. Nothing really changed for the user, but under the hood, the byte representation varies significantly.&nbsp;

FakeCaptcha also <a href="https://x.com/GenThreatLabs/status/1902342309175279748" target="_blank" rel="noreferrer noopener">exploits the userinfo part of URLs</a> (credentials before the ‘@’ symbol) in mshta.exe requests. This is done to obfuscate the URL, so it seems like a common google.com domain (see below), but in fact, the request is made to the attacker’s hosted website.&nbsp;

Additionally, FakeCaptcha is not just a Windows thing anymore. In early Q1/2025, this attack was <a href="https://x.com/g0njxa/status/1884166667498054004" target="_blank" rel="noreferrer noopener">observed on macOS</a>. With a promise of protection against phishing attacks, by following the steps, the campaign was distributing AMOS, an information stealer also known as Atomic Stealer.&nbsp;

In parallel, we also observed a considerable rise in Fake Update campaigns, where attackers trick victims into installing supposed browser updates (such as for Chrome or Opera) that actually deliver malware. These fake updates, designed to closely mimic legitimate prompts, caused a massive +1711% spike in global risk ratios during Q1. While situational, such campaigns can surge dramatically in short bursts before settling back into quieter periods. Notably, this particular wave hit countries like Belgium, Poland, Italy, New Zealand, Switzerland, Spain, the Netherlands, Germany and the United Kingdom especially hard.&nbsp;Scam-Yourself Attacks also allow previously dead malware strains to shine again. During Q1/2025, we observed a resurrection of Wincir RAT/dropper, also known as Legion Loader, which rose to popularity in 2022 before quickly beginning its steady decline.&nbsp;&nbsp;The attack starts with an unofficial third-party website for downloading software. This website is, however, hosted by the attacker and instead of a direct download, instructions on how to proceed are displayed to the user.&nbsp;

Note that the instructions aren’t infecting the victims’ devices directly. Instead, the installer is simply downloaded and conveniently displayed to the user in a traditional Explorer window. After the user double-clicks on it, or presses enter, they execute Wincir manually on their own.&nbsp;

Looking ahead, we anticipate Scam-Yourself Attacks will continue evolving in sophistication and scope. The blending of AI-generated personas, cross-platform malware delivery (including macOS), and advanced social engineering techniques suggests that these attacks will remain one of the most adaptive and challenging threat categories in the quarters to come. Regional surges, like those seen in the Fake Update campaigns, are likely to reappear as attackers test new angles and exploit localized opportunities.&nbsp;Martin Chlumecký, Malware Researcher&nbsp; Jan Rubín, Malware Researcher&nbsp; Luis Corrons, Security Evangelist&nbsp;<h2>In Closing&nbsp;</h2>The Gen Q1/2025 Threat Report revealed an evolving threat landscape where cybercriminals are becoming increasingly sophisticated, leveraging advanced technologies like AI, deepfakes, and cross-platform scams to exploit trust and target their victims. These issues aren’t just technological; they’re deeply personal, affecting real people and real lives.&nbsp;Key insights included a 186% surge in breached records, a growth in Fake Update Scams of 17 times the previous quarter’s levels, and the rise of Scam-Yourself Attacks, which deceived millions of users into compromising their own systems. We saw new players on the ransomware scene, developing attacks created by AI that target businesses’ bottom lines. Financial threats, like CryptoCore’s deepfake-powered cryptocurrency scams, reaped millions in profits, while mobile threats took a deeply personal turn, targeting users’ sensitive data through spyware and banking Trojans.&nbsp;While the overall volume of cyberattacks has not significantly increased, this signals a shift from broad, indiscriminate strategies to more targeted, innovative, and persistent tactics.&nbsp;&nbsp;Despite these challenges, there’s hope. Awareness, proactive measures, and robust cybersecurity practices are critical in countering these threats. Together, we can build a digital future that’s smarter, safer, and more resilient.&nbsp;Stay protected. Stay alert. Stay ahead. &nbsp;

Download the full <a href="https://www.gendigital.com/blog/sites/default/files/2025-05/Gen%20Threat%20Report%20Whitepaper%20final.pdf" target="_blank" title="Q1/2025 Whitepaper">Q1-2024 Threat Report Whitepaper</a> here.&nbsp;Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

Gen Protects Millions of People as Breached Personal Information, Phishing Reports, Fake Browser Update Scams and Scam-Yourself Attacks Are on the Rise 

Gen Q1/2025 threat report 

Understanding cyberthreats can be complex, especially as tactics evolve and terminology expands. This blog is designed to make things easier. Here, you’ll find clear definitions and classifications of key threat types featured in our quarterly <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q1-2025" target="_blank" rel="noreferrer noopener">Gen Threat Reports</a>. We keep it simple, sharp and rooted in real-world things that researchers across the Gen family of brands continue to discover in the wild.&nbsp;&nbsp;As threat insights evolve quarter over quarter, this resource will grow alongside them, helping journalists, analysts and curious minds stay informed while navigating the ever-changing threat landscape. Think of it as your fast, reliable reference to stay ahead of what’s out there.&nbsp;<ul><li>Adware (malware-based threat)&nbsp;Adware threats refer to applications that display intrusive out-of-context adverts to users to generate fraudulent advertising revenue. In other words, it’s sneaky software that shows annoying pop-up ads to make money, often without you realizing where they’re coming from or why. These apps often mimic popular apps like games or camera filters and include stealthy features to avoid detection or removal.&nbsp;</li><li>Alert (threat indicator and metric)&nbsp;An alert refers to any and every notification sent to a user’s app, within a given period, to warn you about possible threats to your identity, money or personal information. &nbsp;</li><li>Bankers (malware-based threat)&nbsp;Bankers are a sophisticated type of malware (and a subset of infostealers), designed to steal banking credentials, crypto wallets and payment information. Generally distributed through phishing messages or fake websites, Bankers can take over a victim's device by abusing the accessibility service. Once installed and enabled, they often monitor 2FA SMS messages and may display fake bank overlays to steal login information.  &nbsp;</li><li>Blocked Attack (threat indicator and metric)&nbsp;A blocked attack means we stopped a specific threat from reaching a specific user during a certain period of time.&nbsp;</li><li>Breach Event (data compromise threat)&nbsp;A breach event is a security incident where unauthorized individuals gain access to personal or identity-related data. For example, the event of identity theft.&nbsp;</li><li>Breached Record (data compromise threat)&nbsp;A breached record is an individual instance of leaked data from a breach, such as an email, a password, your SSN, credit card number or IP address.&nbsp;</li><li>Data-Stealing Threats (data compromise threat)&nbsp;These threats focus on stealing valuable data from a device, including login credentials, cryptocurrencies, browser cookies, passwords and private documents.&nbsp;</li><li>Dating Scams (scam-based threat)&nbsp;Also known as romance scams or online dating scams, these scams involve scammers forming fake romantic relationships online to gain trust and extract money or enough personal data to commit identity theft.&nbsp;</li><li>Digital Fingerprint&nbsp;When you visit websites, small bits of data about your device, browser, and online behavior are collected to identify you. Over time, this data forms a unique “digital fingerprint” that can track your activity across the web. Unlike cookies, it can’t easily be cleared or disabled. Companies use it to personalize ads and content, but it also exposes details about your habits, interests, and identity. This makes it a growing privacy concern and a target for misuse.&nbsp;</li><li>Financial Scam&nbsp;This is a type of fraud where the attacker tricks you into giving them money or sensitive financial information (e.g., fake investment opportunities).&nbsp;</li><li>Gambling Scam (malware type)This is a type of scam where attackers trick you into placing bets on their fake gambling platforms but refuse to pay out legitimate winnings.</li><li>Infostealers&nbsp;This is malicious software that steals passwords, banking credentials, crypto wallet keys, and other sensitive information from your computer.&nbsp;</li><li>Invoice Scam (malware type)This is a type of scam where attackers use fake invoices to impersonate legitimate companies to obtain money from the victims.&nbsp;</li><li>Malicious Browser Push Notifications (scam-based threat)&nbsp;Attackers exploit browser notification features by tricking users into enabling them, then sending harmful or misleading messages.&nbsp;</li><li>Malvertising&nbsp;Short for malicious advertising is when hackers hide harmful software or links inside online ads—even on trusted websites. These ads might look normal, but clicking them (or sometimes just loading the page) can infect your device or steal your info. An example: You visit a news site and see a banner ad that looks like a software update or prize offer. If you click it, it might secretly install a virus or take you to a fake website that steals your passwords. You didn’t have to visit a sketchy site; the bad ad came to you.&nbsp;</li><li>Phishing (scam-based threat)&nbsp;A type of online scam where fraudsters attempt to trick victims into providing sensitive data by impersonating trustworthy sources via emails, texts or fake websites. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.  &nbsp;</li><li>Ransomware (malware-based threat)&nbsp;Ransomware is any type of extorting malware. The most common subtype is one that encrypts files (documents, photos, videos, databases on a victim’s PC) and demands payment (“ransom”) to decrypt them. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware. &nbsp;</li><li>Remote Access Trojans (malware-based threat)&nbsp;RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling activities like surveillance, data theft or spying via webcams.&nbsp;</li><li>Risk Ratio (threat indicator and metric)&nbsp;This metric denotes the severity of threats in a given country and is calculated as:&nbsp; Number of attacked users / Number of active users (monthly average). Unless stated otherwise, risk ratios are only reported for countries with 10,000+ users per month.&nbsp;</li><li>Scam-Yourself Attack (misleading)&nbsp;This attack is a social engineering tactic where victims are tricked into unintentionally compromising their own security—often by entering real credentials or verification codes into a fake but convincing interface. For example, they might send you to a fake login page that looks real, and when you enter your code or password, they use it right away to get into your account.&nbsp;</li><li>Scams&nbsp;A broad category of threats aimed at tricking victims into giving away personal information or money. We track diverse types of scams, including but not restricted to: Malicious browser push notifications, dating scams, tech support scams phishing. &nbsp;</li><li>Sextortion ScamThis is a type of extortion scam where the victim is threatened with sexually explicit material alleged to involve them. Attackers often claim to have obtained this material through hacking or surveillance.</li><li>SpamUnsolicited messages typically sent in bulk, often for marketing or promotional purposes. These messages may not be directly harmful, but are unwanted, generally considered a nuisance and can clutter the recipient's inbox.</li><li>Spyware (malware-based threat)&nbsp;Spyware is sneaky software that secretly watches what you do and steals personal info like your messages, photos, location, or passwords. It often spreads through fake ads, scam messages or tampered apps. Some advanced versions, used by governments, can even break into devices using hidden security flaws.&nbsp;</li><li>Tech Support Scams (scam-based threat)&nbsp;These scams involve fraudsters pretending to be legitimate tech support agents to gain remote access or steal personal and financial data. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services. &nbsp;</li><li>Web skimming (malware type)This threat injects malicious code into web payment pages to steal bank card details or make unauthorized payments.</li></ul>

A no-jargon guide to cyberthreats 

Gen threat glossary & taxonomy 

<h2>Foreword&nbsp;</h2>The year is over, and we can confidently conclude that 2024 was record-breaking. In Q4 alone, we successfully blocked 2.55 billion threats — equivalent to 321 attacks every second and a 9% increase compared to 2023. Social engineering threats, particularly scams, dominated the landscape, making up 86% of all attacks.&nbsp;

Some of you might recall what we <a href="https://decoded.avast.io/threatresearch/avast-q321-threat-report/" target="_blank" rel="noreferrer noopener">mentioned back in 2021</a>, when we launched this series: the threat landscape is highly dynamic and constantly evolving. At that time, we were witnessing one of the major shifts – the move beyond <a href="https://www.avast.com/c-malware">malware</a> and attacks on devices (e.g., exploits, droppers, banking trojans) to more human-centric attacks. While malware threats remain as we enter 2025 and continue to require robust defenses, today’s scam-related threats are far more dangerous, both technically and psychologically.&nbsp;As we step into the new year, we see new threats on the horizon. Rapid advancements in AI and large language models (LLMs), such as <a href="https://openai.com/index/introducing-operator/" target="_blank" rel="noreferrer noopener">OpenAI’s Operator</a>, capable of automating our daily online tasks (e.g., paying invoices, placing online orders), are being eyed by attackers as the next frontier. Imagine the risks when malicious actors attack or manipulate these AI agents. It’s a shift that would redefine the threat landscape yet again.&nbsp;But before we look forward, let’s review the key developments in the final quarter of 2024. Our featured story, The Dark Side of Social Media, delves into how cybercriminals target billions of users across social platforms. Social media threats have evolved beyond traditional malware, with scams such as malvertising, fake e-shops, and phishing becoming prevalent. Facebook emerges as the dominant source of these attacks, followed by YouTube. We also showcase how each platform faces different types of threats, influenced by their unique purposes and user bases, with cybercriminals tailoring their tactics accordingly.&nbsp;The social media threat landscape is closely linked to campaigns targeting personal data, which grew in complexity and scale in the last quarter. Campaigns like ClickFix and FakeCaptcha – what we call “Scam-Yourself Attacks” - continued to psychologically manipulate users. We safeguarded over 4.2 million unique users from FakeCaptcha scams alone, a staggering 130% increase compared to the previous quarter. To help protect people from this growing threat, we introduced a <a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection" target="_blank" rel="noreferrer noopener">Clipboard Protection feature</a> that blocks clipboard-based threats before execution. The attackers linked to these scams deployed the NetSupport remote access trojan (RAT) with iterative improvements to its script, reportedly developed using AI tools like ChatGPT, highlighting the dual role of AI in cybersecurity.&nbsp;While scams dominated the quarter, <a href="https://www.avast.com/c-what-is-ransomware">ransomware</a> threats continued to escalate, with attacks surging by 50% in Q4/2024 building on a staggering 100% increase in Q3/2024. Magniber emerged as the most prevalent ransomware family, accounting for 62% of all detected cases. We observed notable increases in regions such as Mexico (+230%), Japan (+180%), and parts of Europe (e.g., Austria and France, both +100%). Furthermore, Advanced Persistent Threats (APTs) also remained a critical concern, as groups like Lazarus Group employed zero-day exploits and sophisticated social engineering tactics to steal sensitive information from high-value targets.&nbsp;Financial threats demonstrated both persistence and innovation in the fourth quarter, with mobile banking trojans like DroidBot and ToxicPanda targeting EU users across advanced techniques such as NFC relay attacks and the disabling of system monitoring. The BankBot banker also saw a 236% increase in protected users compared to Q3/2024. In India, attackers used WhatsApp to distribute trojans disguised as utility payment apps. Unfortunately, they left the database unsecured, allowing access to thousands of stolen victim credentials. <a href="https://www.avg.com/en/signal/what-is-spyware">Spyware</a> threats also surged, with SpyLoans campaigns causing spikes in several regions, despite law enforcement crackdowns. Furthermore, Crypto scams evolved further, with campaigns like CryptoCore leveraging high-profile events and deepfake technology to defraud victims of millions. The CryptoCore attackers targeted individuals through fake investment schemes tied to newsworthy subjects including the U.S. presidential election and Elon Musk announcements. These deepfakes and manipulated narratives enabled attackers to gain victims’ trust and convince them to transfer funds. This marked the attackers' largest campaign to date, stealing over $7 million in Q4/2024 alone.&nbsp;Scams remained widespread, demonstrating remarkable adaptability. Fake e-shops, for instance, were particularly active during Black Friday and Christmas, using poisoned search results, social media ads, and phishing emails to deceive shoppers. Beyond financial losses, these scams often led to compromised personal data, resulting in identity theft and financial fraud or long-term credit damage. Dating scams also gained momentum, particularly in Nordic countries, preying on individuals’ emotions and trust. Meanwhile, technical support scams surged in localized areas, such as Switzerland and Japan, with attackers adjusting their methods to align with local preferences and contexts. Malvertising continued to serve as a major vector for scams and malware, comprising 41% of all blocked attacks this quarter, the largest share of any single threat type.&nbsp;As we enter 2025, these findings highlight three critical areas that are evolving within the threat landscape: APTs and ransomware, scams and fraud, and attacks on AI systems and AI-driven attacks. Threat actors are constantly refining their tactics to exploit vulnerabilities, both human and technological, across each of these areas.&nbsp;Wishing you an enjoyable read and a safe year ahead in 2025, with security both online and off.&nbsp;Jakub Křoustek, Malware Research Director&nbsp;<h2 class="text-align-justify">Methodology&nbsp;</h2>This report is structured into three main sections: Desktop-related threats, where we detail our intelligence on attacks targeting the Windows, Linux and Mac operating systems, specifically emphasizing web-related threats; and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.&nbsp;We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of the formula: “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, risk ratios are only reported for countries with more than 10,000 active users per month.&nbsp;A blocked attack is defined as a unique combination of a protected user and a blocked threat identifier within a specified time frame.&nbsp;Our quarterly threat reports provide insights about the threat landscape as observed from the Gen family of Cyber Safety brands. We continuously improve our threat telemetry and anticipate further refinements in future reports.&nbsp;<h2 class="text-align-justify">Scams, Threats and Cybercrime&nbsp;</h2><h3 class="text-align-justify">A closer look at how cybercriminals target billions of people through social media platforms&nbsp;</h3>The world is evolving. Today’s threats have moved beyond malware, with new forms of scams arising daily, plaguing our digital world and aiming to defraud unsuspecting victims. The days of <a href="https://us.norton.com/blog/malware/what-is-a-trojan">trojans</a> and worms being the biggest security concerns for people online are gone. Make no mistake, these threats still exist and we need to remain protected against them, but today’s threats are far more dangerous, both technically and psychologically.&nbsp;&nbsp;Adding to this complexity is the rise of Artificial Intelligence (AI), which has recently become a game-changer for cybercriminals. AI-powered tools allow scammers to create highly convincing and adaptive attacks, from <a href="https://www.avast.com/c-deepfake">deepfake videos</a> and voice synthesis to personalized phishing messages crafted to deceive even the most cautious people. This technological edge makes today’s scams much more effective and harder to detect than ever before.&nbsp;One of the most dangerous playgrounds for today’s cybercriminals is social media. It encompasses a wide range of platforms, including traditional social media, video-sharing platforms and messaging apps. These platforms serve different purposes, from connecting friends to sharing content, and their demographics vary significantly.&nbsp;From a security perspective, it’s not just the platforms’ user content and functionality that make them unique, it’s also the nature of the attacks they attract. Each platform’s distinct features and audience shape the strategies cybercriminals use to exploit them. From phishing links on messaging apps to fake profiles on traditional social networks, the variety of scams reflects the diversity of the platforms themselves. In this article, we’ll take a look at these threats, specifically pertaining to Facebook, YouTube, Instagram, TikTok, X, LinkedIn and Messenger platforms.&nbsp;<h3 class="text-align-justify">The Latest in Social Scamming&nbsp;</h3>Scammers have found fertile ground in social media, exploiting their massive user bases and diverse functionalities to target unsuspecting individuals. One prominent example is the "<a href="https://www.gendigital.com/blog/insights/research/tiktok-elonmusk-scam" target="_blank" rel="noreferrer noopener">TikTok Elon Musk Scam</a>", where fraudsters impersonated the tech billionaire to promote fake cryptocurrency giveaways, enticing people to send funds with the promise of doubling their returns. Particularly, the sophistication of the impersonation made it effective, preying on Musk’s real-world influence and TikTok’s younger, tech-curious demographic. Meanwhile, fraudulent job offers have surged under the guise of "<a href="https://www.gendigital.com/blog/insights/research/part-time-job-scams" target="_blank" rel="noreferrer noopener">Part-Time Job Scams</a>", luring individuals with promises of easy income, but ultimately compromising personal information or demanding upfront payments.&nbsp;&nbsp;Another case, the "<a href="https://www.gendigital.com/blog/insights/research/how-a-skype-notification-turned-into-a-costly-lesson" target="_blank" rel="noreferrer noopener">Skype Notification Scam</a>", demonstrates how even old-fashioned messaging apps can lead people into costly traps, showcasing the many ways cybercriminals manipulate trust and digital habits. Additionally, phishing attacks often use social media to harvest account credentials, <a href="https://x.com/GenThreatLabs/status/1854565018177597786" target="_blank" rel="noreferrer noopener">spreading malicious campaigns</a> within the same ecosystem they exploit.&nbsp;However, beyond the specific stories and articles discussing the general risks and threats in social media,&nbsp;many questions remain unanswered. What are the chances of encountering an attack on social media? Which platforms are the most "dangerous"? What are the actual types of threats we can find there? Our researchers set out to answer these questions.&nbsp;<h3 class="text-align-justify">Threats Across Social Media&nbsp;</h3>When analyzing threats detected across social media platforms, Facebook emerges as the dominant source of detected threats, accounting for an alarming 56.19% of the total. YouTube follows with 25.92%, while platforms like X, Reddit, and Instagram contribute 6.91%, 4.65%, and 3.79%, respectively. The remaining threats are scattered across other platforms. This distribution highlights the disproportionate risk posed by some platforms due to their user base size, engagement patterns, and platform-specific characteristics.&nbsp;&nbsp;Interestingly, we have blocked six times more threats on Telegram than on WhatsApp, despite WhatsApp having a significantly larger user base. This aligns with previous observations, where scammers often redirect victims to continue conversations on Telegram, leveraging its unique features to further their schemes. The chart below provides a visualization of these figures, highlighting how cybercriminals capitalize on the distinct dynamics of each platform to target users effectively.&nbsp;

What are the threats that are targeting people on social media? There is a wide range, including:&nbsp;<ol><li>Malvertising (26.95%): Cybercriminals spread malware or redirects users to malicious websites through deceptive online advertising. These ads often distribute harmful content disguised as legitimate advertisements.&nbsp;</li><li>E-shop Scam (23.47%): Attackers create fake online shops (e-shops) to trick users into making purchases. Victims either receive counterfeit goods or nothing at all, losing money and potentially exposing personal data.&nbsp;</li><li>Phishing (18.07%): Scammers use deceptive messages, emails or websites to steal sensitive information such as credit card numbers, banking credentials or passwords. These campaigns often mimic legitimate communications.&nbsp;</li><li>Financial Scam (10.68%): Attackers trick people into giving money or sensitive financial information. Common examples include fake investment opportunities and fraudulent loan offers.&nbsp;</li><li>Generic Scam (10.24%): This broad category includes scams where attackers aim to deceive victims into sharing personal information or money, without fitting into the more specific categories above.&nbsp;</li><li>Tech Scam (5.43%): Scammers impersonate legitimate technical support providers to gain access to victims' computers and data. These scams typically start with fake error messages or unsolicited calls offering help.&nbsp;</li><li>Dating Scam (2.93%): Cybercriminals establish fake romantic relationships to trick victims into sending money or sharing personal information, typically on dating platforms or social media using fake profiles.&nbsp;</li><li>Others (2.24%): A collection of less common, but still significant, threat types that exploit social media in various ways.&nbsp;</li></ol>

These figures show the diverse strategies used by cybercriminals to exploit users on social media. <a href="https://us.norton.com/blog/malware/malvertising">Malvertising</a> remains the dominant threat at 26.95%, targeting large user bases with scalable attack methods within advertising ecosystems. E-shop scams, accounting for 23.47% of threats, reflect how attackers exploit shopping-centric platforms like Facebook and Instagram to take advantage of users’ trust and urgency during transactions. Phishing, at 18.07%, continues to deceive unsuspecting users into revealing sensitive information through deceptive links and messages. Financial scams (10.68%) and generic scams (10.24%) demonstrate the diversity of tactics cybercriminals employ to target victims.&nbsp;&nbsp;The last quarter of 2024 saw a spike in online shopping activity, and cybercriminals were quick to take advantage of the increased traffic. Platforms like Facebook and Instagram, which promote shopping through integrated features, saw a notable rise in e-shop scams during this period. The urgency of holiday deals and the allure of discounts create the perfect conditions for scammers to thrive.&nbsp;Each platform is unique, with different types of users and content shared, reflected in the threats that are prevalent in each one. Let’s take a closer look at the five social media with more threats detected.&nbsp;Facebook&nbsp;The high prevalence of e-shop <a href="https://lifelock.norton.com/learn/fraud/facebook-scams">scams on Facebook</a>, accounting for 26% of all threats, contrasts sharply with their lower representation on other platforms. This is largely due to Facebook’s Marketplace and its community-based interactions, which scammers exploit through fake listings and impersonated sellers. Unlike YouTube's ad-centric threats, Facebook's focus on local commerce and its older demographics makes it an ideal ground for e-shop scams, particularly targeting less tech-savvy users.&nbsp;YouTube&nbsp;Malvertising dominates YouTube, accounting for 54% of the platform’s threats. This is driven by YouTube’s platform’s ad-based revenue model, which scammers exploit to deliver malicious ads to a vast, engaged audience. Unlike Instagram’s visually curated content, YouTube’s reliance on long video engagement provides more opportunities for malicious ads to appear, making it a prime target for malvertising campaigns.&nbsp;X (formerly Twitter)&nbsp;The overwhelming prevalence of generic scams on X, making up 62% of blocked attacks, reflects the platform's open nature and lack of stringent verification. Unlike Reddit’s community-focused structure, X’s fast-paced environment and trending hashtags provide scammers with the opportunity to inject fraudulent content, such as cryptocurrency giveaways and donation scams, into high-visibility discussions.&nbsp;

Reddit&nbsp;Malvertising (66%) and phishing (29%) are the dominant threats on Reddit. Unlike Instagram’s shopping-centric scams, Reddit’s reliance on user-generated content creates opportunities for malicious actors to embed harmful links in posts and comments. The decentralized nature of Reddit communities amplifies these threats, as scammers target niche audiences with tailored phishing schemes.&nbsp;Instagram&nbsp;E-shop scams dominate Instagram, accounting for 42% of threats on the platform. Unlike YouTube’s ad-driven ecosystem, Instagram’s visual-first design and integrated shopping features make it a prime target for scammers. The ability to create polished, fake product galleries and targeted ads enables fraudulent e-commerce to thrive on the platform, particularly during seasonal shopping periods like Q4.&nbsp;<h3 class="text-align-justify">Conclusion&nbsp;</h3>Social media platforms have evolved into bustling hubs for interaction, commerce and entertainment. However, their growth has also created fertile ground for cybercriminals. The interplay platform-specific features and seasonal trends, such as Black Friday and Christmas shopping frenzies, highlights the adaptability of modern scams.&nbsp;Looking ahead, the evolving nature of cybercrime on social media calls for innovative and adaptive approaches to security. As platforms integrate more features and users continue to share more of their lives online, finding the right balance between functionality and safety will be crucial. Only through collaboration between platforms, users and security experts can the growing tide of digital threats be effectively countered.&nbsp;Luis Corrons, Security Evangelist&nbsp; Patrik Holop, Researcher<h2 class="text-align-justify">Desktop-Related Threats&nbsp;</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): From Fake Interviews to Zero-Day Exploits&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.&nbsp;This quarter, the Lazarus Group, a North Korean advanced persistent threat (APT) actor, continued their stream of attacks by integrating both established and novel malware into its infection chains. In Q4/2024, the group continued to target individuals using compromised archive files masquerading as skill assessment tests for IT professionals, spread by Lazarus through LinkedIn messages. Additionally, Lazarus continues to abuse GitHub repositories to deliver JavaScript-based infostealers and leverage zero-day vulnerabilities to deploy the next stage of the attack chain. One notable example involved a fake job offer shared via a LinkedIn message, which directed recipients to a malicious website “willointerview[.]com”. This campaign targeted young IT and cybersecurity professionals who were looking for work.&nbsp;&nbsp;

The infection sequence employed by Lazarus is intricate, utilizing multiple malware components to establish a foothold within targeted systems. Through our research, combined with insights from Kaspersky, we have identified a new downloader and loader named CookiePlus, which is capable of downloading malicious shellcodes and DLLs. We have also observed Lazarus reusing a loader from a previous campaign, referred to as RollMid.&nbsp;In another recent campaign, Lazarus targeted cryptocurrency investors by creating a fake multiplayer online battle arena game called detankzone (hosted at "detankzone[.]com"), which it claimed to incorporate both decentralized finance and non-fungible token features.&nbsp; The website of the detankzone game, appearing as a legitimate game, contained hidden scripts that exploited a zero-day vulnerability in Google Chrome (CVE-2024-4947), enabling remote code execution upon visiting the site. After the remote code execution, Lazarus used another exploit to bypass V8 sandboxing.&nbsp;

This campaign highlights the Lazarus Group's consistent use of advanced tactics, such as zero-day exploits and deceptive lures, to infiltrate systems and steal sensitive information. Their operations remain focused on targeting IT professionals and individuals employed by organizations of strategic interest to the attackers.&nbsp;Luigino Camastra, Malware Researcher&nbsp;<h2>Data-Stealing Threats: Scam-Yourself Attacks Continue to Enable Data Theft&nbsp;</h2>Data-Stealing Threats are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;The fourth quarter of 2024 saw a number of good-news headlines in the world of cyber gang takedowns. One of the biggest stories was <a href="https://www.operation-magnus.com/" target="_blank" rel="noreferrer noopener">Operation Magnus</a>, a joint effort by the Dutch National Police, the FBI and other partners, resulting in the take down of RedLine and META information stealers.&nbsp;While the protectors saw success in taking down malicious actors, new data theft threats emerged. <a href="https://www.gendigital.com/blog/insights/research/glove-stealer" target="_blank" rel="noreferrer noopener">Glove Stealer</a> is a newly discovered information stealer written in .NET. In addition to stealing browser data (cookies, autofill information, etc.), it also heavily focuses on cryptocurrency wallets, 2FA authenticators, password managers, email clients, and other sensitive data. This stealer also follows the trend of bypassing App-Bound Encryption, introduced in Google Chrome, using the IElevator service bypass. Note that we described many existing bypasses for the App-Bound Encryption in the previous <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">Q3/2024 report</a>.&nbsp;Furthermore, we continued to see many FakeCaptcha campaigns, distributing mostly information stealers and RATs. During Q4/2024, attackers introduced multiple <a href="https://x.com/GenThreatLabs/status/1854127111285375392" target="_blank" rel="noreferrer noopener">new adaptations</a> of well-known CAPTCHA designs, including CloudFlare.&nbsp;

Because of the high prevalence of ClickFix and FakeCaptcha campaigns (we will break down the statistics separately below), Gen introduced a brand-new <a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection" target="_blank" rel="noreferrer noopener">Clipboard Protection feature</a>, available in products across the Norton, Avast and AVG brands. This additional defense layer in our protection stack allows us to better address clipboard threats, including Scam-Yourself Attacks. Ultimately, this protection allows us to eradicate the threat before it even has the chance of being downloaded to the users’ systems.&nbsp;By analyzing content being copied from websites via FakeCaptcha scams, we <a href="https://www.gendigital.com/blog/insights/research/cybercriminals-leveraging-chatgpt-to-create-malicious-payloads" target="_blank" rel="noreferrer noopener">uncovered an attack chain</a> used for deploying the remote access trojan (RAT) NetSupport. This chain was orchestrated by a script iteratively developed by the attacker using ChatGPT. Findings like these not only highlight a growing trend of enabling low-skill actors to achieve high-impact outcomes, but they also prove that inventions like Clipboard Protection are key in helping make the world a safer place.&nbsp;ClearFake, one of the many notoriously known Fake Update actors, continued to <a href="https://x.com/GenThreatLabs/status/1849110244221243643" target="_blank" rel="noreferrer noopener">use ClickFix to deliver malware</a>. With the assistance of the EtherHiding technique for delivery, we observed the DarkGate information stealer with vast RAT capabilities being distributed.&nbsp;

Finally, in Q4/2024 we observed a 17% increase in the activity of AtomicStealer, also known as AMOS, one of the most advanced information stealers targeting macOS. This sophisticated malware is designed to steal a variety of personal information, enabling <a href="https://www.lifelock.com/how-it-works/what-is-identity-theft/">identity theft</a>, monetization of stolen data, and facilitating more targeted attacks. A rising trend for threats on this platform is the usage of PyInstallers. These provide a way of executing Python scripts even on devices with no Python installed, effectively simplifying the malware distribution.&nbsp;<h3 class="text-align-justify">Statistics&nbsp;</h3>We happily reported a significant 60% decrease in detections of Lumma Stealer in Q4/2024. This was a welcomed break following the previous quarter where Lumma Stealer spiked dramatically and increased its malware share by massive 1154% with data-stealing malware increasing in risk ratio by 32% in general. Additionally, after the aforementioned Operation Magnus, RedLine and META stealers ceased to operate. Even though it might seem like data theft is cooling in terms of the sheer numbers, we need to have a closer look at the threat landscape to understand the changes better.&nbsp;According to our data and estimations, the decrease of Lumma Stealer and thus information stealer activity overall is due to the protection against typical distribution methods for information stealers, including FakeCaptcha. This is further supported by introducing Clipboard Protection feature to our products. This naturally influences our statistics because we completely eliminate the delivery method at its very origin and thus sooner than the final payload would be delivered to infect the victims’ systems.&nbsp;As described in the previous quarter’s featured story, Scam-Yourself Attacks, such as ClickFix and FakeCaptcha, have taken off, launching massive campaigns all around the world. This trend continued in Q4/2024, where we protected more than 4.2M unique users against FakeCaptcha attacks. The risk ratio of encountering FakeCaptcha scams increased by +130% compared to the previous quarter.&nbsp;

The highest risk ratio of stumbling upon FakeCaptcha was in the Balkan states, including:&nbsp;<ul><li>Montenegro (9.76%)&nbsp;</li><li>Serbia (8.94%)&nbsp;</li><li>North Macedonia (8.92%)&nbsp;</li><li>Kosovo (8.51%)&nbsp;</li></ul>Other countries with a high-risk ratio were:&nbsp;<ul><li>Egypt (8.31%)&nbsp;</li><li>The Philippines (5.14%)&nbsp;</li><li>Argentina (2.91%)&nbsp;</li><li>Spain (2.17%)&nbsp;</li><li>Italy (2.66%)&nbsp;</li><li>India (1.69%)&nbsp;</li><li>Brazil (1.13%)&nbsp;</li><li>France (1.15%)&nbsp;</li></ul>Compared to the previous quarter, the overall risk ratio for information stealers decreased by 32% in Q4/2024.&nbsp;

Conversely, the risk ratio in Indonesia experienced a slight increase of 1.53%, while in Turkey, the risk ratio increased by 10%.&nbsp;

After losing 60% of its malware share, Lumma Stealer is, according to our data, in the second place in terms of information stealer share behind AgentTesla. However, AgentTesla also lost some presence, decreasing its malware share by 9%.&nbsp; Because of this shift in proportion, every other information stealer increased its malware share in Q4/2024. One of them stands out, however, as MassLogger increased its malware share by massive 437%, ranking amongst the top 10 stealers now.&nbsp;The most common information stealers with their malware shares in Q4/2024 were:&nbsp;<ul><li>AgentTesla (16%)&nbsp;</li><li>Lumma (12%)&nbsp;</li><li>FormBook (12%)&nbsp;</li><li>Ramnit (11%)&nbsp;</li><li>Fareit (7%)&nbsp;</li><li>SnakeKeylogger (5%)&nbsp;</li><li>MassLogger (4%)&nbsp;</li><li>Vidar (3%)&nbsp;</li><li>Lokibot (2%)&nbsp;</li><li>ViperSoftX (2%)&nbsp;</li></ul><h2 class="text-align-justify">Ransomware: Third Consecutive Quarter of Growth&nbsp;</h2>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;LockBit, one of the biggest players in the ransomware scene, went through some interesting changes in the latter half of 2024, with a significant decrease in the number of (published) attacks over the last 6 months:&nbsp;

Furthermore, the U.S. Department of Justice <a href="https://www.justice.gov/usao-nj/pr/us-charges-dual-russian-and-israeli-national-developer-lockbit-ransomware-group" target="_blank" rel="noreferrer noopener">announced</a> that they officially charged Rostislav Panev, a LockBit malware developer who was arrested in Israel and is currently awaiting extradition to the USA.&nbsp;&nbsp;

Panev was a key part of the LockBit gang, contributing to their path of destruction which has included attacking children’s hospitals amongst other organizations across industries. It seems, though, that the rest of LockBit has moved on from Panev after announcing that an updated version – LockBit 4.0 - is expected to launch in February.&nbsp;

<h3>Trigona Reemerges with Deceptive Strategy&nbsp;&nbsp;</h3>Trigona ransomware resurfaced in the summer of 2024, but this time with a change in tactics designed to hide its identity. Earlier attacks referenced their own leak site, but recent ransom notes avoid mentioning it altogether. Instead, they point to leak sites belonging to other ransomware groups such as KillSec, Hunters, and DragonForce. However, our analysis has not found any evidence of Trigona victims appearing on these other leak sites, making it unlikely that these groups are actually collaborating. The ransomware group also uses a slightly modified cryptor, which led to it being misclassified as part of a different malware family. Analysis of configuration data inside the binary files confirmed that it is the same Trigona ransomware with some adjustments. This new approach has been observed since June 2024, with additional samples appearing throughout the remainder of the year.&nbsp;

<h3 class="text-align-justify">Statistics&nbsp;</h3>For the third consecutive quarter, ransomware has continued its alarming upward trend, with a notable 50% increase in Q4/2024. This follows a staggering 100% rise in Q3/2024 and a 24% jump in Q2/2024. The sustained growth in ransomware activity highlights an ongoing, escalating threat to both individuals and organizations globally.&nbsp;According to our telemetry, Magniber is still the most prevalent ransomware (62% of malware share). Its high counts come from the <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q3-2024" target="_blank" rel="noreferrer noopener">previous quarter</a>:&nbsp;

Countries with the highest increases in risk ratio are in South America, including:&nbsp;<ul><li>Colombia (+400%)&nbsp;</li><li>Uruguay (+400%)&nbsp;</li><li>Brazil (+370%)&nbsp;</li><li>Argentina (+300%)&nbsp;</li><li>Venezuela (+290%)&nbsp;</li><li>Peru (+270%)&nbsp;</li></ul>Risk ratios also increased in Mexico (+230%), Japan (+180%), Austria (+100%), France (+100%), and Canada (+100%).&nbsp;Absolute risk ratios per country are depicted in the following map:&nbsp;

Ladislav Zezula, Malware Researcher&nbsp; Samuel Vojtáš, Malware Researcher&nbsp; Jakub Křoustek, Malware Research Director&nbsp;<h2>Remote Access Trojans (RATs): Remcos Slowing Down&nbsp;</h2>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as phishing emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance and even taking control of the victim's webcam and microphone.&nbsp;After a substantial increase in Q3/2024, the activity level of RATs remained consistent throughout Q4/2024. Interestingly compared to what we have seen in previous years, this year there was seemingly no decrease in RAT prevalence towards the end of the year.&nbsp;

Countries with the largest increases in risk ratio were:&nbsp;<ul><li>Algeria +37% (mostly driven by HWorm and njRAT)&nbsp;</li><li>Belgium +33% (AsyncRat, Remcos)&nbsp;</li><li>Netherlands +29% (Remcos, QuasarRAT)&nbsp;</li></ul>Largest decreases in risk ratio:&nbsp;<ul><li>Czechia -35%&nbsp;</li><li>Hungary -31%&nbsp;</li><li>Romania -25%&nbsp;</li></ul>The list of safest countries includes France, Sweden and Japan. France and Sweden kept their place among the top 3 countries least impacted by RATs from Q3/2024.&nbsp;

QuasarRAT saw its malware share surge by over 70%, with Turkey, Bulgaria, and Egypt being the most affected countries. Other strains, such as NanoCore and DarkComet, also experienced significant gains, each rising by approximately 30%.&nbsp;We have seen Remcos decrease in activity mostly in Europe, the United States and Canada losing some of its malware share to other strains in Q4/2024. However, Remcos remains the top strain globally in terms of overall share. Additionally, Remcos has been recently updated to version 6.0 - new features are aimed at operators, mostly simplifying the organization of remote (infected) computers. The update also contains some minor bug fixes. From a defender's perspective, the changes are not significant.&nbsp;In the Q3/2024 report, we observed that the online shop which previously sold the XWorm RAT had gone inactive. As far as we can tell, it has not been replaced with another one. We also have not seen a more recent version of XWorm following 5.6 which launched in September 2024 and was the last to be advertised on the now defunct site. However, XWorm is not slowing down as its activity remains at approximately the same level as in the previous quarter.&nbsp;Lesser known RATs are also making their mark, with the FBI issuing a warning regardingHiatusRAT at the end of 2024. Threat actors have been scanning web cameras and DVRs for vulnerabilities using HiatusRAT. Targeted vulnerabilities include CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044 and CVE-2021-36260. While HiatusRAT is not a new threat, being first discovered in early 2023, this warning serves as a reminder of the importance of regularly updating all connected devices, especially those often overlooked like web cameras and DVRs.&nbsp;

Ondřej Mokoš, Malware Researcher<h2>Vulnerabilities and Exploits: Chained Exploits and Sandbox Escapes &nbsp;</h2>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;In Q4, two significant local privilege escalation vulnerabilities in Windows were discovered to be actively exploited in the wild. These vulnerabilities underscore the need for robust sandboxing mechanisms. Additionally, recent findings have linked some of these exploits to advanced threat actors, further emphasizing the sophistication of modern cyberattacks.&nbsp;The first vulnerability, CVE-2024-49138, was found in the Windows Common Log File System Driver (CLFS.sys) and reported by CrowdStrike. This vulnerability allowed attackers to escalate their privileges, potentially compromising system security. While CrowdStrike did not provide specific details about the nature of the vulnerability or the identity of the actors exploiting it, the fact that it targeted a core Windows driver underscores its severity.&nbsp;&nbsp;Google reported the second vulnerability, identified as CVE-2024-49039, which involved an escape from the Windows AppContainer sandbox. This security feature in Windows is designed to provide a sandboxed environment for applications, running them with minimal privileges to isolate them from critical system components and each other, thereby reducing the risk of malware or malicious behavior affecting the broader system. However, this vulnerability allowed a low-privileged user to execute code at a medium integrity level, effectively bypassing AppContainer's protections. The discovery of this vulnerability underscores the ongoing challenges in maintaining robust application isolation.&nbsp;ESET later discovered that CVE-2024-49039 was being exploited in the wild. Attackers were observed chaining this vulnerability with a remote code execution flaw in Firefox, identified as CVE-2024-9680. According to ESET’s analysis, the attackers leveraged CVE-2024-49039 to escape the sandbox from the untrusted process level of Firefox’s content process to a medium integrity level. This chain of exploits demonstrates the sophistication of modern attacks, where multiple vulnerabilities are combined to achieve a specific goal.&nbsp;The technical details of CVE-2024-49039 reveal that the vulnerability relied on calling functions from an undocumented Remote Procedure Call (RPC) endpoint. This endpoint allowed the creation of a scheduled task, a function that should not have been callable from the untrusted process level. By exploiting this flaw, attackers were able to create a scheduled task that executed arbitrary applications at a medium integrity level. This action enabled them to elevate their privileges on the system and break out of the sandbox, effectively bypassing the intended security boundaries of the AppContainer.&nbsp;Adding to this complexity, ESET researchers uncovered a previously unknown vulnerability in Mozilla products that was being exploited in the wild by the Russia-aligned group RomCom. This marks at least the second time that RomCom has been caught exploiting a significant zero-day vulnerability in the wild. Earlier in June 2023, RomCom was linked to the exploitation of CVE-2023-36884 through Microsoft Word. The group’s involvement in exploiting CVE-2024-49039 highlights their capability to adapt and weaponize zero-day vulnerabilities for targeted attacks.&nbsp;The exploitation of these vulnerabilities underscores the importance of continuous monitoring and improvement in security mechanisms. The chaining of CVE-2024-49039 with CVE-2024-9680, along with RomCom’s exploitation of Mozilla products, illustrates how advanced threat actors can combine weaknesses in different components to achieve their objectives. Addressing such threats requires a multi-faceted approach, including rigorous patching practices, comprehensive vulnerability assessments, and robust application isolation mechanisms.&nbsp;In Q4/2024, we continued evaluating the main exploitation and post-exploitation frameworks targeting our users. While our telemetry indicated that the use of frameworks was on a downward trend for this quarter, Cobalt Strike was again the most prevalent strain, occupying 31% of the hits in this category.&nbsp;

To confirm whether the downward trend that marked this quarter is temporary or significative in time, we will continue to evaluate and monitor the evolution of the exploitation and post-exploitation frameworks in Q1/2025.&nbsp;&nbsp;Luigino Camastra, Malware Researcher&nbsp; David Álvarez, Malware Analyst&nbsp; Michal Salát, Threat Intelligence Director&nbsp;<h2 class="text-align-justify">Web Threats&nbsp;</h2>Web threats remain a key focus for our analysts, encompassing numerous sub-categories of scams. Despite attackers continuously introducing modified variations of old scams, the overall downward trend towards the end of the year persisted. The last quarter of the year saw an even further decline, with a 13% drop compared to Q3/2024. This decline was observed in most countries, although there are some exceptions, which we will cover later in the text.&nbsp;<h2 class="text-align-justify">Scams: A Worldwide Challenge&nbsp;</h2>A scam is a type of threat that aims to trick people into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;Despite a downward trend, we observe that certain detections have increased compared to the previous quarter. These detections primarily highlight the main reason for the success of today's scam threats: malvertising.&nbsp;For our regular readers, the concept of malvertising is well-known. However, it’s worth reiterating that the key factor in malvertising is its ability to target specific audiences. When advertisements are presented on social networks, for example, this targeting can be particularly effective because these platforms have access to more accurate and comprehensive user data. Additionally, many users perceive these platforms as safe, which can result in reduced awareness of potential threats. For example, our data indicates that some blocked scams originate from users who have been redirected from Meta's social networks.&nbsp;

In the below screenshot, you can see a notorious landing page. This illustration nicely shows the type of page to which users are redirected by some ads, sometimes resembling a tabloid article. This particular example is a financial scam. The right side of the screenshot shows another way such scams are spread: through push notifications, an increasing threat which we’ve highlighted in numerous reports and blogs. The screenshot also shows that this is a financial scam.&nbsp;

If we take a closer look at the chart below, Q4/2024 was the most active quarter for financial scams in 2024.&nbsp;

Financial scams come in many different packages; this constantly recycled social engineering attack can be presented to people, for example, with a narrative of weight loss advice or as medical scams – the ways in which scammers entice their victims is almost endless.&nbsp;If you look at the global heat map, you’ll see there is almost no place in the world that is not impacted by scams as 2024 comes to an end.&nbsp;&nbsp;

When examining the areas with highest chance of encountering a scam, Slovakia stands out with a risk ratio of 21.30%, although it experienced a slight decrease of 2% compared to the previous quarter. Vietnam follows closely with a risk ratio of 20.69%, showing a significant increase of 6%. Meanwhile, Czechia has a risk ratio of 19.87%, also seeing a 2% decrease from the previous quarter.&nbsp;Beyond the list of countries with the highest risk, several other countries experienced significant quarter-over-quarter changes. South Korea saw the most substantial increase, with a 20% increase to a final risk ratio of 7.51%. Australia also experienced a notable rise, with a risk ratio of 15.24%, increasing by 6%. The United Kingdom saw a significant increase, with a risk ratio of 14.26%, up by 3%.&nbsp;<h3 class="text-align-justify">CryptoCore Exploits U.S. Election and Elon Musk's Statements – $7M Stolen&nbsp;</h3>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;The <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore scam group</a> continued its operations in Q4/2024 with the same modus operandi of abusing high-profile events in the media, luring victims with promises of easy profits using deepfake videos. These attackers also leverage statements and actions by Elon Musk to make their scams appear more legitimate. In Q4/2024, their primary focus, as expected, was the U.S. presidential elections, further amplified by the involvement of Elon Musk.&nbsp;

The CryptoCore activity around the presidential election increased throughout October. The highest threat peak was on November 9, 2024, when Donald Trump won the presidential election in Arizona, completing a clean sweep of all seven battleground states and locking in a decisive electoral college victory over the Democratic Vice President Kamala Harris.&nbsp;If we compare the activities of CryptoCore across 2024, the presidential campaign was the most dangerous since we began <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">tracking the group</a>. The presidential campaign was even more significant than the highly destructive campaigns abusing the topics of the total solar eclipse and SpaceX flight.&nbsp;

The United States remains the country most affected by CryptoCore Scams, followed by the United Kingdom and Germany.&nbsp;&nbsp;

The deepfake videos used as CryptoCore lures used messages emphasizing Donald Trump as a visionary leader who understands innovation and the future of finance, particularly cryptocurrency. They claimed that Trump supports a platform for doubling cryptocurrency investments, presenting it as part of his vision for empowering individuals and revolutionizing financial systems. These scams touted Trump as an advocate for blockchain technology, cryptocurrency adoption, and deregulation to legitimize the fraudulent scheme.&nbsp;&nbsp;

Victims are targeted through hijacked YouTube accounts, which prioritize attackers' videos in search results using specific keywords. These videos typically contain a QR code, which redirects the victim to a well-designed fraudulent website featuring motifs of Elon Musk and Donald Trump.&nbsp;

As CryptoCore's activities escalated dramatically throughout the quarter, and our telemetry captured 3,500 cryptocurrency transactions linked to 500 crypto wallets with a total value of an estimated $7,000,000 in October through December alone. While this figure is a rough estimate, the actual amount could be higher, given the complexity of tracking illicit crypto wallets and abused platforms. Additionally, the sharp rise in the value of most cryptocurrencies used by CryptoCore has significantly increased the group's overall profit in this quarter.&nbsp;

An interesting event exploited by the attackers in Q4/2024 was Elon Musk's promise of a $1 million giveaway per day during the presidential election. Musk's himself added credibility to the CryptoCore scam, because if a real Musk is handing out <a href="https://www.vox.com/politics/378912/musk-trump-voting-contest-million-dollars-swing-state-lottery-pennsylvania" target="_blank" rel="noreferrer noopener">$1 million checks daily</a>, why couldn’t his "official event" be giving away hundreds of thousands in cryptocurrency? The attackers quickly seized the opportunity, creating a fake video based on the official giveaway event. This demonstrates how adept the attackers are at abusing media events to mislead people.&nbsp;We will repeat ourselves again: Always verify the legitimacy of such claims through official channels and avoid making any financial transactions without confirming the offer's authenticity.&nbsp;If it sounds too good to be true, it probably is.&nbsp;<h3 class="text-align-justify">Dating Scams: Love's Illusion&nbsp;</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit identity theft.&nbsp;When examining the risk ratios for dating scams, several countries have shown significant quarter-over-quarter changes. Iceland experienced the largest increase, with a risk ratio of 5.37%, up by 51%. This substantial rise indicates a growing concern for dating scams in the region.&nbsp;

Hungary and Czechia both saw notable increases of 7%, with risk ratios of 4.42% and 3.98%, respectively. Belgium also experienced a significant rise, with a risk ratio of 3.67%, up by 5%.&nbsp;&nbsp;In contrast, Germany and Norway had minimal changes in their risk ratios, with Germany remaining stable at 4.28% and Norway seeing a slight increase to 4.26%.&nbsp;

Overall, these statistics underscore the varying impact of dating scams across different regions.&nbsp;

<h3 class="text-align-justify">Tech Support Scams: Deceptive Assistance&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Japan remains a top target for tech support scams, with a risk ratio of 1.51%, up 14% from the previous quarter.&nbsp;

However, the most significant surge in tech support scams this quarter has been observed in Switzerland, where the risk ratio skyrocketed by 114% to 1.05%. This dramatic increase highlights a new hotspot for these scams.&nbsp;Austria also experienced a substantial rise, with a risk ratio of 1.06%, up by 68%. Similarly, Hong Kong saw a 43% increase, bringing its risk ratio to 0.96%, and Canada recorded a 35% rise, reaching a risk ratio of 0.80%.&nbsp;France continues to be a notable target, with a risk ratio of 1.07%, reflecting a 22% increase from the previous quarter.&nbsp;&nbsp;

Overall, while Japan remains a consistent hotspot, the significant increases in Switzerland, Austria, Hong Kong, Canada, and France indicate a broader and more dynamic threat landscape for tech support scams.&nbsp;

<h3>Email Threats: Unwrapping Christmas Email Scams&nbsp;</h3>The Email threats section tends to cover a wide range of scams targeting almost anyone with an email address. These scams take various forms, including fake invoices designed to mimic legitimate brands and trick recipients into making payments to the attackers. Extortion emails attempt to coerce victims into sending cryptocurrency by falsely claiming to have recorded compromising webcam footage. Lottery scams lure users to websites that offer deals too good to be true, while classic phishing emails falsely inform recipients that their password has expired in an attempt to steal credentials. This section will explore the common email scams that can land in your inbox and the tactics used by cybercriminals to exploit unsuspecting users.&nbsp;Christmas is always a fruitful period, not only for retailers but also for malicious actors. Regarding <a href="https://us.norton.com/blog/online-scams/phishing-email-examples">email scams</a>, the threat intensity remains relatively constant throughout the last quarter of 2024, maintaining a steady threat level. The only notable spike occurs in the weeks preceding Christmas, followed by a slight uptrend toward the end of the year. Attackers take advantage of this period to amplify their efforts, primarily because the end of the year is stressful for many people. As a result, individuals often let their guard down when checking their mailboxes, making them more susceptible to scams. This targeted approach likely makes attackers’ efforts more effective.&nbsp;&nbsp;

As shown on the below map, the red glow is most significant in North America, indicating that the United States and Canada are most affected by email scams. These countries also experienced a notable quarterly increase of 13%. Australia follows this trend closely, with a 10% quarterly rise. The Benelux countries also reported substantial numbers, reflecting high risk ratios. Furthermore, South Africa, France, and the United Kingdom have been significantly impacted.&nbsp;

Apple is one of the most targeted brands by email scams, notably iCloud. The reason for this is simple: scammers aim to exploit services that the majority of users rely on. By using notable cloud providers like Microsoft 365 or Google Drive, they increase their chances of success. The example shown below claims that users will lose their cherished data, incorporating a few prominent red flags. Below are three obvious key red flags in the email:&nbsp;<ol><li>Suspicious Email Address - The sender's email address (no-reply@781[.]qebsjbg...) does not match Apple's official domain (e.g., @apple.com or @icloud.com). A legitimate company like Apple always uses its verified domain.&nbsp;</li><li>Urgent and Threating language - The subject line and content use panic-inducing phrases like "LAST ALERT: ALL YOUR PHOTOS WILL BE DELETED!" and "Your photos and videos will be deleted!!". Scammers often use fear to pressure victims into acting quickly without verifying details.&nbsp;</li><li>Poor Grammar - The phrase "Failed to attempt payment" is grammatically incorrect. Professional emails from Apple or any major company are carefully crafted and free of errors. Additionally, the design feels inconsistent, with mismatched fonts, overly bright colors (e.g., "FULL" in red), and unpolished presentation.&nbsp;</li></ol>

Furthermore, the email code reveals additional issues that are not immediately apparent.&nbsp;<ol start="4"><li>DKIM Signature Failure - The DKIM signature in the email headers shows an error: dkim=permerror (no key for signature) and the domain 602.qunipameoxsp.us is not a verified or trusted sender. This suggests the email's integrity cannot be verified, which is a common sign of phishing emails.&nbsp;</li><li>Malformed Links - The hyperlink in the code (&lt;a href="https://storage[.]googleapis[.]com/loblaman996655/lobla.html#..."&gt;) redirects to a Google storage link instead of an Apple domain. Legitimate companies do not host critical account-related actions on third-party services like Google Storage.&nbsp;</li><li>Excessive Inline Styling and Obfuscation - The email contains overly complex and excessive inline CSS, such as numerous gradient styles and unnecessary hover effects (e.g., .divv:hover, .ligne:hover). These are often used by scammers to disguise malicious content and create a more "professional" appearance.&nbsp;</li></ol>This quarter, we conducted a deeper analysis of the scams our customers receive in their email inboxes. From a collection of malicious emails that we analyzed, we assessed the type of scams using the AI scam type classifiers based on the email displayed to the customer.&nbsp;&nbsp;Interestingly, the most prevalent type of scam was the e-shop scam, where the attackers try to lure people to fake shopping websites. These sites either take payments and never deliver the goods or collect data from users to sell or exploit in other ways. E-shop scams accounted for 51% of all scam emails in Q4/2024.&nbsp;

The second most prevalent category was gambling scams, where attackers trick people into placing bets on fake gambling platforms but refuse to pay out winnings. The third most prevalent category was investment scams, where attackers advertise fake investments promising high returns or guaranteed profits in stocks, forex, property, cryptocurrencies and other assets. Finally, the fourth category was political scams, where attackers take advantage of campaigns and elec21tions to scam people, for example by convincing them to contribute to fake campaigns.&nbsp;&nbsp;&nbsp;The statistics above represent the view for the whole quarter, however, towards the end of 2024, investment scams were on the rise and, in the last days of the year, there 15-25% of the daily analyzed samples were classified as investment scams.&nbsp;&nbsp;

A good example of an investment scam is displayed below. The scam in this case is luring people to click on the link to reveal the name of the cryptocurrency that is going to increase 150 times in the future. This is a common tactic used in scam emails, as the user can be redirected directly to a malicious website or asked to register and transfer funds that would never be retrieved.&nbsp;&nbsp;

<h3>Hidden Dangers of Fake E-Shops: Financial and Health Risks&nbsp;</h3>Fake shop scams involve fraudsters creating imitation online stores that appear legitimate and trustworthy. These fake shops often mimic well-known brands or use professional-looking websites to deceive customers. Victims are lured into making purchases, believing they are buying genuine products. However, the goods never arrive after payment or are of inferior quality.&nbsp;Fake e-shops, also known as scam shopping websites, pose significant consumer risks. A particularly alarming risk is to victim´s financial and physical health. Fake e-shops selling medications, supplements, or other health-related products may distribute unregulated or counterfeit drugs, which can be extremely dangerous. Additionally, falling victim to these scams often leads to financial losses and identity theft.&nbsp;The largest category of fake e-shops consists of stores selling clothing and pharmaceuticals. In terms of medications, the most requested products are drugs for male erectile dysfunction, which require a prescription. Using these medications without consulting a doctor can lead to serious health complications. Moreover, the origin of these drugs is uncertain, and they may be faked substitutes with dangerous side effects.&nbsp;The detected e-shops have been flagged as malicious due to several warning signs, such as the absence of a cookies consent popup, offering huge discounts, lack of clear contact information, and offering suspicious payment methods.&nbsp;&nbsp;

The payment gateways of fake e-shops are typically hosted on separate domains with valid certificates signed by untrustworthy certification authorities. Therefore, it isn't easy to immediately recognize that sensitive data is in danger since the certificate is valid from a technical perspective. However, this ensures the victim's data is securely delivered directly to the attackers. Additionally, the attackers often enhance the legitimacy of secure data transfer by using logos of reputable security companies.&nbsp;

Victims typically end up on fraudulent websites by searching for specific medications, often prescription drugs, and encountering fake sites offering enticingly low prices among the search results. Another standard method to distribute fake e-shops is through advertisements on Facebook, YouTube, and Instagram, amongst other platforms. Finally, the third most frequent method is through unsolicited emails and spam.&nbsp;In Q4/2024, we observed an increase in the activity of fake e-shops, which is an expected phenomenon during the holiday season as people are looking for attractive discounts and offers. The correlation between high-profile sales events, such as Black Friday and Christmas shopping, and the increase in scam incidents underscores the danger of online fraud during peak shopping seasons.&nbsp;

The dangers of fake e-shops go beyond financial loss. These sites can compromise personal data, leading to identity theft, unauthorized transactions, and long-term damage to credit scores. Recognizing the signs of a fake e-shop and understanding the risks involved are crucial for safe online shopping.&nbsp;<h3 class="text-align-justify">Phishing: A Year in Review&nbsp;</h3>Phishing is a type of online scam where fraudsters attempt to obtain sensitive information including passwords or credit card details by posing as a trustworthy entity in an electronic communication, such as an email, text message, or instant message. The fraudulent message usually contains a link to a fake website that looks like the real one, where the victim is asked to enter their sensitive information.&nbsp;In Q4/2024, we protected 14% more users against <a href="https://www.avg.com/en/signal/what-is-phishing">phishing</a> than in the previous quarter. Our data shows a diverse range of phishing activities, with some abused brands experiencing substantial increases in phishing attempts.&nbsp;

Let’s start with phishing attempts targeting Amazon. We saw a dramatic increase, with a malware share of 2.42%, up by 509% from the previous quarter. This surge highlights the growing exploitation of Amazon's brand to lure unsuspecting users. Some of this increase could also be related to attackers trying to take advantage of discount shoppers, which tends to be higher towards the end of the year.&nbsp;Despite a slight decrease of 1% in phishing activity for the brand, Microsoft remains a common target, with a malware share of 0.99%. This indicates a persistent threat level for users of Microsoft services.&nbsp;Phishing attempts targeting Facebook increased by 36%, resulting in a malware share of 0.68%.&nbsp;Financial institutions continue to be prime targets, with phishing attempts particularly for Chase increasing by 295%, leading to a malware share of 0.52%.&nbsp;&nbsp;The most notable increase in brands imitated for phishing purposes was observed with Wix, which saw an astounding 2840% rise in phishing activity, resulting in a malware share of 0.39%. This spike indicates a new focus on exploiting website-building platforms. We observed similar behavior last year with Weebly, but this time, Wix is the primary target.&nbsp;

Phishing attempts on Netflix also saw a substantial increase, with a 375% rise, leading to a malware share of 0.12%.&nbsp;&nbsp;Alexej Savčin, Malware Analyst&nbsp; Branislav Bošanský, Scientist&nbsp; Martin Chlumecký, Malware Research&nbsp;&nbsp; Matěj Krčma, Malware Analyst&nbsp; Nikola Groverová, Data Scientist&nbsp;<h2 class="text-align-justify">Mobile-Related Threats&nbsp;</h2>Mobile threats continues their evolution in Q4/2024 with several new strains and updates to existing ones. MobiDash adware made a resurgence fueled by a new Facebook campaign, distributing the ad-ridden threat to users worldwide by hiding in when installed and displaying out-of-context ads.&nbsp;New bankers join the fray, with DroidBot utilizing its RAT capabilities to go after banking details and cryptowallets, targeting several EU countries. The newcomer ToxicPanda also made its mark, disguised as Visa, dating apps and Chrome. With its ability to disable system monitoring used by banking apps, it can act on behalf of the user to initiate payments. Lastly, the NGate banker mentioned in the previous report was spotted in new countries, utilizing the same NFC relay technique to siphon money away from users.&nbsp;In the Spyware sphere, we saw a new strain sneak onto the Amazon app store, a rather novel distribution method. With its ability to record the screen and spy on victim’s SMS messages, it posed a threat until its prompt removal by Amazon. SpyLoans continue to be a persistent threat to users worldwide, harvesting private and personal information that is later used to extort victims. Several law enforcement agencies have made inroads in tackling this nefarious threat.&nbsp;<h3 class="text-align-justify">Web Threat Data within the Mobile Landscape&nbsp;</h3>Most blocked attacks on mobile devices in Q4/2024 were web-based, mirroring the previous quarter. Consumers are much more likely to encounter phishing websites, scams, malvertising and other web threats on their mobile devices than ever before. These threats can come in a variety of formats such as private messages, SMS and emails but also redirects on less reputable sites, unwanted pop ups and through other avenues.&nbsp;In contrast to these types of mobile scams, traditional on-device malware requires a more complex infection vector where the consumer must also install the malware. For proper functionality of most mobile malware, permissions need to be granted by the consumer first, which again lowers the chances of malicious activity being triggered.&nbsp;Hence, blocking web-threat based attacks is beneficial for the security of mobile devices, as malware actors often use them as an entry point to get the payload onto the mobile device of their victims.&nbsp;

The Dark Side of Social Media, CryptoCore Deepfakes Stole $7 Million, and More than 4 Million Users Protected from Scam-Yourself-Attacks 

Gen Q4/2024 Threat Report 

<h2 class="text-align-justify">Foreword&nbsp;</h2>The Gen Q3/2024 Threat Report is here, offering an in-depth look at the forces reshaping the threat landscape. Scams continued to dominate, while other serious threats—including malvertising, ransomware, droppers, and data-stealing malware—surged ahead. Many of these threats remain closely linked to scams, underscoring the relentless evolution of cybercriminal tactics.&nbsp;

One of the most alarming trends is the rise of “Scam-Yourself Attacks”—an advanced <a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering">social engineering</a> tactic that tricks users into compromising their own systems. This quarter alone, we protected over 2 million users from a variant called FakeCaptcha, which mimics CAPTCHA prompts to deliver malware. With a staggering 614% increase of these Scam-Yourself attacks quarter-over-quarter; social engineering, psychological manipulation tactics, continues to be one of the most dangerous tools in the cybercriminal arsenal.&nbsp;In addition, <a href="https://www.avast.com/c-what-is-ransomware">ransomware</a> threats escalated following a 24% increase in Q2/2024, with a further 100% rise in the risk ratio and number of protected users this quarter. This surge was primarily driven by the AliGater campaign, which delivered the Magniber ransomware. Remote Access Trojans (RATs) also saw a 26% increase, largely due to the spread of XWorm. Our researchers once again uncovered and disclosed a zero-day vulnerability, in the AFD.sys Windows driver, which was exploited in the wild by the Lazarus APT group and specifically targeted a nuclear power plant.&nbsp;Also, among the most significant changes this quarter, information stealer activity rose by 39% quarter over quarter, fueled by the rise of Lumma Stealer. This malware-as-a-service has rapidly gained prominence, fueled by the ultimate objective of data theft, employing various delivery methods like fake YouTube tutorials and abused GitHub repositories. Its ability to bypass protections has made it one of the most formidable threats this quarter.&nbsp;In other social engineering news, malvertising, one of the most persistent types of social engineering, grew this quarter by 18%. Crypto scams, particularly those orchestrated by groups like CryptoCore, have spiked, using deepfake technology to exploit media events and lure victims into fraudulent cryptocurrency schemes. Additionally, malicious browser push notifications surged by 166% in some regions such as Italy.&nbsp;Data stealing <a href="https://www.avg.com/en/signal/what-is-malware">malware</a> also increased on mobile devices in Q3/2024. Financial data theft by banking malware saw a 60% surge, with attacks like Rocinante targeting users in Brazil, while new threats like TrickMo and Octo2 emerged in Europe. <a href="https://us.norton.com/blog/malware/spyware">Spyware</a> also rose sharply, with a 166% spike driven by NGate, an advanced spyware targeting NFC data for ATM withdrawals. A common denominator for the main mobile threats seen this quarter is their delivery via malicious SMS messages. As part of our mobile section, we will also showcase the most prevalent scam types identified through our Norton Genie visibility in 2024 so far.&nbsp;As we look back on the quarter, it’s evident that the cybersecurity landscape is evolving rapidly, with new and sophisticated threats emerging across the board. From the growing impact of social engineering scams to the resurgence of malware, the challenges we face continue to escalate. We encourage you to explore the full scope of insights provided in this report to gain a clearer understanding of these threats and their implications.Jakub Křoustek, Malware Research Director<h2 class="text-align-justify">Methodology&nbsp;</h2>This report is structured into three main sections: Desktop-related threats, where we describe our intelligence around attacks targeting the Windows, Linux and Mac operating systems, with a specific emphasis on web-related threats and Mobile-related threats, where we describe the attacks focusing on Android and iOS operating systems.&nbsp;We use the term “risk ratio” in this report to denote the severity of specific threats. It is calculated as a monthly average of “Number of attacked users / Number of active users in a given country.” Unless stated otherwise, calculated risks are only available for countries with more than 10,000 active users per month.&nbsp;A blocked attack is defined as a unique combination of the protected user and a blocked threat identifier within the specified time frame.&nbsp;Our quarterly threat reports inform about the threat landscape situation as seen from the Gen family of Cyber Safety brands. We continuously enhance our threat telemetry and anticipate further refinements in our future reports.&nbsp;<h2 class="text-align-justify">Featured Story: "Scam-Yourself Attacks” Peak, Tricking Users Into Compromising Their Own Devices&nbsp;</h2>Picture this: You're at your desk, staring at a frustrating error message or a stalled software installation. In a hurry to find a solution, you turn to the Internet. There it is: a YouTube tutorial or an easy step-by-step guide, seemingly offering the perfect fix. With a few clicks, you're on your way to solving the problem. But instead of a solution, what you’ve really done is opened the door to a hidden threat, following a path laid out by cybercriminals.&nbsp;These types of attacks—what Gen has termed “Scam-Yourself Attacks”—are evolving faster than ever, and they’re proving highly effective. In fact, this quarter alone, we’ve seen a staggering 614% increase in these attacks. The term encompasses a variety of threats, from Fake Tutorials to ClickFix scams, FakeCaptcha tricks, and Fake Updates. Together, they form a broader web of deception that’s catching millions of users off guard.&nbsp;<h3 class="text-align-justify">A New Age of Cyber Trickery: Guiding Victims to Perform Their Own Attacks&nbsp;</h3>The landscape of cyberattacks has shifted. Gone are the days when malware simply hid in a suspicious email attachment or shady download. Now, attackers are using your curiosity, and your urgency to fix an issue, against you. They’ve weaponized what seem like harmless instructions to lure you in, and by the time you realize what’s happening, it’s already too late. Whether it’s through seemingly helpful tutorials or fake update prompts, cybercriminals are making you their accomplice.&nbsp;Let’s take a closer look at the different tactics that fall under the umbrella of “Scam-Yourself Attacks”, illustrating how they all work together to deceive.&nbsp;<h4>Fake Tutorials: The Trap Disguised as Help&nbsp;</h4>Imagine a cracked software installer you found online. Along with the software, there's a README file guiding you through the installation. It looks innocent enough, but buried in those instructions is a deadly line: "Disable your antivirus for this software to work properly". What you think is a helpful guide is, in fact, a direct invitation for malware to slip through your defenses.&nbsp;<ul><li>Cracked Software and README Files: These often come with hidden dangers. Cybercriminals cleverly disguise malicious steps within seemingly helpful guides. You follow the instructions, thinking it’s necessary for the installation, only to find you’ve opened the door for malware.&nbsp;</li></ul>

<ul><li>YouTube Tutorials: Another trick in the cybercriminals' playbook involves video tutorials. The video walks you through the process of installing software, but when you click the link in the comments to download it, you’re downloading malware instead. What started as a guide to help you ends with your device compromised. The worst part? You’re the one who clicked, copied, and executed the threat.&nbsp;</li></ul>&nbsp;

But there’s good news: whether you downloaded it from an unofficial website, YouTube, or even GitHub, security vendors like us don’t care where it came from. If it’s malicious, we detect it.&nbsp;<h4>ClickFix: The Illusion of Control&nbsp;</h4>Now imagine you’re trying to fix a problem on your computer—an annoying Windows error code, perhaps. You find what appears to be a genuine solution online. It asks you to copy a script to your clipboard, paste it into the command prompt, and hit Enter. You follow along, thinking you’re resolving the issue, but, in reality, you’ve just run a piece of malware that opens the floodgates to attackers.&nbsp;This is ClickFix, a specific form of so-called Fake Tutorial campaigns where users are misled into performing steps that ultimately compromise their own devices.&nbsp;

The illusion here is control—cybercriminals know you’ll follow the steps because they seem like a straightforward fix. &nbsp;<h4>FakeCaptcha: When Familiarity Breeds Danger&nbsp;</h4>Think about how often you’ve encountered CAPTCHA’s, the little “I’m not a robot” checkboxes. We’ve become so used to them that we rarely question their legitimacy. Cybercriminals know this, and they’re taking advantage. They’ve created <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha</a>—a variant of ClickFix—designed to resemble a real CAPTCHA, tricking you into following steps that lead straight to infection.&nbsp;<ul><li>How It Works: You land on a compromised website or a malicious page, and a CAPTCHA pops up. After clicking “I am not a robot” a script is quietly copied to your clipboard, and you’re prompted to run it. Following these instructions results in malware silently taking over your system.&nbsp;</li></ul>

It’s a perfect example of how attackers exploit familiarity. The CAPTCHA looks real, but the consequences are all too dangerous. What’s happening behind the scenes is that the script acts as a dropper—downloading further malware onto your system, often the infamous <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">Lumma Stealer</a>, one of the most advanced information stealers out there today. In Q3/2024, we observed a surge in Lumma Stealer campaigns, which are discussed in more detail in the Information Stealers section of this report.&nbsp;<h4 class="text-align-justify">ClearFake and Fake Updates: Changing Strategies&nbsp;</h4>ClearFake is a threat actor primarily known for using the Fake Update tactic, where users are tricked into downloading malware disguised as a browser update. This quarter we saw something interesting – ClearFake adapted. They started using the ClickFix tactic in certain campaigns, showing that threat actors are willing to shift strategies when one method proves more effective than another.&nbsp;Typically, ClearFake presents users with what looks like a legitimate browser update page. Once users download the "update," they end up with malware instead. But, this quarter, they also employed ClickFix, guiding users to copy and paste scripts, much like other Fake Tutorials.&nbsp;The Fake Update screens can take many, and often truly legitimate-looking, forms. As an example, in <a href="https://x.com/GenThreatLabs/status/1840762181668741130" target="_blank" rel="noreferrer noopener">this campaign</a> we spotted WarmCookie backdoor being distributed, allowing the adversaries to execute a variety of commands on the victim’s PC.&nbsp;

In a new twist, ClearFake’s latest adaptation combines elements of both Fake Updates and ClickFix. Users encounter a familiar update prompt, suggesting a necessary browser update. However, instead of a one-click download, users are instructed to follow steps: copying a malicious script to their clipboard and pasting it into a PowerShell prompt, effectively giving the script administrator privileges. This approach requires users to feel fully involved in the update process, making them unknowingly complicit in infecting their own devices. It’s a deceptive blend of familiarity and manipulation, designed to take advantage of users’ reliance on routine updates.&nbsp;

<h4>How Big Is This Problem?&nbsp;</h4>In Q3/2024, we protected over 2.1 million users from FakeCaptcha attacks alone. Think about that—millions of people almost fell for it. This is just one piece of a much larger puzzle. The risk ratio for the entire “Scam-Yourself Attacks” category surged by over 614%, demonstrating just how widespread and global these attacks have become. Countries like Italy, Argentina, the Philippines, France, Spain, and Indonesia are among those facing the highest risk ratios for these attacks.&nbsp;

<h4>Conclusion: The Hidden Dangers of "Scam-Yourself Attacks"&nbsp;</h4>In a world where we rely on quick fixes and familiar online prompts, Scam-Yourself Attacks have become a cybercriminal’s dream. Users are unknowingly following instructions that do the attackers’ bidding for them, whether through fake CAPTCHAs, misleading YouTube tutorials, or cleverly disguised README files. &nbsp;What’s more troubling is how effortlessly these scams blend into our daily digital lives. We’ve grown so used to CAPTCHAs and quick-fix guides that we often forget to stop and question them. Also, almost every application needs to be up-to date and if it isn’t, users commonly see screens and dialogues prompting the (mandatory) update. In the hands of cybercriminals, our trust in these familiar formats becomes their most powerful weapon.&nbsp;As these campaigns evolve, one constant remains: they thrive on user deception and manipulation. The question isn’t whether these fake tutorials will persist, but how we will recognize and navigate them before it’s too late.&nbsp;&nbsp;Jan Rubín, Malware Researcher Luis Corrons, Security Evangelist<h2 class="text-align-justify">Desktop-Related Threats&nbsp;</h2><h3 class="text-align-justify">Advanced Persistent Threats (APTs): Evolution of FudModule&nbsp;</h3>An Advanced Persistent Threat (APT) is a type of cyberattack that is conducted by highly skilled and determined hackers who have the resources and expertise to penetrate a target's network and maintain a long-term presence undetected.&nbsp;Over the past quarter, the Lazarus group has once again demonstrated its expertise in stealth and innovation, proving its status as one of the most dangerous cybercriminal organizations. Among the various APTs we’ve been tracking, Lazarus has leveraged sophisticated tools like the FudModule rootkit and has also been using zero-day vulnerabilities to evade detection while orchestrating their cyberattacks.&nbsp;In early June, we identified that Lazarus was exploiting a new zero-day vulnerability in the Winsock driver (CVE-2024-38193). This vulnerability allowed attackers to achieve local privilege escalation (LPE), granting them the ability to deploy the FudModule v3.0 rootkit on targeted systems.&nbsp;On August 19, 2024, <a href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" target="_blank" rel="noreferrer noopener">Microsoft identified</a> two additional zero-day vulnerabilities that are actively being exploited in the wild. The first of these vulnerabilities is a remote code execution (RCE) flaw in Chromium, designated as CVE-2024-7971. This RCE exploit allows attackers to execute code within the sandboxed Chromium renderer process.&nbsp;Once the exploit is triggered, it deploys shellcode that contains a Windows sandbox escape exploit (CVE-2024-38106). This sequence of events ultimately leads to the download and loading of the FudModule rootkit directly into memory.&nbsp;The sandbox escape exploit specifically targets a vulnerability in the Windows kernel. By leveraging this weakness, the Lazarus Group can successfully load the FudModule rootkit into memory, thereby enhancing their capabilities in executing further attacks.&nbsp;The FudModule rootkit itself has undergone significant evolution in its latest version. In addition to its standard arsenal of tools for evading detection and disabling security measures, <a href="https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3" target="_blank" rel="noreferrer noopener">FudModule v3.0</a> now includes new capabilities designed to complicate incident response efforts. One of the most notable features is its ability to disable crash dumps, which are often critical for post-incident analysis. By blocking this functionality, FudModule makes it difficult for security teams to trace the root cause of an infection or reconstruct the sequence of events leading up to an attack.&nbsp;Moreover, FudModule v3.0 is more closely integrated with the payloads it seeks to protect. It injects its payload into a process secured by the Protected Process Light (PPL) framework, a feature typically used to safeguard critical system processes. This integration makes it more difficult for security solutions to detect and remove the malicious payload, as it benefits from the same protections afforded to legitimate system processes.&nbsp;Given these extensive changes, we have classified this version as FudModule v3.0, reflecting the significant advancements it embodies. It has evolved from being a standalone rootkit designed to disable security defenses into a more versatile tool that also actively protects the malicious payload from detection and removal.&nbsp;Several other advanced persistent threat (APT) groups remain highly active across Southeast Asia. One notable actor, MustangPanda, is conducting extensive operations in Myanmar, deploying various backdoors to infiltrate victims’ systems. These attacks are primarily aimed at document theft, with the stolen data being exfiltrated to MustangPanda’s command-and-control (C2) servers. Myanmar continues to be one of the most targeted nations in the region, but we’ve also observed significant APT-related activity across India, the Philippines, Hong Kong, Vietnam, and Cambodia.&nbsp;In addition, several government websites in various Asian countries have been compromised and infected with a JavaScript (JS) backdoor. This backdoor is capable of gathering information from victims and executing encrypted JS modules sent from its C2 server. The malware attempts to exploit a vulnerability in WPS Office, similar to one previously detailed in an ESET report, to achieve remote code execution on targeted machines.&nbsp;We have reported multiple vulnerabilities to Kingsoft, the developer of WPS Office, to address these vulnerabilities.&nbsp;Luigino Camastra, Malware Researcher Igor Morgenstern, Malware Researcher<h3>Bots: Distributed Mess of IoT</h3>Bots are threats mainly interested in securing long-term access to devices with the aim of utilizing their resources, be it remote control, spam distribution, or denial-of-service (DoS) attacks. &nbsp;While this quarter was significantly less rich in terms of law enforcement agency activities compared to the last quarter, it wasn’t eventless. The FBI attempted to take down the Raptor Train botnet that was using SOHO routers, IP cameras, NAS storages and other similar devices as proxies for further attacks. According to their <a href="https://www.justice.gov/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state" target="_blank" rel="noreferrer noopener">report</a>, this botnet was maintained by People’s Republic of China state-sponsored hackers working for the Integrity Technology Group company. The FBI dispatched a command that used the malware's native functionality to disable the malware. This was also noticed by the threat actor who unsuccessfully tried to interfere with these remediation efforts by launching a DDoS on the operational infrastructure.&nbsp;We will use DDoS as a segue to another new botnet that was discovered in September and has been dubbed Gorilla Botnet. Unsurprisingly, the Gorilla Botnet also consists of breached vulnerable IoT devices and is based on a modifier Mirai source code. Coincidentally, Cloudflare reported that it was hit by a world record 3.8 Tbps DDoS attack during September. As if that wasn’t enough for September, a new vulnerability in a common Linux software (Common UNIX Printing System – CUPS) with a huge amplification factor of 600 was discovered.&nbsp;But it’s not all bad news in the world of Bots: the NoName057 group that is behind the DDosia project is still in stagnation. This quarter they came out of hiding to target European banks but, thankfully, the targeted banks were successful in mitigating these attacks. The group presumably tried to improve their success rate by targeting websites of small and usually regional institutions (e.g. regional road maintenance companies). While these attacks were often successful, their impact has been very limited due to the website’s relative irrelevance. The only significant deviation followed the Ukrainian incursion into the Kursk Oblast, when DDosia switched targeting to Ukrainian targets for a few days before returning to their usual operation. We have also noticed that NoName057 is more frequently cooperating with other groups such as CyberArmyofRussia, HackNeT, CyberDragon, and KaliHunt/Russia to coordinate their DDoS attacks.&nbsp;Another prolific botnet, Twizt, &nbsp;underwent frequent updates during September in comparison to the previous month. No significant changes were observed in these updates neither in design nor modulus used to decrypt messages.&nbsp;

<h3 class="text-align-justify">Information Stealers: Lumma is Everywhere&nbsp;</h3>Information stealers are dedicated to stealing anything of value from the victim’s device. Typically, they focus on stored credentials, cryptocurrencies, browser sessions/cookies, browser passwords and private documents.&nbsp;When it comes to information stealers, this quarter was wild. In particular, we observed Lumma Stealer, one of today’s most advanced stealers, being spread globally – and fast. New GitHub campaign? Lumma. Fake tutorial YouTube videos? Lumma. Requests on Steam accounts usernames? Lumma. The numbers are staggering: Lumma increased its information stealers malware share by a massive 1154% this quarter. Let’s dive into some of the campaigns in more detail to explain why this isn’t a typo but rather the effect of broad and varied campaigning.&nbsp;&nbsp;Everything started with a <a href="https://www.gendigital.com/blog/news/innovation/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">surge of FakeCaptcha</a> campaigns, which we also described in our Featured Story in this quarterly issue. These campaigns, usually <a href="https://x.com/GenThreatLabs/status/1827007175627010077" target="_blank" rel="noreferrer noopener">carried over by malvertising</a>, executed more than 2.1 million attacks on our customers &nbsp;in &nbsp;Q3/2024 alone. According to our observations, in most of the cases, these campaigns were spreading Lumma Stealer. The copied PowerShell script to clipboard, which is supposed to be executed in the Run prompt (Win+R), is usually either downloading Lumma Stealer directly in a form of an archive or uses a variety of different intermediary loaders to do the job. Most of the time, we observed HijackLoader (/IDAT Loader) being used to load Lumma.&nbsp;We’ve seen FakeCaptcha being utilized by many different actors with many of those changing the CAPTCHA appearance just a little, as could be observed during the <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">AliGater malvertising</a> campaigns. These campaigns were spreading Lumma Stealer Magniber ransomware. An interested reader can find more information about this threat in the Vulnerabilities and Exploits section of this issue.&nbsp;We also observed quite a few GitHub campaigns, both in the form of polluting repositories with pull requests containing links to malware (= Lumma, again) and <a href="https://www.gendigital.com/blog/news/innovation/lumma-stealer-github" target="_blank" rel="noreferrer noopener">directly in the comments</a>. Thankfully, these dangerous comments are frequently written in poor English, alerting some to the potential risk. This red flag, however, might become less common in the near future with better availability and common adaptation of generative AI.&nbsp;

Finally, Lumma Stealer has launched another interesting approach, rotating C&amp;C addresses in the form of <a href="https://x.com/GenThreatLabs/status/1826232224179687468" target="_blank" rel="noreferrer noopener">account usernames on Steam</a>. These usernames are usually encrypted by a simple Caesar substitution cipher. In an example below, the C&amp;C addresses can be decrypted by applying ROT-15. Leveraging online platforms like this has underlying positive aspects for the attackers,&nbsp; allowing them to rotate the C&amp;C just by changing the username to reflect the new address.&nbsp;

<h4 class="text-align-justify">App-Bound Encryption Bypass&nbsp;</h4>Since the adaptation of <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">App-Bound encryption</a>, which we discussed in the Q2/2024 report, malware developers behind various information stealers were quite busy with figuring out bypasses of this enabled-by-default hardened protection of browser cookies in Google Chrome.&nbsp;We observed many discussions, particularly on Telegram, about approaches to bypass the protection, along with some authors bragging that they already achieved the bypass.&nbsp;

Lumma Stealer is not alone in this, however; we’ve observed similar reports throughout the past quarter from PovertyStealer, Vidar, StealC, WhiteSnake and Meduza, to name a few.&nbsp;There were many different discussions by threat actors regarding how to perform the actual bypass, showcasing the urgency with which information stealer developers were trying to address this protection. For example, developers behind Vidar were considering using a <a href="https://x.com/g0njxa/status/1833894122710515954" target="_blank" rel="noreferrer noopener">TPM module for encryption</a>.&nbsp;Even though the specific bypasses might vary and are still in the testing and development phases, one method stands out and, as usual, it feels like the simplest method wins it all.&nbsp;As recently reported by <a href="https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/" target="_blank" rel="noreferrer noopener">SpyCloud Labs in a blogpost</a>, malware can use specific parameters while starting a new instance of Chrome as described <a href="https://mango.pdf.zone/stealing-chrome-cookies-without-a-password" target="_blank" rel="noreferrer noopener">in the original Mango PDF Zone publication</a>. More specifically, malware can use “--remote-debugging-port=” parameter to listen for a debugger connection. After that, the malware can attach to Chrome via a URL dedicated for DevTools (remote debugger), create a WebSocket and send a message to retrieve the cookies. This can be combined with other common means of hiding such newly created windows, for example by using a “--window-position=” parameter to set the window position outside of the victim’s screen which also avoids the use of standard WinAPI functions.&nbsp;We can (unfortunately) confirm from our research that malware truly doesn’t need any special permissions or user interaction whatsoever. We have found traces of previous misuses, indicating that this approach might <a href="https://issues.chromium.org/issues/40050335" target="_blank" rel="noreferrer noopener">not be fully patched yet</a>.&nbsp;Another recent method, <a href="https://x.com/xaitax/status/1850500705074700298" target="_blank" rel="noreferrer noopener">reported by Alexander Hagenah</a>, for bypassing the App-Bound Encryption uses Chrome’s internal COM-based IElevator service. This bypass requires admin privileges to copy the executable into %PROGRAMFILES%\Google\Chrome\Application folder. This is required since Chrome’s App-Bound encryption is also performing path validation.&nbsp;Cases like this demonstrate that information stealers, especially the ones offered as Malware-as-a-Service, put everything on the line to keep their mass-theft campaigns going, and we can only expect this endless cat-and-mouse game to continue.&nbsp;<h4 class="text-align-justify">Statistics&nbsp;</h4>The risk ratio of getting an Information stealer increased by 39% in Q3/2024, due in large part to the vast campaigns distributed by Lumma Stealer. These campaigns also shifted the whole information stealers market quite a bit, putting Lumma Stealer on a pedestal.&nbsp;

We also observed risk ratio increase in almost all regions with a greater userbase:&nbsp;<ul><li>France: 135%&nbsp;</li><li>Japan: 128%&nbsp;</li><li>Slovakia: 127%&nbsp;</li><li>Canada: 48%&nbsp;</li><li>Spain: 34%&nbsp;</li><li>Brazil: 27%&nbsp;</li><li>United States: 22%&nbsp;</li><li>Czech Republic: 9%&nbsp;</li></ul>

Lumma Stealer now has the largest malware share with 30.95%, a 1154% increase over the previous quarter. Many of the other information stealers had an expected comparative decrease in their malware share (the shift caused by Lumma Stealer), though not all of them. SnakeKeylogger also increased its malware share, with a significant 461% increase.&nbsp;Compared to the previous quarter, in Q3/2024 AgentTesla decreased in malware share by 49%, Ramnit by 30%, and Fareit by 24%. FormBook, however, stayed the same, without any shifts in its malware share.&nbsp;Note that these shifts, especially the decreases, don’t indicate there would be less of such infections across our userbase. This only means that comparatively to each other the malware families are less common, and it doesn’t necessarily reflect they are less prevalent themselves.&nbsp;The most common information stealers with their malware shares in Q3/2024 were:&nbsp;<ul><li>Lumma Stealer (30.95%)&nbsp;</li><li>AgentTesla (17.23%)&nbsp;</li><li>FormBook (8.97%)&nbsp;</li><li>Ramnit (8.39%)&nbsp;</li><li>Fareit (5.36%)&nbsp;</li><li>SnakeKeylogger (3.95%)&nbsp;</li><li>RedLine (3.38%)&nbsp;</li><li>Lokibot (2.06%)&nbsp;</li><li>Vidar (1.58%)&nbsp;</li><li>ViperSoftX (1.43%)&nbsp;</li><li>StealC (1.17%)&nbsp;Jan Rubín, Malware Researcher</li></ul><h3>Ransomware: The Rise and Decline of Magniber&nbsp;</h3>Ransomware is any type of extorting malware. The most common subtype is the one that encrypts documents, photos, videos, databases, and other files on the victim’s PC. Those files become unusable without decrypting them first. To decrypt the files, attackers demand money, “ransom”, hence the term ransomware.&nbsp;Ransomware is a business that certainly does not go away. According to a <a href="https://www.chainalysis.com/blog/2024-crypto-crime-mid-year-update-part-1/" target="_blank" rel="noreferrer noopener">report</a> published by Chainalysis, the amount of $459,800,000 paid by ransomware victims in the first half of 2024 will set a new yearly record, should the payments continue at the same speed for the rest of the year.&nbsp;Magniber Surge&nbsp;Because most of the big ransomware groups focus on attacking corporations, trends in the consumer segment do not change much on a quarterly basis. However, the trend changed in Q2/2024 when <a href="https://www.gendigital.com/blog/news/innovation/q2-2024-threat-report" target="_blank" rel="noreferrer noopener">we noted</a> a 24% increase of ransomware threats, a trend that is continuing in Q3/2024. Further, in August there was a surprising anomaly detected by our sensors: a rapid increase in blocked URLs related to ransomware:&nbsp;

Whilst normally we block less than a hundred of such URLs per day, the number quickly escalated to about 8 thousand per day. <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">We analyzed the URLs</a>, and one of the final payloads was the Magniber ransomware.&nbsp;The Magniber ransomware first emerged in 2017 and has many of the typical ransomware features:&nbsp;<ul><li>Uses known vulnerabilities (<a href="https://nvd.nist.gov/vuln/detail/CVE-2011-3402" target="_blank" rel="noreferrer noopener">CVE-2011-3402</a> in this case)&nbsp;</li><li>Runs as a code injected to other processes&nbsp;</li><li>Uses direct Windows system calls&nbsp;</li></ul>Unfortunately, Magniber ransomware is undecryptable without having the private RSA key, but there are some interesting technical details in this ransomware.&nbsp;Samples related to Magniber ransomware (not just the ransomware itself, but also droppers and downloaders) typically use system calls directly. Using of system calls by Windows applications is strongly discouraged - not only they are undocumented, but they may also change in any new build of Windows. Applications should rely on documented API (such as <a href="https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea" target="_blank" rel="noreferrer noopener">CreateFile()</a>) instead.&nbsp;Magniber ransomware relies on those system calls to perform tasks such as memory allocation or file modification. The reason they do this is because it is more difficult for AV solutions to detect its activity – system calls cannot be intercepted by user mode applications.&nbsp;The following two pictures show a system call in Windows and in Magniber code:&nbsp;

Magniber samples in this campaign do not directly check the Windows version; instead, the way they use system calls only makes sense in Windows 7. This means that this wave of Magniber attacks targets Windows 7 operating system – an outdated one which has only about <a href="https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide" target="_blank" rel="noreferrer noopener">4% of market share</a>.&nbsp;When Magniber encrypts user’s files, it creates a ransom note file that is highly obfuscated:&nbsp;

After deobfuscation, victims can see this message:&nbsp;

The wave of Magniber ransomware lasted about a month, concluding abruptly after September 19 and returning to the old values. However, this campaign and activity of other ransomware strains led to a 100% increase of ransomware activity quarter over quarter.&nbsp;<h4>Decrypted: Mallox ransomware&nbsp;</h4>On better news, we are happy to share that we have launched another free-decryption tool for ransomware victims this quarter. During analysis of the Mallox ransomware, we discovered a flaw in the cryptographic operations. Files encrypted by Mallox ransomware (from January of 2023 to about February 2024) can be decrypted. Files encrypted by Mallox ransomware that can be decrypted are identified by the following extensions:&nbsp;<ul><li>.bitenc&nbsp;</li><li>.ma1x0&nbsp;</li><li>.mallab&nbsp;</li><li>.malox, .mallox, .mallox, .malloxx&nbsp;</li><li>.xollam&nbsp;</li></ul>Victims of the ransomware whose files have one of the above extensions can decrypt data for free using our <a href="https://www.gendigital.com/blog/news/innovation/decrypted-mallox-ransomware" target="_blank" rel="noreferrer noopener">Mallox ransomware decryptor</a>..&nbsp;From March 2024, we have seen new variants of Mallox. Those have different file extensions (see below) and decrypted:&nbsp;<ul><li>.hmallox&nbsp;</li><li>.rmallox&nbsp;</li><li>.x60X60&nbsp;</li></ul><h4 class="text-align-justify">Statistics&nbsp;</h4>Ransomware continues to gain momentum with each passing quarter. In Q3/2024, we have seen a 100% increase in terms of risk ratio and the number of protected users:&nbsp;

We can see the same surge of Magniber that we saw in the previous part. It also impacted the overall increased risk ratio in many countries, including:&nbsp;<ul><li>Bosnia and Herzegovina (930%)&nbsp;</li><li>France and Serbia (both 900%)&nbsp;</li><li>Hungary (700%)&nbsp;</li><li>Slovakia and Greece (630%)&nbsp;</li><li>Romania (620%)&nbsp;</li><li>Poland (550%)&nbsp;</li><li>Spain (300%)&nbsp;</li><li>Germany (200%)&nbsp;</li></ul>The overall risk ratio in Q3/2024 is shown here on the map:&nbsp;

Ladislav Zezula, Malware Researcher Jakub Křoustek, Malware Research Director<h3 class="text-align-justify">Remote Access Trojans (RATs): XWorm Gone but Attacks Persist&nbsp;</h3>A Remote Access Trojan (RAT) is a type of malicious software that allows unauthorized individuals to gain remote control over a victim's computer or device. RATs are typically spread through social engineering techniques, such as <a href="https://www.avast.com/c-phishing">phishing</a> emails or infected file downloads. Once installed, RATs grant the attacker complete access to the victim's device, enabling them to execute various malicious activities, such as spying, data theft, remote surveillance and even taking control of the victim's webcam and microphone.&nbsp;While this quarter did not bring much in terms of major events in the RAT world, the overall activity and risk ratio increased considerably – by 26%. This increase can be seen in the comparison of Q2 and Q3/2024 below. It is also evident that the risk ratio, and therefore the number of protected users, is increasing towards the end of the quarter.&nbsp;

Most countries saw an increased risk ratio of RATs in Q3/2024, with the notable exception of Canada. Two strains drove the values up in the last two quarters: XWorm in Q1/2024 and Remcos in Q2/2024. This quarter, users in Canada were finally able to "catch a break" since we did not see any large-scale campaigns there, according to our data.&nbsp;The largest increase in risk ratio was observed in Serbia (+114%) followed by Indonesia (+107%) and Greece (+95%). According to our data, the most prevalent strain among RATs is Remcos and has been for some time. Its activity is the decisive factor in the risk ratio for nearly any country. However, in Serbia Remcos was joined by XWorm which saw a protected user increase of a staggering 4500%. This large increase is due to XWorm's move from a nearly non-existent threat in Serbia in previous quarters to being number two behind Remcos. In Greece, we saw an increase of 600% in the number of protected users for QuasarRAT.&nbsp;As usual, the list of countries with the highest risk ratio overall did not change, with Afghanistan in the lead, followed by Iraq and Yemen. Contrary to the previous claim about Remcos, HWorm and njRAT are the most prevalent in these regions.&nbsp;The safest countries regarding RAT infection in Q3/2024 are France, Belgium and Sweden. Interestingly, we do not see Remcos as the top threat in Sweden but rather XWorm and njRAT.&nbsp;

Compared to Q2/2024, the number of protected users from XWorm has increased by 190%. The timing of this surge coincides with XWorm going "off the grid": this RAT was previously sold via an online shop where, presumably, the developer published announcements of new versions showcasing added features. To the best of our knowledge, this shop is now inactive. We might speculate whether the development has stopped or gone private and whether XWorm moved to other sale channels.&nbsp;The most prevalent RAT strains for Q3/2024 are as follows:&nbsp;<ul><li>Remcos&nbsp;</li><li>HWorm&nbsp;</li><li>njRAT&nbsp;</li><li>AsyncRat&nbsp;</li><li>XWorm&nbsp;</li><li>QuasarRAT&nbsp;</li><li>Gh0stCringe&nbsp;</li><li>FlawedAmmyy&nbsp;</li><li>Warzone&nbsp;</li><li>NanoCore&nbsp;</li></ul>In other news, researchers from <a href="https://www.kaspersky.com/blog/new-exotic-rat-sambaspy/52179/" target="_blank" rel="noreferrer noopener">Kaspersky</a> have discovered a new RAT called SambaSpy. SambaSpy has the full feature set typical of modern RATs, including file management, the ability to steal sensitive information and remote desktop control of the infected system. Originally, SambaSpy was targeting only Italian users by checking the system language. Kaspersky suggested that it might have been for testing purposes and noted that the attackers have since removed this check. The infection vector looks fairly common for this kind of threat. An unsolicited email redirects users to a site delivering a PDF document with another link which then delivers a dropper responsible for installing the final payload. Both the dropper and the payload are written in Java.&nbsp;Ondřej Mokoš, Malware Researcher<h3 class="text-align-justify">Vulnerabilities and Exploits: Beware, AliGater Seen in Europe&nbsp;</h3>Exploits take advantage of flaws in legitimate software to perform actions that should not be allowed. They are typically categorized into remote code execution (RCE) exploits, which allow attackers to infect another machine, and local privilege escalation (LPE) exploits, which allow attackers to take more control of a partially infected machine.&nbsp;Attackers continue to exploit zero-day vulnerabilities and target unpatched systems. In this section, we explore recent findings, including multiple zero-day vulnerabilities in critical system components such as the Winsock driver (AFD.sys), Chromium’s V8 JavaScript engine, and the Windows kernel. These vulnerabilities have been leveraged by advanced persistent threat (APT) groups to deploy sophisticated rootkits like <a href="https://www.gendigital.com/blog/news/innovation/lazarus-fudmodule-v3" target="_blank" rel="noreferrer noopener">FudModule v3.0</a>. Additionally, we highlight the new AliGater campaign, which is rapidly spreading across outdated Windows systems in Europe via malicious advertising, further exposing users to dangerous malware such as Magniber Ransomware and Lumma Stealer.&nbsp;We discovered and disclosed a zero-day vulnerability (CVE-2024-38193), that was exploited in the wild, which was used to target a nuclear power plant. It is a user-after-free vulnerability found in the AFD.sys (Winsock driver), which provides kernel-mode support for the Windows socket interface used in network communication. In this instance, attackers discovered a method to exploit the vulnerability in the default driver without needing administrator privileges to interact with it. They identified a zero-day vulnerability in the AFD.sys that allowed them to gain read/write (R/W) access in kernel space.&nbsp;Microsoft recently discovered two additional zero-day vulnerabilities being actively exploited in the wild, as mentioned in the APT section. The first, CVE-2024-7971, is a type of confusion vulnerability in the V8 JavaScript and WebAssembly engine, affecting versions of Chromium prior to 128.0.6613.84. This flaw arises when a program mistakenly interprets a variable as a different data type than intended, potentially leading to memory corruption and arbitrary code execution.&nbsp;The second, CVE-2024-38106, is a use-after-free vulnerability in the Windows kernel. It is triggered by incorrect handling of timers (KTIMER2) within the Worker Factory object via the function NtSetInformationWorkerFactory. This exploit was designed to escape Chromium’s sandbox, allowing the deployment of the FudModule rootkit. Once deployed, it uses Direct Kernel Object Manipulation (DKOM) techniques to interfere with security vendors and bypass security mechanisms.&nbsp;<h4 class="text-align-justify">AliGater&nbsp;</h4>The new AliGater campaign is targeting home users in Europe who are still using outdated Windows operating systems and vulnerable versions of Google Chrome. The campaign primarily spreads through malvertising, where attackers embed malicious ads into legitimate websites to infect users’ machines with dangerous malware.&nbsp;Malicious advertisements redirect users to a fake CAPTCHA page, which is used to launch a multi-stage attack. Exploits in Chrome’s V8 JavaScript engine (CVE-2023-2033) and Windows TrueType font parsing (CVE-2011-3402) are then used to deliver the malware payload such as Magniber Ransomware and Lumma Stealer.&nbsp;Although Windows 7 represents only about 4% of the global operating system market, this still translates into millions of vulnerable machines. The consequences are severe, as AliGater spreads rapidly among outdated systems, making users easy targets for exploitation. Detailed information about the infection chain is available on <a href="https://www.gendigital.com/blog/news/innovation/aligater" target="_blank" rel="noreferrer noopener">our blog</a>.&nbsp;The campaign is focused predominantly on Eastern Europe, primarily Balkan states, and thousands of victims have already been identified in countries such as France, Poland, Italy, Spain, Turkey and Hungary.&nbsp;

To protect against the AliGater campaign and its associated malware, it is essential to use up-to-date operating systems and browsers. Home users and businesses should ensure they are running supported versions of Windows and keep their browsers patched against known vulnerabilities.&nbsp;<h4 class="text-align-justify">Cobalt Strike &nbsp;</h4>In Q3/2024, we also evaluated the main exploitation and post-exploitation frameworks targeting our users. Our telemetry indicates that <a href="https://www.cobaltstrike.com/" target="_blank" rel="noreferrer noopener">Cobalt Strike</a> was the more prevalent framework in the quarter. To be more precise, Cobalt Strike was 84.4% more prevalent than Metasploit, and&nbsp; 274.7% more prevalent than BeefProject.&nbsp;

We will continue to evaluate and monitor the evolution of Cobalt Strike, Metasploit, BeefProject, Brute Ratel, Merlin and all the rest of the frameworks targeting our users in the next quarter.&nbsp;Luigino Camastra, Malware Researcher Martin Chlumecký, Malware Researcher David Álvarez, Malware Analyst Michal Salát, Threat Intelligence Director<h2 class="text-align-justify">Web Threats&nbsp;</h2>As cybercriminals continue to adapt to the ever-changing digital landscape, web-related threats remain a dominant area of concern. From Q2 to Q3 of 2024, while we observed a 16% reduction in the overall risk ratio for scams, the landscape remained dynamic and complex. Scammers are continuously refining their methods, using techniques like malvertising and leveraging current events to make their scams appear more credible and harder to detect.&nbsp;Although there was a slight decline in general web threat activity, possibly due to seasonal variations such as the summer holidays, several categories of web threats, including Crypto Scams, Dating Scams, and Tech Support Scams, saw notable increases in specific regions via specific tactics. Push notification scams and phishing activities also remain prevalent, with certain regions showing significant upticks, as detailed in the following sections.&nbsp;As we move forward into the analysis of Q3 data, this report will highlight the evolving nature of these threats, with an emphasis on the geographic trends, the growth of specific scam tactics, and the new methods cybercriminals are using to bypass security measures and deceive users.&nbsp;<h3 class="text-align-justify">Scams: Fewer Scams, Bigger Tricks&nbsp;&nbsp;</h3>A scam is a type of threat that aims to trick people into giving an attacker their personal information or money. We track diverse types of scams which are listed below.&nbsp;In the third quarter, we observed a 16% reduction in the overall risk ratio for online scams, indicating a decline in the volume or effectiveness of these threats. While this decrease is promising, scams remain a persistent issue, with attackers constantly adapting to evade detection. Our analysis highlights shifts in targeting strategies and tactics, signaling the importance of remaining on alert &nbsp;for new methods and flavors of the online scams.&nbsp;

However, this general downturn contrasts with the ongoing rise in specific scam tactics, notably malvertising with a 17% increase quarter-over-quarter. Malvertising, which often operates in tandem with scams, has become an increasingly favored method for scammers to push scam content quickly and efficiently to users.&nbsp;&nbsp;This trend underscores a more nuanced reality: while the overall scam frequency may have declined, certain subcategories are experiencing significant growth.&nbsp;

As we emphasize frequently in our threat reports, one of the common ingredients of a successful scam campaign is the use of advertisements. Moreover, scammers know well that many users use not only AV protection but also ad blockers, which can vary in effectiveness based on their focus. As a result, scammers are constantly innovating to bypass these defenses and no longer solely rely on traditional advertising methods to deliver malicious content. Instead, they increasingly exploit current world events, embedding scams within content that appears credible, relevant and engaging to users. By aligning their campaigns with trending news or global events, scammers increase their chances of deceiving users who are seeking timely information or updates. One such campaign, described in the next section, demonstrates these tactics in action: CryptoCore.&nbsp;<h4>Escalation of CryptoCore Scams&nbsp;</h4>A crypto scam is a cyber threat designed to trick individuals into surrendering their cryptocurrency. These scams exploit the anonymity and irreversibility of blockchain transactions, often targeting those with a limited understanding of how cryptocurrency works.&nbsp;In Q3/2024, we continued investigating the <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore scam group</a>. This quarter, CryptoCore's tactics evolved, with the group intensifying its use of <a href="https://us.norton.com/blog/emerging-threats/what-are-deepfakes">deepfake videos</a> and expanding its targeting to include high-profile global events, especially the U.S. election. These fraudulent campaigns leveraged well-known figures and corporations, including Elon Musk and Tesla, to reinforce their credibility and mislead potential victims. By hijacking popular social media accounts, especially on platforms like YouTube, these scammers reached millions of viewers, convincing them to invest in fake cryptocurrency schemes.&nbsp;The attackers were able to attract a massive audience via deepfake videos that are still evolving. The campaigns are becoming more refined and targeted, especially in politically sensitive regions like the U.S. which will hold its presidential election in early November. &nbsp;The following example demonstrates the use of a deep fake video with the U.S. election theme. The original video is from Tesla's 2022 Annual Meeting of Stockholders, where Elon Musk discussed several key topics, including Tesla's growth, production milestones, and future ambitions. The attackers synthesized the voice of Elon Musk and modified moving the mouth (lip sync) to match the new message.&nbsp;

CryptoCore's activities escalated dramatically after our telemetry captured 3,000 cryptocurrency transactions linked to their scams with a total value of an estimated $4,000,000. While this figure is a rough estimate, the actual amount could be higher, given the complexity of tracking illicit crypto wallets and abused platforms.&nbsp;The countries most affected by this are the United States, followed by the United Kingdom and Germany; see the map below for a reflection of global risk.&nbsp;

CryptoCore’s strategy of capitalizing on major media events is reflected in our telemetry. The following events were key moments in Q3 for CryptoCore scams:&nbsp;<ul><li>July 15: Elon Musk publicly endorsed Donald Trump during a rally in Pennsylvania, just days after an assassination attempt on the former president. This event garnered intense media attention, and CryptoCore wasted no time producing deepfake videos featuring Elon Musk.&nbsp;</li><li>July 27: Musk retweeted a parody about Kamala Harris. This incident drove traffic to YouTube, where CryptoCore’s deepfakes target the election.&nbsp;</li><li>September 1: CryptoCore exploited a legal dispute in Brazil, where Musk’s platform, X (formerly Twitter), faced a temporary suspension.&nbsp;</li></ul>The group's exploitation of real-time media events like these underscores their ability to manipulate public interest for financial gain.&nbsp;

These circumstances indicate that the CryptoCore activities and the risk of crypto fraud caused by these threat actors will increase.&nbsp;Detailed information about the modus operandi of CryptoCore can be found in <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">this article</a>.&nbsp;<h3>Malicious Browser Push Notifications: From Helpful to Harmful&nbsp;</h3>These types of notifications are a common browser feature that allow websites to send users push notifications. They can be pretty handy so, of course, scammers have found a way to exploit them. Attackers trick users into enabling these notifications so they can then be exploited.&nbsp;The activity of push notification scams has remained relatively stable throughout the quarter, with no major fluctuations in the overall threat level. However, some countries continue to face elevated risks: Argentina, Italy, and Spain are currently the countries with the highest risk ratios for push notification scams.&nbsp;

Notably, Italy has experienced a significant surge in activity, with the risk ratio increasing by a staggering 166%. This sharp rise underscores the growing threat landscape in the region, signaling a need for increased attention from users.&nbsp;

<h3>Dating Scams: Scammers Swipe Right&nbsp;</h3>Dating scams, also known as romance scams or online dating scams, involve fraudsters deceiving individuals into fake romantic relationships. Scammers adopt fake online identities to gain the victim's trust, with the ultimate goal of obtaining money or enough personal information to commit <a href="https://www.lifelock.com/how-it-works/what-is-identity-theft/">identity theft</a>.&nbsp;The activity of dating scams has surged significantly over the past quarter, as evidenced by the rising risk ratios. Globally, we’ve seen notable increases in several countries.&nbsp;

Slovakia experienced a substantial rise, with a 17% increase in the risk ratio, while Finland mirrored this with an identical 17% increase. Denmark and Germany also saw moderate growth, with risk ratios increasing by 5% and 3% respectively.&nbsp;&nbsp;

Moreover, Thailand saw the most dramatic increase, with a staggering +154% in the risk ratio, followed by Iceland at +48% and Fiji at +60%. These sharp rises highlight how dating scams are becoming increasingly prevalent in regions that were previously less affected, signaling a shift in targeting strategies.&nbsp;

<h3>Tech Support Scams: Japan Remains the Top Target&nbsp;</h3>Tech support scam threats involve fraudsters posing as legitimate technical support representatives who attempt to gain remote access to victims' devices or obtain sensitive personal information, such as credit card or banking details. These scams rely on confidence tricks to gain victims' trust and often involve convincing them to pay for unnecessary services or purchase expensive gift cards. It's important for internet users to be vigilant and to verify the credentials of anyone claiming to offer technical support services.&nbsp;Despite a significant quarter-over-quarter decline in the risk ratio for tech support scams in Japan (60%) and Germany (33%), these countries remain among the most active in terms of scam prevalence. Japan, with a risk ratio of 1.32%, continues to lead globally, indicating a persistent threat level even amid reductions. In contrast, countries such as France and Hong Kong are experiencing notable increases. France saw a 31% rise in the risk ratio, while Hong Kong’s risk ratio surged by 86%, reflecting high success in this country for these scams. This trend is further emphasized by the increased number of protected users in France (24%) and Hong Kong (82%), signaling targeted activity in these regions.&nbsp;

The graph showing risk ratio for Q2/2024 and Q3/2024 displays a general downward trend across both quarters, suggesting a gradual decrease in tech support scam activity over this period.&nbsp;

The example below shows a TSS lading page of very prevalent campaign targeting French users. France is one of the countries that recorded one of the biggest increases in the last quarter.&nbsp;

<h3>Email Threats: How Scammers Bypass Spam Detection&nbsp;</h3>The Email threats section tends to cover a wide range of scams targeting almost anyone with an email address. These scams take various forms, including fake invoices designed to mimic legitimate brands and trick recipients into making payments to the attackers. Extortion emails attempt to coerce victims into sending cryptocurrency by falsely claiming to have recorded compromising webcam footage. Lottery scams lure users to websites that offer deals too good to be true, while classic phishing emails falsely inform recipients that their password has expired in an attempt to steal credentials. This section will explore the common email scams that can land in your inbox and the tactics used by cybercriminals to exploit unsuspecting users.&nbsp;The prevalence of email threats typically remains constant, but, at the beginning of the summer, we observed an unusual spike in detected threats which raised our concerns about evolving tactics used by cybercriminals. &nbsp;Since the spike, which occurred at the end of July, the number of protected users has again stabilized. We will explore this spike in more detail later, using a real-world example to illustrate how cybercriminals may be attempting to bypass spam filters.&nbsp;

When it comes to countries with the highest risk of encountering email threats or scams, the ratio is now quite similar across continents—a trend we haven’t observed before. Australia, Europe, and North America are currently facing comparable levels of threat risk. In the past, the majority of these risks were concentrated in North America, but now the distribution is more balanced globally. Notably, South Africa has now risen to the top of the list.&nbsp;

Let's examine the statistics of protected users on a quarter-by-quarter basis. Turkey saw the highest increase, with a remarkable 80%, which is extraordinary compared to other countries. The second-highest rise was in the Czech Republic, with a 73% increase, followed by Colombia with a 59% quarterly rise. On the other end of the spectrum, Germany experienced the largest drop at 36%, followed by Italy at 27% and Brazil at 14%. This significant contrast highlights the varied landscape of cybersecurity across regions, with some countries showing impressive improvements while others face steep declines.&nbsp;Japan is a special case, as attacks there tend to occur in spikes, while other regions remain relatively stable without significant changes to the overall trend. This behavior is illustrated in the following graph.&nbsp;

As mentioned at the beginning of this section, there was an email scam targeting users with a simple tactic: a survey that promised a physical prize at the end, likely a cell phone since the scam appeared to come from a mobile provider. What caught our attention, however, was the structure of the email. The HTML code was designed to mislead both spam filters and users. It could hide certain parts of the email from human readers while deceiving the filters.&nbsp;

Let's look at an example that we will be dissecting in this report. First, we'll examine the version that users see, and then we'll delve into the code inside the email (.eml file). There are several red flags for the user to consider:&nbsp;&nbsp;&nbsp;<ul><li>The sender's name does not match the sender's domain, which raises suspicion.&nbsp;</li><li>The subject line does not align with the actual content of the email.&nbsp;</li><li>The font used in the message is unprofessional and inconsistent with what a company of this nature would typically use.&nbsp;</li><li>There is a clear attempt to create urgency, a common tactic in scams.&nbsp;</li></ul>&nbsp;After analyzing the source code of the email (the .eml file), there are several interesting patterns that we also observe in other scam messages. First, email has multiple parts and only a small part is related to the message that is actually displayed to the users and that leads to the malicious web site.&nbsp;&nbsp;Below this message, the email contains a message that is copied from the account registration email with popular OpenAI services:&nbsp;To continue setting up your OpenAI account, please verify that this is your &nbsp; email address. Verify email address (<a href="https://auth0.openai.com/%3cREDACTED" target="_blank" rel="noreferrer noopener">https://auth0.openai.com/&lt;REDACTED</a>&gt;). This link will expire in 5 days. If you did not make this request, please disregard this email. For help, contact us through our Help center (&lt;REDACTED&gt;).&nbsp;This message is ‘hidden’ to the user as it is separated from the main text by multiple breaklines. However, the spam filters tend to extract complete message and thus, as this part closely resembles legitimate emails, it helped this scam message avoid being detected even by major email providers. This can be seen in the following graphs, where we observe the prevalence of this particular threat rising in July as it avoided &nbsp;the spam detection of popular email providers.&nbsp;

Among other methods for avoiding detections, the email contains:&nbsp;&nbsp;<ul><li>using non-standard fonts: the main message with malicious link is encoded using Unicode characters to prevent a clear extraction&nbsp;</li><li>EML file contains multiple parts, and these, while not rendered to the user, can also confuse spam filters&nbsp;</li><li>source code uses incorrect HTML tags, such as&nbsp;&nbsp;</li></ul>&lt;td&gt;&lt;td&gt;&lt;SelECT&gt;&lt;head&gt;&lt;ObjecT&gt;&nbsp;or&nbsp;&nbsp;&lt;z style="height: 24px; width: 1.27315%;"&gt; &lt;/r&gt;&nbsp;&lt;w style="height: 24px; width: 9.83796%;"&gt; &lt;/r&gt;&nbsp;<ul><li>text from other parts of the email uses multiple languages&nbsp;</li></ul>

Reports

SMS threats: the many faces of a tiny text

Gen Q3/2025 Threat Report

Gen Q2/2025 Threat Report

Gen Q1/2025 threat report

Gen threat glossary & taxonomy

Gen Q4/2024 Threat Report

Gen Q3/2024 Threat Report

Gen Q2/2024 Threat Report

Avast Q1/2024 threat report

Avast Q4/2023 threat report

Avast Q3/2023 threat report

Avast Q2/2023 threat report