Author | Lightnews

Netskope @netskope.com · 22h

😱 A creeper just snuck into your storage room! 😱

Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.

⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...

New Python RAT Targets Gamers via Minecraft

Summary During threat hunting activities, Netskope discovered a new, multi-function Python RAT that leverages the Telegram Bot API as a command and

www.netskope.com

Netskope @netskope.com · Aug 8

Netskope Threat Labs released a new open-source tool that detects supply chain attacks.

Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...

Netskope BEAM: Open Source Detector for Supply Chain Compromise

Netskope Threat Labs is pleased to announce the release of a new open-source tool that detects supply chain attacks. Our new tool, Behavioral Evaluation

www.netskope.com

1

Netskope @netskope.com · Aug 5

New Cloud and Threat Report from Netskope Threat Labs dives deep into Shadow AI and Agentic AI, offering crucial insights to help organizations shed light on the shadows along the way.

Read the report: www.netskope.com/resources/re...

Cloud and Threat Report: Shadow AI and Agentic AI 2025

GenAI adoption is surging, bringing new SaaS apps, genAI platforms, and on-premises AI tools and agents. Uncover shadow AI and mitigate risks with this report.

www.netskope.com

1

Netskope @netskope.com · Jun 10

🤔 To block or not to block Grok? For 29% of enterprises, there is no question.

Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...

To Grok or Not To Grok: For 29% of Enterprises...There Is No Question

Grok is a chatbot developed by Elon Musk’s xAI. It was initially released to select individuals in November 2023 and became generally available to all X

www.netskope.com

1

Netskope @netskope.com · Jun 2

🚨 New Phishing Alert 🚨 Scammers are targeting Navy Federal Credit Union customers using Glitch-hosted pages, Telegram, and fake CAPTCHAs.

Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...

Glitch-hosted Phishing Uses Telegram & Fake CAPTCHAs to Target Navy Federal Credit Union Customers

Summary From January to April 2025, Netskope Threat Labs tracked a three-fold increase in traffic to phishing pages created on the Glitch platform. These

www.netskope.com

1

Netskope @netskope.com · May 30

Don't get caught in Scattered Spider's web! 🕸️ Our latest blog breaks down how this financially motivated adversary group's TTPs and shares recommendations for Netskope customers. www.netskope.com/blog/netskop...

Netskope Threat Coverage: Scattered Spider

The adversary group commonly referred to as Scattered Spider is also tracked as UNC3944, Muddled Libra, Octo Tempest, Starfraud, Scatter Swine, 0ktapus,

www.netskope.com

1

Netskope @netskope.com · May 28

⚠️ Think twice before clicking on that dream job offer. New PureHVNC RAT campaign is preying on job seekers with fake offers from fashion and beauty brands.

Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...

PureHVNC RAT Using Fake High-level Job Offers from Fashion and Beauty Brands

Summary In recent months, the Netskope Threat Labs team has observed several different campaigns delivering the PureHVNC RAT and its plugins. In 2024, the

www.netskope.com

1

Netskope @netskope.com · May 27

🌍 The 2025 Netskope Threat Labs Europe report analyzes 3 major cybersecurity risk trends affecting organizations across Europe:

1️⃣ How malware is being distributed

2️⃣ The growing adoption of genAI tools

3️⃣ Rising data policy violations

Read the report: www.netskope.com/resources/th...

Threat Labs Report: Europe 2025

Gain insights into how organizations in Europe are addressing evolving cybersecurity risks, including malware distribution, genAI, and data security.

www.netskope.com

1

Netskope @netskope.com · May 7

🚨 Netskope Threat Labs has uncovered new “DOGE Big Balls” ransomware tools in the wild.

Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...

New DOGE Big Balls Ransomware Tools in the Wild

Summary During the Netskope Threat Labs hunting activities, we came across a payload that led us to a multi-stage chain involving several custom

www.netskope.com

1

Netskope @netskope.com · Apr 4

Netskope Threat Labs discovered a new drive-by download campaign abusing fake CAPTCHA and CloudFlare Turnstile to deliver LegionLoader payload. Get a detailed overview of the entire infection chain. www.netskope.com/blog/new-eva...

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

Starting February 2025, Netskope Threat Labs has tracked and reported on multiple phishing and malware campaigns targeting victims searching for PDF

www.netskope.com

1

Netskope @netskope.com · Mar 26

🚨 New Netskope Threat Labs research reveals a 30x increase in data sent to #genAI apps by enterprise users in the last year, increasing volume of sensitive data exposure.

Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...

Cloud and Threat Report - Generative AI 2025

GenAI adoption soars, but security risks rise. Discover top trends & effective controls in our 2025 Generative AI Cloud & Threat Report.

www.netskope.com

4

Netskope @netskope.com · Mar 21

[3/3] hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand

hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter

hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter%20of%20Demand.HTML

hxxps://morganholdinged.com/newyear5.php

2

Netskope @netskope.com · Mar 21

[2/3] IoCs:
76f1f4b59819576fc7f30f040ccbbc8f
563c09471c7ace59cd87a1f0338adfe3

hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand%20Letter.HTML

1 1

Netskope @netskope.com · Mar 21

[1/3] Netskope Threat Labs observed multiple phishing pages being sent via Fastmail. The pages are tricking victims to log into a fake Office 365 page in order to access a fake payment document. Once the victim insert the credentials and press "View Payment" the credentials are sent to the attacker.

1 1

Netskope @netskope.com · Mar 11

Netskope Threat Labs analyzes Elysium, a variant of the Ghost (Cring) ransomware family, demonstrating how it works and how it encrypts the affected systems. www.netskope.com/blog/analyzi...

Analyzing Elysium, a Variant of the Ghost (Cring) Ransomware Family

Summary In February 2025, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State

www.netskope.com

1

Netskope @netskope.com · Mar 6

🏦 Read the new Netskope Threat Labs Report for strategic, actionable intelligence on the most significant #cybersecurity risks that financial services organizations face and get recommendations on how to protect against these threats. www.netskope.com/netskope-thr...

Netskope Threat Labs Report: Financial Services 2025

Gain insights into how organizations in financial services are addressing evolving cybersecurity risks, including social engineering, personal app, and generative AI risk.

www.netskope.com

1

Netskope @netskope.com · Feb 27

Netskope Threat Labs found that attackers have been distributing malicious PDFs with fake CAPTCHAs across 260+ domains and 4,000+ keywords to steal credit card data and deliver Lumma Stealer malware. Get the details: www.netskope.com/blog/fake-ca...

Fake CAPTCHAs, Malicious PDFs, SEO Traps Leveraged for User Manual Searches

Summary On February 12, 2025, Netskope Threat Labs reported a widespread phishing campaign using fake CAPTCHA images via Webflow CDN to trick victims

www.netskope.com

1

Netskope @netskope.com · Feb 14

Telegram is being abused as command and control (C2) channel for a new Golang backdoor. Get details on the malware features and how it interacts with Telegram to receive commands and send results to it. www.netskope.com/blog/telegra...

Telegram Abused as C2 Channel for New Golang Backdoor

Summary As part of Netskope Threat Labs hunting activities, we came across an IoC being shared by other researchers and decided to take a closer look at

www.netskope.com

Netskope @netskope.com · Feb 12

🚨 New widespread phishing campaign abuses Webflow, SEO, and fake CAPTCHAs to steal credit card information and commit financial fraud.

Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...

#ThreatIntel #ThreatResearch #cybersecurity

New Phishing Campaign Abuses Webflow, SEO, and Fake CAPTCHAs

Summary Netskope Threat Labs is tracking a widespread phishing campaign affecting hundreds of Netskope customers and thousands of users. The campaign aims

www.netskope.com

Netskope @netskope.com · Feb 3

🧵 [2/2]

IoC: bestoflifeyou[.]duckdns[.]org

#phishing #infosec #threatintel

Netskope @netskope.com · Feb 3

🧵 [1/2] Netskope Threat Labs observed a Duck DNS URL used to host a fake CAPTCHA page that redirects to a website disguised as Orange, a french Telecom company. The page asks for Orange user's credentials and contains a malicious JS script to exfiltrate the inserted data via Telegram API.

#phishing

1 2

Netskope @netskope.com · Jan 29

New Netskope Threat Labs Report on organizations operating in Canada shows 3.3x year-over-year increase in #GenAI app users, causing a proportional rise in the amount of sensitive data sent to genAI apps.

More on the top cyber risks facing organizations in Canada: www.netskope.com/netskope-thr...

Netskope Threat Labs Report: Canada 2025

Gain insights into how organizations in Canada are addressing evolving cybersecurity risks, including social engineering, personal app, and generative AI risk.

www.netskope.com

Netskope @netskope.com · Jan 23

🚨 Netskope Threat Labs observed a new malware campaign using fake CAPTCHAs to deliver Lumma Stealer.

Get the details on the latest campaign and the evasion techniques targeting Windows users worldwide. www.netskope.com/blog/lumma-s...

Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection

Summary In January, Netskope Threat Labs observed a new malware campaign using fake CAPTCHAs to deliver Lumma Stealer. Lumma is a malware that works in

www.netskope.com

1

Netskope @netskope.com · Jan 14

The first Security Visionaries episode of 2025 kicks off with a conversation with Ben Morris, Group Head of Cyber Security for @worldrugby.bsky.social, about the intersection between cyber and physical security when it comes to major events.

🎧 Listen: www.netskope.com/resources/po...

Netskope @netskope.com · Jan 7

🆕 Netskope Cloud and Threat Report shows phishing attempts are increasingly successful, with enterprise employees falling victim nearly 3X more in 2024 than in 2023.

Get the latest research on risks organizations face and the strategies they use to manage risks. www.netskope.com/netskope-thr...

Cloud and Threat Report - January 2025

Gain insights into how organizations manage evolving risks, including social engineering risk, personal app risk, generative AI risk, and adversarial risk.

www.netskope.com