Netskope
@netskope.com
Netskope, a leader in modern security and networking, addresses the needs of both security and networking teams by providing optimized access and real-time, context-based security for people, devices, and data anywhere they go. https://www.netskope.com/
Netskope Threat Labs is monitoring an active phishing campaign that exploits the high-frequency nature of virtual meetings. Get a breakdown of the lures attackers are using and the payload in our latest blog: www.netskope.com/blog/attacke...
Attackers Weaponize Signed RMM Tools via Zoom, Meet, & Teams Lures
Summary Netskope Threat Labs is tracking several phishing campaigns that weaponize fake meeting invites for various video conference applications,
www.netskope.com
February 12, 2026 at 11:32 PM
Netskope Threat Labs is monitoring an active phishing campaign that exploits the high-frequency nature of virtual meetings. Get a breakdown of the lures attackers are using and the payload in our latest blog: www.netskope.com/blog/attacke...
Netskope Threat Labs identified a new campaign where malicious Bing ads are redirecting users to tech support scams. Read our latest blog for key findings and tips for avoiding these scams. www.netskope.com/blog/malicio...
Malicious Bing Ads Lead to Widespread Azure Tech Support Scams
Summary Starting on February 2 at around 16:00 UTC, Netskope Threat Labs was alerted to a spike of users across 48 different organizations clicking on
www.netskope.com
February 6, 2026 at 11:16 PM
Netskope Threat Labs identified a new campaign where malicious Bing ads are redirecting users to tech support scams. Read our latest blog for key findings and tips for avoiding these scams. www.netskope.com/blog/malicio...
🇯🇵 The 2026 Netskope Threat Labs Japan report explores recent trends in the adoption and governance of generative AI applications, enterprise AI platforms, API usage, cloud app activity, and data policy violations across Japan.
Read the report: www.netskope.com/resources/th...
Read the report: www.netskope.com/resources/th...
Netskope Threat Labs Report: Japan 2026
Learn how organizations in the Japan region are tackling the evolving cybersecurity landscape, including malware, genAI, and data security.
www.netskope.com
February 3, 2026 at 3:05 AM
🇯🇵 The 2026 Netskope Threat Labs Japan report explores recent trends in the adoption and governance of generative AI applications, enterprise AI platforms, API usage, cloud app activity, and data policy violations across Japan.
Read the report: www.netskope.com/resources/th...
Read the report: www.netskope.com/resources/th...
The Netskope Cloud and Threat Report: 2026 is out. Take a look back at the most significant trends of 2025 and get a preview of the evolving threat landscape for 2026. www.netskope.com/resources/cl...
Cloud and Threat Report: 2026
Learn how organizations are tackling the evolving cybersecurity landscape, including malware, genAI, AI Agents, and data security.
www.netskope.com
January 6, 2026 at 11:57 PM
The Netskope Cloud and Threat Report: 2026 is out. Take a look back at the most significant trends of 2025 and get a preview of the evolving threat landscape for 2026. www.netskope.com/resources/cl...
The new, open-source RedTiger infostealer has recently emerged in the wild, primarily targeting victims’ Discord accounts, Roblox credentials, browser data , and cryptocurrency wallet files.
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts
Summary Gamers are a hot target for infostealers these days. This blog post is the second we have published this month about an infostealer targeting
www.netskope.com
October 23, 2025 at 10:18 PM
The new, open-source RedTiger infostealer has recently emerged in the wild, primarily targeting victims’ Discord accounts, Roblox credentials, browser data , and cryptocurrency wallet files.
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
Get Netskope Threat Labs' analysis of RedTiger: www.netskope.com/blog/redtige...
😱 A creeper just snuck into your storage room! 😱
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
New Python RAT Targets Gamers via Minecraft
Summary During threat hunting activities, Netskope discovered a new, multi-function Python RAT that leverages the Telegram Bot API as a command and
www.netskope.com
October 22, 2025 at 4:23 PM
😱 A creeper just snuck into your storage room! 😱
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
Netskope Threat Labs discovered a new, multi-function Python RAT targeting gamers via Minecraft.
⛏️ Mine the full analysis: www.netskope.com/blog/new-pyt...
Netskope Threat Labs released a new open-source tool that detects supply chain attacks.
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
Netskope BEAM: Open Source Detector for Supply Chain Compromise
Netskope Threat Labs is pleased to announce the release of a new open-source tool that detects supply chain attacks. Our new tool, Behavioral Evaluation
www.netskope.com
August 8, 2025 at 12:24 AM
Netskope Threat Labs released a new open-source tool that detects supply chain attacks.
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
Learn how BEAM (Behavioral Evaluation of Application Metrics) works and how to get access to this new tool. www.netskope.com/blog/netskop...
New Cloud and Threat Report from Netskope Threat Labs dives deep into Shadow AI and Agentic AI, offering crucial insights to help organizations shed light on the shadows along the way.
Read the report: www.netskope.com/resources/re...
Read the report: www.netskope.com/resources/re...
Cloud and Threat Report: Shadow AI and Agentic AI 2025
GenAI adoption is surging, bringing new SaaS apps, genAI platforms, and on-premises AI tools and agents. Uncover shadow AI and mitigate risks with this report.
www.netskope.com
August 5, 2025 at 1:57 AM
New Cloud and Threat Report from Netskope Threat Labs dives deep into Shadow AI and Agentic AI, offering crucial insights to help organizations shed light on the shadows along the way.
Read the report: www.netskope.com/resources/re...
Read the report: www.netskope.com/resources/re...
🤔 To block or not to block Grok? For 29% of enterprises, there is no question.
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
To Grok or Not To Grok: For 29% of Enterprises...There Is No Question
Grok is a chatbot developed by Elon Musk’s xAI. It was initially released to select individuals in November 2023 and became generally available to all X
www.netskope.com
June 10, 2025 at 12:17 PM
🤔 To block or not to block Grok? For 29% of enterprises, there is no question.
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
Read Netskope Threat Labs' latest blog post on Grok’s rise in popularity, how organizations have responded, and recommendations for organizations looking to limit its use. www.netskope.com/blog/to-grok...
🚨 New Phishing Alert 🚨 Scammers are targeting Navy Federal Credit Union customers using Glitch-hosted pages, Telegram, and fake CAPTCHAs.
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Glitch-hosted Phishing Uses Telegram & Fake CAPTCHAs to Target Navy Federal Credit Union Customers
Summary From January to April 2025, Netskope Threat Labs tracked a three-fold increase in traffic to phishing pages created on the Glitch platform. These
www.netskope.com
June 2, 2025 at 4:11 PM
🚨 New Phishing Alert 🚨 Scammers are targeting Navy Federal Credit Union customers using Glitch-hosted pages, Telegram, and fake CAPTCHAs.
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Read the full analysis from Netskope Threat Labs: www.netskope.com/blog/glitch-...
Don't get caught in Scattered Spider's web! 🕸️ Our latest blog breaks down how this financially motivated adversary group's TTPs and shares recommendations for Netskope customers. www.netskope.com/blog/netskop...
Netskope Threat Coverage: Scattered Spider
The adversary group commonly referred to as Scattered Spider is also tracked as UNC3944, Muddled Libra, Octo Tempest, Starfraud, Scatter Swine, 0ktapus,
www.netskope.com
May 30, 2025 at 5:20 PM
Don't get caught in Scattered Spider's web! 🕸️ Our latest blog breaks down how this financially motivated adversary group's TTPs and shares recommendations for Netskope customers. www.netskope.com/blog/netskop...
⚠️ Think twice before clicking on that dream job offer. New PureHVNC RAT campaign is preying on job seekers with fake offers from fashion and beauty brands.
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
PureHVNC RAT Using Fake High-level Job Offers from Fashion and Beauty Brands
Summary In recent months, the Netskope Threat Labs team has observed several different campaigns delivering the PureHVNC RAT and its plugins. In 2024, the
www.netskope.com
May 28, 2025 at 9:33 PM
⚠️ Think twice before clicking on that dream job offer. New PureHVNC RAT campaign is preying on job seekers with fake offers from fashion and beauty brands.
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
Get details on the infection chain and the methods used to lure victims and deliver the PureHVNC RAT. www.netskope.com/blog/purehvn...
🌍 The 2025 Netskope Threat Labs Europe report analyzes 3 major cybersecurity risk trends affecting organizations across Europe:
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
Threat Labs Report: Europe 2025
Gain insights into how organizations in Europe are addressing evolving cybersecurity risks, including malware distribution, genAI, and data security.
www.netskope.com
May 27, 2025 at 7:22 PM
🌍 The 2025 Netskope Threat Labs Europe report analyzes 3 major cybersecurity risk trends affecting organizations across Europe:
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
1️⃣ How malware is being distributed
2️⃣ The growing adoption of genAI tools
3️⃣ Rising data policy violations
Read the report: www.netskope.com/resources/th...
🚨 Netskope Threat Labs has uncovered new “DOGE Big Balls” ransomware tools in the wild.
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
New DOGE Big Balls Ransomware Tools in the Wild
Summary During the Netskope Threat Labs hunting activities, we came across a payload that led us to a multi-stage chain involving several custom
www.netskope.com
May 7, 2025 at 4:37 PM
🚨 Netskope Threat Labs has uncovered new “DOGE Big Balls” ransomware tools in the wild.
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
Get a detailed analysis of the payloads we found during our investigation. www.netskope.com/blog/new-dog...
Netskope Threat Labs discovered a new drive-by download campaign abusing fake CAPTCHA and CloudFlare Turnstile to deliver LegionLoader payload. Get a detailed overview of the entire infection chain. www.netskope.com/blog/new-eva...
New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile
Starting February 2025, Netskope Threat Labs has tracked and reported on multiple phishing and malware campaigns targeting victims searching for PDF
www.netskope.com
April 4, 2025 at 9:11 PM
Netskope Threat Labs discovered a new drive-by download campaign abusing fake CAPTCHA and CloudFlare Turnstile to deliver LegionLoader payload. Get a detailed overview of the entire infection chain. www.netskope.com/blog/new-eva...
🚨 New Netskope Threat Labs research reveals a 30x increase in data sent to #genAI apps by enterprise users in the last year, increasing volume of sensitive data exposure.
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
Cloud and Threat Report - Generative AI 2025
GenAI adoption soars, but security risks rise. Discover top trends & effective controls in our 2025 Generative AI Cloud & Threat Report.
www.netskope.com
March 26, 2025 at 5:10 PM
🚨 New Netskope Threat Labs research reveals a 30x increase in data sent to #genAI apps by enterprise users in the last year, increasing volume of sensitive data exposure.
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
Read the 2025 Generative AI Cloud and Threat Report for top trends: www.netskope.com/netskope-thr...
[3/3] hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter%20of%20Demand.HTML
hxxps://morganholdinged.com/newyear5.php
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter%20of%20Demand.HTML
hxxps://morganholdinged.com/newyear5.php
March 21, 2025 at 7:05 PM
[3/3] hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter%20of%20Demand.HTML
hxxps://morganholdinged.com/newyear5.php
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter
hxxps://user.fm/files/v2-6a29a73ac0bc7a49c5808920871a218d/Letter%20of%20Demand.HTML
hxxps://morganholdinged.com/newyear5.php
[2/3] IoCs:
76f1f4b59819576fc7f30f040ccbbc8f
563c09471c7ace59cd87a1f0338adfe3
hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand%20Letter.HTML
76f1f4b59819576fc7f30f040ccbbc8f
563c09471c7ace59cd87a1f0338adfe3
hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand%20Letter.HTML
March 21, 2025 at 7:05 PM
[2/3] IoCs:
76f1f4b59819576fc7f30f040ccbbc8f
563c09471c7ace59cd87a1f0338adfe3
hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand%20Letter.HTML
76f1f4b59819576fc7f30f040ccbbc8f
563c09471c7ace59cd87a1f0338adfe3
hxxps://user.fm/files/v2-a519782c0795bd8697c4a39edbbac1c5/Demand%20Letter.HTML
[1/3] Netskope Threat Labs observed multiple phishing pages being sent via Fastmail. The pages are tricking victims to log into a fake Office 365 page in order to access a fake payment document. Once the victim insert the credentials and press "View Payment" the credentials are sent to the attacker.
March 21, 2025 at 7:05 PM
[1/3] Netskope Threat Labs observed multiple phishing pages being sent via Fastmail. The pages are tricking victims to log into a fake Office 365 page in order to access a fake payment document. Once the victim insert the credentials and press "View Payment" the credentials are sent to the attacker.
Netskope Threat Labs analyzes Elysium, a variant of the Ghost (Cring) ransomware family, demonstrating how it works and how it encrypts the affected systems. www.netskope.com/blog/analyzi...
Analyzing Elysium, a Variant of the Ghost (Cring) Ransomware Family
Summary In February 2025, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State
www.netskope.com
March 11, 2025 at 10:59 PM
Netskope Threat Labs analyzes Elysium, a variant of the Ghost (Cring) ransomware family, demonstrating how it works and how it encrypts the affected systems. www.netskope.com/blog/analyzi...
🏦 Read the new Netskope Threat Labs Report for strategic, actionable intelligence on the most significant #cybersecurity risks that financial services organizations face and get recommendations on how to protect against these threats. www.netskope.com/netskope-thr...
Netskope Threat Labs Report: Financial Services 2025
Gain insights into how organizations in financial services are addressing evolving cybersecurity risks, including social engineering, personal app, and generative AI risk.
www.netskope.com
March 6, 2025 at 4:52 PM
🏦 Read the new Netskope Threat Labs Report for strategic, actionable intelligence on the most significant #cybersecurity risks that financial services organizations face and get recommendations on how to protect against these threats. www.netskope.com/netskope-thr...
Netskope Threat Labs found that attackers have been distributing malicious PDFs with fake CAPTCHAs across 260+ domains and 4,000+ keywords to steal credit card data and deliver Lumma Stealer malware. Get the details: www.netskope.com/blog/fake-ca...
Fake CAPTCHAs, Malicious PDFs, SEO Traps Leveraged for User Manual Searches
Summary On February 12, 2025, Netskope Threat Labs reported a widespread phishing campaign using fake CAPTCHA images via Webflow CDN to trick victims
www.netskope.com
February 27, 2025 at 5:51 PM
Netskope Threat Labs found that attackers have been distributing malicious PDFs with fake CAPTCHAs across 260+ domains and 4,000+ keywords to steal credit card data and deliver Lumma Stealer malware. Get the details: www.netskope.com/blog/fake-ca...
Telegram is being abused as command and control (C2) channel for a new Golang backdoor. Get details on the malware features and how it interacts with Telegram to receive commands and send results to it. www.netskope.com/blog/telegra...
Telegram Abused as C2 Channel for New Golang Backdoor
Summary As part of Netskope Threat Labs hunting activities, we came across an IoC being shared by other researchers and decided to take a closer look at
www.netskope.com
February 14, 2025 at 7:15 PM
Telegram is being abused as command and control (C2) channel for a new Golang backdoor. Get details on the malware features and how it interacts with Telegram to receive commands and send results to it. www.netskope.com/blog/telegra...
🚨 New widespread phishing campaign abuses Webflow, SEO, and fake CAPTCHAs to steal credit card information and commit financial fraud.
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
New Phishing Campaign Abuses Webflow, SEO, and Fake CAPTCHAs
Summary Netskope Threat Labs is tracking a widespread phishing campaign affecting hundreds of Netskope customers and thousands of users. The campaign aims
www.netskope.com
February 12, 2025 at 9:45 PM
🚨 New widespread phishing campaign abuses Webflow, SEO, and fake CAPTCHAs to steal credit card information and commit financial fraud.
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
Get the analysis from Netskope Threat Labs www.netskope.com/blog/new-phi...
#ThreatIntel #ThreatResearch #cybersecurity
February 3, 2025 at 6:29 PM