The threat hunter’s gambit
Summary: Cisco Talos reports that threat actors are weaponizing legitimate SaaS notification pipelines, such as those in GitHub and Jira, to deliver phishing and spam emails that bypass SPF, DKIM, and DMARC because they originate from verified, trusted domains. Talos also describes UAT-10362 conducting spear-phishing campaigns against Taiwanese NGOs and suspected universities to deliver a new malware family called LucidRook.
Bottom line: Traditional email gateways are blind to these attacks because the messages are technically authenticated and come from trusted domains, so the implicit trust placed in system-generated notifications is exactly what attackers are using to harvest credentials.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026