Adversarial use of current events as lures
Summary: Cisco Talos reports that adversaries increasingly pivot from costly working exploits to lures built on current events, with COVID-19 and racial injustice dominating recent campaigns and calendar events like tax season and Black Friday producing annual spikes. The examples include PoetRAT targeting Azerbaijani citizens with coronavirus-themed documents, Astaroth impersonating the Brazilian Ministry of Health in Portuguese to steal banking credentials, Trickbot using a Black Lives Matter lure with a fake print-button error, and Lokibot delivered via a tax-themed .cab file containing TAX Invoice.exe.
Key Takeaway: Talos notes that virtually every threat it wrote about over several months used COVID as a lure, and that the U.S. tax season was extended to July 15, widening the window in which tax lures can work - so keyword hunting limited to subject lines or filenames alone would have missed the Lokibot attempt.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026