xHunt Campaign: New Watering Hole Identified for Credential Harvesting
Summary: Unit 42 identified a Kuwait government organization's webpage used as a watering hole, containing a hidden image that referenced domains tied to xHunt campaign operators between June and December 2019, first microsofte-update[.]com and then learn-service[.]com. The injected HTML attempted to load an image from a remote file share so that Windows visitors would perform NTLM challenge-response authentication, letting the actors capture account names and NTLM hashes, which Unit 42 reproduced in a lab using the Responder tool.
Why it matters: A single hidden image on a trusted government page can hand attackers NTLM hashes from every Windows visitor whose network lets SMB and NetBIOS reach an outside server, and those hashes can be cracked or relayed to move deeper while the attacker stays undetected for long periods.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026