‘The Manipulaters’ Improve Phishing, Still Fail at Opsec
Summary: DomainTools researchers found that computers tied to the Pakistan-based phishing group The Manipulaters have been infected by data- and password-stealing malware, and that the group's HeartSender spam service exposes customer credentials, authentication tokens, and root-level SMTP credentials to unauthenticated users. The group's Saim Raza identity, who said in January 2024 that they had been jailed and released on bail in Pakistan, denied working on malware and said they had left the country.
What you should know: The same group selling phishing kits that target Microsoft 365, Yahoo, AOL, Intuit, iCloud and ID.me users is leaking its own customers' credentials and SMTP access, and DomainTools notes the Manipulaters may pose more short-term risk to their own customers than law enforcement does.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026