CyberFox

@cyberfoxsec

Joined February 2024

8Posts 1Followers 161Following

CyberFox reposted

Unit 42

@Unit42_Intel

Oct 10

Beware of domains impersonating OpenAI and Sora services following the Sora 2 AI release. These sites are being used for #phishing, #scams, tracking and crypto fraud. Verify all URLs carefully before engaging. Stay vigilant! Details at bit.ly/4mYAqZA

Unit42_Intel's tweet image. Beware of domains impersonating OpenAI and Sora services following the Sora 2 AI release. These sites are being used for #phishing, #scams, tracking and crypto fraud. Verify all URLs carefully before engaging. Stay vigilant! Details at bit.ly/4mYAqZA

CyberFox reposted

Unit 42

@Unit42_Intel

Jul 1

With the rising popularity of POP MART's Labubu, we've seen a surge in newly registered domains (NRDs), many malicious. These domains impersonate POP MART or host #gambling and crypto #scams. Stay vigilant and always verify URLs before engaging! Details at bit.ly/3ZZ3BTR

Unit42_Intel's tweet image. With the rising popularity of POP MART's Labubu, we've seen a surge in newly registered domains (NRDs), many malicious. These domains impersonate POP MART or host #gambling and crypto #scams. Stay vigilant and always verify URLs before engaging! Details at bit.ly/3ZZ3BTR

CyberFox reposted

Unit 42

@Unit42_Intel

Jun 27

Attackers are leveraging over 500 newly registered .shop domains, likely generated via DGA, to launch #phishing campaigns impersonating Microsoft login pages. Domain infrastructure changes post-registration. Details at: bit.ly/4en8Anc

Unit42_Intel's tweet image. Attackers are leveraging over 500 newly registered .shop domains, likely generated via DGA, to launch #phishing campaigns impersonating Microsoft login pages. Domain infrastructure changes post-registration. Details at: bit.ly/4en8Anc

CyberFox reposted

Unit 42

@Unit42_Intel

Jun 10

Cybersecurity Alert: Registered on June 7th, wwdc25[.]com hosts a #scam site impersonating the official WWDC25 event. It promotes a fake #cryptocurrency giveaway to steal funds. Do not send any cryptocurrency to the wallet addresses listed! Details at bit.ly/4mN0RCK

CyberFox reposted

Unit 42

@Unit42_Intel

Jan 30

Since #DeepSeek released its #LLM, multiple newly registered domains (#NRD) using “deepseek” have surfaced. Beware of #phishing sites like deepseeklogin[.]com that mimic the DeepSeek home page and ask for login credentials. Always verify URLs before exploring this new #AI model!

Unit42_Intel's tweet image. Since #DeepSeek released its #LLM, multiple newly registered domains (#NRD) using “deepseek” have surfaced. Beware of #phishing sites like deepseeklogin[.]com that mimic the DeepSeek home page and ask for login credentials. Always verify URLs before exploring this new #AI model!

CyberFox reposted

Unit 42

@Unit42_Intel

Oct 10, 2024

Multiple newly-registered domains like robotaxioneth[.]com, robotaxi2024[.]xyz and cybercab[.]icu are hosting cryptocurrency investment #scams, likely exploiting interest in the release of Tesla’s robotaxi Cybercab. Stay alert for phishing and domain abuse risks. #CryptoScam

Unit42_Intel's tweet image. Multiple newly-registered domains like robotaxioneth[.]com, robotaxi2024[.]xyz and cybercab[.]icu are hosting cryptocurrency investment #scams, likely exploiting interest in the release of Tesla’s robotaxi Cybercab. Stay alert for phishing and domain abuse risks. #CryptoScam

CyberFox reposted

Unit 42

@Unit42_Intel

Sep 26, 2024

As early as June 2024, we discovered domains for a #DNStunneling campaign we call "Capybara" that employs various data encodings like customized Base32. These domains resolve to 104.236.196[.]131 and have a name server at 167.71.250[.]194. More info at bit.ly/4edLaQm

Unit42_Intel's tweet image. As early as June 2024, we discovered domains for a #DNStunneling campaign we call "Capybara" that employs various data encodings like customized Base32. These domains resolve to 104.236.196[.]131 and have a name server at 167.71.250[.]194. More info at bit.ly/4edLaQm

CyberFox reposted

Unit 42

@Unit42_Intel

Aug 13, 2024

We uncovered striking connections between #Olympics-related domains used for #phishing and #scams for the #Tokyo and #Paris2024 Olympics. The shared infrastructure/similarities in domain names indicate a single actor may be behind this abuse. Details at bit.ly/4fG3bYJ