PhishEye Blog · Page 2 of 3
Field notes on phishing detection, typosquat enforcement, search-threat strategy, and the takedown metrics that actually reduce customer harm — not vanity dashboards.
Research · · 8 min read
Over 21 hours a phishing operator hit three of our own mailboxes with spoofed [email protected] emails, rotating lures and cloned login pages across IPFS and Google Cloud Storage. We tear down all three waves, the Formspark exfil, and why DMARC quarantined every one.
Read moreResearch · · 8 min read
15+ Chrome utility extensions (emulators, password managers, converters) embed a bandwidth-sharing SDK that quietly turns the browser into a covert web-scraping proxy via hidden iframes and five Lambda backends. Unit 42's findings, analyzed for defenders.
Read moreResearch · · 8 min read
CAPTCHA gates, multi-step SaaS chains, blob-URL delivery, and Cyrillic look-alike source obfuscation: Unit 42 documented four ways device-code phishing pages dodge automated scanners. What each one defeats, and how defenders keep up.
Read moreResearch · · 8 min read
A new Rhadamanthys infostealer campaign resurfaced days after a law-enforcement takedown, delivered via a cloned RingCentral download, a 385MB anti-sandbox dropper, layered DLL side-loading, and Azure Front Door C2. Unit 42's full chain, analyzed for defenders.
Read moreResearch · · 9 min read
Two threat actors flooded RubyGems with 130+ trojanized copies of popular libraries carrying XMRig Monero miners, one of them worming across SSH and multiple languages. Unit 42's supply-chain findings, with defender guidance.
Read moreResearch · · 8 min read
Unit 42 is tracking an automated factory of 350+ fake VPN Chrome extensions that route every request through attacker-controlled SOCKS5 proxies, with only 14 removed so far. Our analysis of the campaign and the defender playbook.
Read moreResearch · · 12 min read
Starting from a handful of fake Grand Egyptian Museum ticket sites, we mapped an industrial fake-ticket network: 188 domains impersonating ~40 real attractions across 10+ countries, on a handful of shared origin servers.
Read moreResearch · · 12 min read
Hackers take over real hotel accounts on Booking.com, watch the incoming reservation queue, and message each guest a fake 'complete your booking' payment link. A full breakdown of the reservation-hijack scam, with a live example we traced and reported.
Read more
Research · · 36 min read
Microsoft, APWG, KnowBe4 and Check Point 2026 data in one picture, updated with Q2 and Q3 figures: attacks up 10.1% to 1,069,681, credential theft at 94–96%, AiTM 44.6% of phishing techniques, SaaS/webmail the top target, and Cloudflare fronting 34% of phishing sites.
Read moreResearch · · 12 min read
A live SharePoint credential-phishing chain on free Cloudflare infrastructure: a fronted lure and fake-CAPTCHA redirect into a cloaked workers.dev loader, tracked across 5+ auto-provisioned Workers accounts.
Read moreResearch · · 13 min read
Cloudflare Drop deploys a static site to a workers.dev URL in seconds with no account. We weigh the phishing-abuse risk, compare it with other free static hosts, and show why Cloudflare's own abuse-report API blocks the takedown teams fighting back.
Read moreResearch · · 16 min read
One live phishing URL unrolled IronToll: a 73-domain, multi-country phishing-as-a-service campaign built on the Chinese Iron Man kit, stealing credentials and live SMS OTPs. Full IOCs, C2 IPs, and the hunting method.
Read moreCybersecurity · · 8 min read
What threat intelligence feeds are, how CTI feeds work, the main types, and how to evaluate and operationalize them for phishing and brand defense.
Read moreCybersecurity · · 8 min read
Defend the two channels most brand-protection programs under-serve: social media impersonation and fake mobile apps — detection, per-platform takedowns, and how to choose a platform.
Read moreCybersecurity · · 11 min read
A buyer's checklist for brand protection teams: the four criteria that separate a fit-for-purpose phishing detection and takedown platform from a generic email-security tool.
Read moreCybersecurity · · 11 min read
PCI DSS v4.0 turned anti-phishing into a technical control. A pre-audit checklist mapping Requirements 5.4.1, 8.4.2 and 12.6 to DMARC, MFA, simulations and audit evidence.
Read moreResearch · · 15 min read
A live ClickFix campaign poisons your clipboard via a fake CAPTCHA and hides its C2 on the Polygon blockchain (EtherHiding) to defeat takedowns. Full chain, 97-domain IOC feed, defenses.
Read moreCybersecurity · · 12 min read
Trade name vs. trademark, how to register and enforce your business name, and how to defend it online against lookalike domains, fake profiles, and phishing.
Read moreSubscribe to the RSS feed for new posts, or get in touch about the investigations.
