CyberFox @cyberfoxsec

Joined February 2024

Tweets

7
Followers

1
Following

161
Likes

8

Unit 42 @Unit42_Intel

2 months ago

With the rising popularity of POP MART's Labubu, we've seen a surge in newly registered domains (NRDs), many malicious. These domains impersonate POP MART or host #gambling and crypto #scams. Stay vigilant and always verify URLs before engaging! Details at bit.ly/3ZZ3BTR

1 10 33 5K 4

Download Image

Unit 42 @Unit42_Intel

2 months ago

Attackers are leveraging over 500 newly registered .shop domains, likely generated via DGA, to launch #phishing campaigns impersonating Microsoft login pages. Domain infrastructure changes post-registration. Details at: bit.ly/4en8Anc

1 33 96 9K 25

Download Image

Unit 42 @Unit42_Intel

3 months ago

Cybersecurity Alert: Registered on June 7th, wwdc25[.]com hosts a #scam site impersonating the official WWDC25 event. It promotes a fake #cryptocurrency giveaway to steal funds. Do not send any cryptocurrency to the wallet addresses listed! Details at bit.ly/4mN0RCK

3 16 44 4K 3

Download Image

Unit 42 @Unit42_Intel

7 months ago

Since #DeepSeek released its #LLM, multiple newly registered domains (#NRD) using “deepseek” have surfaced. Beware of #phishing sites like deepseeklogin[.]com that mimic the DeepSeek home page and ask for login credentials. Always verify URLs before exploring this new #AI model!

1 23 82 12K 15

Download Image

Unit 42 @Unit42_Intel

11 months ago

Multiple newly-registered domains like robotaxioneth[.]com, robotaxi2024[.]xyz and cybercab[.]icu are hosting cryptocurrency investment #scams, likely exploiting interest in the release of Tesla’s robotaxi Cybercab. Stay alert for phishing and domain abuse risks. #CryptoScam

1 9 18 3K 4

Download Image

Unit 42 @Unit42_Intel

11 months ago

As early as June 2024, we discovered domains for a #DNStunneling campaign we call "Capybara" that employs various data encodings like customized Base32. These domains resolve to 104.236.196[.]131 and have a name server at 167.71.250[.]194. More info at bit.ly/4edLaQm

0 18 31 4K 12

Download Image

Unit 42 @Unit42_Intel

a year ago

We uncovered striking connections between #Olympics-related domains used for #phishing and #scams for the #Tokyo and #Paris2024 Olympics. The shared infrastructure/similarities in domain names indicate a single actor may be behind this abuse. Details at bit.ly/4fG3bYJ