Chinese-speaking Operators Clone FIFA's World Cup 2026 Ticketing Site To Steal Fan Logins and Card Data

Look-alike domains fuel phishing and brand abuse; NetSPI Domain Monitoring discovers and scores them using WHOIS, DNS, and certificate context to speed action against high-risk domains.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

Hunt.io AttackCapture found Ababil of Minab's staging server wide open: 5 GB of victim data including LA Metro SCADA backups and Israeli organizations' credentials, configs, and database dumps.

An exposed UAE-hosted VPS revealed an Iranian-nexus operation against Oman: a webshell on the Justice Ministry, 26,000+ citizen and judicial records stolen, and operator sessions into April 2026.