Exposing a Global Smishing Operation Across 19 Countries: Governments, Postal Services, and Telecoms Targeted

VTI warns of an ongoing targeted phishing campaign in Vietnam since June 2020, using SMS and Facebook messages to steal banking credentials via fake loan, payment and prize sites.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt.io traced five exposed directories to a SecFlow-run campaign that used Claude, Qwen and DeepSeek as workers against government, education and diplomatic targets across Asia.

Hunt.io correlates 28 multilingual phishing pages—Chinese, English and Japanese—sharing ZIP lures and download.php backend logic, targeting financial and government organizations across Asia.

An exposed GoPhish admin panel on a Microsoft-hosted IP served domains spoofing Poland's energy regulator and a renewable energy firm, staged for sector-specific credential collection.