Proofpoint reports that China-aligned TA419 used impersonation and multi-stage adversary-in-the-middle phishing to target U.S. AI policy experts, stealing Microsoft 365 credentials and session cookies through a customized Browser-in-the-Browser tool.
Proofpoint describes a campaign that harvests university credentials and personal information through online forms, then uses compromised accounts to promote fraudulent jobs and advance-fee scams.
Proofpoint researchers report that a TeamFiltration campaign targeted 5,714 accounts across 28 Microsoft 365 tenants, compromising seven dormant service accounts. Post-access activity included VPN probing and access to Azure and SharePoint.
Proofpoint details BlueMoon, an exploit kit chaining Chrome and Windows vulnerabilities that multiple espionage-focused actors used in spearphishing campaigns. The report covers its exploit mechanics, payloads, targets, and detection opportunities.