A financially motivated threat actor tracked as Breeze Comet (previously UNC5669) has been targeting Brazilian financial services, retail, and e-commerce organizations since 2024 by exploiting payment systems and banking software to execute fraudulent transactions. According to Google's Threat Intelligence Group and Mandiant, the group specializes in manipulating payment infrastructure to conduct unauthorized transfers across Brazilian financial networks. This campaign represents a sustained effort against Brazil's critical financial ecosystem with a focus on direct financial fraud rather than data theft.
Cybercriminals are distributing a fraudulent GTA 6 leak that contains malware designed to drain cryptocurrency wallets, steal tokens, and pilfer NFTs from unsuspecting users seeking early access to the game. The scam exploits the high anticipation around the upcoming title to lure victims into downloading malicious files.
Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices. "The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect
The ClickFix campaign has compromised 31 organizations by leveraging the Polygon blockchain as an infrastructure tool, specifically using EtherHiding to dynamically update command-and-control servers. By abusing the blockchain as an attacker-controlled address book, the threat actors can maintain persistent communication channels that are difficult to disrupt through traditional takedown methods.