The web platform, browsers, AI and security, taken apart: news, analysis and research from the FuriaHub team.
OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.
SOCRadar says the AnonyMousKIT phishing-as-a-service harvests Apple IDs and codes so stolen iPhones can be unlocked and Activation Lock disabled. The kit has been active since early 2024, with 506 domains and 168 reseller storefronts.
An attacker vished employees and stood up a fake SSO site on reliaquest.claims. One employee entered credentials and approved MFA. Device-trust still blocked apps.
Zimperium said ToxicPanda 2.0 requests VPN permissions to block Google Play before the rest of the malware lands. The family supports 167 remote commands and phishing overlays for 349 banking and crypto apps in 16 countries.
Marcus Hutchins at Expel described a Teams campaign impersonating IT help desk and delivering a fake PowerShell Cleaner MSI hosted on Azure. The loader, first built around July 28, 2026, can drop PhishLocker, a fake lock screen that Alt+Tab reveals as a borderless app.
Abnormal Security described a $10,000 kit sold on Russian forums that uses a browser-in-the-middle flow, then enrolls a rogue passkey once the victim signs in for real. Demos focused on Google; the sellers also advertised iCloud, LinkedIn, and Microsoft.
GTIG tracked UNC6293, UNC7005, and UNC5976 using OAuth phishing against government, defense, and academic targets. Microsoft tracks UNC6293 as Storm-2945; the clusters used login-URL and code requests, device-code phishing, and a fake Continue with Google button.
FuriaHub