https://blog.dansec.red/actors/voidproxy/Recent content in VoidProxy on DanSec DailyHugoen-gbMon, 15 Sep 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-09-15-cybersecurity-news/Mon, 15 Sep 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-09-15-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>The FBI has issued a FLASH alert regarding UNC6040 and UNC6395, two threat actor clusters actively compromising Salesforce environments. These actors are stealing sensitive data and engaging in extortion of affected organisations.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Chinese-speaking users are being targeted by a malware campaign leveraging SEO poisoning. The campaign uses fake software distribution sites, hosted via GitHub Pages, to deliver HiddenGh0st, Winos, and kkRAT malware families.</li> <li>A new phishing-as-a-service (PhaaS) platform named VoidProxy has been identified. VoidProxy is designed to target Microsoft 365 and Google accounts, including those protected by third-party single sign-on (SSO) services.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Attackers are manipulating search engine rankings (SEO poisoning) to lure users to malicious sites, particularly for distributing malware to Chinese-speaking audiences.</li> <li>There is an observed increase in web searches for ZIP file archives (e.g., backup.zip, web.zip) as noted by web honeypots, indicating potential reconnaissance or exploitation attempts targeting archived data.</li> <li>The use of legitimate platforms like GitHub Pages for malware hosting continues to be a tactic, complicating detection and takedown efforts.</li> <li>VoidProxy’s service highlights the ongoing professionalisation and accessibility of phishing operations, specifically targeting enterprise cloud accounts and SSO-protected environments.</li> </ul>