CloudSEK Updates

France’s underground cyber threat activity has surged more than fourfold in two years, driven largely by stolen credentials, infostealer logs, ransomware, and pro-Russian hacktivism. CloudSEK’s latest report reveals how government bodies, financial institutions, and smaller organisations are becoming increasingly exposed to a fast-growing cybercrime economy.

Tomorrowland 2026 sold out fast, and scammers moved faster. CloudSEK uncovered a dozen fake ticket shops and travel sites mimicking the festival, complete with countdown timers and fake "biometric checks." Some sites harvest identity data and payments; others quietly earn commissions. Read the full breakdown of how each scam works.

Uncover how an 18-day honeypot captured 15 million automated attacks targeting telephony ecosystems in the "Copy of SIP Honeypot Report.pdf". Download the full report to expose active VoIP fraud networks and access 277,632 recovered attacker passwords.

An exposed attacker server has revealed FortiBleed’s complete operation—from credential harvesting and GPU-powered cracking to network intrusion and access sales. CloudSEK’s analysis separates verified compromises from inflated claims, uncovering what the attackers actually achieved.

An exposed attacker server revealed the inner workings of Operation Escaneo—a sophisticated campaign targeting Latin American governments and financial institutions. CloudSEK maps its custom tools, exploitation chain, persistence tactics and suspected links to MexicanMafia. Read the full investigation.

BlueKit is turning phishing into a subscription business, offering 87 ready-made kits, automated account takeover and stealthy peer-to-peer infrastructure. CloudSEK’s investigation reveals how this mature PhaaS platform helps even low-skilled criminals target banks, cloud services and global brands.

As the FIFA World Cup 2026 begins, a highly sophisticated, Chinese-origin threat operation is targeting global football fans. Utilizing pixel-perfect website clones, a multi-tenant reseller network, and an active Man-in-the-Middle framework, these actors intercept payment details and bypass SMS-based two-factor authentication in real time to completely compromise accounts.

Cybercriminals are now targeting real e-commerce checkout pages, not just fake websites. This report reveals how a WooCommerce skimmer silently steals card details during genuine payments. Read the full report to understand the hidden risk.

A real-world AIVigil finding from a customer environment. One unprotected AI integration endpoint with no login required. An attacker chained Server-Side Request Forgery, Local File Inclusion, and live AWS credential exfiltration into a potential full infrastructure takeover. This is how it happened, and how AIVigil found it first.