CloudSEK Updates

CloudSEK has uncovered a malicious SMS spoofing campaign spreading a fake version of Israel’s “Red Alert” emergency app amid the ongoing conflict. Disguised as a trusted warning platform, the trojanized Android app can steal SMS, contacts, and location data while appearing legitimate. The report highlights how cybercriminals are weaponising public fear during crises to deploy mobile spyware with serious security and real-world implications.

The report examines the sharp escalation following the 28 February 2026 joint Israel–U.S. strikes on Iran, triggering a hybrid conflict blending kinetic attacks with unprecedented cyber operations. Iran faced near-total internet disruption, while retaliatory missile and cyber activity spread across Israel, the Gulf, and beyond. Over 150 hacktivist incidents were recorded, with global spillover risks to energy, finance, IT, and critical infrastructure sectors

CloudSEK researchers infiltrated Gunra’s newly launched RaaS affiliate program, gaining access to its live panel and ransomware locker. Our analysis reveals a highly optimized ChaCha20 + RSA-4096 hybrid encryption engine, multi-threaded execution, surgical file targeting, and offline stealth capabilities.

A single leaked credential from a fourth-party vendor recently exposed the digital infrastructure of 200 global airports. This security failure highlights how a lack of Multi-Factor Authentication can jeopardize critical systems, including baggage reconciliation and passenger kiosks. Discover how SVigil identified this backdoor before it cost the industry billions.

CloudSEK researchers have uncovered ZHGUI, a sophisticated China-linked cryptocurrency scam targeting Southeast Asian investors. Disguised as a compliant U.S. exchange using fake regulatory credentials, ZHGUI employs "pig-butchering" social engineering and mirror-exchange infrastructure to siphon millions in USDT. Discover the technical indicators and on-chain evidence behind this global fraud network.

CloudSEK’s latest investigation exposes a rapidly evolving fraud ecosystem targeting Canadians through highly convincing impersonation of government services and trusted national brands. From fake traffic fines and tax refunds to airline bookings and parcel delivery alerts, attackers are scaling operations using shared infrastructure and phishing-as-a-service models. The report reveals how urgency and institutional trust are weaponized—and what organizations must do to stay ahead.

MacSync is a stealthy macOS infostealer delivered through a ClickFix-style phishing lure that tricks users into pasting a single Terminal command. Once executed, it harvests passwords, browser data, crypto wallets, and even trojanizes trusted hardware wallet apps like Ledger and Trezor—turning familiar software into long-term phishing tools

CloudSEK has exposed RedLineCyber, a threat actor infiltrating Discord to distribute Pro.exe. This "clipboard hijacker" silently monitors your system, swapping your destination wallet address for the attacker’s the moment you paste. Targeting streamers and gamers, this stealthy malware operates without a network footprint—making it nearly invisible until your assets are gone.

CloudSEK's TRIAD recently identified a spear-phishing campaign attributed to the Muddy Water APT group targeting multiple sectors across the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign uses icon spoofing and malicious Word documents to deliver "RustyWater," a Rust-based implant representing a significant upgrade to their traditional toolkit