INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Interpol Impersonators Spread Ransomware via Phishing Emails to Small Biz

| 2026-07-02 15:24 CRITICAL MEDIUM RANSOMWARE & EXTORTION LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
An emerging ransomware campaign is targeting small businesses across multiple regions with fake Interpol notices designed to trick victims into downloading malware disguised as evidence of alleged criminal activity. The campaign has so far has targeted businesses in multiple sectors, including pharmaceuticals, food, agriculture, technology, media, and legal services in the US, Europe, Asia, and the Middle East. Small Business Focus Besides its focus on small businesses , the campaign is notable because it highlights how attackers no longer need sophisticated ransomware or the resources of a major cybercrime operation to launch disruptive attacks, Bitdefender said in a report this week.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-33825 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation.
Technical Observables 1 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
files 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-33825CVE-2026-33825
Target & Sectors
EUROPE EUROPE NORTH_AMERICA NORTH_AMERICA MIDDLE_EAST MIDDLE_EAST legallegal pharmaceuticalpharmaceutical governmentgovernment
Incident Timeline
‎September 2023
Threat actors are offering Millenium RAT 4.* as malware-as-a-service for $50 initially, or a one-time purchase of $90 lifetime.
organisation DotStealer
The malware is attributed to a developer named ShinyEnigma, who is also behind DotStealer and was first seen in September 2023.
infrastructure Windows
"As a full-featured remote access trojan, Millenium RAT 4.* is designed to compromise Windows machines," Group-IB said .
organisation Y2K Operators
Exploitation campaigns involving the malware are carried out by a threat actor cluster codenamed Y2K Operators.
financial $10 month
It is offered as malware-as-a-service (MaaS) for $50 for the first month, $10 for subsequent months, or a one-time $90 lifetime purchase.
financial $90 $ lifetime
It is offered as malware-as-a-service (MaaS) for $50 for the first month, $10 for subsequent months, or a one-time $90 lifetime purchase.
‎May 2025
Threat actors used social engineering tactics to trick users into executing malicious payloads, infecting 62,289 devices with the Millenium RAT 4.* malware since May 2025.
tactic Social Engineering
The threat actor has been active since May 2025, using social engineering as a way to trick users into executing malicious payloads by masquerading them as legitimate software or cracked applications.
infrastructure 62,289 devices
As of writing, 62,289 devices have been infected with the Millenium RAT 4.*
‎the period between March 1
Threat actors exploited a vulnerability in ClickFix, a delivery method used by ReliaQuest to target both Windows and macOS systems.
infrastructure Windows
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
infrastructure Macos
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
organisation ReliaQuest
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
‎the month of March 2026
Threat actors used a combination of exploits to infect over 16,000 devices in the month of March 2026.
general_metric 16,000 infections
versions, with more than 16,000 infections reported in the month of March 2026 alone.
‎March 2026
Threat actors used a malicious Chromium-based extension impersonating Perplexity AI to trick users into installing it, resulting in 10,000 installs before being taken down by Google.
organisation Group-IB
"They take popular RATs, builders, and exploit kits, add a backdoor, and redistribute them — so the would-be attacker downloads a working tool and gets infected at the same time," Group-IB said.
organisation Microsoft
Search hijack extension Microsoft said it discovered a malicious Chromium-based extension that impersonates the AI-powered answer engine Perplexity AI to trick unsuspecting users into installing it.
organisation Chromium
Search hijack extension Microsoft said it discovered a malicious Chromium-based extension that impersonates the AI-powered answer engine Perplexity AI to trick unsuspecting users into installing it.
organisation Perplexity AI
Search hijack extension Microsoft said it discovered a malicious Chromium-based extension that impersonates the AI-powered answer engine Perplexity AI to trick unsuspecting users into installing it.
organisation Google
The extension, named "Search for Perplexity ai" (ID: flkebkiofojicogddingbdmcmkpbplcd), has since been taken down by Google, but not before it attracted 10,000 installs.
infrastructure 10,000 installs
The extension, named "Search for Perplexity ai" (ID: flkebkiofojicogddingbdmcmkpbplcd), has since been taken down by Google, but not before it attracted 10,000 installs.
organisation Manifest Version
"However, unlike traditional search hijackers that rely primarily on aggressive monetization or visible redirection, this extension combines Manifest Version 3 (MV3) capabilities with intermediary infrastructure and declarativeNetRequest (DNR) rules to transparently intercept Omnibox queries while preserving the appearance of legitimate search results."
organisation DNR
"However, unlike traditional search hijackers that rely primarily on aggressive monetization or visible redirection, this extension combines Manifest Version 3 (MV3) capabilities with intermediary infrastructure and declarativeNetRequest (DNR) rules to transparently intercept Omnibox queries while preserving the appearance of legitimate search results."
organisation Teams
"That's why we're introducing a new Teams admin policy designed to give organizations more visibility and control over external bots in their meetings.
organisation CAPTCHA
With these new safeguards rolling out, Microsoft plans to retire the existing CAPTCHA verification experience.
‎April 2026
BlueHammer ransomware was first disclosed as a zero-day by Nightmare-Eclipse in April 2026.
organisation BlueHammer
BlueHammer was first disclosed as a zero-day by an anonymous researcher named Chaotic Eclipse (aka Nightmare-Eclipse) in April 2026.
organisation Nightmare-Eclipse
BlueHammer was first disclosed as a zero-day by an anonymous researcher named Chaotic Eclipse (aka Nightmare-Eclipse) in April 2026.
‎May 29, 2026
Threat actors used a customized version of the open-source DCRat framework dubbed BeepRAT, distributed via a Chinese phone number management utility packaged within a ZIP archive, to target victims in China-linked RAT activity.
organisation Cofense
" Platform-aware phishing Cofense said it's observing a "clear shift in phishing operations" where threat actors are moving beyond broad, one-size-fits-all campaigns to adopt platform-aware delivery that adapts to the victim's device, browser, and environment.
infrastructure Windows
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
"What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android," it said .
infrastructure Macos
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
"What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android," it said .
infrastructure Android
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
"What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android," it said .
organisation ConnectWise
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
organisation Ninite Loader
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
organisation Paste Protect
" Clipboard attack defense Opera has introduced Paste Protect, a new security feature designed to block ClickFix -style attacks that deceive users into executing malicious commands through social engineering techniques.
organisation ClickFix
" Clipboard attack defense Opera has introduced Paste Protect, a new security feature designed to block ClickFix -style attacks that deceive users into executing malicious commands through social engineering techniques.
organisation Apple
A vulnerability has been disclosed in Apple's Hide My Email service that allows users' real email addresses to be unmasked.
organisation DNS
The malware establishes persistence on the host via scheduled tasks, and resolves the command-and-control infrastructure using DNS-over-HTTPS (DoH) requests.
organisation the State Department
"Although these malicious cyber activities did not exploit any security vulnerability in the platforms' encryption protections, they have compromised thousands of individual commercial messaging application accounts," the State Department said .
organisation CoT Forgery
The attack, dubbed CoT Forgery, involves injecting fabricated reasoning into user prompts and tool outputs, causing the models to mistake the forgery for their own thoughts and act on them, yielding 60% attack success against frontier models.
organisation API
The relevant code checks Claude Code's base URL environment variable that's used to route API requests to a proxy or gateway.
organisation Opera
"When any kind of suspicious clipboard activity is detected, Opera's Paste Protect warns users before dangerous content can be executed."
organisation Huntress
According to Huntress, ClickFix was responsible for over 53% of all malware loader activity in 2025.
‎May 31, 2026
The U.S. Federal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft.
infrastructure Windows
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
infrastructure Macos
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
organisation ReliaQuest
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
organisation UNC1151
A spear-phishing attack orchestrated by UNC1151 (aka Ghostwriter) targeting Belarusian pro-democracy politician Yury Hubarevich has been assessed to be part of a much broader credential phishing operation.
organisation Censys
Attack surface management platform Censys has since uncovered additional domains impersonating the I.UA email portal, suggesting the activity also likely targeted Ukrainians.
organisation FTC
FTC enforcement action The U.S. Federal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft.
organisation The U.S. Federal Trade Commission
FTC enforcement action The U.S. Federal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft.
organisation Amazon
FTC enforcement action The U.S. Federal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft.
financial $2.25 Amazon
FTC enforcement action The U.S. Federal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft.
organisation FTC’s Bureau of Consumer Protection
"Amazon often puts identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to – records that could help victims protect themselves and recover from the fraudulent conduct," said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection.
‎Jul 02, 2026
A custom-built ransomware payload is being used to target small businesses across multiple regions via phishing emails impersonating law enforcement officials.
organisation Ransomware
Ransomware phishing lure A phishing campaign is targeting small businesses across Europe, Asia, the Middle East, and the U.S. with fake investigation emails impersonating law enforcement officials.
infrastructure Windows
" Sandbox root escape New research from Armadin has discovered an attack chain affecting Claude Cowork on Windows.
organisation Sandbox
" Sandbox root escape New research from Armadin has discovered an attack chain affecting Claude Cowork on Windows.
organisation Armadin
" Sandbox root escape New research from Armadin has discovered an attack chain affecting Claude Cowork on Windows.
organisation Claude Desktop's
The attack allows an attacker with local code execution to plant a malicious file in Claude Desktop's application directory, hijacking a trusted process to communicate with Cowork's underlying VM service.
organisation Cowork
The attack allows an attacker with local code execution to plant a malicious file in Claude Desktop's application directory, hijacking a trusted process to communicate with Cowork's underlying VM service.
organisation Claude Cowork's
"An attacker with local code execution could run arbitrary commands as root in Claude Cowork's sandbox without network egress restrictions," the company said .
‎2026/07/02
Threat actors used a fake Interpol message to trick victims into downloading malware disguised as evidence of alleged criminal activity.
organisation The U.S. State Department
…reat landscape, one that is designed to increase the likelihood of compromise, expand target coverage, and improve threat actor return on investment." Russian hacker reward The U.S. State Department is offering a reward of up to $10 million for information leading to the identification or location of threat actors associated with UNC5792 , a malicious cyber group assoc…
organisation the Russian Federal Security Service
…Russian hacker reward The U.S. State Department is offering a reward of up to $10 million for information leading to the identification or location of threat actors associated with UNC5792 , a malicious cyber group associated with the Russian Federal Security Service (FSB) Border Guards and UNC4221, a malicious group of cyber actors working on behalf of the Russian military services.
organisation BlueHammer Ransomware
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories.
victims 25 employees
…CrowdStrike's State of SMB Cybersecurity Survey showed that smaller organizations got hit disproportionately more frequently in cyberattacks than bigger ones: 29% of SMBs with fewer than 25 employees in the survey were hit in ransomware attacks.
organisation Hacking News / Cybersecurity News
 Ravie Lakshmanan  Jul 02, 2026 Hacking News / Cybersecurity News This week’s security news is mostly about weak spots.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
"What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android," it said .
" Sandbox root escape New research from Armadin has discovered an attack chain affecting Claude Cowork on Windows.
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
"As a full-featured remote access trojan, Millenium RAT 4.* is designed to compromise Windows machines," Group-IB said .
Metrics
infrastructure
‎Macos
Affected Product
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
"What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android," it said .
Data from ReliaQuest for the period between March 1 and May 31, 2026, ClickFix remained the dominant delivery method during this period and targeted both Windows and macOS systems.
Metrics
infrastructure
‎Android
Affected Product
Phishing campaigns have been found to deliver Itarian RAT or the ConnectWise tool via Ninite Loader on Windows, while serving credential harvesting phishing pages when URLs are visited from macOS or Android.
"What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android," it said .
Metrics
financial
2,250,000
Amazon
FTC enforcement action The U.S. Federal Trade Commission has fined Amazon $2.25 million to settle claims that the company failed to help customers who fell victim to identity theft.
Metrics
infrastructure
10,000
Installs
The extension, named "Search for Perplexity ai" (ID: flkebkiofojicogddingbdmcmkpbplcd), has since been taken down by Google, but not before it attracted 10,000 installs.
Metrics
financial
10
Month
It is offered as malware-as-a-service (MaaS) for $50 for the first month, $10 for subsequent months, or a one-time $90 lifetime purchase.
Metrics
financial
90
$ Lifetime
It is offered as malware-as-a-service (MaaS) for $50 for the first month, $10 for subsequent months, or a one-time $90 lifetime purchase.
Metrics
infrastructure
62,289
Devices
As of writing, 62,289 devices have been infected with the Millenium RAT 4.*
Metrics
victims
25
Employees
…CrowdStrike's State of SMB Cybersecurity Survey showed that smaller organizations got hit disproportionately more frequently in cyberattacks than bigger ones: 29% of SMBs with fewer than 25 employees in the survey were hit in ransomware attacks.
Intelligence Sources
Dark Reading 2026-07-02
The Hacker News 2026-07-02