[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feHnAWbEIxS_V5SFoXEA2Tdf4jKhRVi5OlqrdXo2yrK8":3,"$fT5rBm-o0EavTKLmkRja8vqUKTPEUcrErDZ4HImX7658":28},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":24,"created_at":25,"updated_at":26,"published_at":27},"lapsus-phishing-campaign-targets-korean-and-global-financial-sector","LAPSUS$ Phishing Campaign Targets Korean and Global Financial Sector","AhnLab ASEC details multi-stage attack chain with HTML, JS, EXE, and VBE attachments delivering an infostealer payload.","AhnLab ASEC's June 2026 threat analysis reveals a multi-stage LAPSUS$ phishing campaign targeting the Korean and global financial sector, using a chain of HTML, JS, EXE, and VBE attachments to deploy an infostealer payload.",[10,11,12,13,14],"LAPSUS$","phishing","Korean","financial","infostealer","# LAPSUS$ Phishing Campaign Targets Korean and Global Financial Sector\n\n*AhnLab ASEC details multi-stage attack chain with HTML, JS, EXE, and VBE attachments delivering an infostealer payload.*\n\n**Tags:** `LAPSUS$` `phishing` `Korean` `financial` `infostealer`\n\n> AhnLab ASEC's June 2026 threat analysis reveals a multi-stage LAPSUS$ phishing campaign targeting the Korean and global financial sector, using a chain of HTML, JS, EXE, and VBE attachments to deploy an infostealer payload.\n\n---\n\n## LAPSUS$ Phishing Campaign Targets Korean & Global Financial Sector\n\nAhnLab ASEC has published a threat analysis of a multi-stage phishing campaign attributed to LAPSUS$, active since June 2026. The campaign targets the Korean and global financial sector, delivering a chain of HTML, JavaScript, EXE, and VBE attachments that culminate in an infostealer payload.\n\nThe initial HTML attachment executes a JavaScript dropper that downloads the EXE payload, which in turn spawns the VBE script to complete the infostealer deployment. ASEC notes the campaign is a standard LAPSUS$ delivery pattern, with the infostealer capturing browser credentials, cookies, and form data from targeted financial web portals.\n\n## Multi-Stage Phishing Chain: HTML, JS, EXE, VBE\n\nThe campaign delivers four attachments in sequence. The initial HTML file executes a JavaScript dropper that fetches the EXE payload, which then spawns a VBE script to complete the infostealer deployment. ASEC describes the chain as a standard LAPSUS$ delivery pattern, with the infostealer capturing browser credentials, cookies, and form data from targeted financial web portals.\n\n## LAPSUS$ Operational Model\n\nLAPSUS$ does not use an affiliate model to operate its Ransomware-as-a-Service platform. Instead, its members complete every stage of the breach using social engineering, moving from initial access through credential harvesting and data exfiltration without the typical affiliate dashboard and payment split seen in most RaaS groups.\n\n## Key points\n\n- AhnLab ASEC published a June 2026 threat analysis of a LAPSUS$ multi-stage phishing campaign.\n- The campaign targets the Korean and global financial sector.\n- The attack chain uses HTML, JS, EXE, and VBE attachments.\n- The final payload is an infostealer.\n\n## Further reading & sources\n\n- [July 2026 Dark Web Issue Trend Report - ASEC](https:\u002F\u002Fasec.ahnlab.com\u002Fen\u002F94918)\n- [8 Types of Ransomware, Plus Examples of Attacks | Informa TechTarget](https:\u002F\u002Fwww.techtarget.com\u002Fcybersecurity\u002Ffeature\u002F8-types-of-ransomware-plus-examples-of-attacks)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flapsus-phishing-campaign-targets-korean-and-global-financial-sector.png?v=2129e9e17b",{"actors":18},[19],{"url":20,"name":10,"slug":21,"type":22,"origin":23,"motivation":13},"\u002Fthreat-groups\u002Flapsus","lapsus","ransomware","United Kingdom and Brazil","campaign","2026-09-18T17:07:46.926709+00:00","2026-10-16T12:28:29.300205+00:00",null,{"articles":29},[30,41,52,63],{"slug":31,"title":32,"summary":33,"tags":34,"hero_image_url":39,"story_type":24,"created_at":40},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[35,36,37,38,14],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","2026-09-30T07:09:51.117027+00:00",{"slug":42,"title":43,"summary":44,"tags":45,"hero_image_url":50,"story_type":24,"created_at":51},"dr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave","Dr.Web Q2 2026: +5.72% detections, +95.32% unique threats, MAX-messenger phishing wave","Dr.Web's Q2 2026 virus activity review reports a 5.72% increase in total detections and a 95.32% jump in unique threats, with encoder trojans and a MAX-messenger phishing campaign driving the top of the mix.",[46,47,48,49,11],"Dr.Web","Q2 2026","encoder trojans","MAX-messenger","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave.png?v=206efdb9fc","2026-09-20T12:05:24.111918+00:00",{"slug":53,"title":54,"summary":55,"tags":56,"hero_image_url":61,"story_type":24,"created_at":62},"mirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm","Mirage2FA Phishing Toolkit Hijacks 4,500 Microsoft 365 Sessions via AiTM","Mirage2FA is an active phishing-as-a-service toolkit that hijacks Microsoft 365 sessions via Adversary-in-the-Middle, bypassing MFA to steal credentials, 2FA codes, and session cookies from 4,500+ US and EU organizations.",[11,57,58,59,60],"m365","aitm","mfa-bypass","us-victims","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm.png?v=66142d32cc","2026-09-17T07:09:37.283462+00:00",{"slug":64,"title":65,"summary":66,"tags":67,"hero_image_url":73,"story_type":24,"created_at":74},"apt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine","APT28 Deploys BadPaw and MeowMeow Malware Duo Against Ukraine","APT28 (Fancy Bear) is running a new campaign against Ukrainian targets using two new .NET malware components, BadPaw (loader) and MeowMeow (backdoor), delivered through a phishing ZIP that opens an HTA file themed around Ukrainian border-crossing appeals.",[68,69,70,71,72,11],"APT28","Fancy Bear","BadPaw","MeowMeow","Ukraine","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fapt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine.png?v=457c9d4fd3","2026-08-26T17:07:17.029451+00:00"]