Chinese Threat Actors Ditch Static Phishing Pages for Live Credential Interception
2026-05-26T14:52:17Z•bd4b86f848b5e937177b9e0d87d95a92bab8ff415be2a87ad77ef9d1d414be63
Android-RATBTMOBChina-linkedIran-linkedKali365OAuth-phishingSEO-poisoningcredential-theftexchange-zero-dayfragnesia-LPEsensible?github-breachgrafanainfostealerlinux-kernel-flawlive-credential-interceptionnation-state-actorsno-code-buildernpm-wormphishingphishing-kitptracesupply-chain-attacktanstackvs-code-extension-compromisezero-day
What happened
A wave of high-impact cyber incidents and trends: Chinese phishing platforms are moving from static pages to live credential interception and SEO-poisoning campaigns, while phishing-as-a-service (eg. Kali365) and no-code builders (BTMOB) lower the barrier for attackers and enable OAuth token and credential theft. Multiple nation-state and espionage campaigns (China-linked Webworm, Mustang Panda; Iran-linked Nimbus Manticore) continue to deploy bespoke backdoors and malware. Serious supply‑chain and software compromise events were reported (GitHub/VS Code extension compromise, Grafana/TanStack,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- infosecurity_magazine
- Record identifier
- bd4b86f848b5e937177b9e0d87d95a92bab8ff415be2a87ad77ef9d1d414be63
- Enrichment time
- 2026-05-26T14:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.