Tonnerre

Multiple threat campaigns are leveraging social engineering, phishing-as-a-service (PhaaS), and abuse of trusted software to gain unauthorized access to corporate and personal accounts. Microsoft Teams is being abused in vishing attacks to trick users into granting remote access via RMM tools, while PhaaS platforms like Outsider and BlueKit enable credential theft through browser-in-the-middle attacks. Malicious actors are also exploiting misconfigurations in AI instruction files (llms.txt) to deliver malicious packages, and trojanized Electron apps are distributing the RevStealer information stealer. Additionally, attackers are abusing legitimate tools like Faronics Deploy and ScreenConnect to establish persistent remote access, and ransomware operations such as The Gentlemen and CRPx0 continue to target organizations with sophisticated, multi-stage attack chains.