Storm-0900 Hackers Leveraging Parking Ticket and Medical Test Themes in Massive Phishing Attack

Microsoft Threat Intelligence detected and blocked a Thanksgiving-era phishing campaign attributed to 'Storm-0900' that sent tens of thousands of emails across the United States using fake parking tickets and medical results to trick users into interacting with a malicious landing page (permit-service.top). Visitors were shown a fake CAPTCHA to validate interaction, which enabled delivery of XWorm, a modular remote access malware; Microsoft disrupted the campaign with email filtering, endpoint protections, and preemptive blocking of attacker infrastructure.