New Attack Wave Sees Threat Actors Masquerading as Popular Brands to Spread Malware

This report details a sophisticated smishing campaign that spoofs trusted brands by inserting them before the '@' in URLs, uses aged domains (6–12 months) to build reputation before short-lived activation windows (72–96 hours), and delivers multi-stage malware including credential-harvesters and a RAT via APKs or signed executables. Attackers employ redirect chains, CDN-hosted C2, TLS with self-signed certificates chained to legitimate roots, and runtime checks to evade detection; recommended mitigations include improved URL parsing, mobile threat defense, long-press link inspections, and browser isolation.