Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes

Proofpoint observed TA577 phishing campaigns (Feb 26–27, 2024) that delivered ZIP attachments containing HTML files which trigger SMB connections to attacker-controlled servers to capture NTLMv2 challenge/response pairs; the technique enables credential theft and pass-the-hash lateral movement, impacted hundreds of organizations worldwide, and defenders are advised to block outbound SMB.