Hackers Leveraged Trustworthy Platforms for Attack Tools In July 2026, cybercriminals demonstrated their capability by exploiting legitimate business tools such as Microsoft login pages, Zoom event invitations, and official government websites to turn them into attack vectors. Threat intelligence from ANY.RUN highlights that attackers across the United States, Europe, and Brazil systematically used routine corporate workflows to bypass perimeter security controls and harvest credentials for long-term access. Modular payloads like DestinyStealer collected browser credentials, session cookies, Outlook data, VPN profiles, FileZilla logins, and cryptocurrency wallets, exfiltrating information across parallel HTTP and TCP channels.
Meanwhile, variant updates to Banana RAT included randomized file structures and encrypted WebSocket communications while secondary campaigns deployed DARTHVADER Stealer via malicious shortcut files using native Windows utilities, AutoIt, and PowerShell script chains.
Campaign/Threat Core Weaponization Vector Operational Impact Kratos PhaaS Trusted cloud redirects & DocuSign lures M365 credential theft & cloud access Kali365 OAuth device-code login flow abuse Passwordless persistent token harvesting Zoom Lure Operations Counterfeit AI summit event registration pages AiTM redirection & credential harvesting PhantomEnigma Compromised .gov.br portals & government mail Legitimate mail auth bypass & RAT delivery OVERLORD / Banana RAT Live C2 channels & encrypted WebSockets Real-time data exfiltration & persistent access A critical finding from these July campaigns is that threat actors rotate infrastructure far faster than traditional blacklists can update.
