{"id":16563,"date":"2025-10-29T10:02:04","date_gmt":"2025-10-29T10:02:04","guid":{"rendered":"\/cybersecurity-blog\/?p=16563"},"modified":"2025-10-30T12:41:02","modified_gmt":"2025-10-30T12:41:02","slug":"cyber-attacks-october-2025","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/cyber-attacks-october-2025\/","title":{"rendered":"Major Cyber Attacks in October 2025: Phishing via Google Careers & ClickUp, Figma Abuse, LockBit 5.0, and TyKit\u00a0"},"content":{"rendered":"\n

Phishing campaigns and ransomware families evolved rapidly this October, from fake Google Careers pages and ClickUp<\/strong> redirect chains to Figma-hosted credential theft<\/strong> and LockBit\u2019s move<\/strong> into ESXi and Linux systems. ANY.RUN analysts also uncovered TyKit<\/strong>, a reusable phishing kit hiding JavaScript inside SVG files to steal Microsoft 365 credentials across multiple sectors. <\/p>\n\n\n\n

Each of these threats shows how attackers are increasingly abusing legitimate cloud platforms, layering CAPTCHA checks and redirects to bypass detection. All cases were analyzed inside ANY.RUN\u2019s Interactive Sandbox<\/a>, revealing execution flows and behavioral indicators missed by static tools; insights SOC teams can turn into actionable detection logic. <\/p>\n\n\n\n

Let\u2019s break down how these attacks unfolded, who they targeted, and what security teams can learn to strengthen their defenses before the next wave hits. <\/p>\n\n\n\n

1. Google Careers Phishing Campaign: Legitimate Platforms Used to Steal Corporate Credentials <\/h2>\n\n\n\n

Post on X<\/a>\u00a0and LinkedIn<\/a><\/p>\n\n\n\n

ANY.RUN analysts uncovered a phishing campaign posing as Google Careers<\/strong>, where attackers combined a Salesforce redirect<\/strong>, Cloudflare Turnstile CAPTCHA<\/strong>, and a fake job application page<\/strong> to steal corporate credentials. The campaign primarily targets employees in technology, consulting, and enterprise service sectors, exploiting the trust people place in well-known brands and cloud services. <\/p>\n\n\n\n

Unlike typical phishing kits, this campaign weaves together multiple legitimate platforms to make the flow appear authentic, slipping through filters and reputation-based security tools. Once credentials are entered on the fake Google Careers portal, they\u2019re exfiltrated to the command-and-control (C2) server, such as satoshicommands[.]com<\/strong>, enabling further compromise of work accounts, client data, and internal collaboration tools. <\/p>\n\n\n\n

For organizations, this attack creates a chain reaction: compromised mailboxes, lateral movement across SaaS ecosystems, and potential exposure of customer or partner data; all while evading detection from traditional tools that trust the Salesforce and Cloudflare domains in the redirect path. <\/p>\n\n\n\n

See full execution chain exposed in 60 seconds<\/strong><\/a><\/strong> <\/p>\n\n\n

\n
\"\"
Fake Google Careers page displayed inside ANY.RUN sandbox<\/em> <\/figcaption><\/figure><\/div>\n\n\n

Adversaries in this campaign misuse legitimate platforms to host phishing flows that evade automated detection. The combination of trusted domains<\/strong> and multi-step redirection<\/strong> makes these attacks particularly hard to catch without behavioral visibility. <\/p>\n\n\n\n

Below are ready-to-use Threat Intelligence Lookup<\/strong><\/a> queries<\/strong> to expand visibility, uncover infrastructure overlaps, and convert findings into detection rules<\/strong>, not just IOCs: <\/p>\n\n\n\n

Google-like application domains: <\/strong>domainName:”apply.g*.com” OR domainName:”hire.g*.com”<\/a> <\/p>\n\n\n\n

Vercel deployment patterns: <\/strong>domainName:”puma-*.vercel.app” OR domainName:”hiring*.vercel.app”<\/a> <\/p>\n\n\n\n

YouTube TLD impersonation: <\/strong>domainName:”hire.yt”<\/a> <\/p>\n\n\n\n

C2 domain: <\/strong>domainName:”satoshicommands.com”<\/a> <\/p>\n\n\n

\n
\"\"
Google Careers phishing infrastructure tracking with TI Lookup<\/em> <\/figcaption><\/figure><\/div>\n\n\n

Gathered IOCs:<\/strong> <\/p>\n\n\n\n