Japanese Windows phishing campaign delivering MostereRAT
Campaign
Summary
Hide ▲
Show ▼
A phishing campaign is using malicious emails to lure Microsoft Windows users in Japan to a malicious website, creating an initial-access path for staged malware delivery and persistence. The operation matters because it is built to blend into routine business correspondence while setting up covert control of victim systems. The observed chain is not just credential theft; it is a delivery mechanism for MostereRAT and related remote-access tooling. The broader objective remains unclear, but the activity is already structured for long-term access.
Related Happenings
North Korean remote IT worker scam operation targeting American companies
Campaign
H score41
First: 16.04.2026 19:00
Last: 16.04.2026 19:00
Sources 1
About this happening:
A long-running North Korean remote IT worker scam operation used stolen identities and fake placements to embed operators inside more than 100 American companies. The...
North Korean remote IT worker scam operation targeting American companies
CampaignAbout this happening: A long-running North Korean remote IT worker scam operation used stolen identities and fake placements to embed operators inside more than 100 American companies. The...
W3LL Microsoft 365 adversary-in-the-middle phishing campaign
Campaign
H score39
First: 13.04.2026 21:55
Last: 13.04.2026 21:55
Sources 1
About this happening:
The W3LL phishing operation turned into a high-volume Microsoft 365 credential-theft campaign, exposing more than 17,000 victims worldwide to BEC risk. The kit use...
W3LL Microsoft 365 adversary-in-the-middle phishing campaign
CampaignAbout this happening: The W3LL phishing operation turned into a high-volume Microsoft 365 credential-theft campaign, exposing more than 17,000 victims worldwide to BEC risk. The kit use...
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor Meta
H score82
First: 05.03.2026 08:51
Last: 05.03.2026 08:51
Sources 1
About this happening:
Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Tycoon 2FA-Storm-1747 ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: Tycoon2FA has shifted from a subscription-based PhaaS and AitM credential harvester into a more resilient campaign that now uses device-code phishing against Mic...
Latest development: 17.05.2026 17:43
eSentire says Tycoon2FA now uses device-code phishing to target Microsoft 365 accounts, with invoice-themed lure emails carrying Trustifi click-tracking URLs that redirect through Trustifi, Cloudflare Workers, obfuscated JavaScript layers, and a fake Microsoft CAPTCHA page before sending victims to microsoft.com/devicelogin. The kit also adds anti-analysis defenses, including detection of Selenium, Puppeteer, Playwright, and Burp Suite, plus blocks for security vendors, VPNs, sandboxes, AI crawlers, and cloud providers.
Okitipi Samuel-RaccoonO365-Moses Felix alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score35
First: 19.12.2025 21:05
Last: 19.12.2025 21:05
Sources 1
About this happening:
The Raccoon0365 phishing platform functioned as a phishing-kit service sold to other criminals, expanding Microsoft 365 credential theft and account-compromise capacit...
Okitipi Samuel-RaccoonO365-Moses Felix alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: The Raccoon0365 phishing platform functioned as a phishing-kit service sold to other criminals, expanding Microsoft 365 credential theft and account-compromise capacit...
UNK_AcademicFlare Microsoft 365 device code phishing campaign
Campaign
H score36
First: 19.12.2025 19:54
Last: 19.12.2025 19:54
Sources 1
About this happening:
The UNK_AcademicFlare phishing campaign is actively stealing Microsoft 365 credentials through device code authentication abuse, creating account takeover risk for...
UNK_AcademicFlare Microsoft 365 device code phishing campaign
CampaignAbout this happening: The UNK_AcademicFlare phishing campaign is actively stealing Microsoft 365 credentials through device code authentication abuse, creating account takeover risk for...
Timeline
-
08.09.2025 23:49 2 articles · 10mo ago
Fortinet warns of MostereRAT phishing campaign targeting Windows users in Japan
Initial DisclosureFortinet's FortiGuard Labs warned of a phishing campaign targeting Microsoft Windows users in Japan that lures victims through malicious emails, a malicious website, and a weaponized Word document to deploy MostereRAT. The malware uses Easy Programming Language (EPL), staged payload execution, persistence, privilege escalation, AV/EDR evasion, Windows Filtering Platform (EFP) filters to block telemetry, and abuse of legitimate remote access tools such as AnyDesk and TightVNC for long-term control.
Show sources
- 'MostereRAT' Malware Blends In, Blocks Security Tools — www.darkreading.com — 08.09.2025 23:49
- 'MostereRAT' Malware Blends In, Blocks Security Tools — www.darkreading.com — 08.09.2025 23:49