Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Cris Tomboc
BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits
October 30, 2026 10 Minute Read by Serhii Melnyk, Cris Tomboc and King Orande Anyone who has signed in to a streaming app on a smart TV by typing a short code into a phone has used a device code flow. Microsoft supports the same mechanism for Microsoft 365 accounts, and attackers have turned it against the people it was designed to help.
Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts
LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts. In addition to recent reporting by The Hacker News, our analysis examines the kit's evolving techniques and infrastructure, highlighting key changes observed across analyzed variants. Campaign timeline: Active since at least early July 2026 and ongoing as of writing.
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign
October 07, 2026 4 Minute Read by King Orande and Cris Tomboc Key Takeaways The LevelBlue Operational Cyber Threat Intelligence (OpsCTI) Team recently observed a ClickFix campaign delivering Remus Stealer through compromised websites. The campaign uses PhantomPolia, a JavaScript loader that retrieves an encrypted configuration from an Ethereum Sepolia smart contract through public Remote Procedure Call (RPC) endpoints.
Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect
(String: https://www.levelblue.com/hubfs/lb-web/social/sl-metadata.jpg) 10 Minute Read The LevelBlue OpsCTI Team recently identified a large-scale phishing campaign leveraging a new social engineering method to deploy unauthorized ConnectWise ScreenConnect clients.
SocGholish: Turning Application Updates into Vexing…
This blog is the latest in a series that delves into the deep research conducted daily by the Trustwave SpiderLabs Threat Operations team on major threat actor groups and malware currently operating globally. SocGholish, also known as FakeUpdates, has been in service since 2017. Distributed by the threat group TA569, SocGholish is best known for masquerading as a fake application update to trick users into downloading malicious files.
Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader
7 Minute Read Trustwave's Threat Intelligence team has discovered a new malware dubbedPronsis Loader, with its earliest known variant dating back to November 2023. This loader shares similarities with theD3F@ck Loader, which surfaced in January 2024. Pronsis Loader has been observed delivering different malware variants, includingLumma StealerandLatrodectus as its primary payloads. Additionally, the team identified infrastructure linked to Lumma Stealer during the investigation.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Cris
Contact Cris, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack