Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Quentin Bourgue
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
This article was originally distributed as a private report to our customers on 2 June 2026. As part of our threat intelligence and cybercrime mitigation efforts, the Sekoia TDR team actively monitors malware distribution campaigns leveraging the “ClickFix” social engineering technique. Consequently, we conducted an in-depth analysis of the ErrTraffic framework, a central component of this ecosystem.
EvilTokens: an AI-augmented Phishing-as-a-Service for automating BEC fraud – Part 2
A TLP:AMBER version of this post was originally distributed as a private FLINT report to our customers on 30 March 2026. As detailed in our previous blog post New widespread EvilTokens kit: device code phishing as-a-service – Part 1, EvilTokens is a new turnkey Microsoft device code phishing kit sold as Phishing-as-a-Service (PhaaS).
New widespread EvilTokens kit: device code phishing as-a-service – Part 1
This post was originally distributed as a private FLINT report to our customers on 25 March 2026. In March 2026, through our monitoring of phishing-focused cybercrime communities, Sekoia’s Threat Detection & Research (TDR) team uncovered EvilTokens, a new turnkey Microsoft device code phishing kit sold as Phishing-as-a-Service (PhaaS).
Phishing Campaigns "I Paid Twice" Targeting Booking.com Hotels and Customers
This article was originally distributed as a private report to our customers. A Sekoia partner recently reported a phishing campaign targeting hospitality industry customers worldwide. The campaign was observed to involve either emails sent from a hotel’s compromised Booking.com account or messages distributed via WhatsApp.
ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique. When it first emerged in July 2023, the injected code was designed to display a fake web browser download page, tricking users into downloading counterfeit browser updates.
Targeted supply chain attack against Chrome browser extensions
On 26 December 2024, the data security company Cyberhaven informed its users about a compromise of their Chrome browser extension. The attacker exploited the extension developer’s permissions, which had been previously gained through a targeted phishing attack, to upload a malicious version of Cyberhaven to the Chrome Web Store.
Exposing FakeBat loader: distribution methods and adversary infrastructure
Username or Email Address Password Remember Me Over the past few years, cybercriminals have increasingly used the drive-by download technique to distribute malware via user web browsing. This technique mostly involves SEO-poisoning, malvertising, and code injection into compromised websites to trick users into downloading fake software installers or browser updates.
PikaBot: a Guide to its Deep Secrets and Operations
Username or Email Address Password Remember Me Between 27 and 29 May 2024, international law enforcement agencies and partners conducted the Operation Endgame to disrupt criminal services, notably through taking down key botnet infrastructures, including those of IcedID, SystemBC, PikaBot, SmokeLoader and BumbleBee. The Sekoia TDR team supported the French law enforcement agencies by providing valuable cyber threat intelligence, in particular on PikaBot.
Tycoon 2FA: an in-depth analysis of the latest version of the AiTM phishing kit
To enhance our threat intelligence, improve detection and identify new threats, Sekoia analysts engage in continuous hunting to address the main threats affecting our customers. For this, we proactively search and identify emerging threats, using our telemetry data, internal tools and external services.
Scattered Spider laying new eggs
Scattered Spider (aka UNC3944, Scatter Swine, Muddled Libra, Octo Tempest, Oktapus, StarFraud) is a lucrative intrusion set active since at least May 2022, primarily engaged in social engineering, ransomware, extortion campaigns and other advanced techniques.
Adversary C2 infrastructures tracked in 2023
Throughout 2023, Sekoia.io’s Threat Detection & Research (TDR) team actively tracked and monitored adversary C2 infrastructures set up and used by lucrative and state-sponsored intrusion sets to carry out malicious cyber activities. Our analysts identified more than 85,000 IP addresses used as C2 servers in 2023, an increase of more than 30% compared to 2022.
CustomerLoader: a new malware distributing a wide variety of payloads
This blog post was originally sent to our clients on 19 June, 2023. Since the threat is still very active in July 2023 and continues to distribute a variety of malware families, Sekoia.io TDR analysts decided to publish a blog post. During our daily threat hunting routine, we identified an undocumented .NET loader aimed at downloading, decrypting and executing next-stage payloads.
Iran Cyber Threat Overview
This blogpost aims at understanding and contextualising cyber malicious activities associated with Iran-nexus intrusions sets over the 2022-2023 period. It does not establish an exhaustive list of campaigns or reported intrusion sets, but rather offer a strategic analysis pertaining to the Iranian cyber threat. Information cut-off date is 5 May 2023. CONTEXT The Islamic Republic of Iran does not publicly communicate on their cyber offensive doctrine.
Bluenoroff’s RustBucket campaign
Like DPRK soldiers In April 2023, fellow security researchers at Jamf published a report on Bluenoroff’s RustBucket, a newly observed malware targeting macOS platform. Sekoia.io analysts further investigated Bluenoroff’s infrastructure and share their findings in this report. Bluenoroff is a North Korea-nexus intrusion set, allegedly subordinated to RGB’s Bureau 121 tasked with revenue generation since at least 2015.
APT28 leverages multiple phishing techniques to target Ukrainian civil society
Read it later Remove The APT28 intrusion set (aka. Sofacy, PawnStorm, Fancy Bear), associated to the Russian GRU and famous for its cyber espionage and sabotage campaigns, was observed using multiple phishing techniques to target the Ukrainian civil society. These techniques include using HTTP webhook services such as as Pipedream and Webhook, as well as compromised Ubiquity routers to steal victims’ credentials.
Overview of the Russian-speaking infostealer ecosystem: the logs
In the first of the two-part blog post on the Russian-speaking infostealer ecosystem, Sekoia.io analysts highlighted the main distribution channels used by cybercriminals to spread their infostealers to a large public. In this second part, we share our analysis of the phenomenon of large-scale data theft, notably focusing on “logs”, i.e. stolen data collected by the infostealers.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Quentin
Contact Quentin, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack