Storm-2992

☆ pin

Reports

First seen

Sep 22, 2026

Last seen

Sep 28, 2026

Motivation

Financial

Targeting

Sectors

Other ×3

Top ATT&CK techniques

T1566 Phishing ×5T1078 Valid Accounts ×4T1087 Account Discovery ×3T1566.002 Phishing: Spearphishing Link ×2T1110 Brute Force ×2T1041 Exfiltration Over C2 Channel ×2T1114 Email Collection ×2T1598.003 Phishing for Information: Spearphishing Link ×1T1021.002 Remote Services: SMB/Windows Admin Shares ×1T1136 Create Account ×1T1071.001 Application Layer Protocol: Web Protocols ×1T1053 Scheduled Task/Job ×1

Indicators

cve ×61domain ×4filename ×2url ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-42608 (exploited)CVE-2026-63077 (exploited)CVE-2026-68490 CVE-2026-77179 CVE-2026-85102 CVE-2026-87902 CVE-2026-88771 (exploited)CVE-2026-88772 (exploited)CVE-2026-89775 CVE-2026-93952

Recent reports

High

Weekly Security Recap: Citrix NetScaler Exploits, $387M Crypto Hack, Placeholder Domain Abuse

The Hacker NewsSep 28, 2026 High

Microsoft Shuts Down EvilTokens Device-Code Phishing Service Behind 12,000 Compromised Inboxes

The Hacker NewsSep 22, 2026 High

EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts

Bleeping ComputerSep 22, 2026 High

EvilTokens: AI-Powered Device Code Phishing-as-a-Service Platform

Microsoft Threat IntelligenceSep 22, 2026 High

Microsoft disrupts EvilTokens, AI-powered phishing-as-a-service platform targeting 12,000+ inboxes

CyberScoopSep 22, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.