Tessera
Folgen

Stephen Hilt

@sjhilt.hilt.zip

Threat Researcher @ TrendAI (Trend Micro), waffle maker, and dad. My statements and opinions are my own and do not reflect my company.

195 Posts720 Follower402 Folgt
Stephen Hilt@sjhilt.hilt.zip · 2d ago

Tycoon2FA was one of the most prolific phishing kits targeting Microsoft 365. Our latest publication details how TrendAI intelligence supported law enforcement in identifying leading to the arrest of its operators. www.trendaisecurity.com/en-us/resour...

TrendAI™ Intelligence Aids Law Enforcement Arrest of Tycoon 2FA Operators

The Singapore Police Force (SPF), working closely with Pakistan's National Cyber Crime Investigation Agency (NCCIA) and INTERPOL has arrested two individuals linked to Tycoon2FA, a phishing operation ...

trendaisecurity.com

Stephen Hilt@sjhilt.hilt.zip · 2w ago

Kratos (rebranded Sneaky2FA) is down. BKA/ZIT + US authorities took out 200+ servers, Indonesia arrested the developer. AiTM kit rented to 1,800+ subscribers running ~15K phishing campaigns/month against MS365 accounts. We fed intel since 2025. www.trendmicro.com/en_us/resear...

Law Enforcement Takes Down Kratos/Sneaky2FA Phishing Service, With an Assist From TrendAI™

Kratos, the phishing-as-a-Service (PhaaS) platform behind a large share of recent Microsoft 365 credential theft, has been taken offline by the BKA and ZIT in an operation dubbed Olympus Blade.

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 3w ago

How much can one threat actor accomplish with AI? This research from my colleagues at TrendAI explores how the operator behind "Patriot Bait" used AI to help deploy C2 infrastructure. www.trendmicro.com/en_us/resear...

Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet

TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11%...

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 2mo ago

Healthcare data is not just stolen. It is traded, resold, and monetized across a complex criminal ecosystem. Our latest research explores the underground economy fueling healthcare cybercrime. www.trendaisecurity.com/en-us/resour...

The Cybercriminal Underground: Mapping the Healthcare Data Economy | TrendAI (US)

A look inside an industrialized economy where stolen healthcare data is bought, sold, and weaponized, from ransomware breaches to broker access and fake medical documents fueling an expanding criminal...

trendaisecurity.com

Stephen Hilt@sjhilt.hilt.zip · 3mo ago

New research: 3,627 DICOM medical imaging servers exposed online, 99.56% with no authentication, only 0.14% encrypted. Patient data at serious risk. www.trendmicro.com/vinfo/us/sec...

A Hidden Vulnerability in Healthcare: Exposed DICOM Servers and the Risk to Patient Data

Analysis from TrendAI™ Research found that thousands of DICOM medical imaging servers worldwide are exposed online without basic security measures, leaving sensitive patient data and healthcare operat...

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 3mo ago

Strong research from my co-workers at TrendAI on “Inside Shadow Earth-053.” A sharp look at how modern threat actors abuse trusted systems and workflows to evade detection. www.trendmicro.com/en_us/resear...

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

A China-aligned threat group is exploiting unpatched Microsoft Exchange vulnerabilities to conduct cyberespionage against government and critical infrastructure targets across Asia and beyond.

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 4mo ago

New TrendAI™ research: Void Dokkaebi uses fake job interviews to lure devs into cloning malicious repos. - Job lures as entry - Dev workflows exploited - Risk to pipelines www.trendmicro.com/en_us/resear...

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Our research on Void Dokkaebi’s operations uncovered a campaign that turns infected developer repositories into malware delivery channels. By spreading through trusted workflows, organizational codeba...

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 4mo ago

Cyber threats are evolving fast and so is the playbook to stop them. The latest APT report from TrendAI team highlights a clear shift toward proactive security, smarter use of AI, and more coordinated threat actors. Worth a read: www.trendmicro.com/vinfo/us/sec...

2025 APT Report: Staying Ahead of the Modern Threat Landscape

AI‑enabled APTs are accelerating attacks, shrinking response windows, and raising the stakes. This report reveals what’s changed and how to defend against it.

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 5mo ago

The global disruption of Tycoon 2FA, a phishing-as-a-service platform built to bypass MFA using adversary-in-the-middle techniques. Proud TrendAI to have worked with partners across industry and Law enforcement to help dismantle this operation. www.trendmicro.com/en_us/resear...

Europol, Microsoft, TrendAI™, and Collaborators Halt Tycoon 2FA Operations

Tycoon 2FA was dismantled this week by law enforcement and industry partners including TrendAI™. The phishing-as-a-service platform offered MFA bypass services using adversary-in-the-middle (AitM) pro...

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 5mo ago

TrendAI show how AI compresses target profiling from days to minutes using public data, including professional profiles. That shift makes tailored attacks easier to scale and harder to spot. www.trendmicro.com/vinfo/us/sec...

From LinkedIn to Tailored Attack in 30 Minutes: How AI Accelerates Target Profiling for Cybercrime

The industrialization of AI-driven OSINT has transformed individual digital footprints into machine-readable intelligence at scale, enabling attackers to operationalize personalized reconnaissance at ...

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 6mo ago

Attackers are abusing Atlassian Jira Cloud to launch spam campaigns and bypass email defenses by leveraging trusted SaaS notifications. Worth a read from TrendAI Research: www.trendmicro.com/en_us/resear...

Spam Campaign Abuses Atlassian Jira, Targets Government and Corporate Entities

We uncover how a campaign used Atlassian Jira Cloud to launch automated and targeted spam campaigns, exploiting trusted SaaS workflows to bypass security controls.

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 6mo ago

Just published a piece on how TrendAI uses a structured, evidence-based approach to threat attribution instead of speculation, and why this matters for better investigations. www.trendmicro.com/vinfo/us/sec...

Threat Attribution Framework: How TrendAI™ Applies Structure Over Speculation

TrendAI™ brings structure and discipline to threat attribution, helping security leaders and teams make informed decisions about cyber risk, incident response, and overall defensive posture.

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 6mo ago

We are hiring a Senior Threat Researcher for the Forward Looking Threat Research team at TrendAI. Remote in US Eastern and Central time zones prefered. Job is to research financial threats, attacker tooling, and new techniques. Details: trendmicro.wd3.myworkdayjobs.com/External/job...

Senior Threat Researcher, FTR

Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information across enterprises, governments, and consumers. Fueled by decades of security expertise, global...

trendmicro.wd3.myworkdayjobs.com

Stephen Hilt@sjhilt.hilt.zip · 8mo ago

Is the era of “Cybercrime-as-a-Service” is ending? In our new report we show how agentic AI could transform cybercriminals from service-buyers into autonomous operators, enabling scalable, adaptive, and near-self driving attacks. www.trendmicro.com/vinfo/us/sec... #Cybersecurity #AIThreats

The Next Phase of Cybercrime: Agentic AI and the Shift to Autonomous Criminal Operations

We dive into the transformation from “Cybercrime-as-a-Service“ to “Cybercrime-as-a-Sidekick“, which fundamentally alters the operational dynamics of criminal enterprises.

trendmicro.com

Stephen Hilt@sjhilt.hilt.zip · 9mo ago

I have spent two weeks, trying to get rid of streaming audio, and all I learned was my local rock station is repetitive, sucks and I remember why I went to streaming.

Bild
Zack Whittaker@zackwhittaker.com · 9mo ago

When I recently told an executive about the North Korean remote workers' scheme, he almost shit his pants. Known as a triple threat, North Koreans gain real jobs at Western firms, earn a wage, then steal data and extort them when they get caught. All to make the regime money for nuclear weapons.

Thousands of North Koreans have secretly infiltrated US and European companies as remote IT workers

North Korea's secret remote workers are a major threat facing U.S. and European businesses today, taking jobs in Fortune 100 and smaller companies alike. Here's how to recognize and combat the threat.

this.weekinsecurity.com

Stephen Hilt@sjhilt.hilt.zip · 10mo ago

With everyone bailing on a specific streaming service lately I started digging into the airwaves around us and found some cool projects that let you actually decode and listen to HD Radio, but none of the UIs were working. Made my own, also fallback uses analog Radio. github.com/sjhilt/SDR-B...

Bild