GoKawiil
Tech News
Brave has released version 1.94 of its browser with a new Email Aliases feature that lets users create disposable email addresses for signing up to websites, while messages are still forwarded to their real inbox. The feature requires a free Brave Account and works separately from Brave Premium, with up to five aliases available at no cost before a paid tier removes that limit.
Researchers have identified a subscription-based phishing toolkit called NovaCookies that uses adversary-in-the-middle techniques to intercept live Microsoft 365 login sessions. Rather than just harvesting usernames and passwords, the kit captures session cookies, letting attackers bypass multi-factor authentication and take over accounts directly. It is being sold as a service for roughly $320 a month, making advanced phishing capability accessible to less-skilled criminals.
Researchers found threat actors uploading npm packages containing only a malicious HTML file disguised as a Cloudflare verification page. When mirrored by sites like UNPKG and npmmirror, these files become directly viewable in a browser under a trusted domain, redirecting victims to attacker-controlled sites. OX Security identified 24 such packages, following an earlier discovery in July involving a package called 'china_airlines'.
Threat intelligence firm SOCRadar has exposed AnonyMousKIT, a phishing-as-a-service platform active since early 2024 that automates theft of Apple Activation Lock codes needed to unlock stolen iPhones. The operation spans 506 domains and 168 reseller storefronts, and uses AI-driven voice calls impersonating Apple to trick victims into handing over unlock credentials, iCloud data, and Keychain passwords.