Old Scams, New Tricks: From Fake Shipments to Zero-Days

Malwarebytes Blog highlighted a relentless wave of attacks, demonstrating that even ‘old-school’ scams still net victims. Phishing emails disguised as shipment notifications or iCloud storage alerts now deliver remote access tools and demand payment details, respectively. This underscores a critical reality: social engineering remains a primary attack vector, often preceding more sophisticated malware deployments.

Beyond phishing, the report pointed to several significant threats. Fake Slack downloads are handing attackers hidden desktops, and a Booking.com breach is arming scammers with guest data. Furthermore, a Windows infostealer is spreading via fake Proton VPN sites and gaming mods, demonstrating broad targeting. Critically, April’s Patch Tuesday addressed two zero-days, one of which was under active attack, with another Adobe Reader zero-day capable of triggering merely by opening a PDF.

This landscape demands a multi-layered defense. Attackers are leveraging everything from AI clickbait to blockchain-based infostealers like Omnistealer. Defenders must prioritize user education against social engineering, implement robust endpoint protection, and, most importantly, maintain a rigorous patching cadence. The ubiquity of these threats means every unpatched vulnerability or uneducated click is a potential entry point.