Threat Intelligence

Updates on the latest threats, scams, and attacker trends that Netcraft is seeing in the wild.

92 Blogs

Threat Actors are Finding Their Way into Your AI Summaries

Aug. 3, 2026 | Many malicious links and websites are finding their ways into the "AI overviews" in popular search engines when users look for financial institutions.

Ginny Spicer

Threat Analyst

4 min read

Threat Actors are Finding Their Way into Your AI Summaries

Aug. 3, 2026 | Many malicious links and websites are finding their ways into the "AI overviews" in popular search engines when users look for financial institutions.

Ginny Spicer

Threat Analyst

2 min read

From Fake W-8BEN Forms to Crypto Deposits: Scammers Exploit SpaceX IPO Hype

July 15, 2026 | Scammers are setting up fake web pages offering access to the record-breaking IPO.

Ivan Khamenka

Threat Analyst

2 min read

From Fake W-8BEN Forms to Crypto Deposits: Scammers Exploit SpaceX IPO Hype

July 15, 2026 | Scammers are setting up fake web pages offering access to the record-breaking IPO.

Ivan Khamenka

Threat Analyst

7 min read

Branded Gambling Campaigns: How Scammers Are Exploiting Trusted Brand Names to Drive Casino Traffic

July 2, 2026 | Learn how scammers use fake gambling ads, app store pages, and PWAs to impersonate trusted brands and drive users to online casinos.

Gina Chow

Threat Specialist

7 min read

Branded Gambling Campaigns: How Scammers Are Exploiting Trusted Brand Names to Drive Casino Traffic

July 2, 2026 | Learn how scammers use fake gambling ads, app store pages, and PWAs to impersonate trusted brands and drive users to online casinos.

Gina Chow

Threat Specialist

7 min read

Bluekit Phishing-as-a-Service: Browser-in-the-Middle, Evolved

June 25, 2026 | Netcraft analyzes Bluekit, a Browser-in-the-Middle phishing kit that streams legitimate login pages to victims using rrweb. Learn how it works, why it differs from Evilginx, and the detection opportunities for defenders.

Harry Everett

Security Researcher

7 min read

Bluekit Phishing-as-a-Service: Browser-in-the-Middle, Evolved

Harry Everett

Security Researcher

3 min read

Caught on Scam-era: The Rise of Camera-First Phishing

June 2, 2026 | A newly observed phishing campaign impersonates payment verification to harvest selfies, videos, location data, and device information. Learn how camera-first phishing turns browser permissions into a powerful collection channel.

Ivan Khamenka

Threat Analyst

3 min read

Caught on Scam-era: The Rise of Camera-First Phishing

Ivan Khamenka

Threat Analyst

6 min read

EvilTokens and OAuth Abuse

May 27, 2026 | Netcraft uncovers how EvilTokens enables large-scale OAuth device code phishing campaigns, abuses Microsoft authentication flows, and powers emerging attacks like GhostPairing.

Ginny Spicer

Threat Analyst

6 min read

EvilTokens and OAuth Abuse

May 27, 2026 | Netcraft uncovers how EvilTokens enables large-scale OAuth device code phishing campaigns, abuses Microsoft authentication flows, and powers emerging attacks like GhostPairing.

Ginny Spicer

Threat Analyst

5 min read

Foul Play: Scams Targeting the 2026 FIFA World Cup

May 26, 2026 | Netcraft research reveals how threat actors are exploiting the 2026 FIFA World Cup through fake ticket sales, betting scams, phishing, and fraudulent hospitality sites.

Ginny Spicer

Threat Analyst

5 min read

Foul Play: Scams Targeting the 2026 FIFA World Cup

May 26, 2026 | Netcraft research reveals how threat actors are exploiting the 2026 FIFA World Cup through fake ticket sales, betting scams, phishing, and fraudulent hospitality sites.

Ginny Spicer

Threat Analyst

3 min read

Booking DOT com Lookalike Pages Hosted on Webflow Subdomains

May 12, 2026 | Netcraft uncovered Booking.com impersonation pages hosted on Webflow subdomains, leveraging SEO poisoning, lookalike domains, and static phishing infrastructure to target travel-related searches.

Ivan Khamenka

Threat Analyst

3 min read

Booking DOT com Lookalike Pages Hosted on Webflow Subdomains

Ivan Khamenka

Threat Analyst

7 min read

Fibergrid: Inside the Bulletproof Host for 16,000+ Active Fake Shops

April 20, 2026 | Netcraft uncovers Fibergrid, a bulletproof hosting provider enabling 16,000+ fake shops. Learn how stolen IP space, shell companies, and global infrastructure power large-scale fraud, and where it can be disrupted.