CoGUI Phishing Takedown, Ivanti Zero-Day, and Android Banking Malware

Today’s briefing examines a major phishing infrastructure disruption alongside active exploitation of a critical VPN vulnerability. Microsoft and law enforcement partners have taken down the CoGUI phishing-as-a-service operation responsible for over one billion malicious messages targeting 75,000 organisations across 150 countries, though operators remain at large. CISA has added an Ivanti Connect Secure zero-day to its Known Exploited Vulnerabilities catalogue, with confirmed active exploitation dating back to 1 October 2026. UK small businesses using managed service providers should verify their remote access infrastructure is patched immediately. The episode also covers a credential-harvesting campaign targeting WatchGuard VPN users through SEO poisoning, and new Android banking malware that replaces legitimate applications with compromised versions. Practical guidance focuses on credential phishing defences, VPN security verification, and mobile banking application hygiene for business users.

Chapters

• Introduction Overview of a major phishing infrastructure takedown and an actively exploited Ivanti Connect Secure zero-day affecting remote access systems.
• The CoGUI Phishing Takedown Analysis of the disrupted phishing-as-a-service marketplace responsible for one billion malicious messages, why operators remaining at large matters, and a related WatchGuard VPN credential-harvesting campaign using SEO poisoning.
• Call to Action Listener engagement request to share the briefing with others who need threat intelligence.
• Ivanti Connect Secure Zero-Day Breakdown of the CISA-catalogued vulnerability with two weeks of confirmed exploitation before public disclosure, implications for managed service provider customers, and immediate patch verification requirements.
• Hirudo Android Malware New Android malware that replaces legitimate banking applications with modified versions, relevant to businesses conducting mobile banking operations.
• Closing Summary Recap of the day’s threat landscape: phishing infrastructure reconstitution risks, urgent Ivanti patching requirements, and defences against SEO-poisoned software downloads.

Links

• https://www.bleepingcomputer.com/news/security/microsoft-disrupts-massive-phishing-as-a-service-operation/
• https://blogs.microsoft.com/on-the-issues/2026/10/14/cogui-phishing-takedown-digital-crimes-unit/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.huntress.com/blog/watchguard-vpn-credential-phishing-campaign
• https://www.ncsc.gov.uk/guidance/phishing-resistant-authentication