We will hold a Pirate Meetup at the Boston Anarchist Book Fair on November 1-2 at the Cambridge Community Center. We will start at noon on both days and want you to join us!

We will meet at the 5 Callender Street entrance to the Cambridge Community Center. As part of the meetup, we will divide up the area around the Community Center and go searching for Ring and other cameras to add to our Surveillance Camera Map. We mapped some of the cameras in the area and expect there will be more.

Fill out our form to tell us you will be there.

The Cambridge Community Center is an eleven minute walk from the Central Square, Cambridge. Central Square is accessible by the Red Line MBTA stop and multiple bus routes.

masspirates.org/blog/2025/10/2…

Ahoy Pirates,

Our next PPI board meeting will take place on 28.10.2025 at 20:00 UTC. The prior board meeting did not make quorum, and so we expect a fruitful meeting with high attendance.

All official PPI proceedings, Board meetings included, are open to the public. Feel free to stop by. We’ll be happy to have you.

Where: jitsi.pirati.cz/PPI-Board

Minutes of the past meeting: wiki.pp-international.net/wiki…

Agenda: Pad: etherpad.pp-international.net/…

All of our meetings are posted to our calendar: pp-international.net/calendar/

We look forward to seeing visitors.

Thank you for your support,

The Board of PPI

pp-international.net/2025/10/u…

La musica dell’inno dei Marine – il più antico delle Forze Armate americane - è stata scritta da un italiano, Francesco Maria Scala, adattando un’opera del musicista Jacques Offenbach (1819-1880) la “Genevieve de Brabant”, presentata a Parigi il 19 novembre 1859. Scala – per certi versi sorprendente ad apprendersi - era allora Direttore della Banda dei Marine, ed è stato uno dei quattro di origini italiane che sino ad ora hanno guidato tale prestigioso complesso musicale

Scopri di più su tuttostoria.net 👇
tuttostoria.net/storia-contemp…

ed ascolta su yewtu.be l'Inno dei Marine!
yewtu.be/watch?v=Qqv6tzeJ9R4

#USMB #FrancisScala #MarineBand #storiamilitare

@Storia

Introduction

Cyberthreats are constantly evolving, and email phishing is no exception. Threat actors keep coming up with new methods to bypass security filters and circumvent user vigilance. At the same time, established – and even long-forgotten – tactics have not gone anywhere; in fact, some are getting a second life. This post details some of the unusual techniques malicious actors are employing in 2025.

Using PDF files: from QR codes to passwords

Emails with PDF attachments are becoming increasingly common in both mass and targeted phishing campaigns. Whereas in the past, most PDF files contained phishing links, the main trend in these attacks today is the use of QR codes.

Email with a PDF attachment that contains a phishing QR code

This represents a logical progression from the trend of using QR codes directly in the email body. This approach simplifies the process of disguising the phishing link while motivating users to open the link on their mobile phone, which may lack the security safeguards of a work computer.

Email campaigns that include phishing links embedded in PDF attachments continue to pose a significant threat, but attackers are increasingly employing additional techniques to evade detection. For example, some PDF files are encrypted and protected with a password.

Phishing email with a password-protected PDF attachment

The password may be included in the email that contains the PDF, or it may be sent in a separate message. From the cybersecurity standpoint, this approach complicates quick file scanning, while for the recipients it lends an air of legitimacy to attackers’ efforts and can be perceived as adherence to high security standards. Consequently, these emails tend to inspire more user trust.

PDF file after the user enters the password

Phishing and calendar alerts

The use of calendar events as a spam technique, which was popular in the late 2010s but gradually faded away after 2019, is a relatively old tactic. The concept is straightforward: attackers send an email that contains a calendar appointment. The body of the email may be empty, but a phishing link is concealed in the event description.

Blank email with a phishing link in the calendar appointment

When the recipient opens the email, the event is added to their calendar – along with the link. If the user accepts the meeting without thoroughly reviewing it, they will later receive a reminder about it from the calendar application. As a result, they risk landing on the phishing website, even if they chose not to open the link directly in the original message.

In 2025, phishers revived this old tactic. However, unlike the late 2010s, when these campaigns were primarily mass mailshots designed with Google Calendar in mind, they are now being used in B2B phishing and specifically target office workers.

Phishing sign-in form for a Microsoft account from a calendar phishing attack

Verifying existing accounts

Attackers are not just updating the methods they use to deliver phishing content, but also the phishing websites. Often, even the most primitive-looking email campaigns distribute links to pages that utilize new techniques.

Voice message phishing

For example, we observed a minimalistic email campaign crafted to look like an alert about a voice message left for the user. The body of the email contained only a couple of sentences, often with a space in the word “voice”, and a link. The link led to a simple landing page that invited the recipient to listen to the message.

Landing page that opens when clicking the link in the phishing email

However, if the user clicks the button, the path does not lead to a single page but rather a chain of verification pages that employ CAPTCHA. The purpose is likely to evade detection by security bots.

The CAPTCHA verification chain

After repeatedly proving they are not a bot, the user finally lands on a website designed to mimic a Google sign-in form.

The phishing sign-in form

This page is notable for validating the Gmail address the user enters and displaying an error if it is not a registered email.

Error message

If the victim enters a valid address, then, regardless whether the password is correct or not, the phishing site will display another similar page, with a message indicating that the password is invalid. In both scenarios, clicking “Reset Session” opens the email input form again. If a distracted user attempts to log in by trying different accounts and passwords, all of these end up in the hands of the attackers.

MFA evasion

Because many users protect their accounts with multi-factor authentication, scammers try to come up with ways to steal not just passwords but also one-time codes and other verification data. Email phishing campaigns that redirect users to sites designed to bypass MFA can vary significantly in sophistication. Some campaigns employ primitive tactics, while others use well-crafted messages that are initially difficult to distinguish from legitimate ones. Let’s look at an email that falls in the latter category.

Phishing email that mimics a pCloud notification

Unlike most phishing emails that try to immediately scare the user or otherwise grab their attention, the subject here is quite neutral: a support ticket update from the secure cloud storage provider pCloud that asks the user to evaluate the quality of the service. No threats or urgent calls to action. If the user attempts to follow the link, they are taken to a phishing sign-in form visually identical to the original, but with one key difference: instead of pcloud.com, the attackers use a different top-level domain, p-cloud.online.

The phishing sign-in form

At every step of the user’s interaction with the form on the malicious site, the site communicates with the real pCloud service via an API. Therefore, if a user enters an address that is not registered with the service, they will see an error, as if they were signing in to pcloud.com. If a real address is entered, a one-time password (OTP) input form opens, which pCloud also requests when a user tries to sign in.

OTP input form

Since the phishing site relays all entered data to the real service, an attempt to trick the verification process will fail: if a random combination is entered, the site will respond with an error.

Attempting to bypass verification

The real OTP is sent by the pCloud service to the email address the user provided on the phishing site.

OTP email

Once the user has “verified” the account, they land on the password input form; this is also requested by the real service. After this step, the phishing page opens a copy of the pCloud website, and the attacker gains access to the victim’s account. We have to give credit to the scammers: this is a high-quality copy. It even includes a default folder with a default image identical to the original, which may delay the user’s realization that they have been tricked.

Password input form

Conclusion

Threat actors are increasingly employing diverse evasion techniques in their phishing campaigns and websites. In email, these techniques include PDF documents containing QR codes, which are not as easily detected as standard hyperlinks. Another measure is password protection of attachments. In some instances, the password arrives in a separate email, adding another layer of difficulty to automated analysis. Attackers are protecting their web pages with CAPTCHAs, and they may even use more than one verification page. Concurrently, the credential-harvesting schemes themselves are becoming more sophisticated and convincing.

To avoid falling victim to phishers, users must stay sharp:

• Treat unusual attachments, such as password-protected PDFs or documents using a QR code instead of a link to a corporate website, with suspicion.
• Before entering credentials on any web page, verify that the URL matches the address of the legitimate online service.

Organizations are advised to conduct regular security training for employees to keep them up-to-date on the latest techniques being used by threat actors. We also recommend implementing a reliable solution for email server security. For example, Kaspersky Security for Mail Server detects and blocks all the attack methods described in this article.

securelist.com/email-phishing-…