Salt Typhoon is believed to be behind a recently disclosed cyber espionage campaign targeting US House committees and staff. In December 2025, researchers identified intrusions that compromised email systems within the US House of Representatives.
The NJCCIC observed a phishing campaign targeting MetaMask cryptocurrency wallets. The message appears to come from MetaMask, but the actual originating email address can be found in the header information. The threat actor also uses Punycode in the "From" field...
The NJCCIC observed a phishing campaign that abused the legitimate Docusign, leading to the installation of the LogMeIn Resolve remote monitoring and management (RMM) tool. The email is not sent from a legitimate Docusign domain, such as docusign[.]com or docusign[.]net.
There has been an observed social engineering campaign posing as delivery failure notifications from the United States Postal Service (USPS). The message is addressed to a generic “customer” and directs the user to click the provided link to update their address details.
There is a campaign that uses an AI Trading Bot lure. The message makes several claims about the use of machine learning and real-time market analysis to gain a trading advantage. Instead, it installs two remote access trojans (RATs), Dark Crystal RAT (DCRat) and zgRAT.
During this holiday season, there have been continued reports of gift card scams targeting New Jersey State employees and residents. In the above campaign, threat actors create free PenTeleData (ptd[.]net) email accounts to lure their targets in social engineering schemes.
There is a new Xfinity/Comcast phishing campaign in which an email states that access to the user’s mailbox and stored data may be permanently discontinued if the user does not update their email. They employ actions taken by some providers to delete inactive accounts.
The NJCCIC observed a Ledger-themed cryptocurrency drainer phishing campaign targeting New Jersey State employees. Although “Ledger” appears in the sender’s display name, the sender’s email address comes from a “.kr” top-level domain (TLD) for South Korea.
Over the last several weeks, the NJCCIC has observed an increase in compromised New Jersey public sector accounts. These accounts are often compromised after a user submits their account credentials to a fraudulent webpage navigated to via a phishing email.
The NJCCIC identified a phishing campaign aimed at harvesting user credentials. The emails falsely claim that pending messages are waiting in the user’s organization mailbox and include a link to access them. Threat actors warn that the messages might expire within 12 hours if not reviewed.
