Phishing on HackingPassion.com : root@HackingPassion.com-[~]

Phantom Squatting Lets Hackers Buy the Fake Websites Your AI Invents

Wed, 01 Jul 2026 13:25:22 +0200

Your AI assistant just sent you to a login page that did not exist a few weeks ago, and the person who registered it is already collecting the passwords people type in.

You trust the link because it came from your AI. That trust is the attack itself, and it works without a single phishing email.

It has a name now: phantom squatting. Security researchers wrote it up this week. The idea is simple once you see it.

WinRAR Can Still Drop Malware Into Your Startup Folder a Year After the Patch

Tue, 30 Jun 2026 11:05:19 +0200

You unzipped a file with WinRAR, the way you always do. Nothing on screen looked wrong. The next morning you logged in and malware was already running, and the only thing you did was open an archive someone emailed you.

In July 2025, ESET researchers spotted a file called msedge.dll sitting inside a RAR archive, in a folder path that made no sense. That odd path turned out to be a brand new flaw in WinRAR, and someone was already using it in attacks while it was still unknown. That was last summer, and it has not stopped since.

Does Google Control Your Email?

Wed, 24 Jun 2026 12:52:27 +0200

Anyone on the internet can send an email that looks like it came from your bank, your boss, or you, and the system that delivers it will not check whether that is true.

The reason is not a bug someone forgot to fix. Email was built in 1982 to trust whoever was talking, back when a few hundred computers were online and the people running them knew each other, and that trust was never taken back out.

Microsoft 365 Mailbox Rules Are Being Weaponized

Fri, 17 Apr 2026 13:11:20 +0200

Microsoft 365 mailbox rules are being weaponized as a core technique behind $2.77 billion in annual Business Email Compromise losses, and attackers are creating hidden rules that survive password resets, MFA enrollment, and session invalidation. A new Proofpoint report reveals that 10% of all compromised Microsoft 365 accounts get malicious inbox rules installed within seconds of the initial breach, targeting 400+ million users worldwide by abusing built-in email functionality no security tool will ever flag as suspicious. 😏

QR Codes: What You Need to Know

Mon, 06 Apr 2026 16:48:56 +0200

Yesterday, I posted a QR code challenge on this Ethical Hacking page, and it has since been removed. A cipher, hidden inside a QR code, with three security questions and a prize. The comments that followed gave me a good reason to write about this, because this is a topic that deserves a proper explanation.

The comments came in fast. “You should never scan a random QR code.” “This is a trap.” “You failed the first part just by scanning.” “Hackers know better than to do this.” And honestly, that reaction makes sense. You see a QR code on a hacking page, you do not know what is inside it, and being careful is right. But being careful does not mean refusing to engage. It means knowing how to approach it.

Fake Blue Screen of Death Installs $5 RAT Malware via ClickFix Attack

Tue, 06 Jan 2026 15:39:00 +0100

$5 buys two months of complete access to someone’s computer. Keylogging, webcam, passwords, files. The malware is called DCRat. The delivery method: a fake Blue Screen of Death that tricks people into hacking themselves. 😱

ClickFix attacks surged 517% in six months. Now the second most common attack vector after phishing. 8% of all blocked attacks. The campaign is called PHALT#BLYX. Securonix published their analysis January 5, 2026.

An email arrives with subject “Reservation Cancellation.” Sender appears to be Booking.com. The message mentions a refund over €1,000 and urges the recipient to click and review. Booking.com has been a popular target before, with similar campaigns in 2023 and 2024.