Threat actors using a previously undocumented phishing-as-a-service (PhaaS) platform called “VENOM” are targeting credentials of C-suite executives across multiple industries.

The operation has been active since at least last November and appears to target specific individuals who serve as CEOs, CFOs, or VPs at their companies.

VENOM also seems to be closed access, as it has not been promoted on public channels and underground forums, thus reducing its exposure to researchers.

The VENOM attack chain

The phishing emails, observed by researchers at cybersecurity company Abnormal, impersonated Microsoft SharePoint document-sharing notifications as part of internal communication.

The messages are highly personalized and include random HTML noise such as fake CSS classes and comments. The attacker also injects fake email threads tailored to the target, increasing credibility.

A QR code rendered in Unicode is provided for the victim to scan for access. The trick is designed to bypass scanning tools and shift the attack to mobile devices.

“The target’s email address is double Base64-encoded in the URL fragment—the portion after the # character,” Abnormal researchers explain.

“Fragments are never transmitted in HTTP requests, making the target’s email invisible to server-side logs and URL reputation feeds.”

When the victim scans the QR code, they are taken to a landing page that serves as a filter for security researchers and sandboxed environments, ensuring that only real targets are redirected to the phishing platform. Users outside the threat actor’s interest are redirected to legitimate websites to reduce suspicion.

Those who pass the tests are taken to a credential-harvesting page that proxies a Microsoft login flow in real time, relaying credentials and multi-factor authentication (MFA) codes to Microsoft APIs and capturing the session token.

Apart from the adversary-in-the-middle (AiTM) method, Abnormal has also observed a device-code phishing tactic in which the victim is tricked into approving access  to their Microsoft account for a rogue device.

This method has become very popular over the past year due to its effectiveness and resistance to password resets, with at least 11 phishing kits currently offering it as an option.

In both methods, VENOM quickly establishes persistent access during the authentication process. In the AiTM flow, it registers a new device on the victim’s account. In the device code flow, it obtains a token that also provides access to the account.

The researchers note that MFA is no longer sufficient as a defense. C-suite executives should use FIDO2 authentication, disable the device code flow when not needed, and block token abuse by implementing stricter conditional access policies.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Advertisement

Get Your Copy Now

Gerard “Gus” Gaynor, a long-serving IEEE volunteer and former engineering director at 3M, died on 9 March. The IEEE Life Fellow was 104.

Readers of The Institute might remember Gus from his 2022 profile: “From Fixing Farm Equipment to Becoming a Director at 3M.” Just last year, he and I coauthored twoarticles. One discusses how to leverage relationships to boost your career growth. The other weighs the pros and cons of pursuing a technical or managerial career path. He was 103 years old then. How many IEEE members can claim a centenarian coauthor?

I first met Gus in 2009 at the IEEE Technical Activities Board (TAB) meeting in San Juan, Puerto Rico. We sat together in the airplane on our way back to Minneapolis, our hometown. At home I told many of my friends about the remarkable person—who was 87 years young at the time—with whom I chatted during our six-hour flight.

A decade later, he and I met for lunch in Minneapolis. He drove himself to the restaurant, just asking for a hand to navigate the snowy sidewalk.

A dedicated IEEE volunteer

Gus’s involvement with IEEE predates the organization. He joined the Institute of Radio Engineers, a predecessor society, as a student member in 1942. Twenty years later he became an active IEEE volunteer.

He served on the TAB’s finance committee and the Publications Services and Products Board. He was president of the IEEE Engineering Management Society (now the Technology and Engineering Management Society ), and he was the Technology Management Council’s first president. He was the founding editor of IEEE-USA’s online magazine Today’s Engineer, which reported on government legislation and issues affecting U.S. members’ careers. The magazine is now available as the e-newsletter IEEE-USA InSight.

He authored several books on technology management, published by IEEE-USA.

IEEE Life Fellow Gerard “Gus” Gaynor died on 9 March.The Gaynor Family

Most recently, after the formation of TEMS in 2015, he became an active member of its executive committee. He served two terms as vice president of publications.

At 100 years old, he led the launch of a new publication, TEMS Leadership Briefs, a novel short-format open-access publication aimed at technology leaders.

Gus, who is a former member of The Institute’s editorial advisory board, also worked with Kathy Pretz, The Institute’s editor in chief, to start an ongoing series of TEMS-sponsored career-interest articles. He coauthored several of them.

Throughout his 64 years as an IEEE volunteer, he received several honors. They include IEEE EMS’s Engineering Manager of the Year Award, the IEEE TEMS Career Achievement Award, and the IEEE-USA McClure Citation of Honor. In 2014 he was inducted into the IEEE Technical Activities Board Hall of Honor.

A 25-year career at 3M

Gus received a degree in electrical engineering in 1950 from the University of Michigan in Ann Arbor. He worked for several companies including Automatic Electric (now part of Nokia) and Johnson Farebox (now part of Genfare), before joining 3M in 1962.

During his successful 25-year career at 3M, he served as chief engineer for a division in Italy, established the innovation department, and led the design and installation of the company’s first computerized manufacturing facilities. He retired as director of engineering in 1987.

Last year, IEEE Life Fellow Michael Condry, a former TEMS president, organized a Zoom call with Gus and other leaders of the society to celebrate Gus’s 104th birthday. Gus looked well and was his usual upbeat self, telling everyone: “I’m good. Everything’s well. I can’t complain.”

Gus was married to Shirley Margaret Karrels Gaynor, who passed away in 2018. He lives on in the hearts and minds of his seven children, seven grandchildren, two great-grandchildren, and innumerable friends and IEEE colleagues.

A new Lua-based malware, called LucidRook, is being used in spear-phishing campaigns targeting non-governmental organizations and universities in Taiwan.

Cisco Talos researchers attribute the malware to a threat group tracked internally as UAT-10362, who they describe as a capable adversary “with mature operational tradecraft.”

LucidRook was observed in attacks in October 2025 that relied on phishing emails carrying password-protected archives.

The researchers identified two infection chains, one using an LNK shortcut file that ultimately delivered a malware dropper called LucidPawn, and an EXE-based chain that leveraged a fake antivirus executable impersonating Trend Micro Worry-Free Business Security Services.

The LNK-based attack employs decoy documents, such as government letters crafted to appear as if they originate from the Taiwanese government, to divert the user’s attention.

Cisco Talos observed that LucidPawn decrypts and deploys a legitimate executable renamed to mimic Microsoft Edge, along with a malicious DLL (DismCore.dll) for sideloading LucidRook.

LucidRook is notable for its modular design and built-in Lua execution environment, which allows it to retrieve and execute second-stage payloads as Lua bytecode.

This approach enables operators to update functionality without modifying the core malware, while also limiting forensic visibility. This stealth is further increased by extensive obfuscation of the code.

“Embedding the Lua interpreter effectively turns the native DLL into a stable execution platform while allowing the threat actor to update or tailor behavior for each target or campaigns by updating the Lua bytecode payload with a lighter and more flexible development process,” Cisco Talos explains.

“This approach also improves operational security, since the Lua stage can be hosted only briefly and removed from C2 after delivery, and it can hinder post-incident reconstruction when defenders recover only the loader without the externally delivered Lua payload.”

Talos also notes that the binary is heavily obfuscated across embedded strings, file extensions, internal identifiers, and C2 addresses, complicating any reverse-engineering efforts.

During its execution, LucidRook performs system reconnaissance, collecting information such as user and computer names, installed applications, and running processes.

The data is encrypted using RSA, stored in password-protected archives, and exfiltrated to attacker-controlled infrastructure via FTP.

While examining LucidRook, Talos researchers identified a related tool named “LucidKnight,” which is likely used for reconnaissance.

One notable characteristic of LucidKnight is its abuse of Gmail GMTP to exfiltrate collected data, suggesting that UAT-10362 maintains a flexible toolkit to meet varying operational needs.

Cisco Talos concludes with medium confidence that the LucidRook attacks are part of a targeted intrusion campaign. However, they were unable to capture a decryptable Lua bytecode fetched by LucidRook, so the specific actions taken post-infection aren’t known.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Get Your Copy Now

Hitting potholes while driving is never fun. They can cause headaches, car accidents and damage to your vehicle, culminating in a frustrating commute. Waymo, the robotaxi company, and Waze, the free, community-driven GPS navigation app, have come together to do something about potholes.

On Thursday, the two companies announced a joint venture to target potholes that need patching. The new data-sharing pilot program will collect information on troublesome road conditions and communicate the necessary fixes to the city. 

Waymo operates in 11 cities, and the pilot program will begin in five major markets: Austin, Texas; Atlanta; Los Angeles; Phoenix and the San Francisco Bay Area, with plans to expand to more cities in the future. So far, Waymo says it has tracked 500 potholes in the Bay Area alone.

“As Waymo’s autonomous fleet travels across San Jose, we appreciate the collaboration with Waymo and Waze as we explore how technology can help identify issues like potholes faster so we can respond more efficiently,” San Jose Mayor Matt Mahan said in an emailed statement.

Departments of Transportation for each city and state will be able to access this pothole information through the Waze for Cities app. Waymo stated in its blog post that the initial idea for this program was inspired by city officials who expressed the need for a better way to ensure safe road conditions.

Most cities still learn about road issues from residents — through either dialing 311 or using the my311 app — or via manual road inspections. This method has resulted in inadequate fixes and an incomplete understanding of a neighborhood’s road health and the resources needed to maintain it. 

Waymo’s robotaxis use autonomous driving technology, including an array of high-end cameras, lidar, radar and other tracking sensors, making them the perfect platform for collecting road data.

Waze customers in cities where Waymo operates will also be able to view this data directly in the app, which is noteworthy given that Waze operates on a user-based reporting system to identify troublesome road conditions. You can already receive pothole data and locations in the app, but adding Waymo’s tracking data will help verify the data and improve the app’s accuracy.

“For years, drivers on Waze have helped each other by reporting potholes for a smoother, safer ride,” Andrew Stober, Waze strategic partner manager, said in the blog post. “This pilot program with Waymo adds another source of data to that effort, giving cities a clearer picture of road conditions through our Waze for Cities platform.”

A Waymo representative didn’t immediately respond to a request for further comment.

Lenovo packed some seriously powerful gaming specs into a sleek, 8.8-inch design with its Legion Tab Gen 3. Outfitted with a Qualcomm Snapdragon 8 Gen 3 processor and a 6,550-mAh battery, this gaming tablet provides solid gaming performance and respectable battery life.

The Legion Tab has a fairly standard slab design that won’t turn any heads, but its 2,560×1,600-pixel resolution LCD screen with a 165Hz refresh rate will make your games look great. One of the best quality of life features on this gaming tablet is the fact that it actually has two USB-C ports integrated into its chassis: A USB 2.0 port on the left side of the device supports 65-watt chargers, and a USB 3.0 port at the bottom lets you plug into an external display. It’s a real boon to have such a portable device with the capability to connect to a larger monitor when you sit down to play at home, and the feature differentiates the Legion Tab Gen 3 from its competitors.

The base configuration is priced at $550, which is a solid price point for a dedicated gaming tablet, especially if you can’t find the RedMagic Astra and don’t want to wait for the upcoming release of the Legion Tab Gen 5. The Legion Tab offers a bigger display than the iPad Mini at an even lower price, with slightly outdated but still high-performance processing capabilities to boot. The Legion Tab Gen 3 won’t be going toe-to-toe with the RedMagic Astra when it comes to performance or battery life, but it’s a close race. And while the Legion Tab Gen 3 is nowhere near as small as the iPad Mini, it’s certainly more portable than the 9.1-inch RedMagic Astra.

If you’re looking for a dedicated gaming tablet, the Lenovo Legion Tab Gen 3 might be the most accessible option right now. But if you can hold on a little longer, the Legion Tab Gen 5 will be a technological leap forward for Lenovo’s gaming tablet.

Why we like it: The Legion Tab Gen 3 is a great “middle of the road” gaming tablet. It’s older than other gaming tablets we’ve reviewed, but the processing power and performance still hold up for some of the best games to take on the go.

Who it’s best for: If you’re a hardcore gamer, there are a couple of reasons you might skip out on the RedMagic Astra. Maybe it’s currently unavailable in your market. Maybe you’re turned off by the RedMagic’s lack of commitment to OS security updates. Either way, the Legion Tab Gen 3 is the next best thing in the dedicated gaming tablet space, with outdated hardware that’s still respectably powerful. It’s also an extremely portable device, to boot.

Who shouldn’t buy it: If you’re looking for the best-performing gaming tablet on the market, you could stand to do better than the Legion Tab Gen 3. This is a high-performance budget option, but it’s outclassed by other gaming tablets that we’ve reviewed.