Threat actors leverage document publishing sites for ongoing credential and session token theft

Talos IR has responded to several recent incidents in which threat actors used legitimate digital document publishing sites such as Publuu and Marq to host phishing documents as part of ongoing credential and session harvesting attacks.

attacks credential digital document documents harvesting attacks host incidents on the radar phishing publishing session talos theft threat threat actors threats token token theft