The IT Nerd

In a new Fortra blog, Elyse Neumann breaks down real-world examples uncovered by Fortra’s Intelligence and Research Experts (FIRE), including:

• Fake listings with property photos, ratings and reviews
• “Unconfirmed reservation” prompts used to capture personal information and credentials
• Credit card forms paired with live support chat to make payment requests appear legitimate

The blog includes screenshots and examples you can use in your reporting, along with practical red flags travelers can check before booking.

Blog: https://www.fortra.com/blog/fake-holiday-rental-sites-can-steal-more-your-travel-plans

The takeaway: a polished rental listing isn’t proof the site is real.

New research from Fortra Intelligence and Research Experts (FIRE) dives deeps into an active campaign using fake ChatGPT Plus billing emails, revealing the infrastructure and mechanics keeping it running.

Key findings include:

• Live operators control victim sessions and can escalate from card theft to OTP/2FA capture.
• Identical code and shared identifiers connect independently deployed phishing sites.
• Short-lived sites are replaced while the underlying operation continues.
• The phishing kit is evolving, with newer instances showing changes to its front end.

The analysis shows how a familiar phishing lure has become a repeatable, operator-driven payment-card theft operation.

Full analysis was just published here: https://www.fortra.com/blog/anatomy-openai-phishing-kit-rotating-wordpress-hosts-live-operators-and-otp-theft

By Tyler Reguly, Associate Director, Security R&D at Fortra

So, you woke up today and everyone is concerned about a vulnerability in PHP… but what does that mean to you?

A remote code execution (RCE) vulnerability in PHP is a big deal. PHP is a web technology that is used to build websites. An RCE is a vulnerability class that allows code (think: malicious software) to be executed on a system remotely. This means that any website with an affected version of PHP could potentially allow attackers to remotely execute code and take control of the system.

To put it into perspective, depending on where you look, PHP has a 70-80% market share. That means if you visit 4 websites, 3 of them are using PHP. If you are having a hard time visualizing that, think about how many people you see daily with black hair, that’s nearly the same percentage of people on the planet that have black hair.

The next thing worth thinking about is supported versions of PHP. Again, depending on where you look, about 35% of sites utilizing PHP versions that are no longer supported. If 3 of every 4 sites you visit are using PHP, then 1 in every 4 sites you visit are out of support. That means they cannot be patched. This long-term usage of unsupported versions of PHP is one of the scarier aspects of this. It means that 25% of websites on the Internet are vulnerable and cannot be fixed, 25% of websites on the Internet are not impacted, and the remaining 50% of websites are currently rushing to apply patches.

When you think about how broad that impact is, you can start to see why everyone is concerned about this… one of the cornerstones of the Internet is vulnerable and that puts everyone at risk.

So, what happens next?

The world has experienced large scale issues like this in the past, so this is not new, we know what the fire drill looks like. This one may be bigger in scope than we’ve seen previously, but we’ve already seen how this is being handled. Websites may go offline for a little bit while patches are applied or systems are updated. Websites that aren’t updated quickly may be breached.

Right now, you may not be able to trust websites you regularly visit to the same degree you normally would. Reach out and ask them if they are impacted and if they have resolved the issue if they are impacted. Look for websites to display notices that they are impacted or that they are updated. Bottom line, be more cautious as you browse the Internet.

Fortra Intelligence and Research Experts (FIRE) are tracking a sharp rise in phishing disguised as routine business opportunities, including quote requests, project invitations and procurement inquiries.

Key findings include:

• 12-fold increase in malicious emails containing “RFQ” from October 2025 to September 2026
• Nearly 73% of RFQ lures led to credential phishing sites
• 664 distinct sender domains were identified, complicating sender-based detection

Successful attacks can lead to account compromise, payment-redirection fraud, exposure of customer or project information, and phishing from trusted corporate accounts.

The full report can be accessed here: https://www.fortra.com/blog/rise-rfq-and-project-invitation-scams

1,413 vulnerabilities in October can make patching feel unmanageable, but Tyler Reguly argues that volume alone is a distraction. With 26 2026 Microsoft CVEs appearing in CISA’s KEV catalog, security leaders should focus on exploitable risk, and ask whether their teams have the clarity, capacity and support to act.

By Tyler Reguly, Associate Director, Security R&D, Fortra

Recently, I’ve argued that numbers are meaningless. This month’s number, 1413, is no different. There are, however, numbers that hold meaning. 26, for example, is how many 2026 Microsoft CVEs have shown up in the CISA KEV. Last year, that number was 30, and the year before was 32. That means less than 1% of vulnerabilities patched by Microsoft this year are known to be exploited. That’s an important number… but 1413 definitely isn’t.

I’ve talked to some people recently who’ve commented on the number of vulnerabilities announced this year, and I’ve spent a lot of time trying to think of how to explain it to them.

In the US, there are around 5000 movies available in the Netflix catalog depending on which source you look at. At any given moment, you care about one or two of those movies – the one you want to watch and, maybe, the one you want to watch next. The rest are just background noise. You prioritize those movies based on what you want to see, which is decided by your preferences. You don’t need to care about every vulnerability, just the one you are going to patch next, which you prioritize based on factors that matter to your organization. The rest of the vulnerabilities… background noise, no different than that random 1970’s creature feature that keeps showing up on your recommendations, even though you’ll never watch it.

“Pop Quiz, Hotshot” has always been one of my favorite quotes and today I’m directing that statement toward all the CISOs out there with teams actively working on Patch Tuesday. I want each of you to ask yourselves these 5 questions, to see if you really understand those teams work and if you are setting them up for success.

1. Is your team feeling patch fatigue – how tired/stressed are they?
2. Do you and your team truly understand your organization’s prioritization metrics?
3. How complete is your organization’s asset inventory?
4. Are you adequately resourced in terms of people, hardware, and software?
5. What single wish list item do they have that would make their lives easier? Have you ever asked?

The answers to these questions may open your eyes to the needs of your team and help make them a happier, more productive group of individuals.

Fortra Intelligence and Research Experts (FIRE) have observed a massive 475% increase in phishing attacks leveraging remote management tools in 2026. These campaigns are targeting banking customers with fake support pages that prompt installation of legitimate software like AnyDesk, giving criminals ongoing access to victim devices and accounts. Once installed, threat actors have the ability to monitor activity, steal credentials, deploy additional malware or ransomware, and maintain persistent access long after the initial phishing interaction.

Details here: https://www.fortra.com/blog/increase-credential-phishing-remote-management-tools

Fortra Intelligence and Research Experts (FIRE) have identified a new CalPhishing variant where attackers exploit internal referrals to conduct credential theft attacks. 

Key takeaways:

• Attackers pose as prospective customers and contact non-sales employees first.
• Employees unknowingly become “trust bridges” by forwarding meeting-booking links to sales teams.
• The booking page appears legitimate but ultimately prompts users to sign in with Microsoft 365 credentials.
• The attack abuses trusted business workflows instead of spoofed identities or compromised accounts.
• A successful compromise can lead to email access, data theft, fraud, and further phishing attacks.

Full analysis here: https://www.fortra.com/blog/calphishing-through-trust-chain

Fortra Intelligence and Research Experts (FIRE) are tracking an active phishing campaign, first observed in June, that uses HTA malware to gather detailed intelligence about a victim’s device before determining which payload to deploy next.

Rather than immediately delivering malware, the campaign performs reconnaissance on infected systems, collecting information such as OS, BIOS, and user details that can be used to tailor subsequent attack stages. Researchers found the operation combines HTA malware delivered via mshta.exe with off-screen execution, HTML smuggling, and polymorphic payloads designed to complicate detection.

The campaign appears focused on Spanish-speaking users and organizations, using invoice and judicial-notice phishing lures, while the infrastructure remains active and continues distributing updated samples.

https://www.fortra.com/resources/guides/active-campaign-distributing-hta-malware-payloads

By Tyler Reguly, Associate Director, Security R&D, Fortra

I think it is safe to say that, as long as Microsoft is playing catch-up on patching vulnerabilities, numbers have lost all meaning. This is not a Microsoft specific problem… we see the same issue with Oracle and other large vendors that are being proactive. We need to remember that these large CVE counts are a good thing as we’re reducing attack surface before attackers get a chance to find and utilize the vulnerabilities. Eventually, all those long-standing, hard to find vulnerabilities will be fixed and Patch Tuesday will return to its typical cadence. Until that happens, prioritization is key and gift cards for extra coffee for your admins would likely be appreciated.

Even though I think it is temporary and we will return to manageable Patch Tuesday’s, I think it’s important that we acknowledge our current normal. Specifically, have you considered your people and processes during what could easily be called trying times? This is a great time to consider if your processes are designed to handle major changes and potential patching bottlenecks. While the number of patches may not have increased greatly (due to cumulative updates), they have increased as we see more and more one-off patches. How do you handle those one-off patches that may require a manual reinstall of the software or the extraction of a zip file to a specific location to overwrite a vulnerable version? These last few months may have disrupted your normal processes, so this is a great time to step back and really look at them. Are there places for improvement? What about your people. How are they handling the current levels of patches and the tickets that those produce. Are they managing? Are they struggling? Have you even stopped to ask them?

It’s time to put our CISOs and CSOs on notice. How are you helping your teams through these difficult times? Are you eliminating soak tests because some public guidance has suggested ridiculously short patch timeframes? Does that put added stress on your teams because they don’t know what outages they may see as a result? If you’re doing this… STOP! Patches still need to be tested because not all vendors can be trusted and many have broken the trust they had previously gained. Test your patches before you deploy them. Then, think about your deployment. Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.

Right now, if you are in charge of teams managing patches, you are probably struggling with what to do. Support your team, be aware of the difficulties they face, and ask them how things can be improved. If you still prioritize based on CVSS, you are hurting your organization and your employees. If you are constantly flip-flopping as guidance changes, you are putting your organization at risk and jeopardizing employee happiness. You are essentially steering a ship through rough waters, and you need a steady hand to accomplish that. If you keep the ship on course, your team will be able to do the rest.

A new report from Fortra Intelligence and Research Experts (FIRE) documents a 40% increase in online attacks leveraging an SEO poisoning technique dubbed “Chameleon.” In these campaigns, threat actors use cloaked search results to deliver phishing pages only to users arriving from Google or Bing search engines. By concealing malicious content from traditional security scanners, Chameleon campaigns can remain active longer and increase their odds of a successful attack. The article explains how the technique works, why legacy detection methods often miss it, and practical takeaways for CISOs and SOC teams.

The full article can be read here: https://www.fortra.com/blog/the-chameleon-threat