Cybercriminals are increasingly exploiting core internet functions, such as the “.arpa” domain and IPv6 reverse DNS features, to conduct stealthy and sophisticated phishing attacks. These attackers hijack DNS zones by controlling large IPv6 address blocks and creating fake but convincing hostnames that appear legitimate, often using trusted providers to mask their activities. This tactic leverages the inherent trust in reverse DNS lookups to bypass security filters, making it harder for traditional defenses to detect malicious links, which are often designed to be temporary. Meanwhile, a notorious hacking group known as Velvet Tempest is employing advanced social engineering methods, such as the ClickFix technique, to infiltrate organizations. They trick users into executing malicious commands via online ads, then use these to establish backdoors, steal credentials, and deploy malware like DonutLoader and CastleRAT. While they usually carry out ransomware attacks, in recent simulated scenarios, their focus has been on creating persistent access points for future intrusions. CTIX analysts will continue to report on the latest malware strains and attack methodologies.