Water Dybbuk Using Open-Source Toolkits To Carry Out BEC Campaign
The Water Dybbuk threat group targets large companies around the world with a Business Email Compromise (BEC) campaign to steal credentials.
The initial attack vector consists of spear-phishing emails with malicious attachments directing victims to malicious websites.
The operation uses the BadaxxBot toolkit and Evilginx framework along with the JavaScript Obfuscator Tool to carry out the operation.
Featured Resources
View More Resources
blog
Critical RCE in React Server Components CVE-2025-55182 and CVE-2025-66478: What It Means for Security Teams
Ilan Kalendarov, Security Research Team LeadBen Zamir, Security Researcher What was discovered? A critical un-authentication remote code execution (RCE) vulnerability has been disclosed in React
blog
Test LLM Resilience Against Prompt Injection and Jailbreaks with New Cymulate Attack Scenarios
Executive Summary As large language models (LLMs) become embedded in productivity, automation and security workflows, a new class of risks
blog
Testing LLM Resilience: How Cymulate Exposure Validation Simulates Prompt Injection and Jailbreaks
See how Cymulate is redefining LLM security by simulating real-world prompt injection and jailbreak attacks to validate AI defenses.