A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. [...]
Threat actors are using invisible Unicode characters in phishing emails to evade detection by email security filters. This technique, known as ASCII smuggling, involves inserting invisible Unicode characters inside finance-related lure words to split them and bypass keyword-based filters. Microsoft observed a large-scale campaign using this method, peaking at 2.37 million daily messages in early 2026. The phishing messages promote business funding, loans, and credit services and are sent through infrastructure linked to the legitimate ActiveCampaign email-marketing platform. Microsoft Defender still detected over 99% of these messages using other signals. Microsoft recommends normalizing or stripping invisible Unicode characters before applying detection rules to improve filtering effectiveness.
Huntress researchers discovered Knight Office, a phishing kit utilizing Adversary-in-the-Middle techniques to steal Microsoft 365 session tokens. The attack chain begins with DocuSign-themed phishing emails containing redirects through Monday.com and compromised Joomla websites. Victims are directed to credential capture pages where session tokens are harvested and fed into the Knight Office console. These stolen tokens enable attackers to bypass multi-factor authentication entirely by using already-authenticated sessions. In one incident, attackers registered rogue devices in Microsoft Entra ID and bound Windows Hello for Business credentials for persistence. Analysis revealed nine phishing attacks linked to this kit over two weeks, with hundreds of related emails reported since April. The console, hosted at IP 104.37.188.94, manages at least 25 phishing domains using .vu top-level domains.
Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. This abuse involves leveraging the admin tool to deploy unauthorized remote access software, potentially enabling attackers to control affected systems remotely.
Between January and April 2026, a coordinated social engineering operation named Spring Ring leveraged external Microsoft Teams accounts to impersonate IT help desk personnel, targeting over 150 employees across at least 10 companies. Adversaries initiated voice phishing calls to coerce victims into executing remote monitoring and management tools or custom malware. In advanced variants, attackers transitioned from vishing to NTLM relay attacks targeting domain controllers. Two distinct campaigns were observed: Campaign A utilized RMM tools and obfuscated PowerShell-based RATs, while Campaign B employed tailored cloud infrastructure with PetitPotam exploitation for domain-level compromise. The operation demonstrates the weaponization of trusted collaboration platforms as primary attack vectors, exploiting the trust gap in SaaS applications.
The Spring Ring campaign is a voice phishing operation targeting Microsoft Teams users. It abuses the platform to deploy malware and aims at compromising enterprise domain controllers. This campaign leverages social engineering via voice phishing to infiltrate organizations. The threat focuses on enterprise environments using Microsoft Teams for communication.
This report analyzes a polymorphic phishing page that dynamically generates different variants of its credential-stealing content on each visit. The phishing page uses heavily obfuscated JavaScript, which occasionally contains a coding error causing an infinite loop and preventing the page from rendering. The polymorphism includes randomized function and variable names, altered HTML attributes, and obfuscation techniques to evade detection. Despite these changes, the page's core functionality remains consistent. The obfuscation mechanism likely uses a simple random renaming approach rather than advanced AI generation. This polymorphism complicates detection by static signature-based tools but does not fundamentally alter the phishing intent.
A phishing campaign abuses npm package mirrors to host fake Cloudflare Captcha pages embedded in malicious npm packages. These pages are served via trusted mirror domains, increasing their credibility and facilitating phishing attacks such as ClickFix delivery. The campaign uses typosquatted domains and legitimate key-value storage services to redirect victims dynamically. Downloading the packages is not harmful, but accessing the HTML files through mirror URLs exposes users to phishing risks.
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs. These pages redirect visitors to attacker-controlled websites, facilitating phishing attacks. This abuse leverages the trust in npm package hosting and its mirrors to distribute deceptive content.
AnonyMousKIT is a phishing-as-a-service platform that uses voice AI agents to trick victims into revealing iPhone passcodes and Apple account credentials. The service automates the retrieval of unlocking codes to bypass Apple's Activation Lock, enabling thieves to unlock stolen iPhones and access sensitive data. It impersonates Apple through phishing emails and calls, directing victims to fake Apple pages to harvest passcodes and two-factor authentication codes. The platform has been active since early 2024 and operates a large ecosystem with hundreds of reseller storefronts. Most attacks target Brazil, but campaigns have a global footprint including South Africa, Indonesia, Italy, India, and Kenya. Compromised Apple IDs can expose iCloud backups, Keychain passwords, and corporate data. The service lowers the value of stolen devices by enabling full unlocking and data access.
A ReliaQuest employee fell victim to a phishing attack and the hackers gained access to a dashboard. The post ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited appeared first on SecurityWeek .
A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]
Researchers say iAuthFlow V2 can register an attacker-controlled passkey, enabling persistent access even after passwords are changed and active sessions revoked. The post New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets appeared first on SecurityWeek .
Phishing attacks are becoming more sophisticated due to AI, making them more personalized and harder for traditional email filters to detect. Managed Service Providers (MSPs) are advised to monitor identity, email, and endpoint activity to detect and contain phishing attacks that bypass inbox filters. This threat highlights the evolving challenge of phishing in the context of AI-enhanced social engineering.
Attackers are increasingly exploiting enterprise collaboration platforms to conduct identity phishing, credential theft, impersonation, and social engineering. These platforms, integral to business communication and connected to enterprise identity providers, have become part of the attack surface. Threat actors leverage compromised accounts, trusted relationships, and external access to conduct malicious activities that appear as normal collaboration interactions. Over the past year, alerts related to malicious activity in collaboration tools have significantly increased, primarily involving chat or voice phishing. This trend highlights the need for strong authentication and enhanced visibility into activity within authenticated collaboration sessions.
A potential scam is circulating under the name of the Berlin Global Youth Forum 2026, promoted by an entity called OGPS.uk. The offer claims fully or partially funded participation including free tickets and accommodation. There is uncertainty about the legitimacy of OGPS.uk, with concerns raised on social media about whether it is a genuine opportunity or a fraudulent scheme. No confirmed exploits or technical vulnerabilities are associated with this threat. The primary risk is related to phishing or fraud through solicitation of personal information or payment of application fees.
Researchers identified an exposed web directory on infrastructure supporting a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, achieving a 13.6% hit rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fake support cases before being directed to counterfeit wallet applications designed to steal recovery phrases via Telegram exfiltration. Notable findings include extensive use of AI coding assistants throughout development, including GitHub Copilot and Claude Code. When one AI model resisted malicious requests, the operator switched providers and attempted to bypass safety controls using a structured jailbreak prompt targeting the model's reasoning patterns and safety mechanisms.
A user reported receiving multiple emails purportedly from Microsoft support about recent logins to their account, including one from an unexpected location. The emails contained a 'review recent activity' button linking to a Microsoft login page. The user suspects the emails may be a scam but is unsure. No direct evidence confirms whether the emails are legitimate or phishing attempts.
Google Workspace attacks do not always begin with phishing. Stolen OAuth tokens can provide another path into Gmail, Drive, and connected systems. Material Security explains why organizations need defenses that cover the entire Workspace attack chain. [...]
Cisco Talos recently identified an undocumented phishing framework, internally branded "JWR" by its developer, built to convincingly impersonate checkout and login pages across major payment and shopping platforms. The client engine of the JWR phishing framework is a real-time, operator-driven system that, rather than merely logging form submissions like a static credential-stealing page, keeps an AES-CTR encrypted WebSocket open to the threat actor so they can steer each victim's session live. The victim data targeted by the actor using JWR extends well beyond payment data, encompassing identity documents, Social Security numbers, passport and driver's license images, website and PayPal credentials, 2FA codes, and full device fingerprints, all committed to the actor's server once a session ends. Talos assesses with medium confidence that the JWR phishing framework is a variant of "The Outsider," a phishing-as-a-service (PhaaS) platform, based on several similarities in the client engine scripts and functionalities of the two PhaaS platforms. Talos observed a real-world campaign delivering the JWR client via SMS lures impersonating toll authorities, and postal and courier services of several countries in Southeast Asia and the Middle East. JWR phishing framework, a likely variant of the Outsider JWR is a phishing framework capable of harvesting complete payment card data, login credentials, and personally identifiable information (PII) documents and images in real time. The client-side engine of the framework impersonates login, and checkout flows of several payment gateways, including Shopify, PayPal, Apple, Klarna, and banks, while allowing the operator to stealthily control the victim session through an AES-CTR encrypted WebSocket channel. The client engine architecture is divided into a Host Bridge module that relays commands into a phishing inline frame (iframe) and a Vue.js victim application that renders across 44 phishing pages, streams the victim's keystrokes to the actor as they are typed, and carries out more than 40 distinct instructions issued from the command-and-control (C2) console. The data exfiltration schema is a cvvform object that includes fields such as credit card number, CVV, PIN, expiry date, Social Security Number (SSN), passport or ID images, two-factor authentication (2FA) codes, website logins, PayPal credentials, and device fingerprint. Talos discovered that the JWR client engine shares significant code and functional similarities with the client of The Outsider PhaaS platform operated by the Chinese-speaking actor “Outsider Enterprise,” which was reported by external researchers . JWR client architecture and workflow Figure 1. JWR phishing framework’s client engine architecture and execution flow. The execution starts when the parent phishing webpage loads and executes the client's engine. It checks a single global flag, window.__HOST_MODE , which is set by the parent phishing page, and selects one of two execution modes. If the flag is set, the script enters Host Mode, and control passes to the Host Bridge module, an immediately invoked function expression (IIFE) that operates within the parent page, typically a replica of a legitimate checkout or account login page, relaying received details into a child iframe that contains the actual phishing form. It establishes a persistent WebSocket connection to the actor’s C2 server. If the flag is not set, the page enters Content Mode, and control passes to the Vue.js Application, an interactive front end that renders the phishing pages, collects victim input, manages the flow across 44 HTML files, and handles the actor’s instructions from the C2 server, ultimately redirecting to a custom error page after sending the data to the C2. The Content Mode of execution has three communication modes: standalone, pluginIframe, and hostIframe. In standalone mode, the application fully owns its WebSocket connection. In pluginIframe mode, it has no direct link to t…
