This report describes a social engineering threat targeting cybersecurity professionals through fake consultancy offers and job proposals. Attackers use plausible but suspicious offers, such as paid consultations or prestigious job opportunities, to gain trust and extract sensitive, non-public information. The initial contact serves as a screening to identify valuable targets who may then be manipulated into abusing their professional access and relationships. The report also highlights the release of CAIRN, an open-source toolkit for hunting AI-integrated malware, emphasizing the evolving threat landscape with AI-driven attacks.
This report describes a phishing technique using a single URL crafted to evade detection by various security controls. The URL employs three tricks: embedding a userinfo field to create unique URLs and confuse filters, using a hostname with invalid hyphen placement to bypass strict validators, and appending the victim's email address in the path to mislead parsers. These tricks exploit differences in URL parsing rather than software vulnerabilities. The phishing link directs victims to a malicious page that may pre-fill their email address to increase credibility.
EvilTokens was an AI-powered phishing platform that enabled cybercriminals to compromise over 12,000 email accounts across more than 10,000 organizations worldwide by abusing device code authentication flows. The platform used AI to craft targeted phishing messages, select victims, and extract valuable data from compromised accounts. Microsoft disrupted the platform by seizing infrastructure and arresting two suspects linked to its operation. The platform charged users for access and offered numerous phishing themes to increase success rates.
CLOSEDQUORUM is a Windows malware binary representing the first documented implant utilizing autonomous AI-driven command and control. Discovered through Cisco Talos' CAIRN project, it delegates tactical decisions to a panel of commercial large language models including DeepSeek, Qwen, Mistral, and Google Gemini. The system operates through plurality voting among AI models to select actions for credential harvesting and crypto wallet theft, eliminating the need for continuous human operator involvement. The 16.4MB Go-compiled executable employs structured JSON schema to constrain LLM responses to executable attack choices. While containing placeholder credentials in public distribution, development builds demonstrate compile-time injection of operator-specific API keys and Discord webhooks. This architecture represents a significant shift toward effort displacement in cyber operations, where entire attack phases execute autonomously without human bottlenecks, though introducing new dependencies on commerci...
Microsoft has issued a reminder for administrators to migrate Entra ID users to phishing-resistant authentication methods, such as passkeys, ahead of the planned retirement of SMS-based first-factor sign-in in February 2027. This change aims to improve security by reducing reliance on less secure SMS authentication.
Cybercriminals are using fake websites that mimic the legitimate Bitrefill site to defraud users. These lookalike sites appear in search engine results and use domains similar to Bitrefill's, including Punycode variants. Victims are tricked into completing checkout processes that resemble Bitrefill's, paying cryptocurrency to attacker-controlled addresses with no recovery option. The campaign uses sophisticated analytics to optimize victim conversion, indicating organized criminal activity.
Threat actors linked to extortion groups such as ShinyHunters and Helix are conducting passkey-themed phishing attacks targeting corporate Microsoft 365 accounts. These attacks use social engineering to impersonate IT help desks and trick employees into signing into adversary-in-the-middle phishing sites or authorizing device-code authentication flows. Once compromised, attackers perform reconnaissance and systematically exfiltrate data from Microsoft 365 services including SharePoint Online, OneDrive for Business, and Exchange Online. The attackers maintain persistence by registering MFA methods they control and avoid rapid data theft to evade detection.
A large-scale phishing simulation study involving 2.47 million simulated attacks across 1,200 organizations reveals that measuring only click rates in phishing awareness tests is insufficient. The research shows that credential leaks and reporting behaviors are critical metrics for assessing true phishing resilience. Different industries and teams exhibit varying susceptibility, with tech and IT employees surprisingly vulnerable. Sustained training programs improve reporting rates and reduce leaks over time, but initial click and leak rates may increase before declining. The study emphasizes the need for nuanced phishing risk profiles and continuous, behavior-focused training beyond simple click metrics.
This report summarizes multiple cybersecurity news items including a new InjectEave electromagnetic side-channel attack, a SIM swapping conviction, and findings on the Glasswing vulnerability ledger. The InjectEave attack allows attackers to recover audio or appliance states remotely by inducing hardware nonlinearities with RF signals. A former AT&T employee was sentenced for SIM swapping that enabled bank account takeovers. The Glasswing review found a low remediation rate of reported vulnerabilities and discrepancies in severity assessments. Other highlights include phishing evasion using invisible Unicode, a US bounty on an Iranian cyber official, and ties between a Chinese hacking group and military contractors.
Hackers compromised the Brevo marketing platform by exploiting its SAML Single Sign-On (SSO) implementation, gaining unauthorized access to multiple customer accounts. Using this access, attackers sent phishing emails to approximately 347,000 Trezor users, among others, with malicious links designed to steal wallet backups. About 2,500 users clicked the phishing link before the malicious site was taken offline. The incident also involved exfiltration of contact data from 43 Brevo accounts. Other affected customers include BitBox and CoinTracking. This breach follows a recent data leak involving Trezor's third-party shipping provider, increasing the risk of targeted phishing attacks.
Trezor customers were targeted in a phishing campaign after a breach of Brevo, Trezor's third-party email marketing provider. Approximately 347,000 email addresses were exposed, and 2,500 users clicked on malicious links in phishing emails that impersonated Trezor and claimed a hardware vulnerability. The phishing emails attempted to trick users into downloading an app to steal wallet backup seeds. Trezor quickly took down the malicious domain within 20 minutes, limiting the impact. The breach only affected the newsletter database, and no other Trezor systems were compromised. This incident follows previous breaches involving Trezor's support and logistics providers.
Casbaneiro is a banking Trojan active as of August 2026, targeting Latin American users through phishing emails and malicious PDFs disguised as invoices and legal notices. It uses a multi-stage infection chain with HTA downloaders and AutoIt loaders, employing geofencing to restrict infections to specific regions. The malware evades detection by distributing stolen data across multiple servers, deliberately responding with HTTP 403 to some requests, and activating only when victims visit targeted banking websites. It steals email data, performs clipboard injection, and creates fake windows to facilitate fraud. The campaign targets Argentina, Peru, Colombia, and Mexico, while avoiding systems using German, French, or English languages.
Trezor warned customers that threat actors who breached its third-party email provider are conducting phishing attacks targeting its users. The phishing emails impersonate Trezor and claim a critical hardware vulnerability, attempting to trick recipients into clicking malicious links. Trezor has taken down the fraudulent domain and is investigating the breach. This incident follows a prior data breach involving Trezor's shipping provider ShipMonk, which exposed customer order data affecting tens of thousands of users across multiple countries. The phishing attack leverages compromised email infrastructure rather than a direct vulnerability in Trezor products.
Two sophisticated phishing campaigns employed browser-in-the-browser (BiTB) techniques to deceive victims into installing rogue ScreenConnect remote management tools. Attackers sent phishing messages with malicious links redirecting targets to fake Adobe Reader update pages. The BiTB technique created convincing fake browser windows within webpages, displaying legitimate-looking Adobe URLs to bypass user awareness training. Victims were tricked into downloading ScreenConnect installers disguised as Adobe software updates. Each incident resulted in deployment of multiple rogue ScreenConnect instances for redundant persistence, followed by execution of defense-evasion binaries (HideCursor.exe and HideUL.exe) designed to hide attacker activities. The attacks established service-based persistence through Windows services, enabling continued remote access. Both campaigns were intercepted before further damage occurred, demonstrating how threat actors combine social engineering throughout the entire attack chain...
A new phishing attack technique uses trusted Microsoft services and blob URLs to create phishing pages that exist only inside the victim's browser, leaving no static web page for defenders to detect or block. The attack starts with a Docusign-themed email containing a calendar invite to appear legitimate. The victim is redirected through Microsoft Teams to an external resource, which the browser converts into a blob URL rendering the phishing page locally. This method leverages trusted assets to evade traditional detection methods and enables centralized control of the phishing workflow. Detection requires new approaches focusing on browser activity and identity protection rather than static URL or domain blocking.
A global phishing campaign abuses multiple legitimate Google services to bypass email security and firewalls, proxying malicious traffic through trusted Google domains. The campaign encodes victim email addresses in URL fragments to avoid server logging and dynamically impersonates target organizations using live logos and real-time website data. It supports 16 languages and employs two main attack methods: credential harvesting with immediate data exfiltration via Telegram, and silent installation of the ScreenConnect remote access tool. The phishing lures cover diverse themes and target sectors including manufacturing, government, and finance.
A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials. [...]
Threat actors are using invisible Unicode characters in phishing emails to evade detection by email security filters. This technique, known as ASCII smuggling, involves inserting invisible Unicode characters inside finance-related lure words to split them and bypass keyword-based filters. Microsoft observed a large-scale campaign using this method, peaking at 2.37 million daily messages in early 2026. The phishing messages promote business funding, loans, and credit services and are sent through infrastructure linked to the legitimate ActiveCampaign email-marketing platform. Microsoft Defender still detected over 99% of these messages using other signals. Microsoft recommends normalizing or stripping invisible Unicode characters before applying detection rules to improve filtering effectiveness.
A Chinese-speaking cybercrime group known as Gambling Goblin has targeted Brazilian government and educational websites since mid-2025 by compromising web servers and installing malicious Apache modules. These modules reverse-proxy visitors to phishing pages impersonating trusted app stores but actually promote online gambling and sports betting. The attackers manipulate search engine rankings by chaining compromised high-reputation domains, mainly Brazilian government sites. The operation uses a heavily obfuscated Linux toolkit with custom downloaders, backdoors, credential stealers, and reconnaissance tools. The campaign also targets victims in Vietnam, Spain, and English-speaking regions.
Since mid-2025, a Chinese-speaking cybercrime group dubbed Gambling Goblin has conducted a sustained campaign targeting Brazilian organizations, mainly government and educational institutions. The attackers compromise web servers and install malicious Apache modules that stealthily reverse-proxy visitors to phishing pages impersonating trusted app stores. These phishing pages promote online gambling and sports betting while leveraging hijacked high-reputation domains to manipulate search engine rankings and hijack traffic. The group uses a heavily obfuscated Linux toolkit including downloaders, backdoors, credential stealers, and brute-forcers. The infrastructure is scalable and extends beyond Brazil, with parallel phishing networks targeting Vietnamese, Spanish, and English-speaking victims. The phishing infrastructure could be reconfigured to deliver malware directly, posing a latent escalation risk.
