SeasonalInvite is a phishing campaign identified in 2026 that abuses commercial Remote Monitoring and Management (RMM) tools and eCards to conduct social engineering attacks aligned with seasonal events. The campaign has been active since at least January 2026 and leverages legitimate RMM software to facilitate malicious activity. There is no specific patch or fix since this is a phishing campaign exploiting social engineering and tool misuse rather than a software vulnerability. Organizations are advised to maintain strict control and inventory of approved RMM tools to mitigate risk.
Spanish Police dismantled a cybercrime and money-laundering ring responsible for €140 million in losses through investment fraud and business email compromise (BEC) attacks. Four individuals were arrested in connection with this operation. The incident highlights the ongoing threat posed by organized cyber fraud groups using social engineering and financial deception techniques. No specific software vulnerability or affected versions are identified in this case.
LastPass and Bitwarden users are being targeted by a phishing campaign using fake security alert emails. These emails impersonate legitimate corporate communications and direct users to fraudulent websites mimicking services like DocuSign. The phishing sites prompt users to download malicious files and may offer fake live support. LastPass confirms its systems have not been compromised and that the phishing emails do not originate from its infrastructure. Users who enter credentials on these phishing sites are advised to change their master passwords immediately and review their vaults for suspicious activity.
Two new phishing kits named Jalisco and OmegaLord have been identified targeting Microsoft 365 accounts. These kits employ techniques designed to bypass multi-factor authentication (MFA), increasing the risk of unauthorized access. The phishing campaigns specifically aim to steal credentials from users of Microsoft 365 services. No specific affected software versions are indicated. There is no evidence of known exploits in the wild at this time. The overall severity of this threat is assessed as medium.
Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply-chain compromise, and misconfigured guest access targeting SaaS-based applications. The post Defending SaaS-based applications against ShinyHunters OAuth abuse appeared first on Microsoft Security Blog .
This report references a $25 million fraud involving AI-generated deep fake technology used in a phishing context. The information is sourced from a Reddit cybersecurity post linking to a YouTube video discussing AI governance and real-world case studies. There are no technical details, known exploits, or affected software versions provided. The threat is categorized as medium severity based on the reported financial impact and phishing nature.
The attackers call victims to direct them to phishing websites mirroring Microsoft Entra ID login pages. The post Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers appeared first on SecurityWeek .
Anyone who deals with phishing messages caught by basic security filters knows that most phishing samples tend to blend into one another, since only a small set of techniques and approaches keeps reappearing in them. That is precisely why it is worth pausing on the occasional message that does something a little out of the ordinary.
A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments. [...]
A new phishing-as-a-service (PhaaS) operation called Forg365 focuses on stealing Microsoft 365 accounts by combining adversary-in-the-middle (AiTM) and device code methods with AI-assisted lure generation. [...]
A threat actor is conducting voice-based phishing (vishing) attacks targeting Microsoft 365 users by impersonating security requests to enroll a new Entra passkey. These attacks aim to deceive users into performing actions that could compromise their accounts. The campaign affects multiple sectors and relies on social engineering rather than exploiting a technical vulnerability in software.
A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names. The X/Twitter account IRIS C2 (@C2IRIS) has gained more than 4,000 followers since its creation in January 2025, posting frequently about security vulnerabilities, AI and software exploits. IRIS C2 says it is a company in McLean, Va. that sells offensive cybersecurity capabilities. The IRIS C2 website dangles the possibility of million-dollar payouts for exploits to attract talent. “Our business model is this,” reads a pinned post on top of the IRIS C2 account on X. “Attract the very best vulnerability researchers and exploit developers in the world to join our company. This mostly revolves around junior engineers with raw talent/extremely high IQ. We don’t care if they have a college degree/industry experience.” The website linked in that profile — irisc2[.]com — says the company is hiring for a number of open positions, and a recent post on its LinkedIn page enthuses about an overwhelming number of applications from potential employees. The website claims IRIS C2 is in the business of acquiring “zero-day exploits, individual primitives, partial chains, and full capabilities across all major platforms. Payouts range from $10,000 to $7 million depending on target, reliability, and operational value.” The government contracting portal g2exchange.com reports that irisc2[.]com is operated by a business based in Virginia called Calvexa Group LLC . The “contact” link on the website for Calvexa Group — calvexagroup[.]com — forwards visitors to irisc2[.]com. G2Exchange shows that while Calvexa Group LLC is registered as a federal contractor, it does not appear to be working on any direct government contracts. A search on the Arlington, Va. address listed in the incorporation records for Calvexa Group LLC finds the property is occupied by Jack Burkman , the 60-year-old founder and managing partner of the lobbying firm Burkman & Associates . When approached with questions about IRIS C2, Burkman referred further inquiries to his longtime associate, 28-year-old Jacob Wohl . Jack Burkman (left) and Jacob Wohl, at a press conference in August 2020. Image: Wikipedia. Burkman and Wohl have a storied history of creating fake intelligence companies and using them to spread false claims about and frame public figures, including fabricated sexual assault claims against then FBI director Robert Mueller , and Pete Buttigieg , then mayor of South Bend, Indiana and a Democratic candidate for the presidency. In 2019, Burkman and Wohl held press conferences falsely alleging extramarital affairs by Sen. Elizabeth Warren (D-Mass.) and then-2020 presidential candidate Kamala Harris . In the wake of the 2020 presidential election, Wohl and Burkman were prosecuted by multiple U.S. states for making thousands of robocalls to residents of battleground states and disseminating false claims about mail-in ballots. They were indicted in Cleveland on 15 felony counts of orchestrating a robocall scheme aimed at suppressing the black vote in Detroit, and were sentenced in late 2025 to probation after their appeals to dismiss the charges were rejected. In 2022, Wohl and Burkman both pleaded guilty to a single felony charge of telecommunications fraud in Ohio, and sentenced to a fine, probation, and community service. In March 2023, a judge in a New York civil case ruled that Wohl and Burkman had violated federal and state civil rights laws, and the two agreed to pay a $1 million settlement. In June 2023, the Federal Communications Commission (FCC) imposed a $5.1 million fine against Wohl and Burkman for their robocall campaigns, at the time the largest fine ever sought by the FCC under the Telephone Consumer Protection Act. Jacob “Jay” Wo…
The website pechotonbac.fr is reported as a potential phishing site that claims to provide access to baccalaureate exam results. Users attempting to visit the site receive browser warnings indicating phishing activity. There is no confirmed exploit or detailed technical analysis available. The report originates from a Reddit cybersecurity discussion seeking information about the site's legitimacy.
A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews to steal Google account credentials from marketing professionals. [...]
A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365. [...]
An active SMS phishing campaign targets Serbian road users by impersonating Putevi Srbije, Serbia's state road authority. Victims receive text messages claiming they have unpaid traffic fines with urgent payment demands. The fraudulent links lead to cloned government websites designed to steal payment card details. The infrastructure employs JavaScript-based obfuscation techniques to evade automated security scanners and uses disposable domains with uncommon TLDs. Technical analysis reveals connections to both Darcula and Phoenix Phishing-as-a-Service platforms, indicating fraudsters are combining tools from multiple PhaaS vendors. The operation demonstrates coordinated roles including infrastructure setup, SMS distribution, and data harvesting. Similar campaigns have targeted victims globally across government bodies, postal services, and financial institutions.
This report discusses how integrating Criminal IP with OpenCTI enhances threat intelligence by providing additional context such as risk scoring, infrastructure details, and phishing analysis. It focuses on improving the usefulness of threat indicators rather than describing a specific vulnerability or exploit. No direct security vulnerability or exploit is detailed.
Talos has identified "ARToken," a phishing-as-a-service platform that targets Microsoft 365. The ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token persistence, email access, BEC operations, and SharePoint exfiltration.
This morning, an interesting phishing email hit my mailbox. It targets Metamask[1], a cryptocurrency wallet, available as a browser extension and a mobile app, that lets users store, send, and receive crypto money. It's pretty popular, so a juicy target for criminals. In February, I already mentioned a campaign against them[2].
