Threats Tagged 'spoofing'

Threat actors are leveraging complex routing scenarios and misconfigured spoof protections to send phishing emails that appear to be internal communications. These attacks, which have increased since May 2025, use various lures like voicemails, shared documents, and password resets to conduct credential phishing and financial scams. The campaigns, often using PhaaS platforms like Tycoon2FA, are opportunistic and target multiple industries. While Microsoft detects most attempts, organizations can further mitigate risks by properly configuring spoof protections and third-party connectors. The attacks do not affect customers whose Microsoft Exchange MX records point to Office 365, as they are protected by built-in spoofing detections.

MediumMalwareGermanyFranceUnited Kingdom+5#credential theft#tycoon2fa#email

Threat actors are actively exploiting Microsoft 365's Direct Send feature to deliver phishing emails, bypassing perimeter security solutions by routing malicious messages through trusted infrastructure. This technique requires no credentials, only knowledge of the target domain and valid recipient addresses. The attack process involves identifying organizational domains, crafting emails impersonating internal users, and delivering them through Microsoft 365's infrastructure. Recent campaigns have successfully harvested credentials and established footholds within targeted environments. Attackers use automated tools to generate convincing business-themed lures, often utilizing PDF and DOCX attachments with QR codes or obfuscated HTML leading to phishing pages. The abuse of Direct Send represents a critical gap in email security defenses, particularly for organizations relying heavily on email communications.

MediumCampaignUnited KingdomGermanyFrance+7#credential theft#phishing#microsoft 365

A recent campaign attributed to APT36 has been observed spoofing India's Ministry of Defence to deliver cross-platform malware. The attackers used a ClickFix-style infection chain, mimicking government press releases and leveraging a compromised .in domain for payload staging. The campaign targeted both Windows and Linux users, employing clipboard-based execution techniques. On Windows, the attack utilized mshta.exe to execute a heavily obfuscated HTA file, while on Linux, it attempted to execute a shell script. The tradecraft observed, including government-themed lures, HTA-based delivery, and decoy documents, aligns with known APT36 tactics. This activity demonstrates the continued evolution of ClickFix techniques in new contexts.

MediumCampaignGermanyFranceItaly+5#social engineering#spoofing#clickfix