This report discusses difficulties in getting phishing sites hosted on Vercel's platform taken down despite abuse reports. The phishing site impersonates a legitimate brand to harvest credit card data via fake checkout and 3DS OTP prompts. The reporter seeks community advice on effective takedown strategies, including reporting methods and escalation tactics. No direct technical details or exploit code are provided.
An advanced spear-phishing campaign targets Taiwan research organizations using AI-assisted content generation to craft personalized, credible event invitations. The campaign employs real-time adversary-in-the-middle (AitM) phishing kits that impersonate Google authentication pages, relaying credentials and multi-factor authentication (MFA) tokens live to the attacker. The threat actor also uses QR code phishing (quishing) by modifying legitimate event posters with malicious QR codes to expand attack vectors. The phishing infrastructure uses hybrid HTTP and WebSocket architectures to synchronize authentication workflows and capture session cookies and device fingerprints. The campaign demonstrates sophisticated social engineering, leveraging legitimate event details and institutional impersonation to reduce suspicion. The phishing kits are localized primarily in Simplified Chinese and adapted for Traditional Chinese and English. Defenses such as passkeys, device-bound sessions, impossible-travel detection, and rapid takedown of lookalike domains are noted as potentially effective mitigations.
A global cybercriminal network responsible for over one billion phishing messages targeting more than 75,000 organizations across 150 countries has been disrupted by law enforcement and partners. The operation involved a Chinese-language cybercrime marketplace called YAM Store, which sold compromised Microsoft and Google accounts and infrastructure. Phishing kits such as CoGUI, Haozi, and Iron Man were used to conduct large-scale phishing campaigns, including device-code phishing to steal authentication tokens. Microsoft and allied agencies seized domains, deactivated accounts, and blocked domains to disrupt the infrastructure. The campaign targeted Microsoft 365 customers heavily and used sophisticated evasion techniques like geofencing and fake CAPTCHA gates. The takedown is ongoing with continued removal of malicious infrastructure.
Microsoft uncovered a Chinese-language cybercriminal ecosystem involving phishing kit developers, an illicit marketplace called YAM Store, and downstream threat actors. This ecosystem enables large-scale phishing campaigns targeting organizations worldwide, including in Japan, the US, Australia, and India. The phishing kits impersonate legitimate brands and facilitate credential theft. YAM Store sells fraudulently acquired Microsoft and Google cloud environments to support these operations. Microsoft and partners disrupted the primary developers and infrastructure behind this ecosystem.
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace comprising YAM Store, CoGUI, and Iron Man, which sent over one billion malicious messages since January 2026. These services supplied stolen accounts, phishing kits, and infrastructure to criminals worldwide, targeting consumers and more than 75,000 organizations in over 150 countries. The phishing kits allowed real-time credential harvesting with interactive platforms and included thousands of templates tailored to many countries. The disruption was enabled by a US federal court order and involved multiple cybersecurity and law enforcement partners. Microsoft disabled over 20,000 accounts and blocked more than 100,000 domains related to this operation. The phishing infrastructure depended on vendor licensing servers, making it vulnerable to takedown efforts.
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign targeting Taiwan research organizations. The campaign used AI-assisted content generation to craft personalized phishing emails impersonating reputable academic and policy institutions. It combined traditional email phishing with QR code phishing (quishing) by modifying legitimate event posters with malicious QR codes. The phishing infrastructure included an advanced adversary-in-the-middle (AitM) framework impersonating Google authentication pages to intercept credentials and multi-factor authentication challenges in real time. The campaign leveraged legitimate event details as cover but redirected victims to actor-controlled phishing sites. The phishing kit's UI was originally developed in Simplified Chinese and adapted for Traditional Chinese and English, suggesting a developer with a Simplified Chinese primary language background.
Scammers are exploiting the anticipation for the upcoming Grand Theft Auto VI (GTA VI) release by creating fake websites that offer early access, leaked versions, or preorder codes for the game. These sites lure gamers with promises of paid early builds, demos, or exclusive content, often demanding cryptocurrency payments or personal data. Some scams involve fake crowdfunding campaigns or advertising offers within the game. Others require users to download suspicious software under the guise of 'human verification.' These fraudulent schemes aim to steal money, personal information, or infect devices with malware. No legitimate early access or leaked versions are available, and users are advised to avoid interacting with such sites or downloading unknown files.
Microsoft's official X (formerly Twitter) account, with over 13 million followers, was hijacked by attackers who used it to promote a Clippy-themed cryptocurrency scam. The attackers replaced the profile picture with a Clippy image and posted messages endorsing a fraudulent $Clippy token. Microsoft confirmed unauthorized access, removed the malicious posts, secured the account, and is investigating the incident. The exact method of compromise remains undisclosed, with possible attack vectors including phishing, SIM swapping, malware, or third-party tool compromise.
Two former United States Air Force members were sentenced to a combined 189 months in federal prison for their involvement in a multi-year campaign of business email compromise (BEC) scams and phishing attacks. These attacks targeted organizations to fraudulently obtain funds or sensitive information through deceptive emails.
A Vietnamese individual was charged with money laundering related to a large-scale 'pig butchering' cryptocurrency scam that defrauded a victim of $16 million. The scam involved fraudulent activities targeting cryptocurrency investors.
This report describes a social engineering threat targeting cybersecurity professionals through fake consultancy offers and job proposals. Attackers use plausible but suspicious offers, such as paid consultations or prestigious job opportunities, to gain trust and extract sensitive, non-public information. The initial contact serves as a screening to identify valuable targets who may then be manipulated into abusing their professional access and relationships. The report also highlights the release of CAIRN, an open-source toolkit for hunting AI-integrated malware, emphasizing the evolving threat landscape with AI-driven attacks.
This report describes a phishing technique using a single URL crafted to evade detection by various security controls. The URL employs three tricks: embedding a userinfo field to create unique URLs and confuse filters, using a hostname with invalid hyphen placement to bypass strict validators, and appending the victim's email address in the path to mislead parsers. These tricks exploit differences in URL parsing rather than software vulnerabilities. The phishing link directs victims to a malicious page that may pre-fill their email address to increase credibility.
EvilTokens was an AI-powered phishing platform that enabled cybercriminals to compromise over 12,000 email accounts across more than 10,000 organizations worldwide by abusing device code authentication flows. The platform used AI to craft targeted phishing messages, select victims, and extract valuable data from compromised accounts. Microsoft disrupted the platform by seizing infrastructure and arresting two suspects linked to its operation. The platform charged users for access and offered numerous phishing themes to increase success rates.
Threat actors linked to extortion groups such as ShinyHunters and Helix are conducting passkey-themed phishing attacks targeting corporate Microsoft 365 accounts. These attacks use social engineering to impersonate IT help desks and trick employees into signing into adversary-in-the-middle phishing sites or authorizing device-code authentication flows. Once compromised, attackers perform reconnaissance and systematically exfiltrate data from Microsoft 365 services including SharePoint Online, OneDrive for Business, and Exchange Online. The attackers maintain persistence by registering MFA methods they control and avoid rapid data theft to evade detection.
Hackers compromised the Brevo marketing platform by exploiting its SAML Single Sign-On (SSO) implementation, gaining unauthorized access to multiple customer accounts. Using this access, attackers sent phishing emails to approximately 347,000 Trezor users, among others, with malicious links designed to steal wallet backups. About 2,500 users clicked the phishing link before the malicious site was taken offline. The incident also involved exfiltration of contact data from 43 Brevo accounts. Other affected customers include BitBox and CoinTracking. This breach follows a recent data leak involving Trezor's third-party shipping provider, increasing the risk of targeted phishing attacks.
Trezor customers were targeted in a phishing campaign after a breach of Brevo, Trezor's third-party email marketing provider. Approximately 347,000 email addresses were exposed, and 2,500 users clicked on malicious links in phishing emails that impersonated Trezor and claimed a hardware vulnerability. The phishing emails attempted to trick users into downloading an app to steal wallet backup seeds. Trezor quickly took down the malicious domain within 20 minutes, limiting the impact. The breach only affected the newsletter database, and no other Trezor systems were compromised. This incident follows previous breaches involving Trezor's support and logistics providers.
Trezor warned customers that threat actors who breached its third-party email provider are conducting phishing attacks targeting its users. The phishing emails impersonate Trezor and claim a critical hardware vulnerability, attempting to trick recipients into clicking malicious links. Trezor has taken down the fraudulent domain and is investigating the breach. This incident follows a prior data breach involving Trezor's shipping provider ShipMonk, which exposed customer order data affecting tens of thousands of users across multiple countries. The phishing attack leverages compromised email infrastructure rather than a direct vulnerability in Trezor products.
A new phishing attack technique uses trusted Microsoft services and blob URLs to create phishing pages that exist only inside the victim's browser, leaving no static web page for defenders to detect or block. The attack starts with a Docusign-themed email containing a calendar invite to appear legitimate. The victim is redirected through Microsoft Teams to an external resource, which the browser converts into a blob URL rendering the phishing page locally. This method leverages trusted assets to evade traditional detection methods and enables centralized control of the phishing workflow. Detection requires new approaches focusing on browser activity and identity protection rather than static URL or domain blocking.
A global phishing campaign abuses multiple legitimate Google services to bypass email security and firewalls, proxying malicious traffic through trusted Google domains. The campaign encodes victim email addresses in URL fragments to avoid server logging and dynamically impersonates target organizations using live logos and real-time website data. It supports 16 languages and employs two main attack methods: credential harvesting with immediate data exfiltration via Telegram, and silent installation of the ScreenConnect remote access tool. The phishing lures cover diverse themes and target sectors including manufacturing, government, and finance.
