Phishing List - 2026 2025 2024 2023 2021 2020 2019 2018
H AI APT Attack BigBrothers BotNet Congress Cryptocurrency Cyber CyberCrime Exploit Hack ICS Incindent IoT Mobil OS Phishing Ransom Safety Security Social Spam Virus Vulnerebility | 2026 2025 2024 2023
DATE | NAME |
Info | CATEG. |
WEB |
|
18.10.26 |
Global takedown hits network behind 1 billion phishing messages | A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. | Phishing | BleepingComputer |
|
15.10.26 |
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages | Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the | Phishing | The Hacker News |
|
8.10.26 |
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia | Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. | Phishing | The Hacker News |
|
26.9.26 |
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts | The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU). | Phishing | BleepingComputer |
|
23.9.26 |
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises | Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service that it said used artificial intelligence (AI) "at every | Phishing | The Hacker News |
|
17.9.26 |
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security | N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse | Phishing | The Hacker News |
|
13.9.26 |
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data | Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. | Phishing | The Hacker News |
|
13.9.26 |
Passkey-themed phishing attacks lead to Microsoft 365 data theft | Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single sign-on-themed social engineering attacks to compromise corporate Microsoft accounts and steal data from Microsoft 365 services. | Phishing | BleepingComputer |
|
13.9.26 |
Trezor: 347,000 users targeted in phishing attacks after Brevo breach | Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. | Phishing | BleepingComputer |
|
13.9.26 |
Trezor warns users of email provider breach, phishing attacks | Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks. | Phishing | BleepingComputer |
|
11.9.26 |
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations | A phishing-as-a-service framework called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations and steal more than 5,000 Microsoft 365 credentials | Phishing | BleepingComputer |
|
7.9.26 |
Attackers conceal phishing lures using invisible Unicode characters | Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. | Phishing | BleepingComputer |
|
4.9.26 |
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters | Microsoft is alerting of a "high-volume phishing campaign" that's using invisible Unicode tag characters to bypass email filters. "Instead of using these characters to hide instructions from people while exposing them to | Phishing | The Hacker News |
|
3.9.26 |
US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries | An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has | Phishing | The Hacker News |
|
29.8.26 |
Hackers abuse npm mirrors to host phishing redirect pages | Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. | Phishing | BleepingComputer |
|
29.8.26 |
AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes | A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. | Phishing | BleepingComputer |
| 26.8.26 | US Finance Under Phishing Pressure: What the SOC Data Reveals? | With modern campaigns such as Vercel-hosted RMM attacks, the scale and security impact of phishing in US finance should not be understated. As threats get increasingly harder to detect, the phishing challenge raises the stakes in the industry. | Phishing | ANYRUN BLOG |
| 26.8.26 | Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking | Group-IB exposes a Mexican PhaaS operation targeting over 20 financial institutions with live phishing, AI vishing, and mobile RAT capabilities. | Phishing | GROUP-IB |
| 25.8.26 | Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows | Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets | Phishing | The Hacker News |
| 25.8.26 | What is EvilTokens?: The PhaaS Platform That Tells Attackers What to Do After They Get In | As competition in the underground phishing market increases, so does the quality of the products and services offerings, particularly among the Phishing as a Service (PhaaS) category. EvilTokens is completely reshaping how PhaaS affiliate programs operate: rather than offering initial access alone, it also provides malicious analytics services informed by operator experience and AI-driven insights. | Phishing | FLARE.IO |
| 24.8.26 | Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain | The SOCRadar Threat Research Unit (STRU) has conducted an “inside-out” analysis of AnonyMousKIT, an AI-powered Phishing-as-a-Service (PhaaS) ecosystem specifically engineered to disable Apple’s Activation Lock on stolen devices. | Phishing | SOCRADAR |
| 23.8.26 | How MSPs can catch phishing attacks email filters miss | AI is making phishing attacks more personalized, convincing, and difficult for traditional email filters to detect. Kaseya explains how MSPs can monitor identity, email, and endpoint activity to detect and contain attacks that make it past the inbox. | Phishing | BleepingComputer |
|
19.8.26 |
Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US | Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle (AiTM) attacks. | Phishing | ANYRUN BLOG |
|
14.8.26 |
CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps | Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview | Phishing | The Hacker News |
|
12.8.26 |
Top 10 Phishing Kits Used by Cybercriminals | Phishing kits have turned credential theft into a scalable service by packaging fake login pages, hosting, traffic filtering, victim management, and technical support into ready-made platforms. | Phishing | SOCRADAR |
|
10.8.26 |
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA | Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. | Phishing | The Hacker News |
|
8.8.26 |
COLDCARD security audit phishing attack installs remote access tool | COLDCARD security audit phishing attack installs remote access tool | Phishing | BleepingComputer |
|
8.8.26 |
Phishing service spoofs RingCentral to steal Microsoft 365 accounts | The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. | Phishing | BleepingComputer |
|
8.8.26 |
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data | A recent wave of cyber attacks targeting financial services, private equity, and professional services is attributed to a data extortion group known as UNC6671 . "UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT help desk staff facilitating mandatory, urgent security migrations. | Phishing | The Hacker News |
|
7.8.26 |
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails | Cybersecurity researchers have called attention to an active "widespread email-driven phishing campaign" that employs adversary-in-the-middle | Phishing | The Hacker News |
|
6.8.26 |
Formula 1 Phishing Campaign & Kit Analysis | SOCRadar Threat Research Unit (STRU) has identified and analyzed a sophisticated, multi-stage phishing campaign that exploits the high-intensity demand for Formula 1 Grand Prix tickets. The attackers use highly convincing replicas of official ticketing platforms to deceive victims, tricking them into providing payment information and two-factor authentication (2FA) tokens. | Phishing | SOCRADAR |
|
6.8.26 |
Inside Greatness: Telegram-Distributed M365 AiTM PhaaS | ZeroBEC threat research on the Greatness phishing-as-a-service (PhaaS) platform, a commercially distributed kit sold via Telegram that combines adversary-in-the-middle (AiTM) credential and token theft with device code phishing in a single operator product. | Phishing | ZEROBEC BLOG |
|
6.8.26 |
Fake Bank of America "Action Needed" Phishing Email Deposits ScreenConnect Instead | We recently came across a fake Bank of America message that closely imitates the targeted bank's visual style, layout, and branding – from the initial phishing email, to the eventual webpage that victims are redirected to. | Phishing | Huntress |
|
5.8.26 |
Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk | Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled | Phishing | The Hacker News |
|
5.8.26 |
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens | The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code | Phishing | The Hacker News |
|
4.8.26 |
How legitimate cloud platforms enable phishers to bypass MFA | We cover a cloud-based AitM attack scenario leveraging service workers and Ultraviolet, and provide detailed phishing hosting statistics across platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. | Phishing | SECURELIST |
|
27.7.26 |
Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update | Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver | Phishing | The Hacker News |
|
24.7.26 |
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery | The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been | Phishing | The Hacker News |
|
23.7.26 |
Police dismantle Kratos phishing platform, arrest developer | Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia. | Phishing | BleepingComputer |
| 17.7.26 | New phishing kits target Microsoft 365 accounts, evade MFA | Two new phishing kits, Jalisco and OmegaLord, have been discovered in attacks targeting Microsoft 365 accounts, using techniques that defeat multi-factor authentication (MFA). | Phishing | BleepingComputer |
| 13.7.26 | Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft | A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing , adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. | Phishing | The Hacker News |
| 11.7.26 | New Helix vishing group emerges in SharePoint data theft attacks | A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments. | Phishing | BleepingComputer |
| 11.7.26 | Entra passkey enrollment vishing targets Microsoft 365 users | A threat actor has been targeting organizations across multiple sectors with voice-based fake security requests that ask Microsoft 365 users to enroll a new Entra passkey. | Phishing | BleepingComputer |
| 11.7.26 | "Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection? | Anyone who deals with phishing messages caught by basic security filters knows that most phishing samples tend to blend into one another, since only a small set of techniques and approaches keeps reappearing in them. That is precisely why it is worth pausing on the occasional message that does something a little out of the ordinary. | Phishing | SANS |
| 9.7.26 | Phishing poses as big-brand job interview to steal Google accounts | A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, and OpenAI, in fake job interviews to steal Google account credentials from marketing professionals. | Phishing | BleepingComputer |
| 8.7.26 | New Ghost Phishing Wave Is Breaking Traditional Email Security | A recent EvilTokens campaign targeting businesses across the US and Europe is exposing a new email security blind spot. This “ghost phishing” technique keeps the malicious page hidden until it decrypts and comes to | Phishing | The Hacker News |
| 7.7.26 | DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts | A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts | Phishing | The Hacker News |
| 7.7.26 | When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website | The OAuth 2.0 Device Authorization Grant specification was designed to streamline authentication for Smart TVs, IoT devices, and printers. Today, threat actors are weaponizing it. | Phishing | SECURELIST |
| 5.7.26 | ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit | A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse into an extensive toolkit designed to compromise Microsoft 365. | Phishing | BleepingComputer |
| 28.6.26 | Order-tracking app Shop abused to push callback phishing attacks | Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software. | Phishing | BleepingComputer |
| 28.6.26 | Bluekit phishing kit adopts browser-in-the-middle for login theft | The Bluekit phishing-as-a-service platform continues to evolve with nearly 70 new hostnames identified over the past week and by adding browser-in-the-middle capabilities for improved data theft. | Phishing | BleepingComputer |
| 27.6.26 | WhatsApp phishing attack uses fake business docs to hack PCs | An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. | Phishing | BleepingComputer |
| 26.6.26 | Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant | An active phishing campaign has been targeting hotel and other hospitality organizations across Europe and Asia since April 2026, using | Phishing | The Hacker News |
| 21.6.26 | eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address | I detected an interesting phishing email this morning. It targets a major Belgian bank: | Phishing | SANS |
| 2.6.26 | New Wave Of Phishing Emails with SVG Files | For a few days, my SANS ISC mailbox is flooded with emails that delivers SVG files. An SVG ("Scalable Vector Graphic") is a web-friendly vector file format used for graphics and icons. | Phishing | SANS |
| 30.5.26 | FBI warns of Kali365 phishing service targeting Microsoft 365 accounts | The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multi-factor authentication (MFA). | Phishing | BleepingComputer |
| 26.5.26 | Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning | The Iranian state-sponsored threat actor known as Nimbus Manticore (aka Screening Serpens and UNC1549 ) has been attributed to a fresh | Phishing | The Hacker News |
| 24.5.26 | npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks | GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve | Phishing | The Hacker News |
| 22.5.26 | Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing | The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts. | Phishing | BleepingComputer |
| 17.5.26 | Cyber-Enabled Cargo Crime: How Cybercrime Tradecraft is Used to Steal Freight | Cargo theft now starts with phishing emails and stolen credentials, not hijackings, to reroute and steal freight from supply chains. NMFTA outlines how cyber-enabled cargo crime is changing transportation security. | Phishing | BleepingComputer |
| 10.5.26 | Hackers abuse Google ads for GoDaddy ManageWP login phishing | A phishing campaign delivered through Google sponsored search results is targeting credentials for ManageWP, GoDaddy's platform for managing fleets of WordPress websites. | Phishing | BleepingComputer |
| 9.5.26 | Researchers report Amazon SES abused in phishing to evade detection | Cybersecurity firm Kaspersky reports that the Amazon Simple Email Service (SES) is being increasingly abused to send convincing phishing emails that can bypass standard security filters and render reputation-based blocks ineffective. | Phishing | BleepingComputer |
| 5.5.26 | Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries | Microsoft has disclosed details of a large-scale credential theft campaign that has leveraged a combination of code of conduct-themed | Phishing | The Hacker News |
| 5.5.26 | Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools | An active phishing campaign has been observed targeting multiple vectors since at least April 2025 with legitimate Remote Monitoring and | Phishing | The Hacker News |
| 3.5.26 | New Bluekit phishing service includes an AI assistant, 40 templates | A new phishing kit named Bluekit offers more than 40 templates targeting popular services and includes basic AI features for generating campaign drafts. | Phishing | |
| 2.5.26 | Robinhood account creation flaw abused to send phishing emails | Online trading platform Robinhood's account creation process was exploited by threat actors to inject phishing messages into legitimate emails, tricking users into believing their accounts had suspicious activity. | Phishing | BleepingComputer |
| 2.5.26 | 30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign | A newly discovered Vietnamese-linked operation has been observed using a Google AppSheet as a "phishing relay" to distribute phishing | Phishing | The Hacker News |
| 25.4.26 | NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software | The Office of Inspector General (OIG) of the U.S. National Aeronautics and Space Administration (NASA) has revealed how a Chinese national posed as a | Phishing | The Hacker News |
| 23.4.26 | Apple account change alerts abused to send phishing emails | Apple account change notifications are being abused to send fake iPhone purchase phishing scams within legitimate emails sent from Apple's servers, increasing legitimacy and potentially allowing them to bypass spam filters. | Phishing | BleepingComputer |
| 18.4.26 | FBI takedown of W3LL phishing service leads to developer arrest | The FBI Atlanta Field Office and Indonesian authorities have dismantled the "W3LL" global phishing platform, seizing infrastructure and arresting the alleged developer in what is described as the first coordinated enforcement action between the United States and Indonesia targeting a phishing kit developer. | Phishing | |
| 16.4.26 | n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails | Threat actors have been observed weaponizing n8n , a popular artificial intelligence (AI) workflow automation platform, to facilitate sophisticated | Phishing | The Hacker News |
| 14.4.26 | FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts | The U.S. Federal Bureau of Investigation (FBI), in partnership with the Indonesian National Police, has dismantled the infrastructure associated with | Phishing | The Hacker News |
| 12.4.26 | New VENOM phishing attacks steal senior executives' Microsoft logins | Threat actors using a previously undocumented phishing-as-a-service (PhaaS) platform called "VENOM" are targeting credentials of C-suite executives across multiple industries. | Phishing | BleepingComputer |
| 12.4.26 | When attackers already have the keys, MFA is just another door to open | Stolen credentials turn authentication systems into the attack surface. Token shows how wearable biometric authentication verifies the user—not the session—blocking phishing relays and MFA bypass | Phishing | BleepingComputer |
| 6.4.26 | Traffic violation scams switch to QR codes in new phishing texts | Scammers are sending fake "Notice of Default" traffic violation text messages impersonating state courts across the U.S., pressuring recipients to scan a QR code that leads to a phishing site demanding a $6.99 payment while stealing personal and financial information. | Phishing | |
| 6.4.26 | Device code phishing attacks surge 37x as new kits spread online | Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year. | Phishing | |
| 1.4.26 | Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures | A multi-pronged phishing campaign is targeting Spanish-speaking users in organizations across Latin America and Europe to deliver Windows banking | Phishing | The Hacker News |
| 29.3.26 | Dutch Police discloses security breach after phishing attack | The Dutch National Police (Politie) says a security breach resulting from a successful phishing attack has had a limited impact and hasn't affected citizens' data. | Phishing | BleepingComputer |
| 28.3.26 | Tycoon2FA phishing platform returns after recent police disruption | The Tycoon2FA phishing-as-a-service (PhaaS) platform that Europol and partners disrupted on March 4 has already returned to previously observed activity levels. | Phishing | |
| 27.3.26 | AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion | Threat actors are using adversary-in-the-middle (AitM) phishing pages to seize control of TikTok for Business accounts in a new campaign, according to a | Phishing | The Hacker News |
| 25.3.26 | Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse | Cybersecurity researchers are calling attention to an active device code phishing campaign that's targeting Microsoft 365 identities across more than | Phishing | The Hacker News |
| 24.3.26 | Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware | Microsoft has warned of fresh campaigns that are capitalizing on the upcoming tax season in the U.S. to harvest credentials and deliver malware. | Phishing | The Hacker News |
| 22.3.26 | Microsoft Azure Monitor alerts abused for callback phishing attacks | Microsoft Azure Monitor alerts are being abused to send callback phishing emails that impersonate warnings from the Microsoft Security Team about unauthorized charges on your account. | Phishing | |
| 22.3.26 | FBI links Signal phishing attacks to Russian intelligence services | The FBI has issued a public service announcement warning that Russian intelligence-linked threat actors are actively targeting users of encrypted messaging apps such as Signal and WhatsApp in phishing campaigns that have already compromised thousands of accounts. | Phishing | |
| 14.3.26 | Microsoft brings phishing-resistant Windows sign-ins via Entra passkeys | Microsoft is rolling out passkey support for Microsoft Entra on Windows devices, adding phishing-resistant passwordless authentication via Windows Hello. | Phishing | BleepingComputer |
| 14.3.26 | Microsoft Teams phishing targets employees with A0Backdoor malware | Hackers contacted employees at financial and healthcare organizations over Microsoft Teams to trick them into granting remote access through Quick Assist and deploy a new piece of malware called A0Backdoor. | Phishing | BleepingComputer |
| 12.3.26 | FBI warns of phishing attacks impersonating US city, county officials | The Federal Bureau of Investigation (FBI) warns that criminals are impersonating U.S. officials in phishing attacks targeting businesses and individuals who request city and county planning and zoning permits. | Phishing | |
| 12.3.26 | Hackers abuse .arpa DNS and ipv6 to evade phishing defenses | Threat actors are abusing the special-use ".arpa" domain and IPv6 reverse DNS in phishing campaigns that more easily evade domain reputation checks and email security gateways. | Phishing | BleepingComputer |
| 3.3.26 | Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication | Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller that proxies legitimate login pages to bypass multi-factor | Phishing | The Hacker News |
| 28.2.26 | Phishing campaign targets freight and logistics orgs in the US, Europe | A financially motivated threat group dubbed "Diesel Vortex" is stealing credentials from freight and logistics operators in the U.S. and Europe in phishing attacks using 52 domains. | Phishing | |
| 22.2.26 | Hackers target Microsoft Entra accounts in device code vishing attacks | Threat actors are targeting technology, manufacturing, and financial organizations in campaigns that combine device code phishing and voice phishing (vishing) to abuse the OAuth 2.0 Device Authorization flow and compromise Microsoft Entra accounts. | Phishing | |
| 12.2.26 | Microsoft: Exchange Online flags legitimate emails as phishing | Microsoft is investigating an ongoing Exchange Online issue that mistakenly flags legitimate emails as phishing and quarantines them. | Phishing | |
| 3.2.26 | 1Password adds pop-up warnings for suspected phishing sites | The 1Password digital vault and password manager has added built-in protection against phishing URLs to help users identify malicious pages and prevent them from sharing account credentials with threat actors. | Phishing | |
| 27.1.26 | Indian Users Targeted in Tax Phishing Campaign Delivering Blackmoon Malware | Cybersecurity researchers have discovered an ongoing campaign that's targeting Indian users with a multi-stage backdoor as part of a suspected | Phishing | The Hacker News |
| 18.1.26 | ConsentFix debrief: Insights from the new OAuth phishing attack | ConsentFix is an OAuth phishing technique abusing browser-based authorization flows to hijack Microsoft accounts. Push Security shares new insights from continued tracking, community research, and evolving attacker techniques. | Phishing | |
| 7.1.26 | Microsoft Warns Misconfigured Email Routing Can Enable Internal Domain Phishing | Threat actors engaging in phishing attacks are exploiting routing scenarios and misconfigured spoof protections to impersonate organizations' domains and distribute | Phishing | The Hacker News |