Phishing & Social Engineering

Open-source AiTM phishing kits proxy live Microsoft 365 auth sessions, capturing tokens and bypassing MFA protections.

Wiz documents CaptiveCrunch AiTM campaign by Storm-2945/Midnight Blizzard targeting hospitality captive portals to harvest credentials.

Insurance-targeted phishing now triggers immediate real-time account hijacking rather than delayed credential theft for timely money transfer fraud.

AgentForger critical flaw in ChatGPT Workspace could let phishing link build and authorize rogue workspace agents; patched June 8.

APT42 leverages AI-assisted reconnaissance and the resilient TAMECAT malware to target senior government and defense personnel.

Social-engineering attack compromised employee accounts exposing personal and health information at Clover Health Investments.

NCSC and partners attribute a novel zero-click phishing campaign to Russian state-supported actors targeting Western organizations.

UAC-0145 (Sandworm sub-cluster) uses ClickFix CAPTCHAs to trick Ukrainian targets into installing data-stealing malware.

Forg365 phishing-as-a-service uses device-code phishing, AitM, AI lures, and mailbox operations to compromise Microsoft 365 accounts for customers.

Directory listing on misconfigured server exposed three Evilginx phishing operations that bypass MFA to target Microsoft 365 users.

Jalisco and OmegaLord phishing kits target Microsoft 365, using MFA-evasion techniques to steal credentials and session tokens.

Retailer Lidl notifies customers after a third-party supplier breach exposed stored customer data hosted externally.

Rise in deceptive QR-code scams leading to credential theft, fraudulent payments and account takeover attempts.

Forg365 provides AI-driven phishing, session theft and mailbox access to attack Microsoft 365 users via a subscription model.

Threat group O UNC 066 uses phone-based phishing to trick employees into registering attacker-controlled Entra passkeys to hijack accounts.

Phishing campaign weaponizes AnyDesk, uses scheduled tasks for persistence and artifact deletion to maintain stealthy backdoors.

Frontend script injection via a third-party vendor; user reimbursements underway.

Initial access via social engineering on Teams; rapid persistence emphasis for defenders to harden collaboration tools and training.