Q3 2026 Email Threat Landscape Shows Rise in Phishing Attacks
Microsoft Threat Intelligence reports a notable increase in phishing emails during Q3 2026 with new techniques such as CAPTCHA-gated phishing and business domain spoofing.
Tag
#Phishing
24 results in the archive.
AI-Generated Fake Login Pages Heighten Risk of Account Takeovers
Generative AI enables attackers to create more convincing fake login pages that steal passwords and MFA codes, increasing phishing attack sophistication.
Capcom Confirms Data Breach Affecting 11.7 Million Accounts
Capcom confirmed a data breach in its CAPCOM ID service, exposing email addresses and related data for over 11.7 million accounts, raising risks to customer security.
UAT-11985 Targets Taiwan Research with Google AitM Phishing via Fake Invites
APT group UAT-11985 uses fake event invites in spear phishing attacks against Taiwan research targets to deploy an adversary-in-the-middle phishing framework targeting Google credentials and MFA codes.
Microsoft Disrupts 3 Phishing Kits Behind Over 1 Billion Scam Messages
Microsoft, Health-ISAC, JC3, and private partners disrupted three major phishing kits responsible for over 1 billion scam messages since January 2026, targeting global phishing campaigns.
Phishing Platform Targets Credentials via Fake AI Chatbot Ad Portals
Researchers discovered a phishing platform impersonating AI chatbot ad portals like Google Gemini and ChatGPT to steal credentials and MFA codes.
China-Aligned TA419 Targets U.S. AI Policy Experts with Microsoft AitM Phishing
China-linked group TA419 uses Microsoft Account-in-the-Middle phishing to target U.S. AI policy experts at think tanks, universities, and legal organizations.
Star Blizzard advances phishing and malware with RedFlick technique
Since early 2026, Microsoft has tracked Russian state actor Star Blizzard using enhanced phishing and a new malware delivery method called RedFlick, improving their evasion capabilities.
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts
Microsoft disclosed campaigns where attackers exploited third-party email systems for large-scale financial scam phishing and used passkey-themed social engineering techniques to compromise cloud accounts.
BigBear Phishing Service Bypasses MFA at 258 Organizations
The BigBear 2.0 phishing-as-a-service framework bypassed multi-factor authentication at 258 organizations, compromising over 5,000 Microsoft 365 credentials.
Attackers Use Invisible Unicode Characters to Bypass Email Filters
Threat actors use invisible Unicode characters in phishing emails to evade detection by security filters, complicating phishing identification.
ASCII Smuggling Technique Evolves from AI Prompt Injection to Phishing Evasion
Attackers are leveraging invisible Unicode characters originally used to evade AI detection as a new method to obfuscate phishing emails and bypass security filters.
US Charges Russian for Malware Campaign Targeting 80,000 Freelancers
A Russian national has been indicted in the US for a phishing campaign that infected 80,000 freelancers with TVRAT and DarkVNC malware, representing significant cybercrime against remote workers.
Guildma (Astaroth) Malware Infection via Brazilian Portuguese Email
A surge of Guildma (Astaroth) malware infections is spreading through Brazilian Portuguese phishing emails, posing risks through data theft and stealthy behavior.
SynkLoader Malware Spreads via Microsoft Teams Phishing Campaign
SynkLoader malware is delivered through a Microsoft Teams phishing campaign that uses a fake lock screen to steal enterprise user credentials, enabling unauthorized access.
Kimsuky Develops Offline AI Stack to Enhance Phishing and Malware
North Korea’s APT group Kimsuky has implemented an offline AI infrastructure that advances their phishing tactics and automates malware development by integrating AI with internal document search and malware creation tools.
Microsoft 365 AitM Phishing Campaign Targets Payroll and Finance Emails
A widespread phishing campaign uses adversary-in-the-middle techniques to compromise Microsoft 365 accounts and target payroll and finance emails.
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The Greatness phishing-as-a-service toolkit now uses device code phishing to exploit OAuth 2.0 Device Authorization Grant, bypassing MFA and hijacking accounts.
How Threat Actors Are Weaponizing Cloud-Based AI: A Data-Driven Review
Talos analyzed prompt logs from various AI applications used by threat actors to understand their evolving tactics, revealing increased sophistication in leveraging cloud-based AI for malicious activities.
BlueNoroff Uses Zoom Phishing Kit to Profile Crypto Wallets Before Malware
North Korean group BlueNoroff uses a phishing kit impersonating Zoom and Microsoft Teams to profile cryptocurrency wallets and deliver malware via social engineering.
Russian Hackers Exploit Zimbra Zero-Click Flaw for Email Theft
CISA warns that Russian state-sponsored group Laundry Bear is exploiting a patched Zimbra zero-click vulnerability combined with phishing to steal emails from enterprise Zimbra Collaboration servers.
Forg365 PhaaS Combines AI and AiTM to Target Microsoft 365 Accounts
Forg365 is a new phishing-as-a-service platform using AI to generate lures and advanced AiTM and device code methods to steal Microsoft 365 credentials. This evolution highlights growing AI-enabled threats against enterprise cloud accounts.
Hackers Use Fake Microsoft Entra Passkey Enrollment to Target M365 Users
A threat actor known as O-UNC-066 is using a phishing kit to exploit Microsoft 365 users via fake Entra passkey enrollment requests, aiming at data extortion. This tactic spans multiple industry sectors and involves voice-based social engineering.
New Ghost Phishing Wave Evades Traditional Email Security
A new EvilTokens campaign uses ghost phishing to bypass traditional email security by hiding malicious pages until decrypted inside a victim’s browser. This poses high risk to businesses using Microsoft 365 and handling sensitive data.