The UK’s National Cyber Security Centre (NCSC) has issued an alert over a new ‘zero-click’ threat campaign being waged by Russian state-backed hackers.

The advisory, published in collaboration with international partners, warned ‘beehive’ attacks by the ‘Laundry Bear’ threat group aim to steal email correspondence at organizations operating across a range of critical sectors.

This includes organizations in the defense, education, energy, and technology industries, as well as law enforcement and government agencies.

Attacks against these organizations all have a common theme, according to the NCSC, mainly the use of Zimbra Collaboration Suite (ZCS) software. Targeting focuses specifically on those using vulnerable versions of the software, the advisory noted.

Rather than requiring users to click a link or open a file, zero-click attacks mean users only have to view a malicious email to be compromised.

The NCSC urged organisations that use ZCS to follow mitigation advice, patch immediately, and “improve network monitoring capabilities”.

Crucially, analysis of the campaign found these techniques could be adapted to exploit vulnerabilities in other email software applications used by Western organizations.

“This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations,” said NCSC chief operating officer (COO) Beth Hopkins.

Ukrainian organizations used in testing

According to the NCSC, the techniques used by Laundry Bear were “extensively trialled” on Ukrainian victims before use against other Western nations. The security agency noted this is part of a growing trend among Russian threat groups.

Notably, technical analysis of the campaign also highlighted the use of AI in development of a “simple codebase” used during operations.

Zero-click attacks have surged in frequency over the last 12 months, research shows, with threat actors accelerating efforts to capitalize on vulnerabilities.

Analysis from Rapid7 found that vulnerability exploitation has now surpassed social engineering as the “largest initial access vector”, accounting for more than one-third (38%) of all attacks.

More than 50% of all exploited vulnerabilities involved zero-click attacks, rather than network-facing vulnerabilities, the study noted, highlighting evolving techniques by threat actors.

“These types of vulnerabilities require no authentication and no user interaction, giving attackers rapid pathways into exposed systems and edge infrastructure,” Rapid7 noted.

Dray Agha, senior manager of security operations at Huntress, said these types of exploits are a “worst-case scenario for defenders” as potential victims are only required to view malicious emails.

“Simply viewing the email in a vulnerable client triggers the compromise,” he explained. “This completely bypasses traditional employee security training and gives state-backed hackers a silent, invisible backdoor into sensitive communications without the victim ever making a mistake.”

Agha said the rise of these techniques mean organizations need to place a greater focus on regular patching to avoid falling prey.

“This is why defense-in-depth is advised, as where the human security layer is porous, the technical defensive layer can step in,” he said.

“Organizations shouldn’t just rely on their staff acting as a ‘human firewall’. Rapid software patching, coupled with layered technical defenses, is the only reliable safety net against modern state-sponsored threats.”

FOLLOW US ON SOCIAL MEDIA

Email phishing has always been a simple yet effective form of attack. While the method isn’t going away, research is showing attackers evolving beyond email to multiple channels such as Slack and cloud-based platforms.

That’s according to security firm KnowBe4’s Phishing Threat Trends report, which found hackers are leveraging new “touchpoints” when targeting victims, with calendar invites and messaging tools a frequent tactic. The company recorded a 41% increase in Microsoft Teams-based attacks between October 2025 and March 2026 as adversaries strived to create more avenues for success.

With AI offering cybercriminals the ability to supercharge phishing attacks further, what should businesses be doing to manage the risk?

Phishing evolution

In the past, phishing attacks relied on adversaries targeting a wide range of users in the hope that some of them would engage with malicious content, or give away valuable information. But since then, businesses have improved their security, with tools such as multi-factor authentication (MFA) used as standard. This has forced attackers to utilize more sophisticated techniques.

“When attackers cannot compromise technical controls, such as MFA, they are instead seeking to bypass the technology and move the attack onto end users through social engineering,” says Luiz Simpson, head of offensive security at Bridewell.

He cites the example of illicit consent grant attacks in Microsoft 365, which trick users into granting access to data. These attacks often “go completely under the radar”, says Simpson. “Users will accept an untrustworthy app while logged into their cloud workspace and under the legitimate Microsoft or Google workspace platforms. These attacks don’t require any bypass of MFA and almost always aren’t flagged by detection and response.”

Another reason attackers are targeting multiple channels is the fact that the workplace itself has changed. “Employees now spend far more time in collaboration platforms, cloud applications, messaging tools, and video conferencing environments,” says Ray Canzanese, director of Netskope Threat Labs. “Attackers are following that behavior.”

Canzanese describes how phishing lures are increasingly delivered through platforms such as Microsoft Teams, Zoom and fake meeting invitations. “These are designed to exploit the trust users place in familiar collaboration workflows.”

From a criminal perspective, multi-channel phishing is becoming “progressively structured”, according to Benson Varghese, a criminal lawyer and founder and managing partner at law firm Varghese Summerset. Rather than flooding potential victims with random messages, phishers will prepare their sequence, test the response rate, and react to engagement in real-time, he says. “This makes attacks more focused and effective.”

Security shift

Experts believe the evolution of phishing requires businesses to change the way they think about securing communication channels.

The shift means no longer treating phishing as purely an email security problem. “Security teams need visibility across a much broader digital environment that includes collaboration tools, cloud platforms, browsers, unmanaged devices and AI applications,” according to Canzanese.

Almost all social media platforms include user messaging, which supports the distribution of links and images. Yet historically, the focus on preventing social engineering attacks has been around traditional email-based messages, encouraging users to avoid clicking links. “None of these defences will help prevent attackers from contacting end users and sending malicious content across other channels,” says Simpson.

“As these interactions do not arrive via traditional email, there is no URL rewriting, sandboxing or inspections of content,” he points out. “This leaves you with just endpoint and identity-based controls to protect users.”

However, endpoint detection and response (EDR) solutions traditionally fall short in having visibility of what goes on within a browser, Simpon explains. “If a user is to bring your own device (BYOD) with access to enterprise resources, you are very much on the back foot to prevent identity-based attacks.”

Managing multi-channel phishing

The move to multiple channels is just one way phishing is changing. In tandem, AI is accelerating the quality and scale of attacks, while lowering the barrier to entry for new cybercriminals, according to Danny Jenkins, CEO of ThreatLocker.

“Attackers no longer need to spend hours researching targets or carefully crafting convincing messages,” he tells ITPro.

“AI can generate highly personalised, context-aware phishing content in seconds – whether that’s a Teams message, a fake document-sharing notification, or a voice deepfake impersonating a colleague or executive.”

There is also a rise in adaptive social engineering, where AI-driven phishing attempts evolve in real time based on how a user responds, he warns. “Instead of relying on static messages, these interactions can mimic natural conversations, making them significantly more convincing,” explains Jenkins.

The threat from multi-channel phishing is certainly growing, but firms can help boost defenses by making several key changes. Some of these are cultural.

From a security perspective, organizations need to accept that they will not stop every phishing attempt across every channel, says Jenkins.

“Humans are imperfect, and mistakes will happen, and no amount of training can prevent every phishing attempt.”

Instead, the priority should be reducing the impact of an attack and tightly controlling access, rather than trying to eliminate exposure, he advises.

Passkey use can help, says Simpson, pointing out that the UK National Cyber Security Centre (NCSC) has started to actively recommend the adoption of passkeys over passwords and MFA.

“Passkeys help address many of the shortfalls of traditional passwords and MFA. Notably, they’re resistant to phishing because they’re tied to the legitimate website only; they are fast and convenient, and cannot be stolen if a website is breached.”

As with traditional phishing, organizations should adopt a strategy of user awareness and technical controls to defend against multi-channel attacks, according to Simpson.

This means ensuring users are aware that a spectrum of social engineering attacks are possible, beyond solely email-based phishing. Users, especially those in high-risk roles, such as executives and finance teams, should be targeted with training to empower them to identify and report attacks, Simpson advises.

“This should be an ongoing message and constantly refreshed based on active attacks seen in the wild, rather than just an annual policy that’s read and signed off.”

Criminals are posing as Interpol cyber crime investigators to target small businesses across Europe, Asia, the Middle East, and North America.

According to new research from Bitdefender, the phishing messages claim to contain evidence that the recipients are carrying out suspicious activity, pressuring them into opening a password-protected archive.

"Based on information that has come to our attention, there may be activities involving accounts, systems or services associated with your organization that warrant further examination. We have obtained information and video material that may assist in your assessment of the matter," the emails read.

"We recommend conducting an internal review to determine whether any unauthorized, suspicious or potentially fraudulent activities have occurred. Prompt attention to such matters may help mitigate potential financial operational, reputational or regulatory risks."

Upon opening the link, recipients are directed to a Proton Drive-hosted file that delivers a ransomware payload hidden within multiple archive layers. Once executed, researchers said the malware seeks to encrypt files across available drives and presents victims with a ransom message.

The campaign is targeting organizations across multiple industries, including food and agriculture, legal services, pharmaceuticals, media, technology, and finance.

The ransomware is relatively simple, according to Bitdefender researchers. The code contains hardcoded values, including the password used during encryption and decryption, and lacks many of the features typically associated with large ransomware operations.

Interestingly, victims are instructed to contact the attackers through a Tox chat channel to negotiate a ransom, rather than through the more usual dedicated negotiation portal or victim site.

This, researchers noted, is another indication that this is likely a custom-built operation, perhaps assembled using publicly available code and tools rather than the work of an established ransomware group.

What small businesses need to know

Javvad Malik, Lead CISO advisor at KnowBe4, said that impersonating Interpol – or law enforcement in general – is specifically designed to trigger a “rapid emotional response” and dupe victims into ignoring red flags.

"What is interesting about this campaign is that it targets small business,” he said. “These are often understaffed and have no security or even IT expertise on hand, so it's not difficult to see why people would easily fall victim to these kinds of attacks."

Bitdefender has warned small businesses to be on the alert, urging them to verify all unsolicited correspondence by reaching out through official channels to confirm whether the communication is legitimate.

"One of the biggest red flags in this campaign is the delivery method itself," researchers said. "While the attackers impersonate Interpol, legitimate law enforcement agencies don't send unsolicited emails containing Proton Drive links to password-protected files and ask organizations to review alleged evidence of wrongdoing."

They should treat password-protected archives with caution, especially when the password is included in the email. Showing file extensions on Windows devices will make it easier to spot executables masquerading as videos or documents, and multi-factor authentication (MFA) should be used wherever possible.

Elsewhere, the company urged small businesses to ensure staff are trained to help spot tell-tale signs that communications are fraudulent.

"Small businesses are often viewed as easier targets than large enterprises," the researchers warned.

"Many operate without dedicated IT teams or cybersecurity staff. Security responsibilities are often shared among employees who already wear multiple hats, and limited budgets can make it difficult to invest in advanced security measures or ongoing training."

FOLLOW US ON SOCIAL MEDIA

Network Rail is fighting off millions of cyber attacks every month, according to new research, as experts warn of a rising tide of threats facing public services.

Freedom of information (FoI) requests show the organization blocked over 7.1 million malicious emails between December 2025 and March this year.

Of the 7,129,314 email attacks blocked by Network Rail, 331,352 were phishing emails, 1,412 were malware-laden emails, 2,066,392 were spam emails, and 4,730,158 were edge blocked emails.

This all adds up to an average of more than 800,000 attacks per day, including around 37,000 phishing attempts.

“With so many people in the UK depending on public transport for their daily lives, a successful cyber attack could cause significant disruption, such as potentially stopping people from getting to work," warned Simon Edwards, CEO of SE Labs.

"Therefore, it’s vital that our public sector organizations have a dedicated cyber strategy put in place and ensure rigorous testing to identify any security holes and keep hackers at bay.”

Just last week, two members of the hacking group known as Scattered Spider pleaded guilty over their involvement in an attack on Transport for London (TfL) systems.

The attack forced all 28,000 employees to attend a TfL office for a password reset and led to a reported £29 million in losses and recovery costs.

"As we've seen from the recent Scattered Spider convictions, hacking groups have the transport network firmly in their sights. A single successful cyber attack on the rail network could drive Britain to a halt, operationally and economically," said Graeme Stewart, head of public sector at Check Point.

"The transport network is also a treasure trove of personal and financial data, something unscrupulous criminals are eager to get their hands on. That’s why it's vital that our roads, rail and aviation systems are fully protected with the latest cyber defenses to keep hackers locked out."

What happened with the Network Rail cyber attack?

In 2024, Network Rail suffered a cyber attack on its WiFi systems that saw commuters who logged in at affected stations receive information pertaining to terrorist attacks in Europe, as well as a message stating “we love you Europe”.

The attack is believed to have taken place through a third-party service provider, Telent, which managed Network Rail's WiFi services.

More recently, train operator LNER said a cyber attack had led to unauthorized access to files managed by an unnamed third-party supplier.

Travel networks, particularly rail services, are among the top targets for cyber criminals and state-sponsored groups due to the critical role they play in the British economy, according to research conducted last year.

The UK's Department for Science, Innovation and Technology (DSIT) released a report from KPMG that concluded a major attack on the rail network could cost £1.8 billion for a one-week period of disruption.

The direct financial cost to Network Rail would, it concluded, cost around £123 million, with the cost to passengers due to delays adding up to about £281.3 million.

Notably, the impact on Gross Value Added (GVA) could be as much as £1.397 billion, representing approximately 2.8% of the UK’s weekly GDP and 0.05% of annual GDP.

FOLLOW US ON SOCIAL MEDIA

Security experts have urged organizations to take a more considerate approach to cyber awareness training after a Canadian health board sent emails to staff offering paid leave as part of a phishing test.

Ron Johnson, interim chief executive at Newfoundland and Labrador Health Services, apologized for the phishing test last week, admitting the emails were sent in poor taste.

“We acknowledge the approach taken in this particular exercise was not appropriate, and we sincerely apologize to employees, physicians, and union representatives,” he wrote.

The phishing simulation prompted backlash after being circulated to hundreds of employees, and has since prompted a review of future activities, Johnson added.

“We value the feedback and are reviewing how future awareness exercises are developed and communication,” he said.

“It is important they reflect employee and physician perspectives, as well as our organizational values to foster a respectful and supportive workplace culture.”

This isn’t the first time an organization has been forced into a U-turn after a controversial phishing test campaign.

As ITPro reported in late 2024, the University of California Santa Cruz (UCSC) was heavily criticized for a “tone deaf” campaign which used a fake Ebola virus track and trace alert.

The campaign caused a panic on campus and was highly convincing, even employing links to a fake webpage set up to support those affected by the “outbreak”.

Phishing tests are a vital part of cyber hygiene

While this particular incident sparked ire among employees, phishing tests are a common practice by cybersecurity professionals to ensure staff remain vigilant to potential security threats.

Phishing attacks, in particular, are a leading cause of breaches at organizations across a range of industries – and the healthcare sector specifically is a prime target for cyber criminals.

Add AI into the equation, and the threat landscape faced by enterprises today is becoming increasingly perilous, with threat actors using the technology to refine techniques and curate highly convincing emails.

Rob Anderson, head of reactive consulting services at Reliance Cyber, told ITPro that the “best phishing exercises are realistic” – after all, they are intended to emulate the tactics used by cyber criminals.

"They should use the same sneaky tactics that threat actors may use, hopefully triggering the trained, instinctive suspicion we want staff to develop when handling unexpected emails,” he said.

“However, there is a fine line. Nobody likes to be made a fool of, especially at sensitive times.”

Anderson pointed to a phishing exercise by one UK police force’s Information Protection Unit, which circulated emails targeting staff in a typical fashion. Those who fell foul were met with a message stating: “whoops, you’ve failed this training”.

In this instance, Anderson said the Information Protection Unit had “failed to read the room”.

“A week earlier, the force had announced a restructure, with likely compulsory redundancies and transfers,” he said. “Police officers can be a vocal and cynical bunch, and they made their feelings known.”

A delicate balancing act

It’s here that phishing tests often become a delicate balancing act, according to Simon McNalley, identity and access management (IAM) technical director at Thales.

Ultimately, cybersecurity professionals need to ensure that simulations are “realistic enough to reflect the tactics attackers use” without “exploiting goodwill”.

“Scenarios involving pay, bonuses, annual leave, personal hardship, or other highly sensitive employment matters should be approached with caution, as they risk damaging confidence in legitimate internal communications,” he told ITPro.

Anderson echoed McNally’s comments, adding that human resources (HR), communications, and senior leadership should be consulted before campaigns go live.

Ultimately, McNally said the NL Health Services incident should serve as an example to other organizations hoping to keep staff on their guard in light of rising threats.

“There is a place for phishing simulations as part of building cyber awareness, especially as attackers routinely use such techniques. However, it’s vital that these exercises do not come at the expense of trust between employer and employee. Trust is a critical component of security culture,” he said.

“If awareness programs leave employees feeling misled, embarrassed or manipulated, organizations risk undermining the very behaviors they are trying to encourage.”

FOLLOW US ON SOCIAL MEDIA

Cyber criminals are exploiting AI hype to impersonate the branding of AI platforms such as ChatGPT, Microsoft Copilot, DeepSeek, and Anthropic’s Claude, according to new research.

Microsoft Threat Intelligence said it's observed an uptick in phishing, malvertising, and search engine optimization (SEO)-driven attacks that ultimately lead to credential theft, financial fraud, or malware infection.

Campaigns focus on highly anticipated launches or emerging trends, using tried-and-tested tactics such as urgency-driven messaging, abuse of trusted services, and multi-stage redirection chains that require user interaction to evade detection.

"While traditional lures like invoices, payment notifications, or delivery alerts remain effective and continue to be widely used, AI-themed lures reflect a shift in social engineering that is likely to persist as a long-term tactic used by threat actors, from cyber criminal groups to nation states," the company warned.

ChatGPT users in the crosshairs

In one example, Microsoft said it had observed a ChatGPT-themed phishing attack delivering malicious URLs which led to phishing pages that collected credit card and personal information such as names and addresses.

The emails used the sender display name ChatGPT and the subject line: “To ensure your ChatGPT Plus continues to work – please update your payment method”.

This phishing activity, which consisted of 4,500 emails sent to targets in South Africa, was part of a broader campaign using similar themes and infrastructure that delivered as many as 100,000 emails on a single day to targets in Switzerland, Austria, and South Africa.

Microsoft noted the campaign affected a broad range of industries, including higher education and professional services.

Thousands targeted in a Claude-themed phishing attack

In another example, security experts spotted a phishing campaign impersonating Anthropic-branded services to target users with account-related lures tied to the Claude AI platform.

The campaign sent phishing emails to targets across more than 2,000 organizations, mainly in the US, UK, and India.

"The campaign used enforcement-themed messaging claiming that the recipient’s account was in violation of acceptable use policies and required immediate action," the company noted.

"The emails impersonated Anthropic’s popular AI service Claude using the display names Anthropic Teams and Anthropic PBC, masquerading as legitimate account-related communications. Subject lines followed a consistent structure of 'Claude Appeal Request' combined with date elements."

DeepSeek malvertising is a growing threat

Other examples included malvertising campaigns that use AI-themed terms such as 'Awesome AI Windows Plugin' and 'Flux Pro AI' in social engineering lures, and fake DeepSeek V4 installers on GitHub that delivered Vidar Stealer.

"Within hours of DeepSeek previewing their latest version, V4, attackers created a fake GitHub organization and repository. They copied real branding and benchmark data, added AI and SEO-search-friendly content, and pushed malicious archives that looked like installers," explained John Bruggeman, vCISO at CBTS.

"What the attacker did was not particularly exotic, but it was well timed and convincingly packaged. A user searching for the newest model could very easily end up in the wrong place, especially because the malicious repository showed up in GitHub, Google, Bing, or AI-assisted search results. The search results added legitimacy to the malware."

Remain vigilant

To counter these rising threats, Microsoft advised customers to configure automatic attack disruption in Microsoft Defender XDR, enforce multi-factor authentication (MFA) on all accounts, use the Microsoft Authenticator app for passkeys and MFA, and scope conditional access policies to strengthen privileged accounts with phishing-resistant MFA.

Other tips included:

• Enabling Zero-hour auto purge (ZAP) in Office 365
• Configuring Microsoft Defender for Office 365 Safe Links
• Invest in ‘advanced’ anti-phishing solutions

"The companies that have a handle on AI governance (policies and procedures) well will be the ones that make safe AI use easy, risky AI use visible, and malicious activity hard to ignore. That means publishing a clear list of approved tools, blocking obvious lookalike domains and very recently registered domains can help stop this kind of threat," said Bruggeman.

"Monitoring suspicious downloads and sign-ins, and training employees on the AI-themed lures should also be done right now - don't think that generic phishing examples from five years ago are going to cut it today."

FOLLOW US ON SOCIAL MEDIA

Microsoft has issued an alert over a large-scale credential theft campaign that uses lures centered around corporate codes of conduct.

The emails were related to internal compliance or regulatory issues, with display names such as 'Internal Regulatory COC', 'Workforce Communications', and 'Team Conduct Report'.

Subject lines included 'Internal case log issued under conduct policy' and 'Reminder: employer opened a non-compliance case log'.

The emails were sent using a legitimate email delivery service, likely originating from a cloud-hosted Windows virtual machine (VM).

The accusations and repeated time-bound action prompts created a sense of urgency, Microsoft researchers said. Similarly, the emails were based on polished, enterprise-style HTML templates with structured layouts and authenticity statements, making them appear more credible than most phishing emails.

The bodies of the messages claimed that a code of conduct review had been initiated, referenced organization-specific names embedded within the text, and instructed recipients to open a PDF attachment to see the materials of the case.

When clicked, users were first directed to one of two attacker-controlled domains - acceptable-use-policy-calendly[.]de or compliance-protectionoutlook[.]de.

The landing pages displayed a Cloudflare CAPTCHA, presented as checking that the user was coming 'from a valid session', and that likely served as a gating mechanism to impede automated analysis and sandbox detonation.

According to Microsoft, the attack chain ultimately led to a legitimate sign-in experience that formed part of an adversary in the middle (AiTM) phishing flow.

Unlike traditional credential harvesting, AiTM attacks intercept authentication traffic in real time, bypassing multifactor authentication (MFA).

As a result, the attackers were able to proxy the authentication session and capture authentication tokens that could provide immediate account access.

"Phishing campaigns continue to improve sophistication and refinement in blending social engineering, delivery and hosting infrastructure, and authentication abuse to remain effective against evolving security controls," the researchers warned.

What industries are affected?

Between 14 and 16 April this year, the Microsoft Defender Research team said it spotted a series of campaigns targeting more than 35,000 users across over 13,000 organizations in 26 countries. Most targets - 92% - were located in the US.

The campaign didn't focus on a single vertical but instead impacted a broad range of industries, most notably healthcare and life sciences (19%), financial services (18%), professional services (11%), and technology and software (11%).

Microsoft said organizations should review the recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 to check for essential defenses and the ability to monitor and respond to threat activity. They should also invest in user awareness training and phishing simulations.

Enabling Zero-hour auto purge (ZAP) in Defender for Office 365 is advised to quarantine sent mail in response to newly acquired threat intelligence. Users are also urged to retroactively neutralize malicious phishing, spam, or malware messages that have already been delivered to mailboxes.

It's also worth manually checking for, and purging, unwanted emails containing URLs and/or Subject fields that are similar, but not identical, to those of known bad messages.

Organizations should enable password-less authentication methods or use authenticator apps, researchers said, and strengthen privileged accounts with phishing resistant MFA.

FOLLOW US ON SOCIAL MEDIA

Security researchers have issued a warning over a “seismic shift” in how threat actors are conducting phishing campaigns, with traditional email-based attacks no longer the primary vector.

KnowBe4’s Phishing Threat Trends Report found hackers are leveraging new “touchpoints” when targeting victims, with calendar invites and messaging tools now frequently used.

Indeed, across the last year, the company recorded a 49% increase in calendar invite-based phishing attacks, while

Jack Chapman, SVP of Threat Intelligence at KnowBe4, said the report shows “the inbox is no longer the only frontline for coordinated social engineering attacks”.

“Cyber criminals are actively broadening the email threat landscape,” he said.

“As businesses rely on tools for real-time collaboration, cyber criminals have added this to their attacks, along with targeting people’s calendars. This attack method targets people and technology together. This escalation in scale of threat brings a whole new issue to the forefront.”

Microsoft Teams attacks are surging

KnowBe4 warned that threat actors are increasingly leveraging impersonation tactics when conducting phishing campaigns, with legitimate platform and brand names often used to dupe users.

The company recorded a 41% increase in Microsoft Teams-based attacks between October 2025 and March 2026, for example.

These attacks prey on the fact that Teams is “built for speed and informality”, researchers noted, with victims often forgoing security considerations when responding to communications.

“Attackers are banking on this perceived safety, turning our primary collaboration tool into their path of least resistance,” the report states.

Notably, the report warned Teams now forms a core component of “multi-channel” attacks. Nearly one-in-five (17.38%) of all Teams-based attacks are now multi-channel, the study found.

Email still remains the primary attack vector, yet the workplace collaboration platform allows threat actors to “extend the kill chain and create more avenues for success”.

In these cases, threat actors have been observed initiating contact with a victim via email communications, then following up with a message via Microsoft Teams.

This, the report noted, allows them to essentially validate their identity across different environments.

“These threats are particularly dangerous as Teams allows an attacker to communicate consistently with a victim over multiple messages,” the report explains.

“This enables them to build a rapport and a sense of legitimacy that is much harder to achieve through traditional channels.”

KnowBe4 attributed the surge in Teams-based attacks with the launch of the “Chat with Anyone” feature, which allows users to initiate chats using an email address.

Teams is also a go-to platform for threat actors impersonating company personnel, the report found, with a host of roles and professions often impersonated. These include:

• IT professionals
• Human resources professionals (and platforms such as Workday)
• CEOs and company executives
• Finance personnel

“Social engineering is becoming more targeted, making it more difficult to discern what is legitimate versus what is malicious,” said Chapman.

FOLLOW US ON SOCIAL MEDIA

Security experts have issued a warning about the continued risk of Tycoon 2FA attacks, even after a law enforcement operation took down the phishing as a service (PhaaS) platform last month.

According to Barracuda, while attacks have since dropped by 77%, they still persist, with more than two million taking place each month.

Before the takedown, Tycoon 2FA was behind tens of millions of phishing messages, reaching over 500,000 organizations each month worldwide.

First spotted in August 2023, it used adversary in the middle (AitM) proxying to bypass traditional multi-factor authentication (MFA) and capture session cookies in real time, leading to large-scale account compromise.

It was linked to more than 96,000 distinct phishing victims globally, including more than 55,000 Microsoft customers and around 5,350 in the UK, hitting sectors including education, healthcare, finance, and the public sector.

The takedown last month saw Microsoft seize 330 domains forming the core infrastructure of the criminal service, including phishing pages and control panels.

Yet Barracuda said its analysis shows the impact of the takedown has been largely restricted to Tycoon’s own brand name and visibility, along with a drop in the use of Tycoon-linked hosting and domain patterns.

"The ‘body’ of Tycoon: its tools and techniques, live on. They have migrated, been redistributed and diversified across competing platforms, or simply left where they are,” the company said in a blog post.

Pouncing on the Tycoon 2FA takedown

Notably, Barracuda found that other phishing kits have moved quickly to take Tycoon 2FA's place, with increased campaign activity involving the established platforms of Mamba 2FA and EvilProxy, as well as aggressive newcomers such as Sneaky 2FA and Whisper 2FA.

These kits have boosted their feature sets and infrastructure maturity, according to Barracuda, often leveraging tools formerly used by Tycoon 2FA.

"Tycoon 2FA was widely used by independent affiliates. This means that variants of Tycoon 2FA’s attack code that have been cloned or modified by individual adversaries continue circulating. It also means that independently hosted deployments remain active and that fragmented, low-volume campaigns persist," the firm said.

"For example, Barracuda recently detected a ‘device code’ phishing campaign that leveraged Tycoon’s stand-out features. Code similarities included Tycoon’s signature ‘noise’ of motivational style comments. In this incident, the comments all begin with the word ‘success’."

This campaign also featured Tycoon 2FA’s unique anti-analysis, anti-debugging and redirection capabilities.

Tycoon 2FA is still alive and kicking

Barracuda said the reasons for Tycoon 2FA’s persistence include the fact that attackers have reused and repurposed phishing code.

Meanwhile, attack domains remain active until expiry, backup hosting often evades immediate seizure, and some low-visibility phishing campaigns fall beneath alert thresholds.

Phishing frameworks have built-in redundancy, researchers noted, while the disruption of infrastructure doesn't necessarily revoke victim access.

Stolen session cookies may remain valid, OAuth abuse can enable extended cloud access, and organizations may remain compromised after the end of the phishing campaign.

"This does not mean the takedown operation failed. Rather, it shows what happens when disruption hits a maturing underground economy, and why security defenses need to look more broadly than individual players," said Barracuda.

"The Tycoon 2FA takedown accelerated ecosystem diversification. Defensive strategies therefore need to focus on models for identity-based attacks, session abuse and adversary economics. Tycoon 2FA as a branded service has declined, but the techniques it popularized are now more widely distributed than before."

Cyber crime whack-a-mole

Barracuda’s findings highlight a painful recurring theme for law enforcement agencies tackling cyber crime – these operations are very hard to kill outright.

While takedowns cripple infrastructure and hamper operations for a time, many groups simply dust themselves off and get back to it, and often in a far more aggressive way.

There have been repeated instances of cyber crime operations coming back from the dead in recent years despite hard crackdowns by industry stakeholders and law enforcement agencies.

Emotet ranks among the best examples of this. The botnet was used to facilitate an eye-watering volume of attacks over its lifespan before being taken down by a Europol-led operation in January 2021.

Less than a year later, however, the botnet was back up and running, with Analysis from November 2022 showing the cyber criminals behind the operation ramped up attacks to record levels.

Of course, that’s not to say law enforcement should just down tools and stop trying. The impact of these takedowns may have a limited shelf life, but they do provide a temporary reprieve for victims and deliver long-term benefits.

As ITPro reported in the wake of the RAMP hacking forum takedown last year, they enable law enforcement to gain vital intelligence on how these groups work and support other operations further down the line.

This cat and mouse game between hackers and law enforcement is as old as cyber crime itself, and shows no signs of slowing down.

FOLLOW US ON SOCIAL MEDIA

Oil and gas firm Zephyr Energy has reported that one of its US subsidiaries has suffered a cyber intrusion that allowed the attackers to siphon off hundreds of thousands of pounds.

The London-headquartered company said the incident saw a contractor payment diverted to an account controlled by threat actors. The company confirmed around £700,000 was lost in the incident.

"Upon discovery of the incident, the company immediately notified the relevant law enforcement authorities and is working with the corresponding banks and consultants to attempt to recover the diverted funds," the company said in a regulatory filing with the London Stock Exchange.

Zephyr noted that the incident has been contained and IT systems have been thoroughly assessed by a leading cybersecurity consultancy.

Operations and corporate activities are continuing as normal, but its own internal IT teams are keeping a close eye on company systems.

"While Zephyr uses industry standard practices in relation to its technology and payment systems, additional layers of security have been implemented as a result of this attack," it added.

"The company's board of directors can confirm that the company has more than sufficient working capital to ensure that this isolated matter will not impact the company's ability to perform its ongoing operations."

Zephyr Energy attack: What happened?

There's no information on how the attack actually took place, but it has all the hallmarks of a business email compromise (BEC) incident.

Via phishing campaigns, hackers typically gain access to email inboxes or accounting systems that enables them to change bank details during payment or invoice processing, in what's known as an adversary in the middle (AiTM) attack.

Earlier this year, Microsoft warned that AiTM campaigns targeting cloud collaboration platforms such as Microsoft SharePoint and OneDrive were on the rise.

The tech giant specifically highlighted energy companies among those at highest risk of targeting.

At the time, Microsoft’s Defender Research Team said attackers were abusing SharePoint file sharing services to deliver phishing payloads, and had succeeded in compromising a number of accounts.

In terms of mitigation, because the sign-in session is compromised, simply resetting passwords doesn't work. The company outlined a series of steps that organizations should take to mitigate risks, including:

• Using conditional access policies, especially risk-based access policies
• Implementing continuous access evaluation
• Investing in advanced anti-phishing solutions
• Continuous monitoring for suspicious or anomalous activities

FOLLOW US ON SOCIAL MEDIA

AI-generated phishing “became the baseline” for cyber crime operations last year, according to new research from Kaseya.

Findings from the company’s annual report on email security highlight how quickly hackers have managed to take advantage of generative AI models across operations.

The study showed 2025 was an "inflection point" for phishing and AI, with malicious emails now generated by AI by default. That fits with a previous report from Google that hackers are trying to use its Gemini model to augment their attacks.

Kaseya pointed to industry research that showed 83% of phishing emails use AI content in some way, with 40% of business email compromise (BEC) attacks using generative AI in some capacity.

The results aren’t surprising, according to Kaseya, especially given AI-generated phishing emails have a 54% click rate, versus 12% for standard malicious messages.

That's in part down to attacks that react to current events, better formatting and grammar, and personalized messaging, the report noted.

“In the past year, AI-generated phishing became the baseline,” said Dave Baggett, SVP of Security Suite at Kaseya. “Attackers can now produce highly convincing messages at scale, which means the traditional signals security tools relied on for years — bad grammar, suspicious domains, obvious links — are disappearing."

Harder to defend

Baggett warned that AI-generated phishing campaigns are presenting security practitioners with new challenges, particularly with regard to detection.

“Defenders now have to evaluate intent and context, not just indicators,” he said.

Indeed, the report notes that AI tools mean attackers can ditch templates that lead to detectable repetition, meaning spam-spotting systems have to work harder to filter out phishing messages.

The plus side for enterprises is that AI-powered tools are helping take the fight to cyber criminals. New detection models, contextual understanding, and other AI-powered techniques are helping security teams respond rapidly.

"The next phase of email security will not be defined by filtering alone, but by AI systems capable of analyzing messages holistically and adapting continuously as tactics evolve," the report predicted.

Staying ahead of the curve remains a challenge, however. IBM warned last year that AI adoption is outpacing AI security, and TrendMicro spotted that hackers were using AI to read through intelligence reports to help better target their attacks.

Phishing losses are skyrocketing

The report noted that 26% of cyber crime complaints filed to the FBI were down to phishing, adding that while losses from ransomware had fallen 79%, the costs from phishing climbed by 275% from $18.7 billion to $70 billion annually.

Kaseya said this wasn't because ransomware was disappearing, but because companies were getting better at responding and had improved their backup strategies.

"Instead, it reflects a strategic shift: attackers are increasingly applying phishing and business email compromise (BEC) schemes as lower-risk, high-return alternatives to disruptive encryption-based attacks," the report said.

Eight-in-ten of these attacks target small and medium-sized businesses (SMBs) rather than larger counterparts, the company noted, with an average loss per incident of $50,000 for SMBs.

Brand impersonate is still a go-to for hackers

Attackers continue to use brand impersonation to fool victims – styling their malicious emails to look like they came from major companies or the government, for example. INKY detected 6.7 billion brand impersonation emails in the second half of 2025, with the vast majority – more than 5.3bn – from just 25 well-known brands.

Kaseya found that no-payload phishing was increasingly common, with these brand impersonation emails no longer including dodgy links or malicious attachments. In their place, they offer phone numbers, try to trick victims into hitting reply, or use QR codes.

"These techniques reduce detectable indicators while increasing reliance on user decision-making," the report noted.

While phishing dominates the fraud universe, Kaseya also pointed to the rise of new techniques including call centers and emergency scams.

"These figures reflect a broader shift toward social engineering-driven fraud – scams that exploit urgency, fear and trust rather than technical vulnerabilities," the report notes.

"Many of these schemes begin or are supported by phishing-based email campaigns."

FOLLOW US ON SOCIAL MEDIA

Interpol has taken down more than 40,000 malicious IP addresses and servers as part of an international cyber crime operation targeting phishing, malware and ransomware activities.

Law enforcement bodies from 72 countries and territories took part in Operation Synergia III between July 2025 and the end of January this year, with 94 people arrested and another 110 still under investigation.

In all, 45,000 malicious IP addresses were taken down and 212 electronic devices and servers were seized.

“Cyber crime in 2026 is more sophisticated and destructive than ever before, but Operation Synergia III stands as a powerful testament to what global cooperation can achieve," said Neal Jetton, director of Interpol's Cybercrime Directorate.

"Interpol remains at the forefront of this fight, uniting law enforcement agencies and private sector experts to dismantle criminal networks, disrupt emerging threats and protect victims around the world.”

As investigations are still ongoing, some details are under wraps. However, the results include the identification of more than 33,000 phishing and fraudulent websites in Macau, China, related to fake casinos and critical infrastructure, such as official bank, government and payment service sites.

Victims are defrauded by topping up their accounts via the fraudulent sites, or by having their personal information and credit card details stolen.

Police in Togo, meanwhile, arrested 10 suspects operating a fraud ring from a residential area. Some specialized in technical crimes such as hacking social media accounts while others carried out social engineering schemes including romance scams and sextortion.

In Bangladesh, police arrested 40 suspects and seized 134 electronic devices related to a wide range of cyber crime schemes, including loan and job scams, identity theft, and credit card fraud.

Hot on the heels of Tycoon 2FA takedown

The operation follows the disruption last week of the the massive phishing as a service (PhaaS) platform, Tycoon 2FA.

This saw threat actors use adversary in the middle (AitM) proxying to bypass traditional multi-factor authentication (MFA) and capture session cookies in real time, leading to large-scale account compromise.

In an international operation, 330 domains were seized, including parts of the core infrastructure, such as phishing pages and control panels.

Much like that action, Operation Synergia III was carried out in collaboration with a number of private sector organizations, including Trend Micro.

“This kind of international operation highlights the value of close collaboration between law enforcement and the cybersecurity community. Behind every malicious server or phishing kit sits a wider criminal ecosystem that needs to be mapped and understood before arrests become possible," said Robert McArdle, director of cybercrime research at Trend Micro business unit TrendAI.

"Our support for investigations such as Tycoon 2FA, and contributions to operations like this one led by Interpol, demonstrates how actionable threat intelligence can help authorities identify infrastructure, connect actors and disrupt cyber criminal networks at scale.”

FOLLOW US ON SOCIAL MEDIA

North Korean threat groups are using AI to ramp up efforts to infiltrate western companies with fake employees, according to new research.

Analysis from Microsoft’s Threat Intelligence Team shows three groups – Jasper Sleet, Sapphire Sleet, and Coral Sleet (formerly Storm-1877) – are using voice-changing software during remote interviews to disguise their accents and make their cover stories more convincing.

They're also using the AI app Face Swap to place their faces in stolen identity documents and generate convincing headshots for CVs.

"Threat actors are using AI to shortcut the reconnaissance process that informs the development of convincing digital personas tailored to specific job markets and roles," Microsoft warned in a blog post.

"Jasper Sleet leverages generative AI platforms to streamline the development of fraudulent digital personas. For example, Jasper Sleet actors have prompted AI platforms to generate culturally appropriate name lists and email address formats to match specific identity profiles."

The groups are also using AI to search job postings on jobs platforms such as Upwork, then using AI to make their applications meet the jobs' skill requirements.

This includes generating realistic names, email formats, and social media handles using AI prompts, writing AI-assisted resumes and cover letters, creating fake developer portfolios using AI-generated content, and using AI-enhanced images to create professional-looking profile photos and forged identity documents.

Microsoft noted that these personas are used across multiple job applications and platforms.

Voice cloning and agentic AI are in vogue

Elsewhere, Microsoft warned threat groups are using AI-generated voice cloning to impersonate executives or trusted individuals in vishing and business email compromise (BEC) scams

Once the fake workers are inside an organization, they use AI-enabled communications to support daily tasks and fit in with role expectations.

"For example, Jasper Sleet uses AI to help sustain long-term employment by reducing language barriers, improving responsiveness, and enabling workers to meet day-to-day performance expectations in legitimate corporate environments," Microsoft noted.

"Threat actors are leveraging generative AI in a way that many employees are using it in their daily work, with prompts such as 'help me respond to this email', but the intent behind their use of these platforms is to deceive the recipient into believing that a fake identity is real."

With the advent of agentic AI, Microsoft warned threat actors are also flocking to powerful new tools.

The tech giant’s threat intelligence team observed groups using agents to create semi‑autonomous workflows that help refine phishing campaigns, test and adapt infrastructure, maintain persistence, or monitor open source intelligence for new opportunities.

North Korean hackers are prolific

The problem of North Korean fake workers just won't seem to go away. While this trend primarily affected US companies, Google warned last summer that threat groups are now expanding campaigns to target European organizations.

Last month, Security Alliance (SEAL) warned that North Korean hackers are hijacking genuine LinkedIn profiles to apply for remote jobs and infiltrate enterprises.

Hackers typically use real identities, leveraging verified workplace emails and identity badges, and constructing credible employment histories to pass background checks.

Organizations are advised to tighten up their identity verification processes, including document checks and, wherever possible, in-person interviews.

FOLLOW US ON SOCIAL MEDIA

LastPass customers are again being targeted by phishing emails that appear to be forwarded internal messages.

In a customer advisory, the password manager firm warned emails are being sent from several email addresses, with various subject lines, claiming there has been unauthorized access to individuals’ accounts.

"This is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails," the company warned.

The fake email chains are intended to make it appear as though another individual is trying to take unauthorized action on their LastPass account - for example, exporting vaults, attempting full account recovery, or registering a new trusted device.

Attackers use display name spoofing as part of the attack so that the name portion of the sender field appears to be LastPass, while the actual sending email address is unrelated.

This can fool recipients, LastPass warned, as many email clients, especially mobile, show only the display name while the complete sender address is shown if it's expanded.

What LastPass users need to know

The emails ask the recipient to take action such as reporting suspicious activity, disconnecting and locking the vault, or revoking a device, via included links - links that direct the targets to fake Single Sign-On (SSO) pages that then collect their credentials.

"At the center of the phishing chain is the domain https[:]//verify-lastpass[.]com," said LastPass.

"Most malicious links redirect to this domain, but the attackers generate many slightly modified versions by adding different trailing numbers. This lets them produce a large set of URLs that all resolve to the same phishing page."

The emails originate from several addresses, including:

• office@hancochem.at
• admin@salud5i.cl
• no_reply@remstal-praxis.de
• demo@fluxstore.io
• no_reply@kreducationsa.com
• support@yodhafinance.com
• hr@bebran.com
• info@itpbusa.com

Subject lines include "Re: the details", "Re: pending approval", "Re: Access request pending", "Re: FYI", "RE: sign-in — TRZ-2302300", "Fwd: Re: your request" and "Re: credential download".

LastPass emphasized that it will never ask for their master password and said it is working with its third-party partners to have the offending sites taken down as soon as possible.

LastPass users face an array of threats

This is the second phishing campaign against LastPass users in the space of two months, highlighting the range of threats faced by customers.

In January, for example, fraudulent emails were distributed to users claiming that the site was due to undergo maintenance.

That particular campaign urged customers to back-up vaults within 24 hours, and some received phone calls from the scammers aimed at increasing pressure.

In October last year, another campaign used similar tactics, claiming that the company had been hacked.

FOLLOW US ON SOCIAL MEDIA

Credentials stolen from a single government official enabled threat actors to access a French national database containing data on more than 1.2 million bank accounts.

The attackers were able to access the Fichier des comptes bancaires (Ficoba) database, which contains files on all bank accounts opened in France.

Stolen credentials were used by the threat actors to impersonate a civil servant and view data that included personal information such as bank account numbers, account holders' names and addresses, IBANs, and, in some cases, the account owner's tax number.

"Starting at the end of January 2026, a malicious actor, who had impersonated a civil servant with access rights as part of an inter-ministerial information exchange, was able to consult a portion of this file," Ficoba said in a statement.

"As soon as this incident was detected, immediate access restrictions were implemented to stop the attack, limit the scope of the data accessed and extracted from this database – which reportedly includes 1.2 million accounts – and prevent any further unauthorized access."

Ficoba said IT teams at the French Public Finances Directorate, along with other bodies, were working to address this incident and strengthen security. The incident has also been reported to the French Data Protection Authority (CNIL), it said.

The chief of France's Public Finances told Agence France-Presse that affected individuals will be contacted over the next few days. Officials insisted the breach did not give attackers access to account balances or transactions.

FICOBA breach prompts phishing frenzy

Security researchers at Cybernews said that this may not be the full story. While account balances can’t be accessed from this data alone, this incident “still poses risks” to users across the country.

“Exposed PII, such as names and addresses, can be combined with other leaked data to profile people and construct convincing phishing campaigns that can pose as the national bank.”

When combined with tax identification numbers, researchers said this increases the risk of fraud and identity theft, as these numbers can be used as identifiers on government platforms.

Ficoba has warned that "numerous" scams are circulating via email or SMS, aiming to obtain information or payments from users.

Individuals contacted have been urged not to reply directly, and should instead contact their local tax office directly through the secure messaging system in their online account or by phone to check out the authenticity of the message.

Meanwhile, Michael Jepson, penetration testing manager at CybaVerse, said it's worrying that a single individual within the organization was able to access large volumes of sensitive data unilaterally.

"Traditionally, access scope often increased with seniority, an approach that is now widely recognized as problematic in modern threat environments," he said.

"Modern security practice recognizes that access should be determined strictly by operational need rather than hierarchy. Senior figures are frequently primary targets for threat actors, which makes excessive privilege particularly dangerous."

FOLLOW US ON SOCIAL MEDIA

Researchers at Abnormal Security have uncovered a new phishing kit that proxies live login pages, bypasses MFA, and includes a full credential-harvesting platform for a monthly fee.

While most phishing kits rely on static HTML clones of login pages, these are inherently fragile, as even minor interface updates from the impersonated brand can reveal the deception immediately.

However, a new framework called Starkiller – not to be confused with the legitimate BC-Security red team tool of the same name – does things differently.

"Sold openly as a commercial-grade cybercrime platform by a threat group calling itself Jinkusu, Starkiller is distributed like a SaaS product," said Abnormal.

"It launches a headless Chrome instance — a browser that operates without a visible window — inside a Docker container, loads the brand’s real website, and acts as a reverse proxy between the target and the legitimate site."

How Starkiller works

Cyber criminals select a brand to impersonate; for example, Google, Microsoft, Facebook, Apple, Amazon, Netflix, PayPal, and various banks.

Because the recipients are served genuine page content directly through the attacker's infrastructure, the phishing page never goes out of date. Similarly, as Starkiller proxies the real site live, there are no template files for security vendors to fingerprint or blocklist.

Researchers found that Starkiller's control panel gives cyber criminals a polished dashboard for deploying phishing campaigns, and the core workflow requires almost no technical skill.

Docker engine status, image builds, and active containers are managed from the same panel, meaning threat actors don't need to understand reverse proxies or certificate management to launch an attack.

An attacker enters a brand’s real URL, and the platform spins up a Docker container running a headless Chrome instance that loads the real login page.

The container then acts as a man-in-the-middle reverse proxy, forwarding the end user’s inputs to the legitimate site and returning the site's responses.

"Every keystroke, form submission, and session token passes through attacker-controlled infrastructure and is logged along the way," the researchers said.

Keeping tabs on victims

Notably, the package offers real-time session monitoring, allowing attackers to watch the target interact with the phishing page live.

Along with keylogger capture for every keystroke, it includes cookie and session token theft for direct account takeover, geo-tracking of targets, and automated Telegram alerts when new credentials come in.

Because the end user is actually authenticating with the real site through the proxy, any one-time codes or authentication tokens they submit are forwarded to the legitimate service in real time.

Capturing the resulting session cookies and tokens gives the attacker authenticated access to the account. This means that MFA protections can effectively be neutralized, despite functioning exactly as designed.

Jinkusu maintains a community forum where cyber criminals discuss techniques, request features, and troubleshoot deployments.

"The forum shows an active user base sharing operational tips and asking about mobile support, indicating a growing pool of operators using the framework in the wild," the researchers said.

"Operators also receive dedicated support via Telegram, monthly framework updates, and documentation. The level of ongoing development means Starkiller is likely to become increasingly difficult to detect and defend against."

How to avoid falling prey

Traditional detection approaches such as static page analysis, domain blocklisting, and reputation-based URL filtering don't work, as Starkiller dynamically generates phishing pages for each session.

Instead, Abnormal said detection needs to shift toward behavioral signals such as anomalous login patterns and session token reuse from unexpected locations.

Elsewhere, identity-aware analysis needs to be improved to catch a compromised session - even when the phishing page itself looks perfect.

FOLLOW US ON SOCIAL MEDIA

State-backed threat actors from CRINK nations have come to rely on large language models (LLMs) as “essential tools” for researching and targeting victims, according to a new report.

The latest AI Threat Tracker report from Google Threat Intelligence Group (GTIG), produced in collaboration with Google DeepMind, details the numerous ways threat groups are already using AI to plan and carry out attacks.

Advanced persistent threat (APT) groups were tracked using Google’s own Gemini family of models to conduct targeted research on potential victims, probe vulnerabilities, and create tailored code and scripts.

For example, the China-based APT Temp.HEX was found using Gemini to file information on individual targets in Pakistan.

The as-yet-unattributed APT UNC6148 also used Gemini to seek out sensitive information tied to victims, such as email addresses and account details, as the first step in a targeted phishing campaign on Ukraine and the wider defense sector.

In response, Google disabled the assets associated with both groups. Other incidents saw attackers use public AI models to more directly fuel attack campaigns.

Iranian-backed groups such as APT42 were observed using Gemini and other AI models to research potential victims, then craft convincing phishing emails based on target biographies.

That same group was observed using Gemini to translate local languages as well as regional references and phrases.

North Korea-backed groups seized headlines throughout 2024 and 2025, as hackers infiltrated IT departments of major organizations including KnowBe4 with fake addresses and identities.

In the report, the North Korean-backed group UNC2970 was found using Gemini to plan attacks on cybersecurity defense companies and map job specifications.

AI-enhanced malware is gathering steam

The report also noted the growing risk presented by malware that uses AI to achieve novel capabilities such as preventing network detection.

HONESTCUE malware, for example, has been found to use API calls to Gemini to generate ‘stage two’ code. This is used to download and execute additional malware directly in the memory of target systems using CSharpCodeProvider, a legitimate .NET class for executing C# code.

Because the Gemini-produced code executes the secondary malware directly in memory, HONESTCUE infects target systems without leaving telltale artifacts on the victim’s disk.

Though the malware hasn’t been linked to specific attack campaigns to date, GTIG researchers said they believe its developer is a single threat actor or small group testing the waters for future attacks. This is backed up by evidence HONESTCUE has been tested on Discord.

Another example can be found in COINBAIT, a phishing kit created by the APT UNC5356 that shows signs of having been created using the vibe coding platform Lovable.

GTIG has previously warned that while AI malware is still nascent, it’s developing quickly. In the latest report, authors noted that while no “paradigm shift” has yet been unlocked by APTs, their exploration of malicious AI is ongoing and the technology will play a growing role in every stage of the attack lifecycle.

On the other hand, researchers discovered that threat actors are passing off jailbroken public AI models as handmade offensive tools.

For example ‘Xantharox’, a dark web toolkit advertised as tailor-made offensive AI toolset, is actually powered by open source AI tools such as Crush and Hexstrike AI via model context protocol (MCP), as well as public AI models like Gemini.

Threat actors are stealing API keys to enable this hidden activity, with GTIG warning organizations with cloud and AI resources are at risk. Users on platforms such as One API and New API, often those in countries with regional AI censorship, are also targeted for API key harvesting.

Model extraction puts AI developers at risk

Researchers also observed instances of APTs performing ‘model extraction’, in which attackers use legitimate access to frontier models such as Gemini to help train new AI and machine learning (ML) models.

Generally, attackers use an approach known as knowledge distillation (KD) in which a ‘student’ AI model is trained on the answers to specific questions based on the exemplar answers of the pre-existing AI model.

This can result in models with advanced capabilities such as frontier reasoning but none of the guardrails present in public AI models like Gemini. In the future, threat actors could then use

GTIG tracked over 100,000 prompts intended to expose and replicate Gemini’s reasoning capabilities in non-English languages, which were automatically counteracted by Google’s systems.

“Google’s latest AI Threat Tracker marks a specific turning point: we are no longer just worried about bad prompts, but the industrial-scale extraction of the models themselves,” wrote Jamie Collier, lead advisor in Europe at Google Threat Intelligence Group, in a LinkedIn post marking the launch of the report.

Google DeepMind and GTIG blocked attempts at model extraction throughout 2025, noting that the attacks were launched by private companies and researchers around the world rather than APTs.

Distilling secondary models from Gemini is a violation of Google’s terms of service and is considered theft of intellectual property (IP). The hyperscaler recommended organizations that provide AI models as a service should closely observe API access for signs of model extraction.

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have warned Substack users to be on the lookout for potential phishing scams after the blogging platform suffered a data breach.

In an email distributed to users, CEO Chris Best revealed a “security incident” saw account email addresses, contact numbers, and “other internal metadata” exposed.

Exact details on how the breach unfolded are yet to be disclosed. However, on 3 February, the organization discovered an issue that allowed an unauthorized third-party to “access limited user data.”

A preliminary investigation found the data was first accessed in October 2025, Best added.

“Importantly, credit card numbers, passwords, and financial information were not accessed,” the email reads.

“We have fixed the problem with our system that allowed this to happen. We are conducting a full investigation and are taking steps to improve our systems and processes to prevent this type of issue from happening in the future.”

Substack hasn’t revealed information on the scale of the breach. However, reports from BleepingComputer suggest the incident could have impacted over half a million users.

On Monday 2 February, a threat actor uploaded a database to BreachForums allegedly containing 697,313 stolen records.

Substack users should remain vigilant

Best noted that there is currently no evidence that information exposed in the breach is being misused, but nonetheless warned users to remain vigilant.

“We encourage you to take extra caution with any emails or text messages you receive that may be suspicious,” he said.

That same advice has since been reiterated by cybersecurity experts. Phishing attacks are a common occurrence in the wake of a data breach as cyber criminals look to capitalize on contact information to dupe unsuspecting users.

This information often represents a goldmine for threat actors, according to Jamie Akhtar, CEO of CyberSmart.

“While Substack has stated that sensitive data such as passwords and payment information was not accessed, exposure of contact details like email addresses and phone numbers can still be highly valuable to cyber criminals,” he said.

“This type of data is often used as the foundation for targeted phishing, impersonation attempts, and wider social engineering campaigns.”

Javvad Malik, lead security awareness advocate at KnowBe4, echoed Akhtar’s comments, but noted that the information provided by Substack is limited, which could still leave some users at risk.

“It is a bit light on the details which can help people accurately judge the risk and take concrete action,” he said. The timeline is significant. If the data was accessed in October 2025, but only just disclosed, it's a significant dwell time.”

“That isn't to say there's negligence on part of Substack because detection can be difficult,” Malik added. “But impacted users deserve a clearer explanation of how the breach was identified.”

FOLLOW US ON SOCIAL MEDIA

Google Threat Intelligence Group (GTIG) has identified a group with all the hallmarks of ShinyHunters using voice phishing (vishing) and fake credential harvesting websites to steal sensitive data.

In an advisory, the tech giant warned the group primarily gains access to corporate environments by obtaining single sign-on (SSO) credentials and multi-factor authentication (MFA) codes.

Once inside, the attackers target cloud-based SaaS applications to exfiltrate sensitive data and internal communications that they can use in subsequent extortion demands.

Google is currently tracking the activity under several threat clusters, including UNC6661, UNC6671, and UNC6240.

Last month, for example, UNC6661 pretended to be IT staff and called employees at targeted organisations, claiming that the company was updating MFA settings.

The threat actor then directed employees to victim-branded credential harvesting sites to capture credentials and MFA codes, with victims thereafter registering their own device for MFA.

According to Google, threat actors moved laterally through victim customer environments to exfiltrate data from various SaaS platforms.

While the attacks are targeted, analysis suggests that subsequent access is probably opportunistic, determined by the specific permissions and applications accessible via the individual compromised SSO session. Google stressed that the activity isn't the result of a security vulnerability in vendors' products or infrastructure.

"In some cases, they have appeared to target specific types of information. For example, the threat actors have conducted searches in cloud applications for documents containing specific text including 'poc', 'confidential', 'internal', 'proposal', 'salesforce', and 'vpn' or targeted personally identifiable information (PII) stored in Salesforce," researchers said.

"Additionally, UNC6661 may have targeted Slack data at some victims' environments, based on a claim made in a ShinyHunters-branded data leak site (DLS) entry."

Valuable intelligence

Cory Michal, CSO at AppOmni, praised the level of operational detail in the report, and particularly the volume and specificity of indicators of compromise that weren’t previously public.

This intelligence could prove vital for organizations that find themselves in the crosshairs moving forward, Michael noted.

“Publishing concrete domains, tooling names/artifacts, and workflow-level signals gives defenders something they can deploy immediately at scale (email/web filtering, OAuth/app controls, identity telemetry detections, and retro-hunting),” he said.

“It helps the ecosystem disrupt infrastructure and tradecraft faster by enabling consistent blocking and takedown actions across many organizations rather than each team rediscovering the same indicators in isolation.”

What can enterprises do to protect themselves?

Google has published guidance on hardening, logging, and detection against the threats.

Organizations responding to an active incident should focus on rapid containment steps, such as severing access to infrastructure environments, SaaS platforms, and the specific identity stores typically used for lateral movement and persistence.

Long-term defense, meanwhile, requires a transition toward phishing-resistant MFA, such as FIDO2 security keys or passkeys, which are more resistant to social engineering than push-based or SMS authentication.

“Companies should treat this as both a hunt and prevent problem: First, take the IoCs in the report and run them through your detection-and-response workflows (SIEM/SOAR, email security, web proxy/DNS, EDR, and SaaS audit logs) to identify any historical or active exposure," Michal added.

Michael added they should add continuous monitoring for look-alike domain registrations that incorporate their company name or common brands that they use for login, support, and HR.

"In many of these campaigns, those newly registered domains are a leading indicator, they show up before the first vishing call, so catching and blocking them early (and tightening your help desk/MFA enrollment controls in parallel) can meaningfully reduce the chance the intrusion ever gets to the “mass download and extortion” stage,” he said.

FOLLOW US ON SOCIAL MEDIA

Organizations are being warned to look out for a new phishing technique, in which LLMs are used to assemble the attack at the moment of execution in the victim's browser.

The method, said Palo Alto Networks, involves a seemingly benign webpage using client-side API calls to trusted LLM services to generate malicious JavaScript dynamically in real time.

By using carefully engineered prompts to bypass AI safety guardrails, attackers could trick the LLM into returning malicious code snippets via the LLM service API. These are then assembled and executed in the victim's browser at runtime, resulting in a fully functional phishing page.

The technique is designed to be evasive. The malicious content is delivered from a trusted LLM domain, bypassing network analysis, and assembled and executed at runtime.

Similarly, the code for the phishing page is polymorphic, so there’s a unique, syntactically different variant for each visit.

"The dynamic nature of this attack in combination with runtime assembly in the browser makes it a formidable defense challenge," said the Palo Alto researchers.

"This attack model creates a unique variant for every victim. Each malicious payload is dynamically generated and unique, transmitted over a trusted domain."

How the technique works

The proof of concept involved selecting a webpage from an active phishing campaign to use as a model for the malicious code. From there, attackers can create JavaScript code snippets that will be generated in real time to dynamically render the final page displayed to the user.

The next step involved crafting prompts describing the JavaScript code's functionality to the LLM in plain text. These could be iteratively refined, generating malicious code that bypasses existing LLM guardrails.

These generated snippets could differ in both structure and syntax, allowing attackers to create polymorphic code with the same functionality.

Attackers could embed these engineered prompts inside a webpage, which would load on the victim's browser. The webpage then uses the prompt to request a popular, legitimate LLM API endpoint to generate malicious code snippets.

Ultimately, these snippets could be transmitted over popular, trusted domains to bypass network analysis. Subsequently, these generated scripts could be assembled and executed to render malicious code or phishing content.

LLM guardrails at breaking point

This scenario, said the researchers, signals a critical shift in the security landscape: while detecting these attacks is possible through enhanced browser-based crawlers, it ​​requires runtime behavioral analysis within the browser.

"Defenders should also restrict the use of unsanctioned LLM services at workplaces. While this is not a complete solution, it can serve as an important preventative measure," the researchers said.

"Finally, our work highlights the need for more robust safety guardrails in LLM platforms, as we demonstrated how careful prompt engineering can circumvent existing protections and enable malicious use."

FOLLOW US ON SOCIAL MEDIA

A new phishing campaign is abusing trusted collaboration platforms like Microsoft Teams to bypass traditional email security.

Cybersecurity researchers at Check Point have discovered more than 12,000 malicious emails sent to over 6,000 users, most of which use legitimate Microsoft Teams guest invitations to impersonate billing alerts and trick victims into calling fake support lines.

Rather than relying on malicious links or attachments, attackers are exploiting built-in guest invitation options and finance-themed team names to dupe users with fake billing and subscription notifications.

The attacker starts off by creating a new team in Microsoft Teams and assigning it a finance-themed name designed to resemble an urgent billing or subscription notice.

One example given by Check Point researchers read: “Subscription Auto-Pay Notice (Ivoice ID: 2025_614632PPOT_SAG Amount 629. 98 USD). If you did not authorize or complete this m0nthly Payment,plese c0ntact our support team urgently.”

The aim here for attackers is to bypass automated detection by embedding obfuscation techniques in the team name. This includes character substitutions, mixed Unicode characters, visually similar glyphs, and the like.

After creating the team, the attacker uses the Invite a Guest feature in Microsoft Teams, sending the victim an email invitation from a legitimate Microsoft address, with the fake team name displayed prominently in large font.

"At first glance, the message appears to be a genuine Microsoft-generated notification, increasing the likelihood that users trust the content and follow the instructions," the researchers warned.

Recipients are then asked to call a fraudulent support number to resolve the "billing issue".

The fraudulent emails are being used to target a wide range of organizations, researchers noted, with 27% targeting manufacturing, engineering and construction and 1% technology/SaaS.

One-in-eight, meanwhile, went to educational organizations, followed by professional services at 11%, government at 8%, and finance at 7%.

"The distribution likely reflects broad Microsoft Teams adoption across these industries, rather than deliberate targeting," the researchers said. "This suggests the attacker’s primary objective was to exploit a trusted collaboration platform at scale, rather than focus on specific verticals."

Two-thirds of victims were in the US, with 16% in Europe and 6% in Asia.

Microsoft Teams scams are surging

Microsoft Teams, and indeed collaboration platforms and trusted brands, have become a common attack vector for cyber criminals.

This time last year, researchers at Sophos spotted threat actors posing at tech support workers to launch attacks through the platform.

More recently, the Scattered Spider hacking group expanded this technique by impersonating workers to ask IT teams to reset passwords or transfer MFA tokens using both Microsoft teams and Slack.

The hackers even set up fake identities and took part in company teleconferences and remediation and response calls to gather security information.

FOLLOW US ON SOCIAL MEDIA

The energy sector should be on the alert for a new multi‑stage adversary‑in‑the‑middle (AitM) campaign, Microsoft has warned.

Cloud collaboration platforms, particularly Microsoft SharePoint and OneDrive, are popular with threat actors thanks to their widespread presence in enterprise environments.

They offer built-in legitimacy, flexible file‑hosting capabilities, and authentication flows that attackers can take over and use to hide their presence.

This latest phishing and business email compromise (BEC) campaign, Microsoft said, abused SharePoint file sharing services to deliver phishing payloads. Emails with the subject line “NEW PROPOSAL – NDA” appeared legitimate, coming from a previously-compromised email address belonging to a trusted organization.

A number of user accounts have already been compromised, according to the Microsoft Defender Research team.

Victims clicking on a link included in the email were redirected to a fake login page, which collected their credentials. The attackers also altered inbox rules to mark all emails as "read", making their activity harder to detect.

They were then able to make use of trusted internal identities from the target to conduct large‑scale phishing attacks, both within the organization and externally, significantly expanding the scope of the campaign.

In one example, this phishing campaign involved more than 600 emails with a different phishing URL, which were sent to the compromised user’s contacts within and outside the organization, as well as distribution lists.

The attackers then made further efforts to avoid suspicion.

"The attacker read the emails from the recipients who raised questions regarding the authenticity of the phishing email and responded, possibly to falsely confirm that the email is legitimate," said the Microsoft team.

"The emails and responses were then deleted from the mailbox. These techniques are common in any BEC attacks and are intended to keep the victim unaware of the attacker’s operations, thus helping in persistence."

Tackling adversary-in-the-middle attacks

Microsoft highlighted the operational complexity of AiTM campaigns, saying that password resets alone are not enough to fix the problem.

Impacted organizations must, said the firm, make sure that they've revoked active session cookies, reversed the changes to MFA settings made by the attacker on the compromised user’s accounts and removed the altered inbox rules.

"While AiTM phishing attempts to circumvent MFA, implementation of MFA still remains an essential pillar in identity security and highly effective at stopping a wide variety of threats.

MFA is the reason that threat actors developed the AiTM session cookie theft technique in the first place," the team said.

The researchers also advised organizations to work with their identity provider to ensure security controls like MFA are in place.

They added: "Organizations should also consider complementing MFA with conditional access policies, where sign-in requests are evaluated using additional identity-driven signals like user or group membership, IP location information, and device status, among others."

FOLLOW US ON SOCIAL MEDIA

LastPass has urged customers to be on the alert for phishing emails amidst an ongoing scam campaign.

The password management firm said emails claiming the site is due to undergo maintenance have been circulating since 19 January. The messages include prompts for customers to backup vaults within the next 24 hours, LastPass revealed.

"Please be advised that LastPass is NOT asking customers to backup their vaults in the next 24 hours; rather, this is an attempt on the part of a malicious actor to generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails," said the firm in a statement.

The emails come with several different subject lines, including:

• "LastPass Infrastructure Update: Secure Your Vault Now”
• “Your Data, Your Protection: Create a Backup Before Maintenance”
• “Don’t Miss Out: Backup Your Vault Before Maintenance”
• “Important: LastPass Maintenance & Your Vault Security”
• “Protect Your Passwords: Backup Your Vault (24-Hour Window)”.

The sender addresses are support@sr22vegas[.]com and support@lastpass[.]server8/server7/server3.

IPs associated with the campaign include 192.168.16[.]19 and 172.23.182.202, LastPass confirmed.

How to spot the fake LastPass emails

The emails claim that a “legacy access” request has been opened – often using alarming language, such as even informing recipients they may be deceased – and include fake case details to appear legitimate.

Victims are directed to a fraudulent LastPass website that looks like the real thing, hosted at “group-content-gen2.s3.eu-west-3.amazonaws[.]com/5yaVgx51ZzGf”, which then redirects to “mail-lastpass[.]com.”

Here they are prompted to enter their credentials. In some cases, the attackers also follow up with phone calls to increase pressure.

“This campaign is designed to create a false sense of urgency, which is one of the most common and effective tactics we see in phishing attacks,” said a spokesperson for the threat intelligence, mitigation, and esalaction (TIME) team at LastPass.

“We want customers and the broader security community to be aware that LastPass will never ask for their master password or demand immediate action under a tight deadline. We thank our customers for staying vigilant and continuing to report suspicious activity.”

LastPass campaign looks to catch users off-guard

Notably, the campaign was timed for a holiday weekend in the US, probably in the hopes that this would mean reduced staffing levels that could delay detection and draw out response time.

"Please remember that no one at LastPass will ever ask for your master password. Rest assured, we are working with our third-party partners to have this domain taken down as soon as possible," said the firm.

"In the meantime, please take the appropriate precautions and, as always, if you are ever unsure whether a LastPass branded email is legitimate, submit it to abuse@lastpass.com."

The latest advisory marks the second time in six months that LastPass has been forced to put out an alert like this. A phishing campaign in October 2025 used similar tactics, claiming that the company had been hacked.

FOLLOW US ON SOCIAL MEDIA

A London council has written to hundreds of thousands of residents to warn them that criminals may use details leaked via a cyber attack last year to target them for scams.

At the end of November, Kensington and Chelsea was one of a trio of west London councils that suffered an outage that was quickly attributed to a cyber attack.

A week later, the council confirmed that personal data was likely leaked, though it stressed it was only "historical data".

Now, a spokesperson for the council has said the attackers had "criminal intent", with the council's website adding that sensitive data and personal information that could impact residents had been accessed by the attackers.

Council leader Elizabeth Campbell said the "serious" breach required action from the council, with an update in the middle of December saying 100,000 households had already been contacted with warnings following the attack.

A spokesperson told ITPro the letters were sent out at the beginning of December, and the message references the attack of "two weeks ago".

"We decided to go out immediately and say to people this is what's happened, this data has been copied and it has been taken and you should be aware therefore you are at risk," she told the BBC.

Written warning

In a copy of the letter shared with ITPro by the council, recipients are advised to be wary of scam messages, check online accounts for unusual activity, and report any suspicious activity to the National Cyber Security Centre (NCSC).

"Like any local authority, it was always possible that our systems could come under attack and therefore we had invested significantly in our digital, data and technology services over many years," Campbell said in the letter.

"This meant that we had a cyber defence system that was able to spot this attack quickly and protect much of our infrastructure, and the infrastructure of others, as best as possible."

Campbell added: "Despite this, we do believe that some data has been copied and taken. It is important to say we still have access to this information, but it is possible a copy could end up in the public domain. As a priority we are checking if this contains any personal or financial details of residents, customers, and service users. This may take months and we will update residents at every step."

The council is now "going through all the documentation" to spot any specific risks and will contact individuals directly if affected, though it noted that work may take months.

Similarly, the local authority said it was checking which details in files may have been accessed, admitting that work may yield nothing, but said "we want to make sure we turn over every stone."

What happened

The attack began on the morning of 24 November, and was immediately spotted by staff at Kensington and Chelsea, who took steps to isolate systems.

A week later, that council admitted some data had been accessed, including sensitive information; however, it stressed the data wasn't encrypted by the attackers, such as in a ransomware attack, and therefore remained accessible to the council.

Hammersmith and Fulham Council and Westminster City Council were the other two local authorities hit by the outage, as the three organizations share some systems.

Hammersmith has said it so far appears its systems were not compromised, while Westminster earlier this month confirmed that "limited data" had been breached.

Keven Knight, CEO of Talion, told ITPro last year that councils are a prime target for cyber criminals, largely due to the scope of personal and financial information they hold on residents.

"This is the type of information that can’t be changed easily. This means it's now in the hands of a threat actor, and victims will be exposed to an increased risk of phishing," he said.

The Information Commissioner's Office (ICO) has been informed of the incident, and the Metropolitan Police and NCSC are investigating. So far, there's no indication who is behind the attack.

"The Met is leading an investigation and we are working alongside them with the national cyber security centre and the NCC Group," a spokesperson for Kensington and Chelsea council said.

"We are taking steps to work through the data in accordance with ICO and legal rules."

FOLLOW US ON SOCIAL MEDIA

The number of known Phishing as a Service (PhaaS) kits doubled last year, according to new research, with enterprises warned about a looming onslaught of social engineering attacks in 2026 and beyond.

Across the year, 90% of high-volume phishing campaigns leveraged PhaaS kits, researchers at Barracuda found. These make it easier for lower-level cyber criminals to access advanced tools to wage large-scale attacks.

The new kits are sophisticated, evasive, and stealthy, Barracuda noted, with Whisper 2FA and GhostFrame introducing inventive and evasive tools and tactics, including a suite of techniques to prevent analysis of their malicious code.

Established groups in this space, such as Mamba and Tycoon, continued to evolve and thrive. Each kit was behind millions of attacks, with 10 million Mamba 2FA attacks in late 2025 alone.

The main tools were multi-factor authentication (MFA) bypass and URL obfuscation techniques, both seen in 48% of attacks. Attackers also added open redirects and human verification steps, making phishing URLs appear authentic and harder to block.

Polymorphic techniques and the use of malicious QR codes were each seen in around 20% of attacks, and malicious attachments in 18%.

Crucially, researchers warned attackers have now begun splitting QR codes into multiple images or nesting malicious codes within or around legitimate ones to evade detection by email security tools.

“Phishing kits shifted up another level in 2025 as they increased in number and sophistication, bringing advanced, full-service attack platforms to even less-skilled cybercriminals and enabling them to launch powerful attacks at scale,” said Ashok, Sakthivel, director of software engineering at Barracuda.

Phishing lures remain largely unchanged

While techniques may have evolved, the main phishing lures have remained broadly the same – fake payments, financial, legal, digital signature, and HR-related messages.

One-in-five emails related to payment and invoices scams, the Barracuda study found. Digital signature and document review emails accounted for 18% of attacks, with HR-related documents featuring in 13%.

Many exploited trusted brand names, mimicking websites and logos, including Microsoft, DocuSign, and SharePoint with increasing accuracy.

New kits include Sneaky 2FA, an advanced phishing kit leveraging adversary-in-the-middle (AitM) techniques to bypass two-factor authentication, and CoGUI, a sophisticated kit designed with advanced evasion and anti-detection capabilities.

The latter of these is commonly used by Chinese-speaking threat actors, Barracuda noted.

“The kits feature techniques designed to make it harder for users and security teams to detect and prevent fraud," said Sakthivel.

"To stay protected, organizations need to move past static defenses and adopt layered strategies: user training, phishing-resistant MFA, continuous monitoring, and to ensure email security sits at the heart of an integrated, end-to-end security strategy.”

FOLLOW US ON SOCIAL MEDIA

Cybersecurity researchers at Proofpoint have issued a warning over a surge in Microsoft 365 account takeovers through abuse of OAuth device code authorization.

This legitimate Microsoft login process is now being weaponized by both cyber criminal and state-aligned actors, who are tricking users into entering a device code on Microsoft’s real login page - instantly granting unauthorized access.

Proofpoint said the trend signals a major evolution in phishing, shifting attacks away from passwords and towards abusing trusted authentication flows.

Attacks start with an initial message containing a URL embedded behind a button, as hyperlinked text, or within a QR code. Once visited, it initiates an attack sequence leveraging the legitimate Microsoft device authorization process.

The user is presented with a device code with the claim that it's a one-time password (OTP). The user is directed to input the code at Microsoft’s verification URL - and once this is done, the original token is validated, giving the threat actor access to the targeted Microsoft 365 account.

"While this is not necessarily a novel technique, it is notable to see it used increasingly by multiple threat clusters including a tracked cybercriminal threat actor, TA2723," the researchers said.

"Proofpoint threat researchers have identified a malicious application for sale on hacking forums, which could be used for this type of campaign."

Meanwhile, some red team tools, such as Squarephish and SquarephishV2, can be used for this type of attack, helping to mitigate the short-lived nature of device codes and enabling larger campaigns than were previously possible.

In one example, researchers identified a campaign that used a shared document reminder alert to trick users into clicking a Google Share URL hyperlinked as text, to access a fictitious document called “Salary Bonus + Employer Benefit Reports 25”.

The URL leads to an attacker-controlled website with a domain localized according to browsing IP, and showing the targeted company branding.

Thereafter, the website prompts the user to input their email address and go through an authentication process that includes a code that, when input into the Microsoft-provided OAuth page, gives the threat actor access to the user’s Microsoft 365 account.

Proofpoint ascribes this activity to TA2723, a financially-motivated, high-volume credential phishing threat actor notable for its campaigns spoofing Microsoft OneDrive, LinkedIn, and DocuSign. It's seen the group conducting OAuth device code phishing since October.

But the technique is in use by other state-aligned actors, too, including UNK_AcademicFlare.

Since September, the Russia-linked group has been using compromised email addresses belonging to multiple government and military organizations to target bodies within government, think tanks, and the higher education and transportation sectors in the US and Europe.

Earlier this year, Volexity said it had identified several campaigns using the same techniques and carried out by Russian actors.

The company said it believed that at least one was CozyLarch - overlapping with DarkHalo, APT29, Midnight Blizzard, and CozyDuke. It said it was tracking the remaining activity under UTA0304 and UTA0307.

Proofpoint expects the abuse of OAuth authentication flows to continue to grow, with the adoption of FIDO compliant MFA controls. Organizations should strengthen their OAuth controls and educate users about these evolving threats.

"From the use of malicious OAuth applications for persistent access to the abuse of legitimate Microsoft authentication flows with device codes, "threat actors’ tactics to achieve account takeover are evolving with quick adoption across the threat landscape," the researchers said.

FOLLOW US ON SOCIAL MEDIA

While most workers believe they can spot a phishing attempt, nearly one-in-four under-35s would fall for a suspicious message if they thought it came from a colleague or boss.

Four-in-five British workers told Accenture researchers they were confident they'd spot a suspicious message, even though more than a third have never received cybersecurity training.

Men show the biggest faith in themselves, being nearly twice as likely as women to report high confidence in spotting cyber threats, at 22% compared with 12%.

But younger workers in particular may be wrong about this. The survey of over 1,000 British employees found that 15% would share company data or make payments via messaging apps, without verifying the sender, if the message seemed to come from a leader or colleague.

Among under-35s, so those in the millennial and Gen Z demographics, this rose to nearly a quarter (24%).

“With cyber criminals weaponizing information from social media to deceive people with realistic messages or calls, employees must make faster judgement calls on what’s real and what’s not," said Kamran Ikram, Accenture’s security lead in the UK and Ireland.

"The workforce feels cyber confident – though its uneven among men and women – there remains a serious skills and training gap across the board. Being overconfident yet undertrained is a dangerous position to be in."

More cybersecurity training is needed

Notably, more than one-third (37%) of British workers have never received any cybersecurity training, including 44% of over-55s. Meanwhile, only one-in-five have been trained to recognize deepfakes or AI-generated phishing emails.

This lack of training is more significant in smaller companies, where 79% of microbusinesses with less than 10 employees and 55% of small firms with between 10 and 49 employees offer no cybersecurity training at all.

"Organizations must look to be resilient in every area of their operations and supply chain, which means ongoing education on cyber threats," said Ikram. "Businesses can’t rely on patchy preparedness when attackers are advancing by the day.”

Even when employees are receiving training, it's not adequately covering all the risks, Accenture found. Half of those that have been trained said they've received no guidance on using AI safely, such as what data should not be shared with public tools or how to identify AI-enabled attacks.

As a result, 17% have no awareness of AI-driven cyber threats while only 61% are aware of deepfake videos or AI-generated phishing emails, and fewer than half are aware of voice cloning or identity theft.

“AI is bringing immense opportunity to business, but it also is changing the risk landscape as criminals increasingly incorporate AI into their arsenal," said Ikram.

"Today, awareness of AI-enabled attacks is still uneven, and that gap is where the next wave of breaches will likely happen. But more than that - building a cyber-savvy workforce isn’t just about protecting your systems, it’s also what allows innovation and trust to scale together.”

Workers do at least have a sense of collective responsibility. While a quarter of British employees believe that the IT or security department is most responsible for protecting a company against cyber threats, more than twice as many accept that it's a joint responsibility across the organization.

MORE FROM ITPRO

• Are we in a cyber awareness crisis?
• Employee phishing training is working – but don’t get complacent
• Best online cyber security courses

The Scattered Lapsus$ Hunters threat group appears to be targeting Zendesk users in a new phishing campaign, according to analysis from ReliaQuest.

The security firm said it has spotted Zendesk-related infrastructure, including more than 40 typosquatted domains and URLs impersonating the company, created over the last six months.

These domains aim to mimic organizations’ Zendesk environments and host phishing pages, researchers warned.

"These domains, such as znedesk[.]com or vpn-zendesk[.]com, are clearly designed to mimic legitimate Zendesk environments. Some host phishing pages, like fake single sign-on (SSO) portals that appear before Zendesk authentication," said ReliaQuest.

"It’s a classic tactic probably aimed at stealing credentials from unsuspecting users. We also identified Zendesk-related impersonating domains that contained multiple different organizations’ names or brands within the URL, making it even more likely that unsuspecting users would trust and click on these links."

The domains shared several registry details: registration through NiceNic, US and UK registrant contact information, and Cloudflare-masked nameservers.

"These elements are reminiscent of the recent Scattered Lapsus$ Hunters campaign that targeted customer relationship management platform Salesforce in August 2025," ReliaQuest said.

"The domains we uncovered while investigating the August campaign shared similarities with the Zendesk domains: formatting, registry characteristics, and the use of deceptive SSO portals."

Be wary of fraudulent Zendesk tickets

Meanwhile, ReliaQuest said it has observed fraudulent tickets being submitted to legitimate Zendesk portals operated by organizations using the software for customer service.

Pretexts include urgent system administration requests or fake password reset inquiries, and the aim is to infect support and help-desk personnel with remote access trojans (RATs) and other forms of malware.

In September, Scattered Lapsus$ Hunters targeted the communication platform Discord, accessing its Zendesk-based support system and exfiltrating a large number of names, email addresses, billing information, IP addresses, and government-issued IDs.

A message posted on a Telegram channel associated with the group in November claimed: "Wait for 2026, we are running 3-4 campaigns atm."

Another read: "all the IR (incident response) people should be at work watching their logs during the upcoming holidays till January 2026 bcuz #ShinyHuntazz is coming to collect your customer databases."

ReliaQuest said organizations should handle customer support platforms with the same level of security as their own core infrastructure.

"ReliaQuest anticipates that SLSH, or copycat threat actors, will likely continue abusing Zendesk and similar customer support platforms — typically monitored less rigorously than inbound email traffic — to access downstream customers' sensitive data and credentials," said the firm.

"These platforms now warrant equivalent security controls to core infrastructure, particularly since SLSH operates multiple, concurrent attack paths, i.e. external phishing domains coupled with internal ticket injection."

MORE FROM ITPRO

• If you're not taking insider threats seriously, then the CrowdStrike incident should be a big wake up call
• Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?
• Hackers behind Jaguar Land Rover announce their 'retirement' – should we believe them?

Tired of scam messages purporting to have a package for you? So is Google – and it's lawyering up to fight back.

Google said it is adopting a multifaceted approach to takedown a phishing as a service (PhaaS) operation known as 'Lighthouse', not only suing those responsible, but backing bipartisan US legislation to take on such scams and rolling out new AI-based tech to protect users.

"That text message you got about a 'stuck package' from USPS or an 'unpaid road toll'? It’s not just spam. It’s the calling card of a sophisticated, global scam that has swindled victims out of millions of dollars," said Google's general counsel Halimah DeLaine Prado in a blog post.

"Bad actors built 'Lighthouse' as a phishing as a service kit to generate and deploy massive 'smishing' (SMS phishing) attacks."

Those attacks arrive via a text message claiming to have a delivery or warning of an unpaid road toll, with a malicious link where victims are urged to enter their email, banking data, and more.

According to Google, the Lighthouse operation has impacted over one million victims spanning 120 countries, stealing information on anywhere between 12.7 million and 115 million credit cards in the US alone

“This represents a five-fold increase in these types of attacks since 2020,” DeLaine Prado noted.

Google said attacks often make use of legitimate brands and their trademarks on malicious websites, with the tech giant spotting at least 107 website templates using its own branding on fake sign-in screens.

Google getting tough on scams

Google said it is taking legal action in the hopes of dismantling the "core infrastructure" of the Lighthouse operation.

"We are bringing claims under the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act, and the Computer Fraud and Abuse Act to shut it down, protecting users and other brands," DeLaine Prado noted.

The lawsuit is being brought against 25 unnamed people believed to live in China, seeking a restraining order and damages. Of course, given the individuals accused of running Lighthouse are not known, the intent isn't to necessarily target them.

Instead, Google is also asking web hosting providers to block Lighthouse associated IP addresses and domains.

Alongside the lawsuit, Google has thrown its weight behind a trio of bills currently working their way through US Congress: Guarding Unprotected Aging Retirees from Deception (GUARD) Act, Foreign Robocall Elimination Act and Scam Compound Accountability and Mobilization (SCAM) Act.

Those bills would see the establishment of taskforces to target such scams — and funding to investigate them.

Legal actions aside, Google said it is also developing tools using AI to better spot and flag such scams in a bid to better protect users.

Tough fight ahead

While the actions by Google have been welcomed, one industry expert said such efforts may be like playing whack-a-mole. They might knock one down, but another will just pop up again.

"Groups like Lighthouse appear regularly, and while legal action can disrupt them, these operations often re-emerge using alternative infrastructures," said Carl Wearn, head of threat intelligence and analysis & future ops at Mimecast.

"Copycat phishing as a service models will continue to grow, exploiting people’s instinctive trust in familiar digital channels like email and SMS."

While the increase of these scams – which not only now impersonate delivery firms and toll threats but governments and banks to trick victims – may spark more lawsuits from brands following Google's lead, Wearn said that "lasting impact will depend on public awareness, taking a moment to pause, verify and think before clicking."

MORE FROM ITPRO

• Cheap cyber crime kits can be bought on the dark web for less than $25
• Phishing tactics: The top attack trends
• Employee phishing training is working – but don’t get complacent

While enterprises place a huge emphasis on educating workers to look out for phishing scams, the worst offenders when it comes to clicking malicious links are actually security leaders themselves.

That’s according to new research from Arctic Wolf, which found that despite three-quarters of IT and security leaders believing their organization wouldn’t fall for a phishing attack, nearly two-thirds click phishing links.

Notably, one-in-five failed to report falling for a malicious link or phishing email.

Adam Marrè, senior vice president and chief information security officer (CISO) at Arctic Wolf, said the study highlights a major blind spot and degree of hubris among some security leaders.

"When leaders are overconfident in their defenses while overlooking how employees actually use technology, it creates the perfect conditions for mistakes to become breaches,” he said.

Yet despite their own poor record, 77% of IT leaders say they would fire staff who fall for scams, marking not only a double standard but a sharp increase from 66% in 2024.

More than six-in-ten of IT leaders have changed employees’ access or limited their access as a result of falling victim to phishing scams.

Better training and culture require to stop phishing scams

Arctic Wolf said a better strategy to combat the rise of phishing attacks lies in more robust training for staff at all levels. Indeed, companies that emphasize corrective training reported an 88% reduction in long-term risk.

“Terminating employees for falling victim to a phishing attack may feel like a quick fix, but it doesn’t solve the underlying problem," said Marrè.

"Our research shows that better-trained and better-equipped end users are far less likely to be duped — and when organizations take an education-first approach, nearly nine in ten see positive outcomes."

Attacks keep on coming

The call to action comes at a critical time for enterprises. The number of incidents is surging worldwide, according to Arctic Wolf, with 68% of IT leaders saying their organization suffered a breach in the past year.

This marks an 8% increase from 2024. More than one-in-ten had more than five breaches, while only 30% reported none.

Senior leadership teams are a prime target, the study noted, with 39% hit by phishing attempts and 35% facing malware infections that put high-value accounts at risk.

The UK, Australia, New Zealand and Ireland saw the steepest year-over-year increases, with the number of incidents in the UK and Ireland rising by 35% year over year, partly because of recent high-profile attacks on retailers.

"Contributing factors include the sector’s historical reliance on legacy systems, seasonal spikes in consumer activity, and the complexity of managing customer data across distributed environments," the researchers said.

"While these attacks are serious, they also reflect a broader shift in threat actor behavior toward more opportunistic and scalable methods, making retail a prime target."

The researchers found that many organizations are neglecting the basics, with only 54% of organizations enforcing MFA for all users.

“Progress comes when leaders accept that human risk is not just a frontline issue but a shared accountability across the organization," said Marrè.

"Reducing that risk means pairing stronger policies and safeguards with a culture that empowers employees to speak up, learn from errors, and continuously improve.”

MORE FROM ITPRO

• Phishing tactics: The top attack trends
• Four tips for implementing effective cybersecurity awareness training
• Malware as a Service explained

Researchers have issued a warning about a new Google Careers phishing scam used by hackers to dupe tech workers looking for a career change.

Victims receive an 'are you open to talk?' message impersonating an outreach email from Google Careers. If they click the link, they’re taken to a landing page designed to look like a Google Careers meeting scheduler and, from there, to the phishing page.

Detailing the scam in a blog post, Sublime Security threat detection engineer Brandon Murphy said the phishing campaign has evolved rapidly in recent weeks, employing more sophisticated techniques to dupe unsuspecting victims.

"What makes this attack particularly interesting is that it is in active development,” he said. “We have observed threat actors refining and adjusting their tactics and techniques over time, evolving to evade detection."

The initial message may be sent in a number of languages, including English, Spanish, and Swedish, and purports to come from a talent recruiter or recruiting department.

It includes a Book a Call button that leads to a URL that also has a hiring-themed subdomain and Google Careers-themed root domain, although they didn't always match the sender’s domain. There are a number of different links in use, Murphy noted.

How the Google Careers scam works

In almost all cases, after clicking on the Book a Call button, the target is taken to either a real or impersonated Cloudflare Turnstile page.

After completing a Captcha, they are directed to a spoofed Google Careers meeting scheduling page, where their name, email address, and phone number are all recorded by threat actors.

After clicking save & continue, victims are taken to the password phishing phase of the attack, which features a fake login page, as seen in most Google credential phishing attacks.

While most modern credential phishing attacks typically use Adversary in the Middle (AITM) infrastructure to automate the validation and theft of credentials, this attack appears to be using a C2 server, Murphy noted.

What to look out for

With all the variations, there are certain common features of attacks. The phishing messages impersonated Google Careers, but are delivered on non-Google Careers infrastructure, and links to domains that mimic Google branding but are not a legitimate domain.

These domains are typically newly registered, with the sender and/or links within the message using domains that were registered within the past 30 days.

Similarly, there's a misalignment between claimed sender identity – Google Careers – and the actual sender domain, which varies.

As so often with phishing messages, there's a sense of urgency, with job offers coming with vague details, but requiring a call to be scheduled immediately. Messages also use flattering language but are short on the specifics.

"Adversaries will impersonate trusted sites and services to improve their chances of success," said Murphy.

MORE FROM ITPRO

• How leaders can uncover hidden tech talent
• The highest-paying tech jobs
• Phishing tactics: The top attack trends

Security firm Barracuda has issued a warning to Microsoft 365 users after researchers uncovered a new Phishing as a Service (PhaaS) tool that’s being used to target millions of accounts.

Whisper 2FA steals both credentials and MFA tokens while evading detection through complex obfuscation techniques. The tool bears similarities to Salty 2FA, researchers noted, a new PhaaS with a focus on stealing Microsoft 365 credentials reported recently by AnyRun.

It's a well-obfuscated credential harvester with anti-debugging, anti-analysis, and brand mimicking features. Tracked since July 2025, it has already powered close to a million attacks, making it the third most-common PhaaS after Tycoon and EvilProxy.

Whisper 2FA can steal credentials multiple times through a real-time credential exfiltration loop that's enabled by a web technology known as Asynchronous JavaScript and XM (AJAX).

This feature, which speeds up live chat, instant search suggestions and dynamic dashboards, allows websites to update information in real-time without needing to reload the entire page.

"By combining realistic login flows, seamless user interaction and real-time MFA interception, Whisper 2FA makes it extremely difficult for users and security teams to detect fraud," researchers warned.

"Unlike traditional phishing kits that stop after collecting usernames and passwords, Whisper 2FA goes further. It validates sessions in real time, intercepts MFA codes and uses advanced anti-analysis techniques to avoid detection."

Under the hood of Whisper 2FA

Analysts at Barracuda found a wide range of phishing emails leading to Whisper 2FA, many of which were based on well-known, trusted brands and urgent pretexts, including DocuSign, Voicemail, Adobe, and ‘Invoice’.

Notably, researchers warned the kit is evolving rapidly in both its technical complexity and anti-detection strategies. Barracuda said that random text snippets used in the early versions have been removed, stripping away human-readable hints and making static analysis more difficult.

Obfuscation has also become denser and multilayered, with repeated Base64 decoding functions – which suggests the original data was encoded into strings of letters, numbers, and symbols several times over.

Meanwhile, new protections have been added to make it harder for attackers defenders to analyze or tamper with the system. These include tricks to detect and block debugging tools, disabling shortcuts used by developers, and crashing inspection tools by manipulating browser behavior.

Whisper 2FA is becoming harder to crack

Elsewhere, Barracuda analysts warned there are stronger session-based checks and multi-factor authentication (MFA) exfiltration logic, where tokens and one-time passwords are validated in real time through the attacker’s command-and-control (C2) systems.

Users of the phishing kit can now rely on enhanced checks to instantly validate intercepted login codes and tokens through the attackers’ C2 systems.

"The Whisper 2FA phishing campaign demonstrates how phishing kits have evolved from simple credential stealers into sophisticated, full-service attack platforms," researchers said.

"As phishing kits like this continue to evolve, organizations need to move past static defenses and adopt layered strategies: user training, phishing-resistant MFA, continuous monitoring, and threat intelligence sharing. Only then can defenders keep pace with the relentless innovation we’re now seeing in phishing campaigns like Whisper 2FA."

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• Hackers are using Microsoft 365 features to bombard enterprises with phishing emails
• Malicious URLs overtake email attachments as the biggest malware threat

Microsoft has announced a significant takedown of RaccoonO365, a popular tool used by hackers to seize Microsoft 365 credentials via phishing.

The tech giant’s Digital Crimes Unit (DCU) seized 338 domains linked to RaccoonO365, which form the backbone of its phishing as a service (PhaaS) offering used in thousands of attacks worldwide.

Cloudflare partnered with Microsoft for the takedown, tracking user signups to map out the threat group’s infrastructure and disabling all of its domains.

The full takedown began on 2 September, with Cloudflare acting in coordination with Microsoft’s seizure of 338 websites associated with the group as authorized in a court order by the Southern District of New York.

“Cloudflare’s response represents a strategic shift from reactive, single-domain takedowns to a proactive, large-scale disruption aimed at dismantling the actor's operational infrastructure on our platform,” the firm wrote.

“By taking coordinated action in early September 2025, we aim to significantly increase RaccoonO365’s operational costs and send a clear message to other malicious actors: the free tier is too expensive for criminal enterprises.”

RacconO365’s rise and fall

Microsoft designates RaccoonO365 as ‘Storm-2246’, indicating a group under development. It noted that the group has rapidly risen to prominence since June 2024, with its tools directly linked to the theft of at least 5,000 Microsoft credentials, across 94 countries.

In April, Microsoft Threat Intelligence warned of phishing attacks disguised as enterprise and tax documents, launched against 2,300 US organizations via RaccoonO365.

As part of the operation, Microsoft’s DCU also identified the group’s leader as Joshua Ogundipe, based out of Nigeria, following the trail of a cryptocurrency wallet the tool’s operators accidentally exposed.

Steven Masada, assistant general counsel at Microsoft’s DCU, noted that Ogundipe and his fellow group members have made at least $100,000 selling their services on Telegram, with‘RaccoonO365 Suite’ $355 subscriptions for 30 days’ access, or $999 for 90 days.

RacoonO365 is believed to have 100-200 active subscribers paying in cryptocurrency. Microsoft noted this is enough for hundreds of millions of phishing emails sent per year – and is most likely an underestimate of the full customer figures.

In a screenshot of the Telegram group shared by Cloudflare, the group advertised how it manages “all tech updates & backend” and offers a “100% clean codebase – no backdoors, no tracking”.

The tool was centrally managed, with the operators able to roll out new evasion methods or attack campaign strategies without needing to roll out new kits by simply altering a small amount of code.

Ogundipe is believed by Microsoft to have written the majority of RaccoonO365’s code, which Cloudflare researchers noted includes protections against connections from 17 major security vendors including Microsoft Defender and Proofpoint, reverse proxying to disguise its phishing servers as having legitimate Cloudflare IP addresses.

Since December 2024, RaccoonO365 had been deploying Cloudflare Worker clusters to obscure its attack infrastructure, expanding its features and growing in sophistication with each deployment.

By August 2025, the tool was capable of real-time data exfiltration and the group had begun to advertise an AI-powered tool ‘RaccoonO365 AI-MailCheck’.

Cloudflare had been mitigating individual RaccoonO365 domains based on complaints for some time but partnered with Microsoft after it launched its legal efforts to achieve a broader victory against the group.

It has now banned all Workers scripts linked to the group, suspended associated user accounts, and placed phishing warnings on banned domains.

“It’s positive that Microsoft DCU has worked to proactively take down this site, which was clearly putting internet users across the world at serious risk,” said Simon Phillips, CTO of engineering at CybaVerse.

“Users of RaccoonO365 were offered a ready-made package to send out thousands of phishing emails every day, in a bid to steal Microsoft credentials, with minimal effort.”

“With everything being ready-made, this lowered the barrier to entry for phishing scammers, offering them a tried and tested package, that would yield results quickly. This would have made the phishing emails far more convincing, with artwork, language and spelling all accurate.”

Phillips added that stolen credentials are especially effective against victims who reuse passwords across accounts. He cautioned that attackers cut off from PhaaS tools could still turn to the dark web to purchase email addresses for AI-powered phishing campaigns of their own.

Microsoft stated that RaccoonO365’s operators will likely attempt to rebuild infrastructure but that it will continue to take legal action to prevent attackers from resuming their operations.

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• Phishing tactics: The top attack trends
• Hackers are using Microsoft 365 features to bombard enterprises with phishing emails

Varonis has announced plans to acquire SlashNext, an AI-native email security vendor that specializes in phishing and social engineering detection.

Founded in 2017 by Atif Mushtaq, one of the main architects behind FireEye’s malware detection technology, SlashNext uses AI to defend organizations from multi-channel phishing attacks.

The solution will be integrated into Varonis’ Data Security Platform to enable advanced protection against AI-generated threats sent via email, SMS, and messaging services such as WhatsApp, Slack, Zoom, and Microsoft Teams.

By combining the two offerings, Varonis said it is aiming to deliver a comprehensive platform capable of thwarting threats long before their data is impacted.

Terms of the transaction were not disclosed in the company’s announcement but reports suggest the deal could total up to $150 million.

Commenting on the agreement, Varonis co-founder and CEO Yaki Faitelson described the acquisition as a “natural evolution” of the company’s platform, with the move set to “significantly expand” its total addressable market.

“By connecting the dots between email, identity, and data we will dramatically increase the value of our MDDR service and help customers stop threats in their inbox, where many data breaches begin,” he said.

Varonis eyes email security gains

SlashNext leverages predictive AI models that use techniques such as computer vision, natural language processing, and virtual browsers to protect users against attacks across communication and collaboration platforms.

The technology identifies characteristics in tone and style to reveal the intent and motive of the attacker before training itself on the core threat as well as possible variations that it self-generates.

In an independent test of cloud security vendors conducted by The Tolly Group back in 2024, SlashNext was found to demonstrate the highest overall detection accuracy (99%) when compared with its market competitors, and scored a perfect 100% detection rate for business email compromise (BEC) and QR code attacks.

“At SlashNext, we built a fast, automated solution to stop advanced threats across communication channels,” commented Atif Mushtaq, SlashNext’s founder and CPO.

“I’m excited to join the Varonis team on their mission to protect the world’s data, giving customers end-to-end protection from the first point of attack to the last."

MORE FROM CHANNELPRO

• Blackpoint Cyber and NinjaOne partner to bolster MSP cybersecurity
• Workday snaps up AI-powered conversation recruitment platform
• Okta acquires Axiom Security to enhance privileged access management

A new spear phishing campaign has targeted more than 900 organizations with fake invitations from platforms like Zoom and Microsoft Teams.

Analysis from Abnormal.ai shows the campaign involves tricking victims into downloading legitimate remote monitoring and management (RMM) software such as ConnectWise ScreenConnect.

Thereafter, attackers are able to assume control of end-user devices and extract sensitive information.

"To manipulate targets into engaging and downloading ScreenConnect, the attackers employ advanced deception techniques built around impressive impersonations and familiar business contexts, effectively creating workflows that align with end-user expectations," researchers said.

"Specific tactics observed include the utilization of compromised legitimate email accounts, AI-generated phishing components, and strategic URL obfuscation methods, as well as the exploitation of trusted business tools such as file-sharing platforms for hosting malicious links."

Initial access comes via phishing emails from compromised accounts, disguised as meeting invitations via trusted entities like Zoom and Microsoft Teams.

Researchers noted the threat actors also incorporate various themes to make these invitations look legitimate, for example, "Meeting Invite - 2024 Tax Organizer".

Targets are then tricked into installing ScreenConnect through AI-generated landing pages, legitimate file-sharing platforms, direct session links, or executable email attachments.

Once installed, ScreenConnect gives the attackers remote access capabilities that enable comprehensive system control equivalent to direct access while avoiding detection due to minimal signal activity.

Attackers then leverage compromised systems for account takeover, including lateral phishing campaigns and credential harvesting. They often use the targetʼs email accounts to target colleagues and business partners with the same techniques.

"This campaign represents a significant evolution in cybercrime tactics," the researchers said.

"The weaponization of a legitimate IT administration tool — one designed to grant IT professionals deep system access for troubleshooting and maintenance — combined with social engineering and convincing business impersonation creates a multi-layered deception that provides attackers with the dual advantage of trust exploitation and security evasion."

How to stay safe

Researchers pointed out that the sophisticated and resilient infrastructure supporting these attacks implies a mature criminal ecosystem, with dark web vendors operating like legitimate software providers.

"The commoditization of advanced attack capabilities —driven by bad actors who profit from widespread tool adoption — has democratized complex cybercrime operations and poses an escalating threat to organizations across all sectors, particularly those with legacy security infrastructure or limited security awareness programs," they said.

The attackers don't appear to be targeting any particular sector, with a fairly even spread across industries. Most victims were based in the US, with Canadian, Australian and UK organizations also affected.

CISOs should deploy AI-powered email security solutions capable of detecting complex social engineering attacks that bypass traditional security controls, and establish comprehensive monitoring for legitimate remote access tools, focusing on unauthorized installations and suspicious usage patterns.

Similarly, researchers urged enterprises to update training programs to address evolving tactics and implement network segmentation and access controls to limit the potential impact of compromised systems with remote access capabilities.

MORE FROM ITPRO

• Hackers are targeting Windows Quick Assist remote desktop features to deploy ransomware
• The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employees
• State-sponsored cyber groups are flocking to the 'ClickFix' social engineering technique

There's been a sharp rise in the number of phishing and URL-based attacks over the last year, with malicious URLs now being used four-times as often as attachments in email threats.

Malicious links are embedded in messages, buttons, and even within attachments like PDFs or Word documents to entice clicks that initiate credential phishing or malware downloads.

According to a new report from Proofpoint, researchers observed around 3.7 billion URL-based threats over a six month period, highlighting the growing scale of the problem.

Only 8.3 million of these threats were intended to deliver malware, however, with the most frequently-observed payloads in URL-based campaigns being remote monitoring and management (RMM) tools and remote access software (RAS).

These attacks are getting increasingly difficult for users to identify, Proofpoint noted, with cyber criminals now using advanced social engineering techniques and AI-generated content to create their malicious URLs.

Not only are they impersonating trusted brands, but also abusing legitimate services, tricking users with fake error prompts and bypassing traditional security by embedding threats in QR codes and SMS messages.

"URL-based phishing threats are no longer confined to the inbox, they can be carried out anywhere and are often extremely difficult for people to identify,” said Selena Larson, senior threat intelligence analyst at Proofpoint.

New techniques are paying off for hackers

Some of the URL-based credential phishing campaigns with the highest volumes in the past 12 months have been facilitated by off-the-shelf 'phish kits' like CoGUI and Darcula.

CoGUI is primarily used by Chinese-speaking threat actors, according to Proofpoint. These high-volume campaigns typically include message counts ranging from the hundreds of thousands to tens of millions at a time, and are mainly used to steal personal details such as credit card numbers.

Meanwhile, ClickFix malware campaigns - a phishing technique that lures users into running malicious code by displaying fake error messages or CAPTCHA screens - are up by nearly 400% year-over-year.

Malware operators are exploiting the urge to resolve a perceived technical issue, helping them spread remote access trojans (RATs), infostealers and loaders.

QR code and smishing threats are rising

Proofpoint also identified more than 4.2 million QR code phishing threats in the first half of 2025 alone. In these cases, the main aim of attackers is credential phishing, with 3.7 billion URL-based attacks aimed at stealing logins.

With phishing lures that impersonate trusted brands and use off-the-shelf tools such as CoGUI and Darcula phish kits, Proofpoint said even low-skilled actors can deploy highly convincing campaigns that bypass multi-factor authentication (MFA) and lead to full account takeover.

The number of smishing campaigns rocketed by 2,534%, as attackers shift their focus to mobile devices - at least 55% of suspected SMS-based phishing messages analyzed by the firm contained malicious URLs, often mimicking government communications or delivery services.

“From QR codes in emails and fake CAPTCHA pages to mobile-first smishing scams, attackers are weaponizing trusted platforms and familiar experiences to exploit human psychology," said Larson.

"Defending against these threats requires multi-layered, AI-powered detection and a human-centric security strategy.”

MORE FROM ITPRO

• Why ‘malware as a service’ is becoming a serious problem
• Developers face a torrent of malware threats as malicious open source packages surge 188%
• The best malware removal kits for small businesses

New hires are far more likely to fall victim to phishing attacks, according to a recent study, highlighting the need for more robust security training during onboarding.

Figures from Keepnet’s 2025 New Hires Phishing Susceptibility Report show new team members are 44% more likely to click on malicious links compared to more seasoned colleagues.

Indeed, the study noted that nearly three-quarters (71%) of new hires are duped by phishing scams or social engineering techniques within the first three months on the job.

“New hires pose a high cybersecurity risk during onboarding due to their lack of familiarity with cybersecurity processes and limited cybersecurity training, increasing their phishing susceptibility to social engineering attacks,” the study warned.

Among the most common attack types encountered by new hires were CEO impersonation, according to Keepnet, with threat actors specifically targeting inexperienced staff through this method.

The firm noted that in these instances, new hires typically receive an “urgent email” from a sender impersonating the chief executive requesting they transfer money or divulge sensitive information.

“They may comply without question because they are unfamiliar with international communications norms,” the study noted.

These particular types of attacks had a far higher success rate among new hires compared to experienced colleagues.

Elsewhere, vendor invoicing scams are another common tactic employed against inexperienced members of staff. These once again include requests for payment, except from what appears to be a recognized vendor.

“New hires in finance or procurement roles who are unfamiliar with standard vendor interactions might approve such payments,” the study warned.

Security awareness training is critical

The risks faced by new employees, and by default their employers, highlights the need for more robust training during the onboarding process, experts told ITPro.

Greg Crowley, CISO at eSentire, noted that training “needs to start from day one”.

“Security awareness should be a core part of onboarding, not an afterthought or something we expect employees to ‘catch up on’ later,” he explained.

Crowley added that the onboarding process at eSentire focuses heavily on running new hires through the threats they face, as well as company-specific tools and policies.

In doing so, they become far more comfortable reporting issues and navigating their early days at the company.

“Employers need to let them know that it is very common for new hires, just like them, to be targeted by threat actors,” he explained.

“Tell them specific things to watch out for, such as unexpected text messages claiming to be the CEO or someone senior in the company asking for a favor.”

Crucially, security awareness training should be “ongoing and engaging” and not a one-time affair, Crowley said.

“People forget, threats evolve, and attackers get smarter,” he said. “So we ensure that there is recurring security training, we push simulated phishing campaigns, and communicate timely, real-world threats to the company with reminders on what to look out for and how to report.”

Masha Sedova, VP, Human Risk Strategy at Mimecast, echoed Crowley’s comments on continuous training strategies - which is a practice she noted often falls flat at enterprises.

“These findings point to a broader issue with how many organizations approach cybersecurity training,” Sedova said. “For years, awareness efforts have relied on annual modules and phishing simulations that create a false sense of progress.”

“They often treat all employees the same, regardless of role, exposure or previous behavior and that one-size-fits-all approach rarely delivers lasting impact,” Sedova added.

“Training completion rates may tick the compliance box, but they don’t reflect whether employees are actually making better decisions in the moments that matter.”

Keepnet advised organizations to implement dedicated security behavior and culture programs for onboarding processes in order to protect new hires. These, the company noted, can reduce risks by up to 30%, at least according to its own offering on this front.

However, Crowley said that senior employees play an equally important role in helping new hires. This, he told ITPro, is “one of the most underused resources in any organization.”.

“The influence they have is huge. When senior team members model good security habits — like using password managers, reporting phishing attempts, or being cautious about links — others notice and follow,” he said.

“Especially for new hires, it's not just the training they remember; it's how their manager or team lead handles this stuff in practice.”

In fostering a culture of collaboration between new hires and senior staff, Crowley said this helps alleviate the pressure placed on the latter and reduces the “fear of messing up”.

“We want people to report issues immediately, and seasoned employees who are comfortable saying, ‘hey, I once clicked something bad too — just report it quickly’ help create that psychological safety,” Crowley explained.

“That culture matters more than any tech control you can put in place.”

MORE FROM ITPRO

• Hackers are using PDFs to impersonate big brands in a new threat campaign
• Phishing tactics: The top attack trends
• Employee phishing training is working – but don’t get complacent

Security experts have warned of a new phishing campaign which exploits Microsoft’s 365’s Direct Send feature to steal credentials – and they’ve already hit more than 70 organizations.

Direct Send is a feature in Exchange Online that allows devices and applications to send emails within a Microsoft 365 tenant. It uses a smart host with a format like "tenantname.mail.protection.outlook.com".

Intended for internal use only, the feature doesn't require authentication, meaning that attackers don’t need credentials, tokens, or access to the tenant, just a few publicly available details.

According to researchers at Varonis, attackers have been taking advantage of this since May to spoof internal users and deliver phishing emails without ever needing to compromise an account.

The victims span multiple verticals and locations, but are mainly US-based organizations.

The attacker used PowerShell to send emails appearing to come from a legitimate internal address via the smart host. Notably, because the email is routed through Microsoft’s infrastructure and appears to originate from within the tenant, it can bypass traditional email security controls.

Microsoft’s own filtering mechanisms, for example, may treat the message as internal-to-internal traffic, while third-party email security solutions often rely on sender reputation, authentication results, or external routing patterns to flag suspicious messages.

The Varonis MDDR Forensics team said it has observed multiple instances across different environments where organizations have received alerts for “abnormal behavior: Activity from stale geolocation to the organization.”

"In one case, the alert was triggered by a Ukrainian IP address, an unexpected and unusual location for the affected tenant," said Tom Barnea, a forensics specialist at Varonis.

"Typically, alerts tied to abnormal geolocation are accompanied by authentication attempts. This time, however, there were no login events, only email activity. Even more unusual, users were sending emails to themselves with PowerShell as the user agent."

How the phishing emails work

In one instance recorded by Varonis, emails were designed to resemble voicemail notifications - complete with a PDF attachment that contained a QR code redirecting users to a phishing site designed to harvest Microsoft 365 credentials.

To stay safe, Varonis recommends that organizations should enable “Reject Direct Send” in the Exchange Admin Center and implement a strict DMARC policy, for example p=reject.

They should flag unauthenticated internal emails for review or quarantine, enforce “SPF hardfail” within Exchange Online Protection (EOP) and use anti-spoofing policies.

User education is also important, as is the use of MFA and conditional access policies, in case a user’s credentials are stolen.

Similarly, organizations should enforce a static IP address in the SPF record to prevent unwanted send abuse, as recommended, but not required, by Microsoft.

"Direct Send is a powerful feature, but in the wrong hands, it becomes a dangerous attack vector," said Barnea.

"If you’re not actively monitoring spoofed internal emails or haven’t enabled the new protections, now is the time. Don’t assume internal means safe."

MORE FROM ITPRO

• How hackers are using legitimate tools to distribute phishing links
• Phishing tactics: The top attack trends
• Employee phishing training is working – but don’t get complacent

The FIN6 hacking group, also known as Skeleton Spider, has been spotted impersonating job seekers to target recruiters with malware.

Contacting recruiters and HR departments on sites such as LinkedIn or Indeed, the group is submitting convincing-looking job resumes containing phishing links. These links lead to the applicant's 'personal website', said to contain their resume. The links are given in a 'johnsmith[.]com format.

"The faulty links are crafted in a way that evades detection and blocking, requiring recipients to type them on their browsers manually," said Andrew Costis, engineering manager of the adversary research team at AttackIQ.

"The domains are registered anonymously, and come equipped with environmental fingerprinting and behavioral checks to ensure that only the target can open the landing pages."

In a new report by DomainTools, researchers identified a number of these domains hosted on AWS infrastructure, including bobbyweisman[.]com, emersonkelly[.]com, and davidlesnick[.]com.

"It is likely the actors behind these domains use disposable or fraudulent email addresses, anonymous or foreign IP addresses, and prepaid or stolen payment methods to create and maintain these accounts," the researchers said.

"Combined with the use of resume-themed domain names and impersonation techniques, this registration strategy allows FIN6 to keep their infrastructure alive just long enough to carry out active phishing campaigns while avoiding rapid takedown by security researchers or registrars."

The researchers said that, when accessed, the sites often display a professional-looking fake resume, lulling recruiters into a false sense of security.

Meanwhile, to help them stay under the radar, the attackers use traffic filtering techniques to control who can access the malicious content, with only users appearing to be on residential IP addresses and using common Windows-based browsers allowed to download the malicious document.

If the visitor is coming via a known VPN service, cloud infrastructure like AWS or corporate security scanners, the site instead delivers a harmless plain-text version of the resume.

DomainTools said that one of the group's favorite payloads is more_eggs, a stealthy JavaScript-based backdoor developed by the Venom Spider group, also known as Golden Chickens, and offered as malware-as-a-service.

The more_eggs malware facilitates credential theft, system access and follow-on attacks, including the use of ransomware. And FIN6 has been using this malware since at least 2018, with Visa warning in 2019 that the group was targeting e-commerce firms, placing skimming malware on their checkout pages.

"What makes FIN6 a particularly dangerous group is the length of time they've survived and the breadth of different attack tactics they've been observed implementing," said Costis.

"The group has compromised point-of-sale systems to conduct financial fraud, expanded into ransomware attacks, and most recently used social engineering campaigns to deliver malware-as-a-service JavaScript backdoors for credential theft. This vast pool of experience makes them especially threatening to unprotected data."

The UK's tax revenue service has lost £47 million in a breach that started last year and impacted 100,000 people.

The HMRC told the treasury select committee yesterday that the account scam was the result of "organized crime" that set up PAYE, or ‘Pay As You Earn’, accounts for individual taxpayers and used them to claim refunds.

"This was organized crime phishing for identity data out of HMRC systems, so stuff that banks and others will also unfortunately experience, and then trying to use that data to create PAYE accounts to pay themselves a repayment and/or access an existing account," HMRC CEO John-Paul Marks said, according to media reports.

The total amount stolen was £47 million, though Marks said that no individual would face any financial loss from the incident. HMRC said that individuals' own money wasn't targeted..

"This was an attempt to claim money from HMRC, not an attempt to take any money from you," it said on the HMRC website.

What happened?

The incident appeared to have happened last year, with a subsequent investigation resulting in arrests. It was unclear why the incident is only now being revealed — a point raised by the treasury select committee itself, with Chair Dame Meg Hillier offering "a word to the wise" to advise parliament of such matters rather than let the committee hear about it from the news.

HMRC officials stressed that its systems weren't directly attacked nor breached, but instead involved criminals setting up new accounts in the name of people who didn't need a tax account and didn't have one already set up. The criminals did so using information from phishing attacks or elsewhere, according to HMRC.

However, as the incident was being investigated and addressed, the "nature of the attack altered", said Angela MacDonald, HMRC’s deputy CEO, with the methods used by the attackers evolving throughout time.

"What has been a challenge in terms of... cleaning the accounts up is being clear that we were then talking to the genuine customer and not in fact talking to the criminal who was on the other end of the account," she added, according to the BBC.

Was HMRC hacked?

MacDonald said that the incident was "not a cyber attack, we have not been hacked, we have not had data extracted from us."

She later clarified: "The ability for somebody to breach your systems and to extract data, to hold you to ransomware and all of those things, that is a cyber-attack. That is not what has happened here."

The clarification seems designed to make clear this incident isn't akin to the recent round of cyber attacks against retailers, which has left M&S struggling to recover — though it may also be a reaction to accusations from five years ago that the HMRC was "incompetent" following 11 serious data breaches.

However, treasury select committee Chair Dame Meg Hillier didn't seem to accept the distinction: "Money was got. By criminals. By penetrating the digital system. A lot of people would consider that a cyber crime, however you define it."

Will Richmond-Coggan, a partner specializing in data and cyber disputes at Freeths LLP, suggested the incident showed the impact of previous attacks.

“While HMRC were at pains to stress that their own systems had not been compromised in a cyber attack, this incident nonetheless underscores how widespread the consequences of cyber incidents can be," he noted.

"It is clear from HMRC's explanation that the crime against HMRC was only possible because of earlier data breaches and cyber attacks. Those earlier attacks put personal data in the hands of the criminals which enabled them to impersonate tax payers and apply successfully to claim back tax."

What next?

In a statement given to the press, HMRC said it has “acted to protect customers identifying attempts to access a very small minority of tax accounts”.

The tax office added that it’s currently working with law enforcement agencies in “both the UK and overseas” to find those responsible.

HMRC said on its website that it had locked down all affected accounts, deleted impacted login credentials, removed any incorrect information from tax records, and checked that no other details were changed. It has also written to affected users to let them know. Letters should arrive over the next three weeks.

Any individuals seeking to check their account themselves could sign in, head to Settings in their Profile, and view the sign-in history to look for suspicious activity.

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• This hacker group is posing as IT helpdesk workers to target enterprises
• Cyber scams cost businesses $1.7 million per year, claims report

Increased phishing training is paying dividends for enterprises, according to new research, particularly in larger enterprises.

Analysis from KnowBe4 shows awareness and resilience are improving based on what it describes as ‘Phish-prone Percentage’ (PPP) metrics. This tracks the percentage of employees likely to fall for social engineering or phishing attacks, the company said.

According to the firm’s 2025 Phishing by Industry Benchmarking Report, organizations have a baseline PPP of around a third worldwide on average - but can improve that dramatically with the right training.

Globally, PPP drops on average to 19% after three months' training, and to just 4.8% after 12 months. After a year's training, all regions achieved average improvement rates of more than 80%, with North America showing the biggest improvement at 90%, and South America a close second at 89%.

The highest baseline PPPs were found in South America at 39%, North America at 37%, and Australia and New Zealand at 37%. The most phish-prone of all were organizations with 1,000-plus employees in Australia and New Zealand, with 44.6% happily clicking on simulated phishing hyperlinks.

The most cautious, meanwhile, were organizations with fewer than 249 employees in both Asia and the United Kingdom and Ireland, where fewer than a quarter of employees clicked the links.

"The cybersecurity landscape in the UK and Ireland is rapidly evolving, driven by AI advancements, supply chain vulnerabilities, and a shift in how we view the human element in defense," said Javvad Malik, lead security awareness advocate at KnowBe4.

"AI offers both powerful tools and new risks, while supply chain security has become a critical focus due to its interconnected nature."

In the UK and Ireland, healthcare and pharmaceuticals, consumer services, and hospitality tend to have a higher initial baseline resilience to phishing attacks, especially in the case of larger organizations.

Similarly, bigger firms often start with a higher baseline, but show more substantial improvements over time. Researchers suggested this is perhaps because they can afford more comprehensive training resources.

Notably, KnowBe4 researchers said they have observed a shift in perception, with employers increasingly seeing their staff as a crucial line of defense against cyber threats.

There's also been a move away from punitive approaches to security training, with organizations now empowering employees to make security decisions and report potential threats without the fear of being penalized.

"The biggest shift is the growing recognition of employees as an essential line of defense, with organisations now fostering a culture of cybersecurity awareness," said Malik.

"While progress is being made, it is clear from the data in the Benchmarking Report that sustained security training is essential to drive long-lasting change."

MORE FROM ITPRO

• Fake file converter tools are on the rise – here’s what you need to know
• Hackers are using this new phishing technique to bypass MFA
• Cyber scams cost businesses $1.7 million per year, claims report

Notorious Russian threat group Midnight Blizzard has been mixing up its attack methods in recent months, according to analysis from Check Point, including targeting European diplomats with the lure of luxury events.

In a blog post detailing the campaign, researchers said the threat group has been targeting European governments and diplomats since January this year.

The campaign saw hackers impersonate a “major European Ministry of Foreign Affairs” and target victims with phishing emails inviting them to a wine tasting event.

Malicious emails curated by the group contained a link to deploy a backdoor dubbed ‘GRAPELOADER’, researchers added.

“The emails contained a malicious link that led, in some cases, to the download of an archive, eventually leading to the deployment of GRAPELOADER,” the blog post reads.

“In other cases, the link in the phishing emails redirects to the official website of the impersonated Ministry of Foreign Affairs.”

The malicious emails in question were sent from two distinct domains, according to Check Point - bakenhof[.]com and silry[.]com - and sought to mimic legitimate communications from a particular individual in the fake Ministry of Foreign Affairs.

When the target clicks the malicious link, this initiates the download of an archive dubbed ‘wine.zip’ which sets the next stage of attack in motion. This archive contained three files, including:

• A legitimate PowerPoint executable, ‘wine.exe’, which the group exploited for DLL side loading.
• A hidden DLL, ,AppvIsvSubsystems64.dll’, which researchers said serves as a “required dependency for the PowerPoint executable to run
• Another “hidden and heavily obfuscated” DLL, ppcore.dll, which functions as a loader and used to deliver the payload in later phases of the attack

Once wine.exe is executed and the GRAPELOADER DLL is side-loaded, researchers explained the malware copies contents of the wine.zip archive to a new location on the device disk.

“It then gains persistence by modifying the Windows registry’s Run key, ensuring that wine.exe is executed automatically every time the system reboots,” the blog post noted.

“Next, GRAPELOADER collects basic information about the infected host, such as the host name and username. This collected data is then sent to the Command and Control (C2) server, where it waits for the next-stage shellcode to be delivered.”

Sound familiar? You’re not far off

If you’re wondering why this sounds familiar, it’s because a similar campaign has already been carried out by the Midnight Blizzard.

Last year, the threat group targeted German politicians with fake invitations to a dinner reception using malware dubbed ‘WINELOADER’. This latest campaign, Check Point revealed, is a continuation of that previous flurry of attacks.

In this instance, GRAPELOADER is designed specifically for the initial stages of an attack.

“It is primarily used for fingerprinting the infected environment, establishing persistence, and retrieving the next-stage payload,” researchers said.

Detailed analysis of both show that they share a range of similarities, particularly with regard to code structure, obfuscation techniques, and string decryption processing, the company added.

Notably, Check Point revealed this particular campaign also included a new variant of WINELOADER being used in conjunction with GRAPELOADER, which suggests “codebase overlaps or shared development tactics”.

This new variant displayed improved stealth and evasion techniques, which researchers warned will muddle detection efforts.

Midnight Blizzard doesn’t quit

Midnight Blizzard, also known as Cozy Bear, is among the most active and aggressive threat groups operating globally. With links to the Russian government, the group has been identified as the culprit behind a raft of breaches in recent years, including an attack on Microsoft which saw email communications compromised.

This particular attack saw the group reportedly use password spraying techniques to compromise a legacy account. In the wake of the incident, Microsoft revealed the group was able to access a “very small percentage” of corporate email accounts.

Some of these accounts belonged to members of the tech giant’s senior leadership team, as well as staff from its security and legal teams.

MORE FROM ITPRO

• HPE alerts affected staff after Midnight Blizzard breach
• Sneak-and-peek Midnight Blizzard attack highlights “worrying flaws” in Microsoft security processes
• Midnight Blizzard is on the rampage again, and enterprises should be wary of its new tactics

Hackers are ramping up phishing campaigns involving fake helpdesk domains to target the legal, financial services, and accounting sectors in the US.

According to researchers at EclecticIQ, with the help of threat researchers Silent Push, the Luna Moth group - also known as Silent Ransom Group, UNC3753, and Storm-0252 - has carried out a flurry of 'callback phishing' attacks since March this year.

The group is believed to be linked to the 2021 BazarCall campaign, known for deploying Conti and Ryuk ransomware. However, it's recently turned its focus to data theft and extortion, threatening to expose stolen data on a dedicated leak site and demanding seven-figure ransoms.

In a blog post detailing the group’s TTP’s, researchers said the campaign begins with a phishing email that lures its victim into calling a fake helpdesk number. Here, live operators posing as IT staff deceive victims into installing remote monitoring and management (RMM) tools.

These applications, which include Syncro, SuperOps, Zoho Assist, Atera, AnyDesk, and Splashtop won't be flagged by security software as they're legitimate tools, researchers noted.

However, once installed, they give the attackers access to sensitive data.

Luna Moth then threatens to leak the data publicly on its own clearweb domain unless the victims pay a ransom of between $1 million and $8 million.

In order to collect victim data, the attackers have also registered typosquatted domains via GoDaddy, impersonating US firms to collect contact details and enable targeted social engineering.

Typical examples include [company_name]-helpdesk.com and [company_name]helpdesk.com.

"As of March 2025, EclecticIQ assesses with high confidence that Luna Moth has likely registered at least 37 domains through GoDaddy to support its callback-phishing campaigns," researchers said.

"Most of these domains impersonate IT helpdesk or support portals for major US law firms and financial services firms, using typosquatted patterns."

One example impersonated a US-based law firm, with a Contact Us form collecting names, emails, and a message from the victim, enabling attackers to identify high-value targets. Another uses a 'CISO Helpdesk’ lure.

"By impersonating a helpdesk for Chief Information Security Officers (CISOs), the phishing page leverages the authority and urgency typically associated with executive security communications," said the researchers.

"This approach is designed to increase victim compliance and maximize the chances of compromising privileged accounts within the target organization."

Luna Moth tactics are hard to spot

EclecticIQ warned that Luna Moth’s activities can be hard to spot as no malicious links or attachments appear in the phishing emails. Similarly, victims are installing signed, legitimate software themselves.

Meanwhile, few security tools can handle voice interactions and activity remains local to the infected machine and network.

"This slow-paced, trust-based approach slips past both signature-based and behavioral threat detection, revealing a critical blind spot in modern security architectures," they said.

The best strategy is to lock or restrict installations of Zoho Assist, AnyDesk, and other RMM tools unless they've been explicitly approved, researchers advised.

Organizations should track the use of RMM tools and file transfer utilities like WinSCP or Rclone for suspicious parameters and execution patterns.

They should also use email rules to flag messages from impersonated helpdesk domains, and give staff regular training on social engineering to help spot spoofed invoices and verify suspicious support requests.

MORE FROM ITPRO

• Hackers are duping developers with malware-laden coding challenges
• Fake file converter tools are on the rise – here’s what you need to know
• Why government email servers are top targets for state-backed hackers

The vast majority of phishing attacks against the healthcare sector go unreported to security teams, leaving organizations unable to fully learn from their mistakes.

In a survey of 150 US-based healthcare IT leaders for secure email firm Paubox, six-in-ten said they had experienced at least one email security breach last year, and three-quarters that they expected even more security challenges this year.

The top risks were phishing, man-in-the-middle attacks, and password guessing, often through personal information revealed on social media.

However, IT leaders said 95% of phishing attacks went unreported to security teams, along with 96% of known email violations of the 1996 Health Insurance Portability and Accountability Act (HIPAA), aimed at protecting sensitive health information from disclosure without patient's consent.

As a result, these incidents weren't investigated, meaning that systems weren’t patched, staff weren’t alerted, and patients weren’t warned that their data may be at risk.

"We encountered a significant case where an outdated email system directly impacted patient care due to a cybersecurity breach," said Matt Murren, CEO of healthcare IT support firm True North ITG.

"The phishing attack compromised user credentials and eventually deployed ransomware across the network. It shut systems down for two weeks. Appointments were delayed. Test results were inaccessible. Urgent care cases were diverted elsewhere. Patients lost trust. This isn’t just an IT failure — it’s a patient safety crisis."

The problem doesn't seem to be a lack of awareness amongst staff. Nine-in-ten said they carried out staff training.

Ryan Winchester, CareM director of information technology, said "no amount of training can completely eliminate human error, so businesses must have safeguards in place."

The report found that healthcare organizations currently allocate only 11–20% of their IT budgets to email security, despite email being their top risk area. One persistent problem is poor infrastructure, with 83% of healthcare IT leaders saying that legacy systems disrupt day-to-day operations.

"I’ve seen first-hand how legacy email platforms can quietly — but critically — undermine operational stability and efficiency across healthcare organizations" said Murren.

In larger healthcare networks, the most common challenges include high maintenance costs that drain IT resources, persistent security vulnerabilities, outdated and complex user interfaces, system performance bottlenecks, and limited support for mobile and remote working.

The result is reactive firefighting, with about 37% of healthcare IT leaders spending between 11 and 20 hours per week just resolving secure email tickets.

"Healthcare doesn’t need more patchwork fixes — it needs a mindset shift. Patients expect secure, convenient communication, and it’s on us to meet that standard," said CEO of Paubox Hoala Greevy.

MORE FROM ITPRO

• Are phishing tests a waste of time?
• 10 quick tips for identifying phishing emails
• Phishing tactics: The top attack trends

While inflation is rising around the world, some things are getting cheaper - and one is the cost of launching a phishing attack.

Phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.

This means that even criminals with minimal tech skills can easily steal personal information, carry out identity theft and access bank accounts. Meanwhile, malware infections can lead to the complete loss of device control, enabling cyber criminals to steal files, encrypt sensitive data, or launch ransomware attacks.

"Phishing kits are a force multiplier for cyber crime. They put powerful attack tools into the hands of people who may not have the skills to build them on their own," said Adrianus Warmenhoven, a cybersecurity expert at NordVPN.

"With features like drag-and-drop website builders, email templates, and even contact lists, these kits enable even the least technical attackers to carry out professional-looking scams."

Phishing as a Service is booming

Meanwhile, subscription-based Phishing as a Service (PhaaS) is also on the rise, with these services handling everything from hosting to victim targeting.

“Phishing kits and PhaaS platforms lower the barrier to entry, so we’re seeing a surge in the number and variety of attacks. That means consumers need to be more alert than ever," said Warmenhoven.

The research team found that last year's most commonly impersonated brands in phishing attacks were Google, Facebook, and Microsoft - and that fake URLs imitating these popular platforms are a primary method for cyber criminals to harvest credentials.

Nearly 85,000 fake Google URLs were discovered last year.

Similarly, .exe, .zip, .php, .dll and .pdf were the riskiest extensions when downloading files. Video hosting, entertainment and sports, meanwhile, were the domain categories with the most malware.

According to research from Barracuda Networks, the first quarter of this year showed a massive spike in phishing, with more than a million attacks detected by the firm's systems in January and February.

Tycoon 2FA was the most prominent - and sophisticated - platform, accounting for 89% of incidents in January 2025. Next came EvilProxy, with a share of 8%, followed by a new contender, Sneaky 2FA, with a 3% share of attacks.

To stay safe, Warmenhoven recommended constantly checking suspicious links for misspellings or inconsistencies before clicking, avoiding free video hosting sites, and enabling multi-factor authentication.

"Be cautious of unsolicited emails, especially those offering deals or urgent requests. Always verify the legitimacy of files before downloading and use anti-malware tools to scan them," he said.

"Protect your privacy using tracker blockers to block personal data collection, and ensure your devices are regularly updated to close security vulnerabilities."

MORE FROM ITPRO

• A new phishing campaign is exploiting Microsoft’s legacy ADFS identity solution to steal credentials and bypass MFA
• Why ‘malware as a service’ is becoming a serious problem
• Hackers are using this new phishing technique to bypass MFA

Troy Hunt, the security blogger behind data breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.

In a blog post disclosing the incident, Hunt described how the attack took place, with screen shots of the phishing email, which purported to come from his email marketing provider, Mailchimp.

The trap used a classic phishing tactic of including a button that linked to a page with a similar url to the legitimate one – mailchimp-sso.com (now deactivated) versus mailchimp.com.

Hunt, who said he was “really jet lagged and really tired” at the time entered his credentials and the one time password (OTP) and the page then hung, rather than loading.

“Moments later, the penny dropped,” Hunt wrote. “I logged onto the official website, which Mailchimp confirmed via a notification email which showed my London IP address.”

“I immediately changed my password, but not before I got an alert about my mailing list being exported from an IP address in New York,” he added.

Hunt himself and others in the industry reacting to the news have said this is an example of how hackers exploit human weaknesses to carry out successful attacks.

In the case of Hunt, tiredness led to lack of attention, which in turn led to him falling for a phishing scam of the kind he said he would typically have recognized early.

Erich Kron, security advocate at KnowBe4, said the incident is a prime example of how even a seasoned cybersecurity veteran can fall prey to cyber criminals.

"Social engineering is largely getting the right message to the right person at the right time, and that combination can lead to unfortunate situations such as this.”

Aditi Gupta, principal security consultant at Black Duck, echoed Kron's comments, noting that bad actors deliberately "feed on fear and weaknesses such as tiredness and a sense of urgency" to bait unsuspecting users.

"This recent phishing attack further highlights that, in the end, we are all humans, and sophisticated phishing attacks could get the best of us."

Kron commended Hunt, adding that he “deserves kudos” for revealing what had happened to him and using the incident as an opportunity to educate others.

For his part, Hunt said he has gone through the usual gamut of emotions felt by someone who falls for a scam, including feeling “so stupid” and acknowledged “[his] own foolishness”.

However, he also hit out at some of Mailchimp's own practices that he claimed are poor in relation to data security. These include not offering phishing-resistant two factor authentication (2FA) and not automatically deleting unsubscribed email addresses.

Hunt concluded his blog post by offering his “sincere apologies to anyone impacted by this”, but added that “on balance I think this will do more good than harm and I encourage everyone to share this experience broadly”.

MORE FROM ITPRO

• Hackers are using this new phishing technique to bypass MFA
• 10 quick tips for identifying phishing emails
• How hackers are using legitimate tools to distribute phishing links

Almost all critical national infrastructure (CNI) organizations in the UK (95%) experienced a data breach in the last year, according to new research.

Analysis from Bridewell found that more than half had incurred financial losses of over £100,000 per breach, mostly thanks to cybersecurity upgrades, systems recovery, and increased operational costs.

Cloud services have become the most targeted attack vector across IT and OT environments in UK CNI sectors, the study found, with web browsing and internet access the second biggest.

Similarly, data protection remains a big concern, with nine-in-ten organizations worried about meeting compliance requirements.

The speed of response is the fastest-growing priority, with only 22% of organizations saying they could respond to a ransomware attack within an hour, and 69% within six hours.

Notably, the study found that while nine-in-ten respondents believe they have a mature cybersecurity strategy, only a quarter are following best practices for cyber risk assessments.

Confidence in OT security maturity is even lower, with just a third describing their OT security as 'very mature', compared with 44% for IT security.

CNI organizations concerned about supply chain resilience

Despite growing reliance on third-party providers, only 42% of UK CNI organizations said they were 'very confident' in their ability to handle supply chain cyber threats.

More than half (57%) of respondents experienced a supply chain attack in the past year, with the top three types being firmware attacks, data interception and tampering, and third-party breaches.

Bridewell CEO Anthony Young said the study highlights the need for critical infrastructure organizations to ramp up their cybersecurity capabilities and boost resilience.

“As cyber threats continue to evolve, UK CNI organizations must prioritize rapid incident detection and response, as well as bolster their cybersecurity maturity and strengthen resilience against supply chain risk," he said.

The report highlighted a sharp increase in AI-driven cyber threats, with phishing emerging as the top AI-powered attack vector. Around 83% of respondents specifically highlighted this threat as their top concern in the year ahead.

"With AI taking a bigger role in both attacks and defences, organizations must remain proactive to safeguard critical infrastructure and national security, especially in a tumultuous geo-political climate," Young added.

'Contradictory confidence' placing firms at risk

Dray Agha, senior manager of security operations at Huntress, said the report makes for worrying reading and urged CNI firms to bolster their defences.

"A staggering 25% of breached organizations only realized they were compromised when the attacker told them. This highlights critical failures in detection capabilities: organizations need to improve proactive threat hunting, EDR monitoring, and anomaly detection," he said.

Agha noted that the study also highlighted a “contradictory confidence” among CNI organizations. Around 90% of respondents said they believe their cyber risk assessment practices accurately reflect their security posture, yet 95% suffered breaches.

This overconfidence suggests many organizations may be relying on outdated or incomplete risk models, failing to assess real-world attack pathways."

Conversely, Tim Ward, CEO and co-founder of ThinkCyber Security, said the study does showcase signs of improvement.

Nearly half (40%) of respondents identified employee reporting as a leading method for detecting breaches, he noted, which is encouraging and highlights a growing awareness among staff.

“Organizations also rate investment in training employees most highly as a practice to counter supply chain attacks," Ward added.

"It is imperative for organizational leaders to seek ways to integrate achieving secure behaviors into the day to day for busy staff, whilst they continue to focus on their day jobs. Approaches such as nudging as risks are encountered, and direct metrics of secure behaviors will be key to increasing resilience in these highly targeted sectors."

MORE FROM ITPRO

• Why attacks against critical national infrastructure (CNI) are such a threat
• Data centers will now be classed as critical infrastructure in the UK
• US sanctions Chinese tech firm that targets critical infrastructure

Microsoft 365 is the source of almost half of all healthcare email breaches, thanks mainly to misconfigurations in security settings.

According to Paubox’s 2025 Healthcare Email Security Report, email is the main attack vector in the sector, with Microsoft 365 accounting for 43% of all breaches.

Proofpoint was next, at 13%, followed by Barracuda Networks and Mimecast at 7%, and Google Workspace at 3.%.

The report found that many healthcare organizations are failing to implement fundamental email security protocols, with virtually all breached organizations lacking Mail Transfer Agent Strict Transport Security (MTA-STS) protections and exposing email communications to interception.

More than a third of Microsoft 365 users had Domain-based Message Authentication, Reporting, and Conformance (DMARC) in monitor-only mode, meaning a concerning volume of phishing attempts went undetected.

Notably, researchers found three-in-ten lacked any DMARC records at all. Meanwhile, 12% lacked Sender Policy Framework (SPF) records and four-in-ten had weak configurations, making it easier for attackers to spoof emails.

“HIPAA-regulated entities need to be proactive in ensuring their compliance with the HIPAA rules, and not wait for OCR to reveal long-standing HIPAA deficiencies," warned HHS Office for Civil Rights (OCR) director Melanie Fontes Rainer.

According to the report, there's been a 264% increase in ransomware attacks on healthcare organizations since 2018, with email acting as the main attack method.

Shockingly, though, only 1% of the analyzed healthcare organizations had a low-risk email security posture. Three-in-ten were categorized as high risk, meaning they had multiple security gaps that exposed them to major cybersecurity threats.

According to IBM, the average cost of a healthcare email breach is $9.8 million - and that's before you take into account HIPAA fines, which amounted to more than $9 million last year.

These include a $9.76 million settlement by Solara Medical Supplies, after a phishing attack gave hackers access to eight employee email accounts. More than 114,000 patient records were compromised.

LA Cares was also hit with a $1.3 million fine over systemic security lapses that led to a breach.

"The increasing frequency and sophistication of cyber attacks in the health care sector pose a direct and significant threat to patient safety," said HHS deputy secretary Andrea Palm.

"These attacks endanger patients by exposing vulnerabilities in our health care system, degrading patient trust, disrupting patient care, diverting patients, and delaying medical procedures."

Email attacks show no sign of slowing down

Looking ahead, Paubox said it expects to see more attacks on cloud-based email systems, with attackers developing more sophisticated techniques to exploit misconfigurations and bypass existing security measures.

The use of AI in phishing attacks will also rise, it said.

As a result, organizations will have to work harder, with more healthcare firms required to move from optional security measures to mandatory enforcement of DMARC and SPF.

"The data shows that even the most established email security tools are just a starting point in protecting patient data," said Paubox chief compliance officer Rick Kuwahara.

"To stay compliant, organizations must continuously evaluate their implementations. That can mean adding in additional layers of defense."

MORE FROM ITPRO

• Business email compromise attacks are evolving, but what can be done about it?
• Hackers are using Microsoft Teams to conduct “email bombing” attacks
• Why government email servers are top targets for state-backed hackers

Google appears finally ready to deprecate using SMS codes for multi-factor authentication (MFA) in Gmail, according to insiders at the search giant.

On 23 February, Forbes reported internal sources at Google had revealed the firm made the decision to do away with SMS codes for authentication, with QR codes set to replace them.

A Google spokesperson said that much like its effort to replace passwords with passkeys, it's looking to move away from SMS authentication in light of a global torrent of cyber attacks abusing SMS-based MFA processes.

The primary weakness of SMS code authentication is that attackers trigger the MFA process to intercept the one time passcode (OTP) and use this to compromise accounts.

This can be achieved by tricking victims into revealing their OTPs via social engineering scams, or by taking control of the victim’s phone number via a SIM swapping attack.

The spokesperson said SMS verification also plays a role in ensuring cyber criminals cannot abuse its services for malicious purposes, but has been exploited in some scams like SIM swapping and traffic pumping.

Rishi Bhargava, co-founder of Descope, said Google’s decision to finally do away with SMS code authentication as a pivotal moment in the security industry, but considering the process's weaknesses he labelled the move long overdue.

“Google's decision to abandon SMS authentication is a watershed moment in security, but it's unsurprising, given that SMS has been the weakest link in MFA for years,” he noted.

Bhargava highlighted that Google also cited traffic pumping, which involves criminals tricking service providers into sending OTPs to premium lines they control thus generating profit each time an SMS verification was generated.

“While SMS codes are better than no authentication, they are vulnerable to phishing, SIM swapping, and real-time interception attacks that bypass traditional MFA. What's particularly telling is Google citing 'traffic pumping' scams as a key driver - where fraudsters exploit SMS infrastructure for financial gain.”

Google’s QR code switch set for the ‘near future’, but fears remain

Moving forward, when verifying phone numbers Google will be transitioning to using a QR code that the user can scan using their mobile device.

Firstly, this will significantly reduce an attacker’s ability to trick users into sharing their verification codes as it's far more difficult to share a QR code than a simple six digit number.

The new verification system will also remove the network providers who can be manipulated in SIM swapping and traffic pumping.

QR codes are not without their own weaknesses when it comes to cybersecurity. QR code phishing, or ‘qishing’, is an increasingly prevalent attack vector employed by threat actors.

After Google transitions to QR code verification, cyber attackers may take advantage of the increased usage of the tool and tailor their phishing attack chains to mirror this process.

In one campaign observed by Trend Micro, threat actors were found distributing a malicious QR code disguised as a two-factor authentication method for ‘documents’ being sent to victims.

A senior researcher at Trend Micro told ITPro that QR code-based attacks pose a considerable threat as phones often lack many of the security protections that PCs are equipped with and are an easier target to compromise for attackers.

Google has not given a specific timeframe in which the transition will be made for Google account holders, but added that users should look out for updates from the firm in the ‘near future’.

MORE FROM ITPRO

• INSERT CONTENT

There was a distinct surge in separate malware campaigns delivering the same payload last year, research shows, suggesting hackers are increasingly procuring tools from ‘malware as a service’ platforms.

The malware as a service model is becoming the dominant mode of cyber attacks as the cyber crime space continues to mature into a lucrative ecosystem for hackers for hire.

New research from Darktrace found the malware as a service (MaaS) model was responsible for 57% of all cyber threats detected in the second half of 2024, up 17% from the first half of the year.

A report from WatchGuard also warned it observed an “astronomical surge” in total malware threats in the third quarter of 2024, surpassing 420,000.

Total malware threats refers to the number of unique attempts detected on WatchGuard-protected endpoints with any duplicates - those with the same hash are not counted.

WatchGuard noted this represented a 300% increase on the previous quarter’s figures, which is the largest quarterly rise it has ever observed.

The report stated that one might conclude this surge was driven by an overall increase in new threats, but WatchGuard found that there was actually an “uncharacteristic decline in new threats”.

It noted that the results of its telemetry indicate there has been a “flood of homogenous spam-like malware arriving on endpoints, likely separate malware campaigns with the same payload”.

The report further stated that there are often numerous duplicate malware families from quarter to quarter, but this time there was only one: Glupteba.

WatchGuard described Glupteba as a multi-faceted malware with various capabilities, such as acting as a botnet, stealing information, mining cryptocurrency, and loading other malware onto the system.

Malware as a service rise propped up by phishing attacks

Phishing remains the dominant initial access vector used in these attacks, with Darktrace recording over 30.4 million phishing emails targeting its customers between December 2023 and 2024.

Just under two-fifths (38%) of these emails were targeted spear phishing attacks tailored for ‘high value individuals’.

Darktrace noted 32% of the detected phishing emails contained AI generated text that displayed some form of ‘linguistic complexity’ such as increased text volume, punctuation, and sentence length.

The sophistication of these techniques has blossomed, the report added, stating that 70% of the emails containing AI-enhanced phishing content passed the popular DMARC authentication system, which is used to verify the legitimacy of incoming emails.

Moreover, 55% of all the emails had successfully found their way through all of the target organization’s existing layers before being detected.

Attacks leveraging QR codes, or qishing, have become a growing trend in today’s threat landscape, exploiting the often-weaker security of mobile devices, and Darktrace detected just under a million (940,000) malicious QR codes in the emails it analyzed.

Legitimate service attacks are another key focus

The report also noted threat actors were often seen abusing legitimate services to lend authenticity to their scams. The researchers observed hackers exploiting a number of trusted services such as Microsoft Sharepoint, Zoom Docs, QuickBooks, HelloSign, and Adobe to disguise their sender address.

In addition, trusted service providers were also appropriated as parts of the threat actor’s attack infrastructure, Darktrace noted.

“Threat actors were frequently observed using redirects via legitimate services like Google to deliver malicious payloads, effectively evading detection,” the report said.

“Additionally,Darktrace noted instances where attackers hijacked email accounts, including Amazon Simple Email Service (SES) accounts, belonging to legitimate third parties, such as business partners and trusted vendors.”

ITPro learned that living off trusted services (LoTS) attacks are becoming an increasingly important part of the threat actors arsenal as general security awareness among their targets grows.

A recent report from security firm Mimecast explained that while these tactics often make their attacks more complex, it helps attackers get around increased authentication checks on corporate accounts.

It added that major cloud providers whose services are often abused in these attacks, namely Google and Microsoft, have begun taking steps to root out the malicious use of their platforms in such attacks.

As a result, threat actors have been observed migrating to slightly smaller trusted services providers that they can use to lend authenticity to their attacks.

MORE FROM ITPRO

• What is hackbot as a service and are malicious LLMs a risk?
• The ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry
• Open source malware surged by 156% in 2024