grep -rl "phishing" ./articles
Microsoft says extortion groups tied to ShinyHunters and Helix are phoning staff about urgent passkey or single sign-on updates, then steering them into relayed sign-ins or device-code approvals. Once in, they register an MFA method of their own, map the tenant through Microsoft Graph and take files at under 1,000 an hour to stay unremarkable.
Phishing that reached 347,000 Trezor newsletter subscribers came from Trezor's genuine Brevo account, so it passed every sender check. Brevo's post-mortem says the attacker created an account, switched on single sign-on, invited real Brevo users into it, and was then let into every organisation those users could reach. Early coverage spoke of stolen login details. Brevo's account involves none.
Attackers hid characters from Unicode's Tags block inside words like funding and credit, splitting them so keyword matching could not see them, and pushed up to 2.37 million messages a day. Microsoft says over 99% were caught anyway — by sender reputation, IP and domain signals. The technique defeated exactly one layer.
Marcus Hutchins at Expel picked apart SynkLoader, pushed through Microsoft Teams by attackers posing as the IT help desk and hosted on Azure so the download looks legitimate. Its PhishLocker module paints a convincing Windows 11 lock screen to harvest the password. It is a borderless full-screen app, and Alt+Tab exposes it.
MalwareHunterTeam spotted the technique in July and SOCRadar says it is still running. A phishing ZIP drops a shortcut file, the shortcut connects to an FTP server and takes commands from the greeting banner, and either E4del or PINHOLE lands. Novel — and SOCRadar notes that being novel is also what makes it visible.
Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.
Flight 591 out of Las Vegas carried 199 passengers and a network called 'Delta WiFi Fast' that served a page harvesting Google logins. Crew killed the Wi-Fi for 30 minutes; federal officers boarded on landing.
Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.