#Phishing
All CosmicBytez Labs articles tagged #Phishing, across news, security advisories, how-to guides, and projects.
- News
Global Takedown Hits Network Behind 1 Billion Phishing Messages
Microsoft, Japan's NPA, and partners dismantled YAM Store, a phishing-kit marketplace tied to over 1 billion malicious messages in 150 countries.
- News
Cyberattack on Arizona's Court System Exposes Data on Over 1.3 Million People
A phishing-triggered breach of Arizona's court system exposed fines, protection orders, and foster care records dating back decades.
- News
Fake ChatGPT, Gemini, and Claude Sites Steal Advertising Accounts and MFA Codes
A browser-in-the-browser phishing campaign impersonates AI tools to hijack ad account managers' logins and real-time MFA codes.
- News
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Island researchers disclosed a human-operated phishing platform impersonating ChatGPT, Gemini, and Claude ad portals to steal logins and MFA codes.
- News
Nikkei Discloses Breaches of Employee Microsoft 365, Google Workspace Accounts
Japanese publisher Nikkei disclosed breaches of two employee email accounts, one used to send roughly 9,000 phishing emails to staff and sources.
- News
The EDR Blind Spot: 3 Ways Browser Attacks Evade Endpoint Telemetry
AiTM phishing, malicious extensions, and clipboard-hijack attacks finish inside the browser, leaving little for endpoint detection tools to catch.
- News
Know Your Enemy: Browser-Based Attack Techniques in 2026
Six browser-native attack techniques — from AiTM phishing kits to malicious extensions — now carry the entire intrusion chain inside a single browser tab.
- News
Russian APT Star Blizzard Uses 'RedFlick' Infection Chain in Recent Attacks
FSB-linked Star Blizzard shifted to a 'RedFlick' infection chain, hitting 100+ Ukraine-linked orgs since January to deploy the CosmicPulse backdoor.
- News
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
FSB-linked Star Blizzard dropped ClickFix for a one-click 'RedFlick' chain, expanding phishing beyond Ukraine to deploy its CosmicPulse backdoor.
- News
Arizona Supreme Court Says Hackers Stole Residents' Personal Data
Hackers used a phishing email to steal protective-order and foster care records from Arizona's court system, affecting many residents.
- News
Former US Air Force Members Sentenced to 189 Months Combined Over BEC Scheme
Two former U.S. Air Force members were sentenced to a combined 189 months in prison for a two-year BEC and phishing scheme that stole millions.
- News
Former US Air Force Members Sentenced to Prison for $2 Million Cyber Fraud Scheme
Chijioke Odimegwu and Harafat Mogaji, both former Dover AFB airmen, received a combined 189 months for a multiyear BEC and phishing scheme.
- News
'Salesbleed' Exploits Salesforce Agentforce to Enable Anonymous Slack Phishing
Zenity Labs: chained Agentforce flaws let attackers bleed CRM data via Web-to-Lead forms, then hijack a trusted agent to phish staff in Slack.
- News
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Microsoft details passkey-themed social engineering that hijacks Microsoft 365 accounts, plus a 1M-email AI-driven CEO invoice fraud campaign.
- News
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
Roundup: novel InjectEave EM eavesdropping, an AT&T insider's SIM-swap sentencing, a Glasswing audit, and a $10M bounty on an Iranian cyber chief.
- News
Passkey-Themed Phishing Attacks Lead to Microsoft 365 Data Theft
ShinyHunters and Helix affiliates use fake passkey/help-desk lures with AiTM and device-code phishing to steal Microsoft 365 data.
- News
Phishing Research Challenges Conventional Security Awareness Testing
Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks.
- News
Trezor: 347,000 Users Targeted in Phishing Attacks After Brevo Breach
A breach at email platform Brevo let attackers hijack Trezor's newsletter account and phish 347K addresses; 2,500 users clicked the malicious link.
- News
Phishing Campaign Used Invisible Unicode Tag Characters to Slip Past Filters
Microsoft found a high-volume phishing operation hiding invisible Unicode tag characters inside words like 'funding' to dodge keyword-matching filters.
- News
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
A $320/month AitM phishing kit rides real Docusign notification emails to relay Microsoft 365 logins and steal live session cookies.
- News
Hackers Abuse npm Mirrors to Host Phishing Redirect Pages
Threat actors are planting malicious HTML packages on npm and its mirrors that impersonate Cloudflare CAPTCHAs, silently redirecting victims to attacker sites.
- News
24 npm Packages Abuse unpkg CDN to Host Fake Cloudflare CAPTCHA Phishing Pages
Attackers published 24 npm packages using the unpkg CDN as malware hosting infrastructure, serving ClickFix CAPTCHA lures to steal credentials.
- News
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Two new malware loaders — WordlistLoader and SynkLoader — deliver ransomware-enabling payloads and steal Windows credentials via phishing.
- News
WordlistLoader & SynkLoader: New Malware Families Delivering Infostealers and Phishing Windows Credentials
Two new malware loaders target ransomware access brokering: WordlistLoader drops Amatera Stealer via ClickFix, SynkLoader harvests Windows credentials.
- News
New SynkLoader Malware Pushed in Microsoft Teams Phishing Campaign
SynkLoader is a new modular loader spread via Teams vishing that steals credentials, tunnels network traffic, and gives attackers persistent remote access.
- News
FBI: Hackers Using Social Engineering to Breach Accounts and Steal Explicit Content
The FBI warns hackers are breaching social media accounts to steal explicit content via credential stuffing, impersonation, and fake clone sites.
- News
When Credentials Are No Longer Enough: Device Trust in the AI Era
AI is making phishing, credential theft, and MFA bypass faster and cheaper than ever. As traditional trust signals — passwords, MFA codes, IP geolocation...
- News
Valve Notifies Steam Hardware Customers of CEVA Logistics Data Breach
Valve is notifying Steam hardware customers in Europe that hackers stole shipping and personal data after compromising its logistics partner CEVA...
- News
In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street
This week's security roundup: Apple caps bug bounty submissions as AI-generated reports surge, NC ports hit by cyberattack, hedge funds targeted by...
- News
COLDCARD Security Audit Phishing Attack Installs Remote Access Tool
Attackers impersonating COLDCARD hardware wallet makers are sending fake 'security audit' emails to exploit user anxiety over the RNG vulnerability....
- News
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
State-sponsored threat group 'Laundry Bear' is weaponizing a Zimbra zero-day using half-click phishing emails that trigger exploitation simply by opening...
- News
CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
New research from CTM360 shows that phishing campaigns targeting insurance and financial portals have moved beyond simple credential harvesting. Attackers...
- News
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
Attackers are modifying DNS settings on Wi-Fi devices at hotels and conference centers to redirect users attempting to reach Microsoft 365 to convincing...
- News
Russian APT 'Laundry Bear' Exploited Zimbra Zero-Day with Half-Click Email Attack
Russia-backed Laundry Bear (Void Blizzard/TA488) exploited CVE-2025-66376 — a stored XSS flaw in Zimbra's Classic UI — to compromise US, Ukrainian, and...
- News
AegisAI Raises $36 Million for AI-Powered Email Security
AegisAI has closed a $36 million funding round led by Battery Ventures, Accel, and Foundation Capital, bringing the company's total raise to $49 million...
- News
ShinyHunters Data Leaks Fuel $2,000 Sextortion Email Scam
Threat actors are leveraging email addresses exposed in ShinyHunters data breaches to send highly personalized sextortion emails demanding $2,000 in...
- News
AegisAI Raises $36 Million to Fight AI-Crafted Phishing with AI Defenses
AegisAI has closed a $36M Series A, bringing total funding to $49M, to scale its AI agent-based email security platform purpose-built to counter the rise...
- News
ChatGPT 'AgentForger' Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Zenity Labs disclosed a critical cross-site agent forgery vulnerability in ChatGPT's Workspace Agent Builder that let a single phishing link silently...
- News
Identity Attacks Overtake Exploits as Top Ransomware Cause
Sophos 2026: 79% of ransomware attacks start with stolen identities. MFA was present in 97% of credential-based cases yet failed to stop every one of them.
- News
Turning the Tables on Email Scammers With 'ScamBuster'
An open-source, AI-driven system called ScamBuster adopts victim personas to actively engage with phishing attackers — gathering intelligence on criminal...
- News
Misconfigured Server Exposes Three Evilginx Phishing Ops Targeting M365
An attacker's operational security mistake — leaving a Python HTTP server and .bash_history exposed on a public port — allowed researchers to uncover...
- Project
Gophish Phishing Simulation Lab: Security Awareness Testing in Docker
Deploy a self-hosted phishing simulation platform using Gophish in Docker. Build real-world phishing campaigns, track user engagement, and run security...
- News
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS
Phishing kits now fingerprint victims via user-agent headers to deliver OS-specific payloads automatically — device code phishing attacks spiked 1,380% in...
- News
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat
Palo Alto Networks Unit 42 queried AI models 685,000+ times and found they hallucinate 2.1 million plausible-but-fake domains — attackers are now...
- News
ARToken PhaaS Exposes EvilTokens' Microsoft 365 Phishing Toolkit with AI-Powered BEC
Cisco Talos has uncovered ARToken, a Phishing-as-a-Service platform affiliated with EvilTokens that weaponizes Microsoft's OAuth device code flow to...
- News
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Blackpoint Cyber researchers have uncovered Avalon, an AI-assisted modular malware framework that chains phishing, credential theft, lateral movement, and...
- News
236,000 DCloud Uni-App Sites Powering Crypto Scams and Wallet Drainers
Infoblox researchers have uncovered over 236,000 websites built on the legitimate DCloud Uni-App framework being weaponized for investment scams,...
- News
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Abuse
Russian FSB-linked APT group Gamaredon has mounted 35 distinct spear-phishing campaigns against Ukrainian targets in 2025, deploying an expanded malware...
- News
U.S. Offers $10 Million for Russian Hackers Targeting WhatsApp and Signal Users
The U.S. Department of State is offering up to $10 million through its Rewards for Justice program for information identifying members of UNC5792 and...
- News
FBI: Russian Hackers Now Target Signal Backup Recovery Keys
The FBI and CISA warn that a Russian-linked phishing campaign targeting Signal users has evolved to steal Backup Recovery Keys, giving attackers full...
- News
Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Ukraine's SSU and the FBI have exposed a sustained Russian intelligence campaign using fake support SMS messages to steal Signal, WhatsApp, and Telegram...
- News
Ukraine and FBI Expose Russian Intelligence Campaign Stealing Signal Credentials via Fake SMS
The SSU and FBI jointly disclosed a sustained Russian intelligence operation targeting messaging credentials of government officials, military personnel,...
- News
Russia Used Social Engineering to Breach Prominent Messaging Accounts, Ukraine Says
Ukraine's SBU and the FBI have jointly exposed a long-running Russian intelligence operation using fake tech-support workers to steal messaging app...
- News
INTERPOL Warns Phishing, Ransomware, and AI Scams Are Rising Across Asia-Pacific
A new INTERPOL report reveals a dramatic surge in Asia-Pacific cybercrime, with phishing rates nearly double the global average, ransomware attacks...
- News
WhatsApp Phishing Attack Uses Fake Business Docs to Hack PCs
An active malware campaign is targeting WhatsApp users across multiple countries with deceptive messages pushing VBScript-based droppers disguised as...
- Newsletter
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
- News
Fake Microsoft Security Alerts Used to Deploy North Korean NarwhalRAT Malware
North Korean state-sponsored group APT37 (ScarCruft) is conducting spear-phishing campaigns impersonating Microsoft Account security notifications to...
- News
FBI and Google Dismantle 'Outsider Enterprise' Phishing Service
A joint FBI and Google operation took down the Outsider Enterprise phishing platform — responsible for over 9,000 fake sites, nearly 4 million stolen...
- News
FBI and Google Dismantle 'Outsider Enterprise' Phishing-as-a-Service Platform
A joint FBI and Google operation has dismantled the 'Outsider Enterprise' phishing-as-a-service platform responsible for over 9,000 phishing sites, nearly...
- News
Sniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts
Cybersecurity researchers have uncovered a large-scale phishing campaign by the Sniper Dz threat group targeting Middle East and North Africa users...
- News
FBI Dismantles Massive AI-Powered Chinese Phishing-as-a-Service Operation
The FBI, Google, and Black Lotus Labs jointly dismantled Outsider Enterprise, a massive Chinese phishing-as-a-service platform that operated over one...
- News
ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories
This week's threat intelligence roundup covers a supply chain attack kit posted publicly, a $5,000-per-month RAT that clones browser sessions, AI agents...
- News
What the 2026 DBIR Confirms: Attacks Are Living in the Browser
The 2026 Verizon DBIR confirms phishing, shadow AI, malicious extensions, and credential theft now execute inside the browser, exposing major security gaps.
- News
In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks
Noteworthy cybersecurity stories from the week: Trump Mobile exposes customer data, phishers target 2026 FIFA World Cup fans, and CISA responds to recent...
- News
Chinese-Speaking Fraud Gang Targets 2026 World Cup Fans with 4,300 Fake FIFA Domains
A Chinese-speaking cybercriminal group has registered over 4,300 fraudulent domains impersonating FIFA's official web presence since August 2025,...
- News
Ghostwriter Targets Ukraine Government Entities with Prometheus Phishing Malware
The Belarus-aligned Ghostwriter APT (UAC-0057/UNC1151) has launched a new phishing campaign impersonating Prometheus, a Ukrainian e-learning platform, to...
- News
FBI Warns of Kali365 Phishing-as-a-Service Targeting
The FBI has published an advisory on Kali365, a Telegram-based phishing-as-a-service platform that captures legitimate OAuth tokens to gain persistent...
- News
Tycoon2FA Hijacks Microsoft 365 Accounts via Device-Code
The Tycoon2FA phishing-as-a-service platform has added device-code phishing to its arsenal and abuses Trustifi click-tracking URLs to bypass Microsoft 365...
- News
''FrostyNeighbor'' APT Carefully Targets Govt Orgs in Poland, Ukraine
A Belarusian nation-state threat group dubbed FrostyNeighbor is conducting a precise espionage campaign against government organizations in Poland and...
- News
KongTuke Hackers Now Use Microsoft Teams for Corporate
Initial access broker KongTuke has pivoted to Microsoft Teams for social engineering attacks, gaining persistent access to corporate networks in as little...
- News
New Bluekit Phishing Kit Features AI Assistant and Automated Domain Registration
A newly discovered phishing-as-a-service toolkit called Bluekit is emerging on underground forums, offering threat actors an AI assistant for campaign...
- News
ConsentFix v3 Automates Azure OAuth Abuse With Mass
A new iteration of the ConsentFix attack toolkit has surfaced on cybercriminal forums, adding automation and scaling capabilities to OAuth consent...
- News
Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive
Researchers at Infoblox and Confiant have uncovered a dual-threat fraud operation active since 2020: fake CAPTCHA pages secretly send up to 50...
- News
Microsoft to Roll Out Entra Passkeys on Windows in Late
Microsoft is rolling out passkey support for phishing-resistant passwordless authentication to Microsoft Entra-protected resources from Windows devices...
- News
No Exploit Needed: How Attackers Walk Through the Front
Stolen credentials remain the dominant initial access vector in 2026 — no zero-days, no malware, just valid logins that blend in with normal activity...
- HOWTO
Phishing Trends Hitting Western Canadian SMBs in 2026
Five phishing patterns we're seeing specifically targeting small businesses across Alberta, Saskatchewan, and BC in 2026 — including invoice fraud…
- News
Apple Account Change Alerts Abused to Send Phishing Emails
Threat actors are exploiting Apple's legitimate account change notification system to embed fake iPhone purchase scams inside genuine Apple emails,...
- News
Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks
Following law enforcement disruption of the Tycoon 2FA platform, threat actors are reusing its tools and techniques across a wave of new phishing kits,...
- News
Ukraine Confirms APT28 Campaign Targeting Prosecutors and Anti-Corruption Agencies
Ukraine's CERT-UA has confirmed a suspected APT28 espionage campaign targeting Ukrainian prosecutors and anti-corruption agencies, exploiting Roundcube...
- News
Cybercriminals Target Accountants to Drain Russian Firms'
Cybercriminals are stealing millions from Russian companies by compromising accountants' computers and disguising fraudulent transfers as routine salary...
- News
Traffic Violation Scams Switch to QR Codes in New Phishing
Scammers are sending fake "Notice of Default" traffic violation SMS messages impersonating state courts across the U.S., pressuring recipients to scan a...
- News
Device Code Phishing Attacks Surge 37x as New Kits Spread
Device code phishing attacks abusing the OAuth 2.0 Device Authorization Grant flow have exploded 37-fold in 2026 as ready-made phishing kits proliferate...
- News
CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails
Ukraine's Computer Emergency Response Team (CERT-UA) has disclosed a large-scale phishing campaign in which threat actor UAC-0255 impersonated the agency...
- News
New Infinity Stealer Malware Grabs macOS Data via ClickFix
A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka...
- News
Manager of Botnet Used in Ransomware Attacks Gets 2 Years
Ilya Angelov, co-leader of the TA551/Mario Kart cybercrime group, was sentenced to two years in prison for operating a phishing botnet that sent 700,000...
- News
FBI Warns Russian Intelligence Targeting Signal and WhatsApp in Mass Phishing Campaign
FBI and CISA alert warns Russian state actors have compromised thousands of messaging accounts belonging to US government officials, military personnel,...
- News
Operation Synergia III: Police Sinkhole 45,000 IPs in Global Cybercrime Crackdown
An international law enforcement operation codenamed Operation Synergia III has sinkholed 45,000 IP addresses and seized servers linked to ransomware,...
- News
Europol-Coordinated Action Dismantles Tycoon2FA — 330
An international coalition led by Europol and Microsoft has taken down Tycoon2FA, a phishing-as-a-service platform responsible for 87.5 million phishing...
- News
Operation Epic Fury Triggers Unprecedented Cyber Escalation
Following the joint U.S.-Israeli military operation against Iran, Palo Alto Networks Unit 42 reports an unprecedented surge in cyber retaliation with...
- News
Diesel Vortex: Russian Cybercrime Ring Steals 1,649
A Russian-linked phishing operation dubbed Diesel Vortex has stolen over 1,649 credentials from major freight and logistics companies across the US and...
- News
ClickFix Campaign Targets European Hotels with Fake
A sophisticated phishing campaign dubbed PHALT#BLYX is targeting European hospitality organizations with fake Booking.com cancellation emails that display...
- News
6.8 Billion Emails Exposed Online in Massive Data Leak
A hacker revealed 6.8 billion email addresses online on February 11, 2026, in one of the largest email database leaks in history, raising concerns about...
- Security
Windows SmartScreen Bypass Under Active Exploitation
Actively exploited Windows Shell vulnerability bypasses SmartScreen protection, allowing malicious files to execute without security warnings. Patch...
- Security
WinRAR Path Traversal Flaw CVE-2025-8088 Actively Exploited
Critical path traversal vulnerability in WinRAR enables ransomware and credential theft as Russian and Chinese threat actors weaponize phishing campaigns...
- News
FBI Warns of AI-Generated Deepfake Phishing Targeting
The FBI and CISA issue joint advisory on sophisticated AI-generated deepfake voice and video attacks targeting C-suite executives in financial...
- News
AI-Powered Phishing Achieves 54% Click-Through Rate
Microsoft reveals adversaries using AI for automated vulnerability discovery, phishing campaigns, and malware generation. AI-crafted phishing emails...