Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or block. https://www. securityweek.com/new-phish

Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or block. https://www.

Device Code Phishing: The Microsoft 365 Attack That Walks Past MFA http:// scamdrill.com/blog/m365-oauth- device-code-phishing

Device Code Phishing: The Microsoft 365 Attack That Walks Past MFA http:// scamdrill.com/blog/m365-oauth- device-code-phishing

Community Health Care Inc. Reports Data Breach After Phishing Attack A phishing attack compromised a single Community Health Care Inc. employee email account, exposing Social Security numbers, contact

It is great having a SOC Analyst in the house! https://www. linkedin.com/pulse/family-targ eted-phishing-deconstructing-attack-anna-franz-8nv7e/ # phishing

OAuth Consent Phishing: The Attack a Password Change Does Not Fix A new FBI IC3 advisory describes an attack that survives both a password change and multi-factor authentication, because it never touc

Heart Care Centers of Illinois Reports Multi-Month Email Breach Following Phishing Attack Heart Care Centers of Illinois reports a data breach after a phishing attack allowed unauthorized access to an

Heart Care Centers of Illinois Reports Multi-Month Email Breach Following Phishing Attack Heart Care Centers of Illinois reports a data breach after a phishing attack allowed unauthorized access to an employee email account for over two months in 2024. The breach, discovered in 2026, exposed sensitive patient information including Social Security numbers, financial data, and detailed medical records.

Mixed Cybersecurity Incidents and Announcements

This cluster aggregates unrelated security news: DCSync attacks, Operation STANDOFF malware, a Houston City College breach of 831,642 records, FFmpeg vulnerabilities, and PortSwigger's Burp AI tool announcement. No single narrative unifies these disparate incidents.

A Phishing Trip with Fancy Bear Hands-on analysis of a real APT28 attack chain — phishing email → payload → persistence → C2. Interactive platform, real artefacts, free tools only. Beginner-friendly.

AmnesiaStealer Introduces Interactive Browser Session Hijacking to macOS https:// packetstorm.news/news/view/428 85 # news

AmnesiaStealer Introduces Interactive Browser Session Hijacking to macOS https:// packetstorm.news/news/view/428 85 # news

Phishing Landscape 2026 – Who were the Most-Phished Brands? Phishing attacks take advantage of well-known brands (either in the phishing content or in the domain names used as part of phishing attacks

Fort Scott restores systems after ransomware attack # Ransomware # Phishing # Kansas # Microsoft # OneDrive # Antivirus https:// dysruptionhub.com/fort-scott-r ansomware-recovery/

Cisco report: phishing and remote management tools drive Q2 2026 attacks

Cisco Talos Incident Response's Q2 2026 report identifies phishing and weaponized remote management tools as primary tactics for initial access and persistent compromise. Attackers are bypassing multi-factor authentication, exploiting organisations' own infrastructure for stealthy intrusion.

Exactly one year after I drafted an article about a phishing attack delivered through a calendar invitation, my son received the same kind of attack. It claimed that a $499.99 PayPal charge had been p

Exactly one year after I drafted an article about a phishing attack delivered through a calendar invitation, my son received the same kind of attack. 99 PayPal charge had been processed and urged him to call a fake support number.

Kimsuky group targets diplomats with phishing and malware

North Korean threat actor Kimsuky conducted phishing attacks impersonating diplomatic officials, deploying PebbleDash and PrxClient malware. Security researcher Ahnlab published analysis of the campaign targeting diplomacy workers.

Cybersecurity phishing alert mixed with garden anecdote

Bsky post about a new phishing attack discovered by NCSC and Five Eyes partners, followed by unrelated Mastodon post about maintaining a bird bath in a garden. No connection between items.

JUMPSEC analyzed the BlueNoroff phishing kit's source code. The DPRK ClickFix attack fakes Zoom and Teams calls to profile and drain crypto wallets. # BlueNoroff # ClickFix # Lazarus # CryptoTheft htt

⚪️ Trezor and BitBox Owners Targeted in Another Phishing Attack 🗨️ Representatives of hardware cryptocurrency wallet makers Trezor and BitBox have warned users about phishing emails disguised as urge

Mon Health Medical Center Discloses Phishing Breach Affecting Patient Data Mon Health Medical Center reported a data breach affecting 2,173 individuals after a phishing attack allowed unauthorized acc

New. Any.Run: CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access https:// any.run/cybersecurity-blog/csu ite-attack-analysis/ # infosec # malware # malwareanalysis

⚪️ Defusing Email Threats: A Simple Guide to Recognizing Phishing Attacks 🗨️ Phishing is one of the most common attack vectors and one of the most popular forms of social engineering. That’s no surpr

[wiki Δ-1630] Social engineering (security)

OnyRiv: → Remove 2014 Sony pictures leak, no evidence given to support it was a phishing attack

This polymorphic phishing attack uses server-side randomization to generate unique, obfuscated pages for every request, rendering traditional signature-based detection ineffective. Defenders should in

New article: When AI Hallucinations Turn Into Phishing Infrastructure — An examination of how AI hallucinations are reshaping phishing tactics and expanding attacker toolkits. This piece covers attack

Expel analyzed the SynkLoader malware attack chain. Discover how SynkLoader malware uses Teams phishing and fake lock screens to steal credentials. # SynkLoader # Malware # CyberSecurity # Expel # Thr

When a coding test for a job interview turns into a # phishing attack - I did not know, that this is a legit attack vector. I wrote about what happened to a friend of mine when contacted by a recruite

A new PhaaS toolkit named iAuthFlow V2 captures passkey registrations during phishing sessions and uses them as persistent backdoors that survive password resets. Passkeys, widely marketed as phishing

LHC Group Vishing Attack Exposes Protected Health Information LHC Group suffered a data breach after an employee fell victim to a voice phishing attack, allowing the hackers to steal credentials and a

FortiGuard Labs observed a Casbaneiro attack campaign targeting users in Latin America, using phishing emails and PDF files themed around fake invoices and legal notices as the initial stage. https://

Microsoft detected a campaign sending 2 million emails daily using invisible Unicode characters hidden in financial keywords. The technique, called ASCII smuggling, was borrowed https:// deafnews.it/e

Microsoft detected a campaign sending 2 million emails daily using invisible Unicode characters hidden in financial keywords.

Unrelated tech, geopolitics, and security fragments

Cluster mixes Fairphone Linux phone charging, Middle East defense pact, DOE nuclear projects, and RDP honeypot data with no single story. Reports span consumer hardware, international security, energy policy, and cybersecurity intelligence.

🔹 SecurityWeek ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited A ReliaQuest employee fell victim to a phishing attack and the hackers gained access to a dashboard. The post ReliaQu

Spain's AEPD disclosed the first notified breach where an AI agent chained multiple attack stages autonomously. It moves beyond AI-assisted phishing to agent-driven execution across the kill chain, wi

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Mixed tech, climate, and infrastructure developments span August–September

Disparate reports cover Samsung Galaxy S27 camera redesigns (2026-08-25), Anthropic's Claude memory integration (2026-08-25), Bangkok flooding and California ocean phenomena (2026-09-28), and an NRC workforce assessment (2026-09-29). A systemd SSD issue also circulated online (2026-08-27).

Namibia Investigates RansomHouse Ransomware Attack on Ministry of Defence The Namibian Ministry of Defence and Veterans Affairs suffered a ransomware attack by the RansomHouse group after an officer c

ShinyHunters Claims Theft of 284 Million Records from McKesson via Vishing Attack McKesson Corporation reports a data breach after the ShinyHunters group used voice phishing to compromise employee Okt

ShinyHunters Claims Theft of 284 Million Records from McKesson via Vishing Attack McKesson Corporation reports a data breach after the ShinyHunters group used voice phishing to compromise employee Okta credentials and access Salesforce and Snowflake environments. The attackers claim to have stolen 284 million records containing sensitive patient medical and identity information, demanding a $55 million ransom.

🚨 # CSuite is hitting tech, government, and manufacturing, with 60% of its victims from the US The operation blends device-code # phishing , M365 session theft, and RMM abuse. See how CSuite works an

You can be on the real @X website & still get hacked. This # phishing attack looked so convincing that I almost fell for it. Attackers don’t need your password. Here’s how the scam works & how to spot

Lampard Prepares Coventry to Face Arsenal in Premier League Opener Coventry City's head coach Frank Lampard has urged his squad to rise to the occasion ahead of their Premier League debut. The newly p

Lampard Prepares Coventry to Face Arsenal in Premier League Opener Coventry City's head coach Frank Lampard has urged his squad to rise to the occasion ahead of their Premier League debut. The newly promoted side faces a daunting challenge as they prepare to host the reigning champions, Arsenal.

You can be on the real @X website & still get hacked. This # phishing attack looked so convincing I almost fell for it. Attackers don’t need your password. I show how the # scam works. If you dig a li

We've seen quite a few of these phishing kits popping up lately. Here's some insight into one called Knight Office. Analysis by Andrea Hatcher, @ threatresearch @ tanner and @ LindseyODWelch from @ hu

Trellix’s latest threat-hunting report traces state-backed phishing, the DarkSword iPhone exploit kit, a Node.js-based crypto stealer and poisoned Axios npm packages across five covert campaigns. List

ReliaQuest confirms failed data-theft attack after ShinyHunters breach

Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team.

The mechanism is elegant in its devastation. Malicious and jailbroken large language models now handle phishing content, malware generation, vulnerability analysis, and target profiling. The herd has

German police read Signal, Telegram, WhatsApp messages without breaking encryption

Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Credentials

Hackers are modifying DNS settings on Wi-Fi equipment in hotels and conference centers to redirect guests to fake Microsoft 365 login pages, compromising authentication tokens and corporate accounts. The attack exploits the business travel infrastructure of enterprise employees.

Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud

com/microsoft-ev... The popular phishing-as-a-service platform used AI throughout the attack chain, allowing cybercriminals to steal tokens for account takeover and business email compromise.

Infoblox's Darby Wise & Nick Sundvall look inside an adversary-in-the-middle phishing (AiTM) campaign targeting universities, enterprises, and multinational institutions, including European Union & Un

Infoblox's Darby Wise & Nick Sundvall look inside an adversary-in-the-middle phishing (AiTM) campaign targeting universities, enterprises, and multinational institutions, including European Union & United Nations agencies. https://www.

New on Insinuator: Part 1 of a four-part series on token theft in Microsoft Entra ID, accompanying ERNW White Paper 80. The target is no longer the password or even MFA, but the token issued once auth

Microsoft disrupted the EvilTokens device code phishing operation this week, confirming the technique is now industrial-scale MFA bypass. The target signs in on the real Microsoft page with real MFA,

Unexpected "Hi, How Are Things?" Can be a Phishing Indicator A cold sales email using an innocuous "how are you?" opener, then falsely claiming an existing conversation ("great to hear back from you")

The Domains Keep Disappearing, but the Malware Infrastructure Behind Them Never Moves

Decoding a Recent Wallet Hack: A Post-Mortem to Boost Your Security

"GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign" published by CloudSEK. # GitHub , # NPM , # PolinRider , # NullRece

SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents

21929v1 Announce Type: new Abstract: Agent skills extend coding agents with task-specific instructions, scripts, and resources, but they also create a trusted instruction channel that can be abused beyond conventional security attacks. This paper studies token amplification through skill injection: an economic resource-abuse threat in which a malicious skill causes an agent to consume substantially more tokens than needed for normal task execution.