tag: Phishing · 58 items
- Engineer — Plan: Device code phishing abuses the OAuth device authorization grant, which many cloud tenants leave unrestricted by default; audit Conditional Access policies in Entra ID to block or scope device code flow to legitimate managed devices only.
- SOC/IR — Act: Active named campaign targeting U.S. organizations via device code auth abuse — hunt for anomalous device code authentication events in Entra ID/M365 sign-in logs (filter on ‘DeviceCode’ grant type) and flag suspicious OAuth token issuances since at least early October 2026.
- Leader — Learn: This campaign highlights that modern account takeover can succeed through legitimate auth flows rather than credential theft, making it harder to detect via traditional controls; useful framing for risk conversations but no immediate leadership action required absent a confirmed breach at a dependent vendor.
- Engineer — Plan: Evaluate phishing-resistant MFA (FIDO2/passkeys) to eliminate credential-harvest and real-time MFA-relay risk; audit any apps relying solely on TOTP for high-privilege access.
- SOC/IR — Plan: Build or tune detections for session-hijacking patterns (impossible travel, cookie reuse from new ASN) to catch post-phish access that bypasses MFA entirely.
- Leader — Learn: No active breach or regulation trigger here, but this trend is useful board-deck context when arguing for phishing-resistant MFA investment over legacy OTP.
- Engineer — Skip
- SOC/IR — Plan: New platform-native detection capability arriving in Teams; review what coverage it provides and identify any gaps relative to existing phishing detection rules to avoid duplication or missed telemetry.
- Leader — Plan: Upcoming Teams phishing detection capability is worth noting for your next security controls review — confirm rollout timeline with your M365 tenant and assess whether it affects your current phishing-awareness program scope.
- Engineer — Learn: AI-polished phishing erodes the value of behavior-only email filters; worth factoring into security-control design when evaluating or tuning email gateways, but no patch or configuration change is actionable from this report alone.
- SOC/IR — Plan: Plan to audit reliance on behavioral signals (grammar/template heuristics) in email detection rules and supplement with structural signals — URL clustering, header anomalies, sender-graph analysis — that AI fluency cannot easily erase.
- Leader — Learn: Useful backdrop for the next security-awareness or email-security budget conversation, but no near-term board or customer action follows from a vendor conference presentation with no independent corroboration.
- Engineer — Skip
- SOC/IR — Learn: Awareness of the CoGUI, Haozi, and Iron Man System kit families and their scale is useful for triage context, but the summary provides no IOCs, TTPs, or detection surface to act on now.
- Leader — Learn: The billion-message scale and coordinated industry takedown illustrates the organized phishing-as-a-service ecosystem — useful background for board or customer conversations about email threat trends, but no immediate action is required.
- Engineer — Learn: The research describes phishing kit infrastructure and supply chains but identifies no exploitable vulnerability or misconfiguration in software engineers run — no patch or config action is warranted.
- SOC/IR — Plan: Review the full Microsoft blog for IOCs and TTPs tied to Storm-2990 and Storm-3119; use them to tune phishing detection rules and run a retroactive hunt for pre-disruption lure activity against your estate.
- Leader — Learn: Useful threat-landscape context on industrialized phishing-as-a-service for board or security awareness programs, but the disruption is already complete and no immediate leadership action is indicated.
- Engineer — Learn: The sheer scale—75,000 targeted organizations—underscores how mature commodity phishing infrastructure has become; no patch or configuration change is indicated, but it reinforces the value of robust email filtering and anti-phishing controls in the pipeline.
- SOC/IR — Learn: A significant infrastructure takedown, but the summary provides no IOCs or TTPs to hunt or detect on; worth monitoring follow-on reporting for any published indicators from the seized infrastructure.
- Leader — Learn: Useful context for board discussions on phishing risk at scale; no immediate action is indicated, but the 75,000-organization targeting figure is benchmark data worth citing when justifying email security investments.
- Engineer — Learn: Wazza’s infrastructure-level controls (traffic filtering, session management) represent a maturation in phishing kit design worth understanding when evaluating email security gateway and anti-phishing tool coverage, but no software patch or configuration change is indicated.
- SOC/IR — Plan: The kit’s delivery-layer filtering and traffic controls create novel evasion patterns for phishing infrastructure; build or tune detections for anomalous phishing delivery behavior in this style, and watch the ANY.RUN feed for IOC releases from this campaign.
- Leader — Learn: Active campaign targeting sectors that likely overlap with your organization or supply chain; useful for situational awareness and security awareness program updates, but no vendor exposure or regulatory trigger is indicated at this time.
- Engineer — Learn: No software to patch or config to change; this is a social-engineering campaign. Awareness that AI-branded ad portals are being weaponized is worth knowing when reviewing phishing simulation scope or employee guidance.
- SOC/IR — Plan: Build or tune detections for MFA-bypass phishing patterns targeting AI platform lookalikes — review proxy/email logs for suspicious redirects to ChatGPT/Gemini/Claude impersonation domains and flag anomalous token submissions.
- Leader — Learn: Active campaign targeting business users of AI advertising tools is worth folding into the next security-awareness cycle, particularly for marketing and finance teams who manage ad-platform accounts.
- Engineer — Learn: No attack vector disclosed and no enrichment signals, so no specific patch or config action is warranted; treat as a real-world reminder to validate MFA enforcement and conditional access policies on M365/Google Workspace accounts in your own environment.
- SOC/IR — Learn: No IOCs or ATT&CK-mappable TTPs were published, so there is nothing actionable to hunt or detect right now; the incident reinforces awareness that phishing campaigns can originate from previously-trusted domains after account takeover.
- Leader — Learn: Nikkei is not a systemic vendor for most enterprises, so this does not trigger exposure-verification or board-level action; it is useful context for future discussions on email account security posture and incident disclosure practices.
- Engineer — Learn: Browser-in-browser phishing targeting SaaS credentials is a technique worth understanding for security awareness programs and evaluating whether your SSO/FIDO2 posture would resist it; no patch or config change needed today.
- SOC/IR — Plan: Build or tune detections for browser-in-browser lure patterns targeting ad platform logins; consider hunting for anomalous OAuth grant activity in M365/Google Workspace logs from users in marketing or growth roles.
- Leader — Skip
- Engineer — Plan: AitM phishing bypasses authenticator-app MFA; audit whether high-value Microsoft accounts have phishing-resistant (FIDO2) MFA enabled and review Conditional Access token-binding policies to reduce session-hijack risk.
- SOC/IR — Plan: The AitM-against-M365 technique warrants tuning detections for anomalous OAuth token issuances and Conditional Access bypass patterns; build a hunt targeting users in AI/policy roles for suspicious sign-in behavior since no IOCs were published.
- Leader — Learn: China-nexus espionage group targeting AI policy think tanks, universities, and legal firms is useful sector-awareness context; no immediate action unless your organization operates in AI policy research or adjacent legal advisory work.
- Engineer — Plan: No exploitable CVE here, but the tactic relies on uncontrolled RMM installs reaching endpoints; audit endpoints for unauthorized MSP360 or ScreenConnect installations and enforce an allowlist policy for approved RMM tools via EDR or software-control policy.
- SOC/IR — Plan: The dual-RMM pattern (MSP360 dropping ScreenConnect) is a concrete detection target; build or tune rules to alert on MSP360 installations from non-IT asset-management contexts and correlate with ScreenConnect process spawns, and hunt for both tools installed since September 2026.
- Leader — Learn: The campaign illustrates a maturing trend of threat actors using legitimate RMM tools to bypass controls; worth noting for the next review of acceptable-use and third-party remote-access policy, but no immediate board-level action required absent evidence of a breach in your sector.
- Engineer — Plan: Audit your environment for unauthorized ScreenConnect or MSP360 installations; enforce an approved-software allowlist for remote management tools and review recent RMM deployments against your IT change log.
- SOC/IR — Plan: Build or tune detections for unexpected RMM binary executions (MSP360, ScreenConnect) outside your approved management estate; create a hunt query for remote-access tools installed in the past 30 days that don’t match IT provisioning records.
- Leader — Learn: Documents a growing pattern of threat actors weaponizing legitimate remote-management software to evade controls; useful context for a quarterly risk review of MSP or RMM-tool exposure, but no immediate leadership action is indicated by the available signals.
- Engineer — Skip
- SOC/IR — Learn: Serves as a reminder that BEC campaigns carry real prosecution risk and underscores the sustained threat of multi-year phishing operations; no new TTPs or IOCs to act on.
- Leader — Learn: High-profile sentencing reinforces the criminal and reputational stakes of BEC fraud, useful context when briefing leadership on why BEC prevention investments matter.
- Engineer — Plan: Session token theft bypasses MFA controls — review M365 Conditional Access policies for continuous access evaluation and token binding; audit which RMM tools are permitted to execute in your environment to limit post-phishing persistence.
- SOC/IR — Act: Active campaign with a clear behavioral signature: hunt for unauthorized RMM tool installations on endpoints and anomalous M365 sessions (new device or geolocation logins shortly following phishing delivery) since campaign has 351 tracked sandbox submissions concentrated in the US.
- Leader — Plan: Campaign explicitly targets C-suite at technology, manufacturing, government, and consulting organizations — brief senior executives and their assistants on the risk this quarter and confirm whether your sector shows up in threat intel targeting lists.
- Engineer — Learn: RedFlick is a novel malware delivery technique, not a patchable CVE; useful for understanding evasion tradecraft that may bypass current email and endpoint controls, but no specific infrastructure change is required today.
- SOC/IR — Act: Star Blizzard’s active large-scale phishing campaign with the RedFlick delivery technique has been running since January 2026; pull the full Microsoft post for IOCs and ATT&CK TTP mappings, then hunt for RedFlick-associated lures in email gateway logs and sweep endpoint telemetry for associated malware staging behaviors.
- Leader — Learn: Russian state actor Star Blizzard has evolved its evasion and delivery capabilities; file as threat-landscape context and flag for a targeted-sector check — if your organization operates in government, defense, or policy circles, consider a brief to security leadership on exposure.
- Engineer — Learn: Technique analysis of a crafted phishing URL designed to fool automated security controls; no patch or configuration change required, but useful context for tuning email gateway URL inspection policies.
- SOC/IR — Plan: SANS ISC breaks down specific URL obfuscation methods used to evade scanners — review the full diary to extract patterns and consider adding corresponding URL-decoding or pattern-matching rules to your email security or SIEM pipeline.
- Leader — Skip
- Engineer — Plan: Device-code phishing bypasses MFA by abusing the OAuth device-authorization flow; review Conditional Access policies to restrict or block device-code grant type for untrusted networks or users who don’t need it.
- SOC/IR — Plan: The service is dismantled but the TTP persists — build or tune detections for anomalous device-code authentication requests (unusual tenant, geolocation, or off-hours token grants) in your SIEM before copycats emerge.
- Leader — Learn: Takedown of a 12,000-inbox-compromise phishing platform reinforces the AI-enhanced threat narrative worth including in the next leadership or board briefing on evolving phishing sophistication; no immediate exposure action required given the service is offline.
- Engineer — Plan: AiTM-style phishing that bypasses MFA by hijacking legitimate auth flows warrants reviewing phishing-resistant MFA (FIDO2/passkeys) and conditional access policies; audit identity provider logs for anomalous session tokens this quarter.
- SOC/IR — Plan: No IOCs are provided, but the technique — abusing legitimate auth flows to harvest session tokens — is worth building detections for: tune SIEM rules to flag impossible-travel logins and anomalous OAuth token grants from new IP ranges.
- Leader — Learn: Broad US/EU targeting of businesses via identity compromise is a useful data point for risk discussions around MFA strength, but no named victims or sector-specific details make this a board-level action item yet.
- Engineer — Learn: Demonstrates that passkey-themed social engineering can bypass MFA assumptions — worth factoring into how passkey enrollment flows and conditional access policies are hardened, but no CVE or patch action follows from this disclosure.
- SOC/IR — Plan: The active campaign pattern — CEO-impersonation lures leading to passkey/cloud credential harvesting — is worth building detections around: hunt for anomalous passkey registration events in Entra ID and tune email-gateway rules for third-party-relayed CEO impersonation at volume.
- Leader — Learn: Useful context that passkey adoption does not eliminate cloud account takeover risk; informs future board or customer messaging about layered identity controls, but no vendor breach or regulatory trigger here.
- Engineer — Plan: Active campaign exploiting passkey/SSO trust to bypass MFA means now is the time to enforce phishing-resistant authentication (FIDO2 hardware keys, not app-based) in M365 conditional access policies and audit OAuth app consent grants in Entra ID.
- SOC/IR — Act: Named extortion actors (ShinyHunters, Helix) are running active M365 credential theft campaigns — hunt for anomalous Entra ID sign-ins, suspicious OAuth consent grants, and new delegated permissions added to M365 tenants since this campaign surfaced.
- Leader — Plan: ShinyHunters is a data-publication extortion group; their targeting of M365 raises breach-disclosure risk for organizations holding regulated data in that platform — schedule a review of M365 data residency, DLP controls, and phishing-awareness coverage for passkey/SSO lure themes this quarter.
- Engineer — Plan: If your org uses Brevo (Sendinblue) as an email/marketing service provider, audit your account for unauthorized access and review what customer data is stored there; this breach shows ESP compromise can expose your customer lists to targeted phishing.
- SOC/IR — Learn: The attack chain—ESP breach leading to targeted customer phishing—is a useful lure pattern to understand, but no IOCs or ATT&CK-mappable TTPs are provided in this item to act on.
- Leader — Learn: A clear example of third-party SaaS vendor risk: a breach at email provider Brevo exposed Trezor’s customer list and enabled downstream phishing; worth citing in vendor risk review discussions, but no immediate action required unless your org uses Brevo.
- Engineer — Learn: The digest themes — overpermissioned extensions, supply-chain packages, and unpatched legacy bugs — are directionally relevant, but the summary is too thin to identify any specific software or action; skim the full roundup for items that touch your stack.
- SOC/IR — Learn: Browser-based phishing chains that abuse trusted services are a useful TTP pattern to keep in mind when tuning lure-detection rules, but no IOCs or specific campaign details are surfaced here.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: Active phishing campaign leveraging a breached third-party email provider to send lures from a trusted sending domain is a relevant TTP, but no IOCs or detection details are published to act on now.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: DoppelCart’s scale (119k domains) is notable for understanding adversarial infrastructure patterns, but no IOCs or detection guidance are provided to act on immediately.
- Leader — Learn: Useful context for board-level awareness of large-scale payment fraud operations; no vendor exposure or regulatory trigger requires immediate action.
- Engineer — Learn: The recap references a supply chain attack via a trusted software source and a Chrome 0-day, but the summary lacks package names, versions, or CVEs to act on; follow up on the individual Coder supply chain story to determine if it touches your toolchain.
- SOC/IR — Plan: The text-only QR code phishing technique — rendering a scannable code from ASCII characters to survive image-blocking — is a novel lure evasion worth adding to email detection logic; build or tune rules to flag text-pattern QR codes in message bodies.
- Leader — Skip
- Engineer — Learn: ASCII smuggling with invisible Unicode is a useful technique to understand when evaluating email security tooling or building internal phishing-resistant workflows; no patch or configuration change required today.
- SOC/IR — Plan: Add detection coverage for invisible Unicode characters in email bodies and subject lines — tune existing email security filters to flag or quarantine messages containing high-density non-printing Unicode codepoints, and build a hunt query against recent inbound mail logs for this pattern.
- Leader — Skip
- Engineer — Plan: Audit email security gateway and filtering pipeline for Unicode normalization support; configure rules to strip or flag invisible Unicode tag characters (U+E0000 block) before keyword matching, as current filter logic may silently pass these.
- SOC/IR — Act: Active high-volume campaign with a specific, huntable TTP: query recent inbound email logs for messages containing invisible Unicode tag characters interleaved within financial keywords; tune SEG/SIEM detections to flag this pattern going forward.
- Leader — Learn: Novel evasion technique shows email filtering products may have a systematic blind spot around Unicode normalization; useful context when next reviewing email security vendor capabilities or during security questionnaire assessments.
- Engineer — Plan: Audit email security gateway and content-inspection rules to detect invisible Unicode characters used to bypass filters; evaluate whether your email platform has updated signatures for this evasion class.
- SOC/IR — Act: Build or tune detection rules to flag emails containing invisible/tag Unicode codepoints (U+E0000 range); hunt for recent phishing lures that may have bypassed filters using this technique since the evasion method is now publicly documented.
- Leader — Learn: A novel phishing evasion technique is gaining traction; no board-level action needed now, but awareness is useful context for the next email security or AI-risk discussion.
- Engineer — Learn: RMM tool abuse as a phishing payload vector is a design-level concern for teams that deploy RMM software; no specific CVE or patch is indicated, and the summary lacks enough technical detail to drive a configuration change.
- SOC/IR — Plan: The ANY.RUN dataset of 601 cases offers an opportunity to pull sandbox telemetry and build or tune detections for tax-lure phishing delivering RMM agents; prioritize hunting for unexpected RMM tool installations and outbound RMM beacons in US-based enterprise estates.
- Leader — Learn: Useful threat-landscape context — US enterprises are the primary target of a broad RMM-based phishing operation — but no named vendor breach or regulatory trigger warrants immediate leadership action at this stage.
- Engineer — Skip
- SOC/IR — Learn: TVRAT and DarkVNC are remote access trojans worth reviewing in your detection library; no new IOCs or active campaign signals in this item, but the freelancer-targeting lure pattern is worth noting for awareness.
- Leader — Learn: A useful data point on scale of freelancer-targeting campaigns (80,000 victims) for risk discussions around contractor onboarding and device trust policies.
- Engineer — Skip
- SOC/IR — Learn: Decade-old campaign with no current exploitation or IOCs; useful as historical context for malicious-attachment lure tradecraft but yields no actionable detection work today.
- Leader — Learn: Demonstrates ongoing DoJ extradition efforts against cybercrime actors; no immediate vendor exposure or board-level risk action required given the 2016–17 vintage of the campaign.
- Engineer — Learn: No CVE or patch involved — attackers are abusing a legitimate admin tool’s functionality. Review whether Faronics Deploy is in your environment and whether its deployment permissions are appropriately scoped.
- SOC/IR — Act: Hunt for unexpected ScreenConnect installations originating from Faronics Deploy processes; build detections for remote-management tool deployments not initiated by IT change management workflows.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: SANS ISC diary on the Astaroth/Guildma infection chain; useful for understanding email-lure TTPs, but the summary is too thin to extract IOCs — read the full diary if this actor targets your sector.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: The analysis of polymorphic phishing page behavior — including how the page mutates and occasionally self-breaks — offers useful context for tuning detection logic around evasive phishing infrastructure, but there are no IOCs or detections provided here.
- Leader — Skip
- Engineer — Learn: This highlights npm and its mirrors being misused as hosting infrastructure for phishing redirects — not a package-level supply-chain attack, but a reminder that npm CDN URLs can surface malicious HTML content. No patch or config change needed today; worth noting if internal tooling renders or fetches npm-hosted content for users.
- SOC/IR — Learn: A novel phishing delivery technique using trusted npm mirror domains as redirect hosts; without specific IOCs in this report, there is no immediate hunt to run, but analysts should track for follow-on reporting with domains or URLs to add to proxy/DNS blocklists.
- Leader — Skip
- Engineer — Learn: Novel abuse of unpkg CDN as free phishing infrastructure — developers who install the packages are not the target, but this technique shows how legitimate CDN reputation can carry malicious payloads. Worth factoring into proxy/WAF policy reviews for unpkg.com egress.
- SOC/IR — Plan: ClickFix-style fake CAPTCHA pages hosted on unpkg.com may bypass domain-reputation filters; build or tune proxy detections for unpkg.com redirects to non-package HTML content and correlate with clipboard-execution behaviors downstream.
- Leader — Skip
- Engineer — Learn: No exploitable software vulnerability here — the attack surface is social engineering over Teams external messages. Review whether your Teams tenant restricts external/guest messaging and confirm phishing-resistant MFA is enforced for all accounts.
- SOC/IR — Plan: Active campaign using Teams external messages to deliver a fake lock screen overlay for credential harvesting; build or tune detections for Teams-sourced phishing followed by unusual lock screen events and credential access patterns in EDR telemetry.
- Leader — Learn: Confirms Microsoft Teams is an active credential-phishing vector, useful context for awareness training priorities, but no corroborating signals or sector-specific targeting reported that would require immediate leadership action.
- Engineer — Learn: Research on how attackers abuse trusted communication channels (Slack, Teams, email) for credential theft; review OIDC/SAML trust configurations and conditional access policies as a follow-up architecture exercise.
- SOC/IR — Plan: Unit 42 analysis of TTPs for collaboration-tool identity phishing is worth building detections around this quarter — prioritize tuning alerts for anomalous OAuth consent grants and unusual login sources following collaboration-platform interactions.
- Leader — Skip
- Engineer — Learn: No exploited vulnerability or configuration to change; this is a conceptual piece on how AI-generated sender agents are outpacing signature-based email filters — useful context when evaluating email security tooling this cycle.
- SOC/IR — Learn: No IOCs or ATT&CK-mapped TTPs, but the framing — that phishing intent is now harder to detect because the sender is an AI agent, not a human — is worth internalizing when tuning behavioral email analytics.
- Leader — Learn: No breach or regulation trigger; the AI-on-both-sides framing is useful background for board-level conversations about whether current email security investment is keeping pace with AI-enabled adversaries.
- Engineer — Plan: Active campaign bypasses MFA via session-token theft on M365 — no KEV or PoC signals, but the exposure is real. Prioritize enforcing phishing-resistant MFA (FIDO2/passkeys) for finance and payroll accounts in Entra ID conditional access policies this quarter.
- SOC/IR — Act: Widespread active campaign with clear TTPs: AitM proxy intercept, residential proxy blend-in, and finance-account targeting. Hunt M365 sign-in logs for logins from residential proxy ASNs, and sweep finance/payroll mailboxes for new unauthorized forwarding rules or OAuth app grants added since the campaign was reported.
- Leader — Plan: An active, widespread BEC-style campaign harvesting payroll and finance email warrants directing the security team to assess phishing-resistant MFA coverage for high-risk financial roles and briefing finance leadership on social-engineering risk this quarter.
- Engineer — Skip
- SOC/IR — Act: A phishing campaign is actively distributing ScreenConnect as a RAT using COLDCARD vulnerability lures; hunt for unexpected ScreenConnect installations on endpoints and tune EDR detections for ScreenConnect deployed outside approved baselines.
- Leader — Learn: This campaign illustrates how high-profile crypto incidents are rapidly weaponized as phishing lures; useful context for security awareness briefings but no immediate organizational action required.
- Engineer — Learn: Browser-level, technique-based phishing detection is a useful design principle to evaluate when assessing IdP or SSO defenses, but no specific CVE or configuration change is required today.
- SOC/IR — Plan: Evaluate whether current phishing detections rely heavily on domain blocklists and investigate adding technique-based behavioral signals (e.g., credential-harvest page patterns) to supplement IOC-driven coverage.
- Leader — Learn: Useful framing for a board conversation about why threat intelligence investments have diminishing returns against AI-assisted phishing — relevant for future budget and vendor evaluation discussions.
- Engineer — Learn: No CVE or patchable component; this is a social-engineering lure delivering macOS malware via fake downloads. Useful for hardening developer and CI/CD endpoint policies around unsanctioned software installs.
- SOC/IR — Plan: Build or tune detections for ClickFix-style clipboard-execution patterns on macOS endpoints; begin collecting the 250+ domain indicators from the Microsoft Threat Intelligence report to block and hunt across DNS and proxy logs.
- Leader — Learn: Illustrates that attackers are specifically targeting macOS users — a data point worth referencing when justifying endpoint security coverage parity between Mac and Windows fleets.
- Engineer — Plan: Device code flow phishing is a real and growing vector for M365/Azure tenants; audit Conditional Access policies to block or restrict device code flow for user accounts that don’t require it, and enforce compliant-device requirements where the flow must remain enabled.
- SOC/IR — Plan: Build or tune detections on Entra ID sign-in logs for device code authorization events originating from unexpected locations or apps; also hunt for refresh token reuse anomalies that may indicate post-phishing lateral movement within M365.
- Leader — Learn: A named actor targeting US M365 tenants via Microsoft’s own authentication UI is useful context for the risk register and customer security questionnaire responses, but no confirmed breaches or near-term regulatory deadlines make this a monitor-and-track item rather than an executive action.
- Engineer — Learn: Novel attack class showing how state-dependent smart contracts can make malicious transactions appear benign during wallet simulation previews; relevant for teams building Web3 integrations or DeFi applications, but no patch or configuration action is available for typical enterprise stacks.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: No KEV listing, EPSS, or PoC signals present; the campaign targets iOS users via fake AWS phishing pages rather than a vulnerability in cloud infrastructure itself. Worth understanding the DarkSword exploit kit’s capabilities if you manage MDM or BYOD policies, but no immediate patch or config action is indicated.
- SOC/IR — Act: Over 100 fake AWS sign-in domains linked to a single actor provide a concrete hunting surface — search proxy/email logs for traffic to lookalike AWS domains and tune phishing detections around this lure pattern; the Censys report implies enough infrastructure detail to build IOC-based blocks.
- Leader — Learn: A Chinese threat actor running a large-scale iOS phishing campaign mimicking AWS is worth noting for sector awareness and BYOD risk discussions, but without confirmed breaches at named organizations there is no immediate board-level action required.
- Engineer — Learn: No patch or config action — this is a social-engineering delivery chain, not a software vulnerability. Worth knowing that legitimate RMM binaries (Level RMM, ScreenConnect) are being weaponized so anomalous installations can be flagged during code-review or build-pipeline audits.
- SOC/IR — Act: Active campaign uses a fake Microsoft Teams update lure to drop legitimate RMM tools that provide persistent remote access; hunt for unexpected Level RMM or ScreenConnect processes spawned from browser or user-space paths, and tune detections for counterfeit Microsoft Store redirect chains since Teams-themed lures are a high-volume enterprise vector.
- Leader — Learn: Noteworthy campaign pattern — abusing legitimate RMM software bypasses many controls — but no named vendor breach or regulatory trigger; file for context when briefing on social-engineering trends or evaluating security-awareness training priorities.
- Engineer — Skip
- SOC/IR — Plan: AiTM (adversary-in-the-middle) phishing bypasses MFA by proxying sessions in real time; build or tune detections for impossible-travel, session token anomalies, and auth from new ASNs immediately after login events.
- Leader — Learn: Real-time session hijacking erodes MFA as a control — useful context for risk register and security awareness program updates, but no immediate action required given no corroborating signals or named breach.
- Engineer — Plan: Review whether corporate travel policy requires VPN enforcement on untrusted Wi-Fi; audit M365 tenant for conditional access policies that would block logins from non-compliant networks or flag impossible-travel anomalies.
- SOC/IR — Act: Hunt for M365 sign-ins from hotel/conference-center IP ranges or unexpected geolocations since this campaign began; tune Conditional Access or SIEM rules to flag credential use immediately after untrusted-network logins.
- Leader — Learn: A reminder that credential phishing via rogue DNS is an ongoing risk for traveling employees; no board-level action warranted without evidence of organizational impact, but useful context for travel security awareness programs.
- Engineer — Plan: Vulnerability is already patched server-side by OpenAI (June 8), but organizations using ChatGPT Workspace should audit deployed agents for any unauthorized instances created before the patch date.
- SOC/IR — Plan: Novel attack chain — phishing link silently builds and authorizes an autonomous AI agent inside the target org — is worth mapping to detection coverage; build or tune detections for unauthorized workspace agent creation and authorization events.
- Leader — Plan: This flaw illustrates AI workspace agents as a persistent-access attack surface; use it to prioritize an AI agent governance policy — defining who can authorize agents and what audit logging is required — before enterprise rollout expands.
- Engineer — Plan: Configure DNS/URL filtering to block typosquatted Zoom and Teams domains; audit endpoint policies to detect script execution spawned from video-conferencing app processes, which is an anomalous ClickFix-style delivery path.
- SOC/IR — Plan: Build or tune detections for ClickFix-style prompts (unexpected clipboard/script-paste behavior) and process chains where msiexec or PowerShell launches as a child of a meeting application; no IOCs are published yet but the TTPs are specific enough to act on this quarter.
- Leader — Learn: North Korean BlueNoroff is maturing its crypto-sector targeting by combining compromised industry contacts with wallet-profiling before payload delivery — useful context for risk posture briefings if your org has cryptocurrency holdings or operates in financial services.
- Engineer — Skip
- SOC/IR — Learn: The shift toward Teams-based social engineering and automated multi-stage attack chains signals new lure surfaces worth reviewing when tuning detection coverage for collaboration platforms.
- Leader — Learn: Useful benchmarking data on Q2 phishing trends — the Teams social engineering expansion is a talking point for future board or awareness discussions, but no immediate action is required.
- Engineer — Learn: Kratos used adversary-in-the-middle techniques to steal M365 session tokens and bypass MFA — a reminder that TOTP/push-based MFA is insufficient against phishing; engineers should evaluate phishing-resistant MFA (FIDO2/passkeys) for privileged M365 accounts.
- SOC/IR — Learn: No IOCs or detection specifics are provided, so no immediate hunt is actionable; the takedown does validate that AiTM session-token theft against M365 was widespread, which reinforces monitoring for anomalous token reuse and impossible-travel sign-ins if not already covered.
- Leader — Learn: The scale of Kratos confirms that MFA bypass via phishing is not theoretical — useful evidence when making the case for phishing-resistant MFA investment or reviewing identity risk with the board; no immediate action required given the infrastructure has been seized.
- Engineer — Skip
- SOC/IR — Learn: Active campaign harvesting password manager credentials could affect enterprise employees; no IOCs or TTPs are published in this item to hunt or detect against, but credential-stuffing follow-on activity is worth monitoring in identity logs.
- Leader — Learn: If staff use LastPass or Bitwarden for work credentials, this campaign warrants a targeted security awareness reminder; no breach or vendor incident requiring formal action at this time.
- Engineer — Plan: Evilginx bypasses TOTP-based MFA by proxying credentials; if your M365 tenant uses authenticator-app OTP rather than FIDO2/hardware keys, plan migration to phishing-resistant MFA and enforce Entra ID Conditional Access requiring compliant devices this quarter.
- SOC/IR — Act: Three live AiTM operations were exposed with their full toolkits; pull the IOCs Lexfo published, sweep M365/Entra ID sign-in logs for unfamiliar token-issuing IP ranges, and tune detections for impossible-travel or session-token reuse patterns since AiTM bypasses MFA alerts entirely.
- Leader — Learn: The exposure of three concurrent industrial-scale M365 phishing operations illustrates why TOTP MFA is insufficient as a control; useful context when building the case for phishing-resistant MFA investment in the next budget cycle.
- Engineer — Learn: Comment stuffing in HTML attachments is a novel obfuscation technique worth understanding when tuning email security tooling or evaluating AI-based scanning products; no patch or config change required.
- SOC/IR — Plan: Build or tune email-gateway detections to flag HTML attachments with abnormally high comment-to-content ratios, as this technique is designed specifically to bypass AI-based filters your stack may rely on.
- Leader — Skip