Phishing - 1

2026 (8)

March (5)

security: When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

Microsoft Security Blog

2026-03-19

Microsoft says threat actors are using tax-season urgency to deliver phishing and malware via refund notices, payroll forms, filing reminders, and fake tax-professional requests. The lures can include malicious attachments, links, and QR codes.

security: Help on the line: How a Microsoft Teams support call led to compromise

Microsoft Security Blog

2026-03-16

Microsoft describes a DART investigation into a Teams voice-phishing attack that used deception and trusted Microsoft tools to enable an identity-led intrusion. The post focuses on how the compromise happened and how to prevent similar attacks.

security: Contagious Interview: Malware delivered through fake developer job interviews

Microsoft Security Blog

2026-03-11

Microsoft describes the Contagious Interview campaign, where attackers impersonate recruiters from crypto and AI firms to target developers with fake coding assessments. The delivered malware installs backdoors and steals API tokens, cloud credentials, crypto wallets, and source code.

security: Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Microsoft Security Blog

2026-03-04

Microsoft reports that the Tycoon2FA adversary-in-the-middle (AiTM) phishing-as-a-service kit enabled large-scale phishing campaigns and says it coordinated a disruption of the kit’s infrastructure with Europol and industry partners.

security: OAuth redirection abuse enables phishing and malware delivery

Microsoft Security Blog

2026-03-02

Microsoft reports attackers abusing OAuth redirect behavior to move users from legitimate sign-in pages to attacker-controlled sites, enabling phishing and malware delivery via trusted authentication flows.

February (1)

security: New Clickfix variant ‘CrashFix’ deploying Python Remote Access Trojan

Microsoft Security Blog

2026-02-05

Microsoft reports a new ClickFix variant, “CrashFix,” that intentionally crashes browsers to trick users into running commands that install a Python-based remote access trojan (RAT). The campaign abuses built-in utilities (finger.exe) and a portable Python runtime to reduce detection and maintain persistence on targeted systems.

January (2)

security: Resurgence of a multi‑stage AiTM phishing and BEC campaign abusing SharePoint

Microsoft Security Blog

2026-01-22

Microsoft Defender researchers reported a resurgence of a multi-stage Adversary-in-the-Middle (AiTM) phishing campaign paired with business email compromise (BEC) that abused SharePoint and targeted multiple organizations in the energy sector, according to a Microsoft Security Blog post.

security: Phishing actors exploit complex routing and misconfigurations to spoof domains

Microsoft Security Blog

2026-01-06

Threat actors are exploiting complex mail routing and misconfigured anti-spoof protections to send phishing emails that appear to come from internal senders.

2025 (2)

October (1)

security: Cybersecurity Awareness Month: Security starts with you

Microsoft Security Blog

2025-10-01

Microsoft highlights that cybersecurity is as much about people as technology in its Cybersecurity Awareness Month post, "Security starts with you." The blog directs readers to Microsoft’s resources and practical guidance to help individuals stay safe online and adopt safer habits.

September (1)

security: AI vs. AI: Detecting an AI-obfuscated phishing campaign

Microsoft Security Blog

2025-09-24

Microsoft Threat Intelligence detected and blocked a credential-phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses, highlighting a trend of attackers leveraging AI and the need for defenders to anticipate and adapt to AI-driven threats.