Back to updates

Phishing - 1

2026 (11)

May (3)

security: World Passkey Day: Advancing passwordless authentication

Microsoft Security Blog

2026-05-07

Microsoft says it is advancing passkey adoption as a replacement for passwords, with the goals of reducing phishing risk and simplifying sign-in. The post is framed around World Passkey Day and passwordless authentication.

security: ClickFix campaign uses fake macOS utilities lures to deliver infostealers

Microsoft Security Blog

2026-05-06

Microsoft reports a ClickFix campaign targeting macOS users with fake utility fixes that prompt victims to run malicious Terminal commands. The malware is used to steal credentials, crypto wallets, and other sensitive data while bypassing traditional defenses.

security: Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Microsoft Security Blog

2026-05-04

Microsoft Defender Research documented a large-scale credential theft campaign using code-of-conduct-themed lures, a multi-step phishing chain, and legitimate email services to send authenticated messages from attacker-controlled domains. The campaign led to adversary-in-the-middle (AiTM) token compromise.

April (3)

security: Email threat landscape: Q1 2026 trends and insights

Microsoft Security Blog

2026-04-30

Microsoft reported that email threats rose in early 2026, driven by credential phishing, QR code phishing, and CAPTCHA-gated campaigns. It also said disruption of the Tycoon2FA phishing platform reduced observed volume by 15% and prompted changes in attacker tactics.

security: Inside an AI‑enabled device code phishing campaign

Microsoft Security Blog

2026-04-06

Microsoft describes a new device code phishing campaign that uses AI and end-to-end automation to generate live authentication codes on demand. The result is more scalable account compromise, higher success rates, and longer post-compromise access.

security: Threat actor abuse of AI accelerates from tool to cyberattack surface

Microsoft Security Blog

2026-04-02

Microsoft says threat actors are increasingly using generative AI to improve cyberattacks, including much higher phishing click-through rates and industrialized MFA bypass. The post frames AI as part of the attack surface, not just a tool attackers use.

March (5)

security: When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

Microsoft Security Blog

2026-03-19

Microsoft says threat actors are using tax-season urgency to deliver phishing and malware via refund notices, payroll forms, filing reminders, and fake tax-professional requests. The lures can include malicious attachments, links, and QR codes.

security: Help on the line: How a Microsoft Teams support call led to compromise

Microsoft Security Blog

2026-03-16

Microsoft describes a DART investigation into a Teams voice-phishing attack that used deception and trusted Microsoft tools to enable an identity-led intrusion. The post focuses on how the compromise happened and how to prevent similar attacks.

security: Contagious Interview: Malware delivered through fake developer job interviews

Microsoft Security Blog

2026-03-11

Microsoft describes the Contagious Interview campaign, where attackers impersonate recruiters from crypto and AI firms to target developers with fake coding assessments. The delivered malware installs backdoors and steals API tokens, cloud credentials, crypto wallets, and source code.

security: Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Microsoft Security Blog

2026-03-04

Microsoft reports that the Tycoon2FA adversary-in-the-middle (AiTM) phishing-as-a-service kit enabled large-scale phishing campaigns and says it coordinated a disruption of the kit’s infrastructure with Europol and industry partners.

security: OAuth redirection abuse enables phishing and malware delivery

Microsoft Security Blog

2026-03-02

Microsoft reports attackers abusing OAuth redirect behavior to move users from legitimate sign-in pages to attacker-controlled sites, enabling phishing and malware delivery via trusted authentication flows.