Phishing - 1

2026 (6)

September (5)

security: Unmasking EvilTokens: Getting to the root of device code phishing

Microsoft Security Blog

2026-09-22

Microsoft says it helped disrupt EvilTokens, a phishing-as-a-service platform used for device code phishing and token theft. The post describes AI-assisted lures, automated infrastructure, and Microsoft DCU’s role in the disruption.

security: Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft Security Blog

2026-09-10

Microsoft describes an AI-assisted business email compromise campaign that impersonated executives and used fake invoices to target finance teams for ACH payment fraud. The post focuses on the attack pattern and how organizations can protect against it.

security: Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Security Blog

2026-09-10

Microsoft Defender is described as detecting and disrupting AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post is a Microsoft Security Blog entry dated 2026-09-10.

security: ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft Security Blog

2026-09-03

Microsoft reports that invisible Unicode characters, previously used in AI prompt injection, are now being used to hide words from email filters as part of phishing evasion. The technique relies on obfuscating text before parsers process it.

security: Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft Security Blog

2026-09-01

Microsoft describes an active malware campaign that uses fake software download pages and repackaged installer archives to impersonate legitimate vendors. The post includes observed tactics, Defender XDR detections, indicators of compromise, and mitigation guidance.

July (1)

security: Email threat landscape: Q2 2026 trends and insights

Microsoft Security Blog

2026-07-23

Microsoft reports that Q2 2026 saw continued declines in several phishing techniques after disruption of the Tycoon2FA platform. Attackers shifted toward Teams-based social engineering and more automated, multi-stage attack chains.