Phishing - 1

2026 (9)

November (1)

security: Email threat landscape: Q3 2026 trends and insights

Microsoft Security Blog

2026-11-05

Microsoft Threat Intelligence reported a sharp rise in email-based phishing activity in Q3 2026, while QR code phishing declined. The post also noted a rebound in CAPTCHA-gated phishing and highlighted risks from malicious messages spoofing familiar business-service sender domains and security override behavior.

October (1)

security: The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft Security Blog

2026-10-14

Microsoft says it uncovered a Chinese-language cybercrime ecosystem linking phishing kit operators (Storm-2990) and an illicit marketplace (Storm-3119) that sold phishing tools and infrastructure. Microsoft’s Digital Crimes Unit worked with law enforcement and partners to disrupt the network.

September (7)

security: Phishing Abuses RMM Tools for Persistent Access

Microsoft Security Blog

2026-09-29

Microsoft reported phishing campaigns that abused MSP360 RMM to deploy ScreenConnect and establish redundant remote-access channels for later malicious activity. The focus is on persistence and follow-on access rather than initial compromise alone.

security: Star Blizzard refines phishing and malware delivery with the RedFlick technique

Microsoft Security Blog

2026-09-29

Microsoft says it has observed Russian state actor Star Blizzard since January 2026 using large-scale phishing, compromised website accounts, and a new malware delivery method it tracks as RedFlick. The update focuses on the actor’s improved detection evasion and delivery techniques.

security: Unmasking EvilTokens: Getting to the root of device code phishing

Microsoft Security Blog

2026-09-22

Microsoft says EvilTokens emerged as a major phishing-as-a-service platform for device code phishing, using AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft’s Digital Crimes Unit disrupted its infrastructure and operations.

security: Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft Security Blog

2026-09-10

Microsoft describes an AI-assisted business email compromise campaign that impersonated executives and used fake invoices to target finance teams for ACH payment fraud. The post focuses on the attack pattern and how organizations can protect against it.

security: Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Security Blog

2026-09-10

Microsoft Defender is described as detecting and disrupting AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post is a Microsoft Security Blog entry dated 2026-09-10.

security: ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft Security Blog

2026-09-03

Microsoft reports that invisible Unicode characters, previously used in AI prompt injection, are now being used to hide words from email filters as part of phishing evasion. The technique relies on obfuscating text before parsers process it.

security: Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft Security Blog

2026-09-01

Microsoft describes an active malware campaign that uses fake software download pages and repackaged installer archives to impersonate legitimate vendors. The post includes observed tactics, Defender XDR detections, indicators of compromise, and mitigation guidance.