55
42
30
55
60
30
30
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes
SOCRadar details AnonyMousKIT, a phishing-as-a-service platform using AI voice agents posing as Apple Support to steal passcodes and 2FA codes.
SOCRadar's Threat Research Unit documented AnonyMousKIT, a credit-metered phishing-as-a-service platform that strips Activation Lock from stolen Apple devices across email, SMS, WhatsApp, recorded calls and AI voice agents. The 'Alice from Apple Support' personas request the device passcode, Apple ID credentials and a live 2FA code, with lures citing the handset's model identifier and live Find My status. Of 200 recovered AI calls made between August 31, 2025 and May 30, 2026, 179 targeted Brazil, and the calls cost $19.24 total via voice platform Vapi. Exposed log paths revealed 30 kit installations on 42 domains and 6,092 send attempts family-wide between March and July 2026.
58
AnonyMousKIT phishing-as-a-service uses AI voice calls to steal iPhone passcodes
SOCRadar details AnonyMousKIT, an active phishing-as-a-service platform using AI voice agents across 506 domains to steal Apple ID credentials from stolen iPhone owners.
SOCRadar analyzed AnonyMousKIT, a pay-per-action phishing-as-a-service platform built to harvest Apple ID credentials needed to remove Activation Lock from stolen iPhones. A bare-relative-paths flaw exposed a reseller supply chain of 506 domains and 168 storefront brands active since early 2024, plus 200 call logs and 55 transcripts, with 179 of 200 calls going to Brazil at a total cost of $19.24. Voice-agent personas like 'Alice Dias, Apple Support' convince victims to dictate their four- or six-digit passcode and enter an unlock code from a security link, allowing thieves to remove Activation Lock and resell devices. The platform ran five personas in English, Spanish, and Brazilian Portuguese and remained active at the end of the investigation.
55
30
30
42
42
30
30
30
Risky Bulletin: BEC campaign steals €35 million from French notaries
Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.
A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.
72
30
ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More
60
42
35
Phishing 3.0: The Fight Moves to Agent Versus Agent
Agentic AI transforms phishing economics, enabling personalized multi-channel attacks with deepfakes like the $25M Arup deepfake heist.
The article argues phishing has evolved through three stages: from malicious content, to intent-based BEC, to AI-powered multi-channel campaigns where attacker agents autonomously conduct reconnaissance and generate tailored lures. The widely reported Arup case saw a deepfake video call impersonating colleagues convince an employee to approve transfers worth roughly $25 million. An Osterman Research study of 128 security leaders found 88% experienced trust-undermining incidents, while Microsoft 365 EOP and Google Workspace were measured missing hundreds of phishing messages per 100 mailboxes monthly. The author argues defenders must adopt their own agents to match attacker speed.
40
30
42
30
GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation
eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.
eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.
73
30
30
30
30
30
42
30
30
30
30
FBI: Hackers using social engineering to breach accounts and steal explicit content
FBI warns hackers use social engineering and password-stuffing to hijack social media accounts and sell victims' explicit content on criminal marketplaces.
The FBI issued an alert on threat actors who breach social media accounts of adults and children using password-stuffing with credentials from data leak sites, impersonation of social media support staff, and cloned login pages, in order to steal and sell explicit content. Stolen content is often posted with victims' personal information, leading to sextortion, harassment, and stalking. Related DOJ cases include a man who pleaded guilty to hacking about 600 Snapchat accounts and a former University of Michigan coach who accessed records of about 150,000 people across 100+ colleges.
42
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
NovaCookies AitM phishing kit, a Sneaky 2FA variant, uses genuine Docusign lures to steal Microsoft 365 sessions at hundreds of organizations.
Island disclosed NovaCookies, a $320/month adversary-in-the-middle phishing-as-a-service platform that relays Microsoft 365 sign-ins through attacker infrastructure to capture credentials, MFA codes, and authenticated sessions. Campaigns abuse genuine Docusign envelopes and Microsoft/Google redirect hops so each step looks legitimate, with lure domains on .vu and alternating-case labels such as PwPt-sHaRe. Proofpoint assesses NovaCookies as a Sneaky 2FA variant with added flows for Okta and Entra domains federated to GoDaddy, and a fully managed PhaaS model. It has targeted hundreds of organizations in the U.S., U.K., Canada, Germany, Israel, and the U.A.E., and is advertised via Telegram with anti-analysis checks like a Cloudflare gate.
45
30
30