Search: “phishing-framework”

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security

N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.

The N0va phishing kit targets organizations in government, technology, consulting, and healthcare across North America and Europe with lures impersonating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Victims are guided through legitimate authentication flows, including device code phishing, after which N0va captures access and refresh tokens and abuses token-exchange or device-registration mechanisms to establish SSO access. ANY.RUN tracks the campaign via a characteristic /api/verification/init URL pattern and demonstrates detection in its interactive sandbox.

The Hacker News·11:58 UTC · 2h agoPhishing & fraud in the wild 10 sources

New Phishing Attacks Use Trusted Email Infrastructure and URL Cloaking to Bypass Security Tools

Virus Bulletin Q3 2026 report details phishing using DKIM-aligned senders, Amazon SES delivery, and real-time URL cloaking to evade email security and scanners.

Virus Bulletin's Q3 2026 testing found phishing campaigns delivered through trusted infrastructure like Amazon SES with DKIM-aligned sender domains. Samples included a German overdue-invoice lure redirecting to OpenSea crypto fraud and a Romanian BCR-branded PSD2 banking credential-theft campaign. Cloaking pages used hidden iframes, browser fingerprinting, and time-zone checks to show different content to scanners versus victims. Defenders are urged to inspect full redirect chains rather than attachments or initial URLs alone.

Cyber Security News·updated Sep 15, 13:04 UTC · 1d ago·first Sep 15, 12:02 UTC · 1d agoPhishing & fraud in the wild 2 sources

New Phishing Attack Uses Blob URLs to Hide Malicious Pages From Security Scanners

Barracuda detailed a DocuSign-themed phishing campaign that renders credential-harvesting pages as browser blob URLs, evading URL reputation and blocklist defenses.

Barracuda researchers report a credential-harvesting phishing campaign that starts with a DocuSign-themed email containing a calendar invitation and routes victims through legitimate Microsoft OAuth endpoints and Microsoft Teams. A crafted redirect parameter leads Teams to load external content from cdn.bloom[.]io, which the browser renders as a blob URL — a session-only address held in local memory with no persistent public URL to crawl, categorize, or blocklist. The locally generated page registers a service worker, runs inside a sandboxed iframe, and is dynamically steered by backend infrastructure, indicating a centrally managed phishing platform. Barracuda recommends phishing-resistant MFA such as FIDO2 keys and passkeys, monitoring OAuth flows and redirect chains, and Teams malicious URL protection.

GBHackers·updated Sep 10, 14:04 UTC · 6d ago·first Sep 10, 10:57 UTC · 6d agoPhishing & fraud in the wild 3 sources

Dissecting the JWR phishing framework

Cisco Talos uncovered an undocumented phishing framework branded JWR that impersonates checkout and login pages of major payment and shopping platforms.

Cisco Talos researchers identified an undocumented phishing framework internally branded JWR by its developer. The framework is built to convincingly impersonate checkout and login pages across major payment and shopping platforms, likely to harvest credentials and payment details. Talos's analysis details the framework's infrastructure and impersonation capabilities, giving defenders indicators to detect campaigns using it.

Cisco Talos·Aug 13, 10:00 UTC · Aug 13, 2026Phishing & fraud

Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research

Researchers release NEST-Phish, a synthetic enterprise phishing email dataset with matched legitimate and phishing emails and cue annotations for detection research.

Academic researchers introduce NEST-Phish, a publicly released synthetic enterprise phishing email dataset built around a fictitious organization named Nebulon. It contains matched synthetic legitimate and phishing emails across a broad set of workplace communication themes, each with interpretable phishing-cue annotations. Human-subject categorizations and supervised classifier evaluations indicate the dataset supports meaningful variation in phishing judgments and provides learnable signal for detection models. It is intended to support work on phishing detection, human susceptibility, explainability, and benchmark development.

arXiv cs.CR·Sep 3, 20:58 UTC · 12d agoResearch

Phishers are hijacking legitimate cloud infrastructure

Kaspersky Securelist·Aug 4, 12:00 UTC · Aug 4, 2026Threat actor1

Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress

Huntress details modern phishing tactics including ClickFix, browser-in-the-browser, and OAuth consent phishing beyond basic credential harvesting.

Huntress describes a shift in phishing attacks beyond basic credential harvesting toward advanced tactics. Covered techniques include ClickFix social engineering, browser-in-the-browser (BitB) attacks, and OAuth consent phishing. The post recommends training users on these patterns through Huntress SAT simulations.

Huntress·Aug 28, 16:00 UTC · 18d agoPhishing & fraud in the wild1

New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser

Barracuda details a phishing campaign that renders pages in-browser via blob URLs, routed through Microsoft Teams and cdn.bloom[.]io to evade detection.

Barracuda researchers analyzed a phishing campaign that generates a blob URL to render the phishing page entirely inside the victim's browser, leaving no static page for scanners to inspect. The chain begins with a Docusign-themed email containing a calendar invite, followed by a crafted redirect through Microsoft Teams to a resource on cdn.bloom[.]io that the browser converts into the blob URL. Service workers, iframes, and a hidden command-and-control configuration indicate the page is part of a centrally managed phishing platform that can be updated and steered across victims. Researchers recommend inspecting blob URL activity, monitoring OAuth authorization flows, and analyzing the full click path in email security controls.

SecurityWeek·Sep 9, 10:00 UTC · 7d agoPhishing & fraud in the wild

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · security·Sep 10, 15:14 UTC · 5d agoPhishing & fraud

Teach Yourself to Phish | Huntress

Huntress outlines the strategy behind phishing simulations to help organizations build resilience against real phishing threats.

Huntress published guidance on the strategy behind phishing simulation programs. The piece argues simulations should mirror real attacker behavior to train employees and measure organizational resilience. The content promotes Huntress's security awareness training offering.

Huntress·Aug 28, 16:00 UTC · 18d agoIndustry

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point identifies Chinese-speaking group Gambling Goblin hijacking Brazilian government domains via malicious Apache modules for SEO-manipulated gambling phishing.

Check Point Research tracks a sustained campaign since mid-2025 against Brazilian government and educational organizations by Gambling Goblin, a Chinese-speaking cybercrime cluster linked to Earth Berberoka. Attackers compile and install malicious Apache modules that silently reverse-proxy visitors to phishing pages impersonating Google Play, Microsoft Store, and Amazon, chaining compromised high-reputation domains to inflate search rankings. The group deploys a heavily obfuscated Linux toolkit including DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcers, with parallel phishing networks localized for Vietnamese, Spanish, and English victims.

Check Point Research·Sep 2, 10:16 UTC · 14d agoThreat actor

Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters

Microsoft warns of a high-volume phishing campaign using invisible Unicode characters to split keywords like 'funding' and evade filters, peaking at 2.37 million daily messages.

Microsoft's Security Research team documented a high-volume phishing operation inserting deprecated Unicode Tags characters (U+E0000-U+E007F) inside financial keywords such as 'funding' so literal-string and regex email filters stop matching them. The campaign ran on a weekly cadence with 1-2.37 million weekday messages between February and May 15, 2026, peaking on February 26, 2026. It used hundreds of disposable finance-themed sender domains and relayed mail through ActiveCampaign's click-tracking infrastructure (acemlnd[.]com, activehosted[.]com), lending legitimate platform reputation. Microsoft ties the activity to an AI-assisted SBA loan phishing campaign that Fortra's FIRE team disclosed in September 2025.

The Hacker News·Sep 4, 15:57 UTC · 11d agoPhishing & fraud in the wild

New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

Fortra researchers track an active phishing campaign targeting Spanish speakers that abuses mshta.exe to run HTA payloads for reconnaissance and credential theft.

Fortra's FIRE team says a phishing campaign active since June 2026 targets Spanish-speaking users with invoice ('Facturación') and judicial ('Aviso Judicial') lures, many sent via libero.it/italiaonline.it infrastructure with SCL:-1 markings to bypass anti-spam. Clicking embedded links delivers an HTA launcher executed via mshta.exe, which hides its window off-screen, builds dynamic C2 URLs, and performs reconnaissance using WMI, PowerShell, and environment-variable inspection. A second-stage JavaScript dropper uses HTML smuggling to reconstruct a Base64-encoded ZIP in the browser, delivering a 7-Zip self-extracting executable disguised as a Firefox installer; staged design allows later delivery of credential stealers or ransomware. Defenders are urged to block archivogratuito[.]online and shortener domains goo[.]su, abrir[.]link, and abre[.]ai, and to restrict mshta.exe execution via AppLocker or ASR rules.

GBHackers·Sep 12, 06:16 UTC · 4d agoPhishing & fraud in the wild1

Def Con Attendees Targeted by Persistent Phishing Campaign

Huntress reports a persistent and elaborate phishing campaign targeting attendees following the Def Con security conference.

A Huntress researcher documented being targeted by an elaborate and persistent phishing scam after attending Def Con. The campaign specifically went after conference attendees, suggesting deliberate targeting of the security community. Details of the social engineering approach and persistence were shared.

Infosecurity Magazine·Aug 20, 09:30 UTC · 27d agoPhishing & fraud

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia

Suspected Russian clusters abuse OAuth and authentication flows to phish academia, defense, government, and think tank targets across Europe and the US.

Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage clusters abusing legitimate authentication flows. Newly detailed clusters UNC7005 and UNC5976 conduct phishing, abuse OAuth flows, and/or deploy malware, alongside previously reported UNC6293 phishing operations. Targets include individuals in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks in the United States.

Google Threat Intelligence·Aug 20, 14:00 UTC · 27d agoThreat actor in the wild

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.

Abnormal Security analyzed iAuthFlow v2, a phishing toolkit sold on a Russian-language cybercrime forum for a $10,000 base price with additional capability modules sold separately. Using a browser-in-the-middle relay behind a trycloudflare.com subdomain with valid TLS, it captures Google logins and uses the authenticated session to enroll an attacker-controlled passkey within six seconds of login. Because the passkey persists after password changes and session revocation, operators regain mailbox access even after victims reset credentials. The build examined targets Google, while the seller advertises versions for Microsoft, iCloud, and LinkedIn.

Security Affairs·Aug 24, 07:17 UTC · 23d agoPhishing & fraud1

JavaScript obfuscation: From party trick to phishing kit

Cisco Talos explains JavaScript obfuscation techniques used by phishing kits and the approaches researchers use to reverse them.

Cisco Talos published an educational walkthrough of JavaScript obfuscation as used in modern phishing kits. The piece covers why analysts deobfuscate malicious scripts and outlines several practical approaches to reversing obfuscated code. The techniques help defenders unpack phishing kit payloads during investigations.

Cisco Talos·Aug 27, 10:00 UTC · 20d agoResearch

How QR-code phishing can slip past corporate security measures

ESET explains how QR-code phishing (quishing) bypasses corporate security controls and offers guidance for defenders to close the gap.

ESET WeLiveSecurity published an analysis of quishing, describing QR-code phishing as an increasingly popular alternative to traditional phishing. Because QR codes push victims to scan and open links on personal devices, they often evade corporate email security gateways and URL inspection. The article outlines how businesses can close the resulting gap with appropriate security measures and user awareness.

ESET WeLiveSecurity·Aug 17, 09:00 UTC · Aug 17, 2026Phishing & fraud

Stop Telling People Not To Click Links

Tailscale CEO argues link-clicking is not the problem; deploying phishing-resistant authentication like passkeys and WebAuthn eliminates entire attack classes.

Tailscale CEO Avery Pennarun argues in an opinion piece that clicking links is a symptom, not the disease, and that weak authentication is the real failure behind phishing damage. He advocates phishing-resistant FIDO/WebAuthn, passkeys, and device-bound tokens, plus continuous identity-anchored network access so unexpected login prompts become suspicious signals. He argues this approach makes security less burdensome for users while neutralizing credential replay and fake login pages.

Lobsters · security·Sep 3, 21:56 UTC · 12d agoIndustry

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.

Huntress uncovered a phishing campaign targeting attendees after Black Hat and DEF CON. Attackers used X direct messages pointing to a malicious Google Doc as the delivery vehicle. Payloads include AMOS, a macOS infostealer, and the NetSupport RAT, among other malware.

Huntress·Aug 19, 13:00 UTC · 28d agoPhishing & fraud

Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US

Mirage2FA phishing-as-a-service kit uses AiTM attacks to hijack Microsoft 365 sessions, with over 4,000 US victims.

ANY.RUN analyzed Mirage2FA, an active phishing-as-a-service toolkit that steals Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle phishing pages. About 63.7% of identified victims are in the US, with Technology, Manufacturing, and Education the most targeted industries. Thousands of compromise events were recorded between 2024 and 2026.

ANY.RUN·Aug 18, 09:28 UTC · 29d agoPhishing & fraud in the wild1

Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing

A study of 180 US workers found each LLM phishing personalization level raised click-intention odds by 28%, but credibility depends on context fit.

The arXiv paper evaluates how personalized pretexts in LLM-generated spear phishing affect perceived credibility, using 180 US working adults across 1,436 evaluations of emails with four cumulative personalization levels, from workplace context to shared-project details. Convincingness rose 2.40 points per level in sensitivity analysis and click-intention odds increased 28% per level, while non-clickers shifted toward deleting rather than reporting. Qualitative coding showed details matching the recipient's role and routines supported credibility, whereas incorrect, vague, or channel-inappropriate details raised suspicion. The authors argue personalization effectiveness depends on pretext fit, with implications for workplace security training.

arXiv cs.CR·Sep 3, 19:21 UTC · 12d agoResearch

US Finance Under Phishing Pressure: What the SOC Data Reveals?

ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.

ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.

ANY.RUN·Aug 26, 09:17 UTC · 21d agoPhishing & fraud in the wild

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security Labs·00:00 UTC · 14h agoResearch in the wild

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.

Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Recovered prompts, shell history, and project files show the operator relied on AI coding assistants to package Electron applications, obfuscate code, troubleshoot builds, and modify phishing infrastructure.

Rapid7 Blog·Aug 17, 11:29 UTC · Aug 17, 2026Phishing & fraud

ZeroTokens Phishing Platform Steers Attacks in Real Time

ZeroTokens phishing platform hands operators live control of victim sessions in ongoing attacks targeting 53 financial brands.

ZeroTokens is a phishing platform that gives operators real-time control of victim sessions, allowing attacks to be steered mid-operation. The platform is being used in campaigns targeting 53 financial brands. Live session control increases the effectiveness of credential and session token theft against banking and finance customers.

Infosecurity Magazine·Aug 25, 14:30 UTC · 22d agoPhishing & fraud in the wild